bytexus
February 16th, 2003, 17:03
The new version of nav Comes whith a new protection (i say). First i see the progs runs with no nags(i sayd to myself goobye vbox) but when i look at proces list i see two processes rundll32.exe. So we have a vboxed aplication(4.6.2).The main executable is not crypted with VBOX (i think) "main.exe". But the other thing that i've noticed is that the nav uses some dll "crypt32.dll"and reads some interesting values from registry. I think it uses some encryption algoritm(rsa????). I tried softice but you can breakpoint only api's(if i put a breakpoint on some memory adress a nav window will pop up), finaly i make the program run(by changeing only a jump) but the programs doesn't load the plugins->so it doesn't work. I've found the call that loads the plugins but thi was my end. I trace into some calls until i reach into a call from ole32.dll. When the prog stil is in the trial time this the cal from ole32.dll returns some (good) values in the registers.When the trials expires the call returns other values(bad) in the registers. I replaced the values with the good one but i got a crash(probably those values were on stack also).
I don't know what else i could try to do because i can't crack-it.
I must say i am a newbie and don't have too much experience.
thanks.
I don't know what else i could try to do because i can't crack-it.
I must say i am a newbie and don't have too much experience.
thanks.