crackme160--(5)

It is not intended to be mapped. Because of this, I never cracked it,--!.

Anyway, try it. Say is Dephi program so directly on the Dede bar. cannot be resolved. Use OL to say is Selfmodify file. Then there is the shell. Now the stage as a novice should be manually shelled.

OL Open first is Pushad so in the ESP under the hardware breakpoint F9 run up and stop on the JMP statement. That makes you happy. Jump directly to Oep. Use the Petools dump process. But there's a little episode here.

Dump out of the program after repairing the IAT does not work properly. So I will compare the original procedure with the one step after shelling F8. Found in the original program where a system function is called. After shelling the program this location is not the correct data. So I thought about whether it was a dump mistake. The Petools dump setting is then changed to read the PE header directly from the disk file. So successful dump

The previous registration button on the program interface. So I put the dump after the program into Dede found unable to read the event. Had to use OL step-by-step. Find Window procedure handler function I was learning VC + + Experience

1. Breakpoints found at RegisterClass are broken several times before the program interface appears, but each time the window handler functions point to the same address. Then the down program at that address runs up and clicks the button or any other action cannot be broken. Failed

2. Use in the DispatchMessage place to break down. With conditional breakpoints, the message type of the MSG structure is 201 (leftbuttonup) 202 (Leftbuttondown) down. Can be broken after a click. But. Behind the code I really do not know what he wants to do!!!

There's no way to find it online, see this article

http://www.52pojie.cn/forum.php?mod=viewthread&tid=264914

Thanks to this @44018723 (should be novice according to my observation)

He then I found clues, procedures and according to the animation to verify the registration code. In other words, the validation event is written in a SetTimer callback.

I was drunk and drunk. You win, JoJo, big.

Next time we fight.

crackme160--(5)