View Full Version : Help finding Breakpoint (Serial Fishing) Olly
Amber
January 30th, 2009, 09:51
I have a software which needs a registration code if not in 30 days it will stop working. According to PEiD it is Microsoft Visual C++ 7.0 Method2.
I have tried W32Dasm but can't find bad boy message "Your registration code is not valid".
In Olly I can only find the badboy in the stack window multiple times but I am unable to find it when I search for all referenced text strings.
How Can I find the registration code?
I have tried multiple tutorials even the ones that say to search for GetDLGItemText (but I only have GetDLGItem).
If anybody can help me I really would appreciate it :-)
naides
January 30th, 2009, 11:06
Quote:
[Originally Posted by Amber;79038]I have a software which needs a registration code if not in 30 days it will stop working. According to PEiD it is Microsoft Visual C++ 7.0 Method2.
I have tried W32Dasm but can't find bad boy message "Your registration code is not valid".
Chances are it is an encrypted string or resource, and is only recognizable as such at run time
In Olly I can only find the badboy in the stack window multiple times but I am unable to find it when I search for all referenced text strings.
Once the bad boy message starts showing up in the stack, the program already knows the serial is incorrect, so you need to pinpoint a branching point BEFORE the bad boy message is decrypted and placed in the stack to be displayed
How Can I find the registration code?
I have tried multiple tutorials even the ones that say to search for GetDLGItemText (but I only have GetDLGItem).
If anybody can help me I really would appreciate it :-) |
Search "Punto H", or "H point" tutorial by Ricardo Narvaja, and you will learn a "universal" way to catch an app processing a serial/key input
Amber
January 30th, 2009, 15:07
--- Naides ,
I tried to follow Point H But when I reach the point when I go to the MEMORY MAP window and choose SEARCH. I am unable to find my complete serial, instead I am only able to find it broken up in sets of 4.
if I set a BP Memory on Access (by selecting only the first character of my serial? right click BP.. or did I have to select more and right click?) Eitherway if I set a BP memory on access and then run Olly does not stop at point H (in fact it doesn't move. If I click pause Olly stops in REPE SCAS DWORD PTR ES:[EDI]. However, I don't believe that this is my H point because when I continue on and set BP on memory on access for this point H I can't go back to the program and click register for olly to break on that point.
Please Help.
Thank you I attached image to show results
http://s2.largeimagehost.com/displayimage.php?img=PUNTOH.jpg&loc=ecXUtcs&skey=june30
Ricardo Narvaja
January 31st, 2009, 05:11
if you understand the tutorial the point H is a REPS MOVS instruccion in this point the ESI register point to the source when you input data is, and EDI point to the destination where your data will be copied, point the DUMP with GOTO ADRESS =EDI in this moment and reach the ret of the api, or EXECUTE TILL RETURN, you see the info you entered in the dump, put a MEMORY ON ACCESS in the dump in this info and when the program, try to use your info, you will be very close to the HOT ZONE, continue tracing the hot zone and understand the use of your input, by the program.
If the first time stop in the point H you don't find ESI pointing to your input, press RUN and stop the second time, and try again, the times you need.
ricnar
arc_
January 31st, 2009, 07:24
GetDlgItemText is indeed not an existing function. Rather, it is a macro which resolves to GetDlgItemTextA or GetDlgItemTextW, depending on whether or not the program was compiled as unicode (A = ascii, W = wide i.e. 16 bits per character). You will see this kind of naming with most Win32 functions that work with text: GetWindowTextA, LoadLibraryA, ...
So, put a breakpoint on e.g. GetDlgItemTextA and try with that.
Powered by vBulletin® Version 4.2.2 Copyright © 2020 vBulletin Solutions, Inc. All rights reserved.