The art of cracking - Tutoriali

0040100C . 85C0TEST EAX,EAX0040100E . 74 1EJE SHORT damn_con.0040102E00401010 . A3 95234000 MOV DWORD PTR DS:[402395],EAX00401015 . 8307 01 ADD DWORD PTR DS:[EDI],100401018 . 33C0 XOR EAX,EAX0040101A . 50 PUSH EAX ; /lParam => NULL0040101B . 68 45104000PUSH damn_con.0040104500401020 . 50 PUSH EAX ; |hOwner => NULL00401021 . 6A 73 PUSH 73 ; |pTemplate = 7300401023 . FF35 95234000 PUSH DWORD PTR DS:[402395]00401029 . E8 B3030000 CALL damn_con.004013E10040102E > 6A 00 PUSH 0 ; /ExitCode = 000401030 . E8 F4030000 CALL damn_con.00401429 ; \ExitProcessSta sam vam rekao na OEPu smo. Sada preostaje samo da izvrshimo dumpprograma i to je to. Idemo na Plugins -> OllyDump -> Dump debugedproccess. Default podesavanja su OK pritisnite Dump i snimite fajl. ZatvoriteOlly i probajte da startujete novi fajl i on radi !!!!!! Ok uspeli smo. Da bi smoproverili da li je sve OK otvorimo dumpovan fajl u Olly-u. Idemo na Desnodugme -> Search for -> All referenced strings. Vidimo ovo:Text strings referenced in dmp:CODEAddress DisassemblyText string00401000 PUSH 0 (Initial CPU selection)0040108D PUSH dmp.00402023 ASCII "-=[ ABOUT ]=-"00401092 PUSH dmp.00402031 ASCII "You are just trying to solve DAMN's Officialjoinig Contest. Made by tHE EGOiSTE/DAMN. Atfirst make a keygen for this simple keycheckroutine, then try to crack this program. TheLOCKED - Button should show an UNLOCKED-signand if "...00401107 PUSH dmp.0040227D ASCII "-=[ YEAH! ]=-"0040110C PUSH dmp.0040220EASCII "You got it! Thank you for registering!"00401124 PUSH dmp.00402353 ASCII " "00401149 PUSH dmp.00402321 ASCII " "0040127E PUSH dmp.00402317ASCII "About"004012CE PUSH dmp.0040228B ASCII "-=[ CHECK ]=-"00401301 MOV EDI,dmp.00402353 ASCII " "Ovo izgleda ok. Sada idemo na ALT + E da proverimo da li su svi imorti OK.Desno dugme na ime .exe fajla pa na View names. Tabela izgleda ovako:Names in dmpAddress Section Type ( NameComment004030B0 .idata Import ( user32.AppendMenuA004030B4 .idata Import ( user32.DeleteMenu004030F8 .idata Import ( GDI32.DeleteObject004030B8 .idata Import ( user32.DialogBoxParamA004030BC .idata Import ( user32.DrawMenuBar004030C0 .idata Import ( user32.EnableWindow004030C4 .idata Import ( user32.EndDialog004030EC .idata Import ( kernel32.ExitProcess004030C8 .idata Import ( user32.GetDlgItem004030CC .idata Import ( user32.GetDlgItemTextA004030F0 .idata Import ( kernel32.GetModuleHandleA004030D0 .idata Import ( user32.GetSystemMenu004030D4 .idata Import ( user32.Loa dBitmapA004030D8 .idata Import ( user32.LoadIconA004030DC .idata Import ( user32.MessageBoxA00401000 CODE Export 004030E0 .idata Import ( user32.SendDlgItemMessageA004030E4 .idata Import ( user32.SendMessageA004030AC .idata Import ( user32.SetWindowTextA004030A8 .idata Import ( user32.wsprintfASve izgleda OK. Znaci sve je OK t.j. raspakovali smo fajl kako treba !!! Poimortima se zakljucuje da je ova .exe fajl pisan u ASMu.The Art of Cracking by Ap0x Page 126 of 165