Log in

View Full Version : 32 bit asm to 64 bit asm (cracking help)


mr_tex
August 25th, 2012, 04:29
http://postimg.com/82000/photo-81273.jpg ("http://postimg.com/82000/photo-81273.jpg")

these are pictures of asm of an identical function in a program im trying to crack (32 bit vs 64 bit). this function checks to see if it's the registered version of the software.
on the left, is the 32-bit version already cracked by adding:
Code:
xor eax,eax
inc eax

right before the final line (return, or ret)

the right side, is the 64 bit version of the software, uncracked because I don't know how to translate the
Code:
xor eax,eax
inc eax


into 64-bit asm, can someone tell me how?

Indy
August 25th, 2012, 06:33
Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 2B, page 511.

mr_tex
August 25th, 2012, 19:03
I found the page you are talking about, and although it's written in the English language, I didn't understand anything but the first 2 opcodes which look familiar (1C and 1D)

The descriptions for everything on that page starts with "Subtract with borrow.." but what I'm trying to do is add (inc eax).

I admit that I don't understand hardly any of the theoretical backing in doing this stuff, but literally all I'm trying to do is inc eax in 64-bit as the application is extremely easy to crack (even without understanding what is going on or how I did it) in 32-bit mode. And I don't crack a lot of software or need to just this one.

Surely there is some conversion tool somewhere that can tell me the 64-bit equivalent of my 32 bit opcodes?

Aimless
August 25th, 2012, 21:31
Hello Tex,

64-bit is a quite different than compared to 32-bit, as I am sure you must have discovered.

I'd humbly suggest getting a good primer of the 64-bit architecture first (leave the instructions for now) and when you are comfortable, dive into a wee bit of coding, just to get your feet wet, you know what I mean?

Then, you can begin reversing the 64-bit architecture.

I shudder to think what is going to happen when you come up against a 64-bit .NET executable.

Have Phun