Hi,
since of there are many ways to solve the crackme, it might be a good idea to have some little solutions based on the tool used. Here is a little explanation using Dede.
Load and process the crackme. After some seconds, Dede ends the initial procedure and shows all the informations retrieved about the crackme.
The 'Forms' panel contains all the relative infos about the form(s) inside the crackme, in this case we have only one form named TForm1. If you click above this voice, you will see all the controls inside the only dialog in the crackme; the one we are looking for is:
Code:
object pass: TEdit ; edit control
Left = 104 ; left position inside the dialog
Top = 16 ; top position inside the dialog
Width = 137 ; width
Height = 21 ; height
Color = clYellow ; background color
TabOrder = 0 ; tab order...
Text = 'Entrer un password valide' ; initial text
OnChange = passChange ; procedure called when the password is changed
end
The check procedure is all inside 'passChange' routine. To see the procedure you have only to click on the 'Procedures' panel and then, double click over the voice 'passChange'. The last thing to do is to read the right password:
Code:
* Reference to: Controls.TControl.GetText(TControl):TCaption;
00464E1B E820C3FCFF call 00431140 ; get the serial
00464E20 8B45FC mov eax, [ebp-$04] ; eax -> serial
* Possible String Reference to: '3625043'
00464E23 BA7C4E4600 mov edx, $00464E7C ; edx = 3625043
* Reference to: System.@LStrCmp;
00464E28 E817F8F9FF call 00404644 ; compare between our serial and '3625043'
00464E2D 7512 jnz 00464E41
* Possible String Reference to: 'Mot de passe correcte'
00464E2F BA8C4E4600 mov edx, $00464E8C ; edx -> "password is right"
* Reference to control TForm1.verif : TEdit
00464E34 8B83F4020000 mov eax, [ebx+$02F4]
* Reference to: Controls.TControl.SetText(TControl;TCaption); ; set the right message
00464E3A E831C3FCFF call 00431170
00464E3F EB10 jmp 00464E51
* Possible String Reference to: 'Password Erroné'
00464E41 BAAC4E4600 mov edx, $00464EAC ; edx -> "password is not right"
* Reference to control TForm1.verif : TEdit
00464E46 8B83F4020000 mov eax, [ebx+$02F4] ; set the wrong message
* Reference to: Controls.TControl.SetText(TControl;TCaption);
regards,
ZaiRoN