You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
P E P a c k 1 . 0Prelistavajuci neke tudje keygeneratore koje imam na svom hard diskunaisao sam na jedan zanimljiv keygen za CDRLabel 4.1 koji su napravilimomci iz CORE crackerske grupe. Meni licno sam keygen nije bio zanimljivnego mi je bila zanimljiva zastita sa kojom je pakovan ovaj keygen. Upitanjuje PE Pack koji nikada ranije nisam runo odpakovao pa sam odlucio da seoprobam i sa ovim pakerom. Molim vas da imate na umu da mene, a ne bitrebalo ni vas, ne interesuje sta ova meta radi, nego me interesuje kako bihja to mogao da je odpakujem. Meta se nalazi u folderu Cas10 a zove secrcdl41.pepack10.exe. Ovu metu cemo otvoriti pomocu Ollya i pogledacemosta se nalazi na OEPu.00401212 > $ /74 00 JE SHORT cr-cdl41.0040121400401214 >-\E9 E74D0000 JMP cr-cdl41.00406000Dosta cudno, ali nema veze, sa F8 cemo izvrsiti oba skoka i nacemo se ovde:00406000 60 PUSHAD00406001 E8 00000000 CALL cr-cdl41.0040600600406006 5D POP EBP00406007 83ED 06 SUB EBP,6Sa F8 cemo izvrsavati red po red sve dok ne dodjemo do jednog dugackogloopa:004060D4 /73 38JNB SHORT cr-cdl41.0040610E004060D6 |48DEC EAX004060D7 |74 35JE SHORT cr-cdl41.0040610E004060D9 |78 33JS SHORT cr-cdl41.0040610E004060DB |66:8B1C39 MOV BX,WORD PTR DS:[ECX+EDI]004060DF |80FB E8 CMP BL,0E8004060E2 |74 0FJE SHORT cr-cdl41.004060F3004060E4 |80FB E9 CMP BL,0E9004060E7 |74 0AJE SHORT cr-cdl41.004060F3004060E9 |66:81FB FF25 CMP BX,25FF004060EE |74 0FJE SHORT cr-cdl41.004060FF004060F0 |41INC ECX004060F1 ^|EB E3JMP SHORT cr-cdl41.004060D6004060F3 |294C39 01 SUB DWORD PTR DS:[ECX+EDI+1],ECX004060F7 |83C1 05 ADD ECX,5004060FA |83E8 04 SUB EAX,4004060FD ^|EB D7 JMP SHORT cr-cdl41.004060D6004060FF |295439 02 SUB DWORD PTR DS:[ECX+EDI+2],EDX00406103 |83C1 06 ADD ECX,600406106 |83EA 04 SUB EDX,400406109 |83E8 05 SUB EAX,50040610C ^|EB C8 JMP SHORT cr-cdl41.004060D60040610E \C685 D3000000 F>MOV BYTE PTR SS:[EBP+D3],0F800406115 5B POP EBX00406116 5A POP EDX00406117 5E POP ESI00406118 ^ E9 76FFFFFF JMP cr-cdl41.004060930040611D 6A 04 PUSH 4Da ne bi smo izvrsavali ovaj dugacak loop postavicemo break point na adresu0040611D, odnosno na PUSH 4 komandu jer cemo tu sigurno stici odmahposle izvrsavanja ovog loopa to jest posle odpakivanja u memoriju. Sa F8cemo polako izvrsavati kod sve dok ne dodjemo do adrese:004061C2 0385 47050000 ADD EAX,DWORD PTR SS:[EBP+547]004061C8 52 PUSH EDX ; cr-cdl41.00404000<strong>The</strong> Art <strong>of</strong> Cracking by Ap0x Page 134 <strong>of</strong> 165
Change language