The Art of Reversing by Ap0x - Tutoriali.org

0040100C . 85C0
TEST EAX,EAX
0040100E . 74 1E
JE SHORT damn_con.0040102E
00401010 . A3 95234000 MOV DWORD PTR DS:[402395],EAX
00401015 . 8307 01 ADD DWORD PTR DS:[EDI],1
00401018 . 33C0 XOR EAX,EAX
0040101A . 50 PUSH EAX ; /lParam => NULL
0040101B . 68 45104000
PUSH damn_con.00401045
00401020 . 50 PUSH EAX ; |hOwner => NULL
00401021 . 6A 73 PUSH 73 ; |pTemplate = 73
00401023 . FF35 95234000 PUSH DWORD PTR DS:[402395]
00401029 . E8 B3030000 CALL damn_con.004013E1
0040102E > 6A 00 PUSH 0 ; /ExitCode = 0
00401030 . E8 F4030000 CALL damn_con.00401429 ; \ExitProcess
Sta sam vam rekao na OEPu smo. Sada preostaje samo da izvrsimo dump
programa i to je to. Idemo na Plugins -> OllyDump -> Dump debugged
proccess. Default podesavanja su OK pritisnite Dump i snimite fajl. Zatvorite
Olly i probajte da startujete novi fajl i on radi! Ok uspeli smo. Da bi smo
proverili da li je sve OK otvorimo dumpovan fajl u Ollyju. Idemo na Desno
dugme -> Search for -> All referenced strings. Vidimo ovo:
Text strings referenced in dmp:CODE
Address Disassembly Text string
00401000 PUSH 0 (Initial CPU selection)
0040108D PUSH dmp.00402023 ASCII "-=[ ABOUT ]=-"
00401092 PUSH dmp.00402031 ASCII "You are just trying to solve DAMN's Official
joinig Contest. Made by tHE EGOiSTE/DAMN. At
first make a keygen for this simple keycheck
routine, then try to crack this program. The
LOCKED - Button should show an UNLOCKED-sign
and if "...
00401107 PUSH dmp.0040227D ASCII "-=[ YEAH! ]=-"
0040110C PUSH dmp.0040220E
ASCII "You got it! Thank you for registering!"
00401124 PUSH dmp.00402353 ASCII " "
00401149 PUSH dmp.00402321 ASCII " "
0040127E PUSH dmp.00402317
ASCII "About"
004012CE PUSH dmp.0040228B ASCII "-=[ CHECK ]=-"
00401301 MOV EDI,dmp.00402353 ASCII " "
Ovo izgleda OK. Sada idemo na ALT + E da proverimo da li su svi importi OK.
Desno dugme na ime .exe fajla pa na View names. Tabela izgleda ovako:
Names in dmp
Address Section Type ( Name Comment
004030B0 .idata Import ( user32.AppendMenuA
004030B4 .idata Import ( user32.DeleteMenu
004030F8 .idata Import ( GDI32.DeleteObject
004030B8 .idata Import ( user32.DialogBoxParamA
004030BC .idata Import ( user32.DrawMenuBar
004030C0 .idata Import ( user32.EnableWindow
004030C4 .idata Import ( user32.EndDialog
004030EC .idata Import ( kernel32.ExitProcess
004030C8 .idata Import ( user32.GetDlgItem
004030CC .idata Import ( user32.GetDlgItemTextA
004030F0 .idata Import ( kernel32.GetModuleHandleA
004030D0 .idata Import ( user32.GetSystemMenu
004030D4 .idata Import ( user32.LoadBitmapA
004030D8 .idata Import ( user32.LoadIconA
004030DC .idata Import ( user32.MessageBoxA
00401000 CODE Export
004030E0 .idata Import ( user32.SendDlgItemMessageA
004030E4 .idata Import ( user32.SendMessageA
004030AC .idata Import ( user32.SetWindowTextA
004030A8 .idata Import ( user32.wsprintfA
Sve izgleda OK. Znaci sve je OK tj. raspakovali smo fajl kako treba! Po
importima se zakljucuje da je ovaj .exe fajl pisan u ASMu.
The Art of Reversing by Ap0x Page 208 of 293