sonkite
February 15th, 2004, 07:10
Quote:
[Originally Posted by Foreigner]Hi people,
I am new to Visual Basic, can you help me?
I am not able to find all the informations sonkite gave us; in particular, how did you find the value 4294967296 and where did you find the call to GetDiskFreeSpaceExa? I am using Ollydbg without success... any hint!?!
f. |
If you follow this call (at startup of crackme):
0043C539 CALL DWORD PTR [EDX+38]
.....
73577C78 CALL DWORD PTR [7358977C] ; GetDiskFreeSpaceExA
.....
735743A1 FILD QWORD PTR [ESP+4]
735743A5 POP ESI
735743A6 FSTP QWORD PTR [ESP]
735743A9 FLD QWORD PTR [ESP]
735743AC FMUL QWORD PTR [73587830]
735743B2 MOV DWORD PTR [ESP],EAX
735743B5 MOV DWORD PTR [ESP+4],EDX
735743B9 FILD QWORD PTR [ESP]
735743BC XOR EAX,EAX
735743BE FSTP QWORD PTR [ESP]
735743C1 FADD QWORD PTR [ESP]
735743C4 FSTP QWORD PTR [ECX+8]
There it calculates the values.