OD cracked an MFC program without signature No strings software notes (simple Exercises)

Crack file Address https://pan.lanzou.com/i0lcf6j

After the course was found to be C + + compiler, but not easy language ..... An MFC Program! Search string without any strings MFC button event also not found!! Maybe I remember wrong, if there is a better way to comment a wave!

"MFC program" feature code
RELEASE
Signature: FF EB 7F FF 0C
Signature Source: MFC42.DLL
DEBUG
Feature code: FF-FC E9-C9
Signature Source: MFC42D.DLL

I use the Suspend method (not described) to stop to the system airspace (also can be next to the MessageBox breakpoint) and then alt+f9 back to the user, found that return does not go back, and then step to follow, and then if the Stack window back to the existing return to the XXX right-click disassembly window following.

After returning to the program airspace, under the broken head down!! (Because the person thinks, the broken head should be a button event code, the broken tail is an execution result)

Break the first code:

004028FF            nop00402900  /$  6A FF         push-0x100402902  |.  373d4000   push crackme.00403d37                    ;  SE handler installation 00402907  |.  64:A1 0000000>mov eax,dword ptr fs:[0]0040290d  |.            Push eax0040290e  |.  64:8925 00000>mov dword ptr fs:[0],esp00402915  |.  83EC 0C       Sub esp,0xc00402918  |.  8b4424     mov eax,dword ptr ss:[esp+0x20]0040291c  |.            esi0040291d Push  |.            Push eax0040291e  |.  8D 4C24     Lea Ecx,dword ptr ss:[esp+0x8]00402922  |.  C74424 000>mov dword ptr ss:[esp+0x10],0x00040292a  |.  E8 9d0a0000 call   <jmp.&mfc42. #CString:: cstring_537>0040292f  |.  8D 4C24     Lea Ecx,dword ptr ss:[esp+0x24]00402933  |.  C74424 010>mov dword ptr ss:[esp+0x18],0x10040293b  |.  E8 5a0c0000 call   <jmp.&mfc42. #CString::cstring_540>

After analysis one wave: found no critical call only key to turn

This program jumps after continue to judge the registration code and True code consistency, no words prompt other errors, of course, this in the plug may be a blue screen lattice tray of the dark pile: Some of the comparison of the picture

................... Roughly like this

After the crack

After the crack program link:: Https://pan.lanzou.com/i0lcmni

2

OD cracked an MFC program without signature No strings software notes (simple Exercises)