PDA

View Full Version : Function calls in delphi


uad782
November 10th, 2008, 02:33
Hi,

I am trying to reverse a Delphi target. I have found the call which beings up the Nag screen. After extensive searching I cannot find a jump to avoid this call.

Is it possible that Delphi could be setting the address dynamically with the address being changed if the target was licensed?

A copy of the call is below:

0051EF5B FF92 FC000000 CALL DWORD PTR DS:[EDX+FC] ; XXXXXX.0047702C

Any tips/help would be greatly appreciated
Thanks

Nacho_dj
November 10th, 2008, 03:47
Quote:
[Originally Posted by uad782;77674]Hi,
Is it possible that Delphi could be setting the address dynamically with the address being changed if the target was licensed?
Maybe, but think about the possibility that inside the code invoked by that call there could be your searched conditional jump also, performing a return of the routine without opening that nag...

Best regards

Nacho_dj

Maximus
November 10th, 2008, 05:28
Code:

--> class TUnregist:TRegist:TBase
--> virtual TBase::CheckRegister
...
TBase Obj;
if Unregistered then
Obj := TUnregist.Create
else
Obj := TRegist.Create
....
Obj.CheckRegister;

uad782
November 14th, 2008, 14:56
Thanks