What about today? In the course of the work of the West, we found such an. exe, we have to crack (of course, not a simple forced blasting, not a simple patch) we first use PE to see what it is written with or without a shell or something.
Well, it's VC6.0, and there's no packers, just a little first. Then test this program, first a window to write the user name, and registration code
The error will eject the invalid key window. All right, let's load it with OD.
Go in, and then F8 walk, too slow to ctrl+f8.
In this position the program breaks down, indicating that this is useful place to look at the next breakpoint. Reload the program into the breakpoint. F7, let's go inside.
Look up to see a point of judgment of the program this is important place, may jump above the function is more important, we first break in to see
F8 walk around, you may find something useful. Walk again found out again, and then will enter the judgment there, which means we find the call is right, then we re-loaded the program went to the original place, just down point, no relationship
Come on. The entire algorithm is used by us to enter the registration code and the correct registration code comparison, that is to say we have got the correct registration code, after all, it has been shown, we can change the previous jump for forced blasting, or input this obtained key is also possible, test
It worked! Of course it can be brute force.
is also quite ok!
From for notes (Wiz)
Crackme1.exe decryption Process
