Hello,

I have an *.exe which reads after starting an *.ini. This ini has some parameters - one of them is SN (Serialnumber).

In case you enter a SerialNumber in the program, you are only asked to restart the program. Means, I think that the process to verify the serial is only used after starting the *.exe. Unfortunlately you will not get a "error message" or "error screen" after inserting a wrong serial number. This means, I am not able to look for a MessageBox.

In case you have no or a wrong serialnumber, you will get a "Wait screen" - starting with 10 sec. for each action.

Is someone in this board willing to help me ?



reagards kuzco

well im not "willing to help",but I like to 'help'. ;p

bp on ReadFile..find xrefs to the buffer.

this should lead you to the area where it compares the sn in the exe..unless they send it out over the internet for verification..good luck..

regards BanMe

err read file on an ini? doubt it...

probably GetPrivateProfileString ... would be more logical

ahh after doing a little lookup on GetPrivateProfileString you are indeed correct, that would be a more logical choice to bp on..to find the buffer used for storage after verifying GetPrivateProfileString is used though.. a bp on NtReadFile should work...my bad..

BanMe

https://www.openrce.org/forums/posts/1139

Or you could just use the buffer that is passed to GetPrivateProfileString (4th argument) to receive the result which, in this case, will be the serial number.

I doubt NtReadFile would be useful, as that would only be used internally and then partial contents copied to the passed string above.

You are my man

GetPrivateProfileStringA was the solution !

Many thanks.

Hello,
long time ago you all helps me to find a number for a *.ini with ollydbg and GetPrivateProfileString.
Now I have chnaged my PC and I have to reasd it again.

Unfortunately I can not remmber how to do it:
1. Have started ollydbg
2. open the *.exe
3. F9 (for run)
4. ???

Where can I insert the "search for" GetPrivateProfileString ?

Any hint is welcome .

thanks
kuzco

Please ignore (more or less) my last mail.

The *.exe was packed with UPX. After unpacking I was able to search for GetPrivateProfileStringA.
Unfortunaltely I am not able to find the SN again.

Can someone give me a hint ?
Whole program has only 1 MB.

regards
kuzco