Read below if it dont get deleted.

First, tell us what YOU have done to try to find the answer to your OWN question. Have you been to the OLLY Forum and read anything there??? Have you done any searching here or on the net to see if the answer to your question is ALREADY out there??? These are things you are supposted to do BEFORE you post a question here.

This is NOT the place to post a question if you have done NOTHING to try to solve your own problem.

I don't want anyone answering this guy's question until he responds with information about the results of his own search.


Regards,

I know what I did maybe is not the correct way of doing this,but hey I got it done(partially). First I searched for all the tuts related to my vb program, and elimated them by comparing them with the program I had. Which searched for username/pw at start-up with a nag screen.

Well I finally limited my tuts to Olly tut by Gabri3l(hxxp://cracking.accessroot.com/). I used different segments of each finally got the program reversed. Tut1- I did a str ref with wdsam wrote down the offset(for both jumps since it was asking for u/pw) for the jumps then went to hex edit 4.1 and changed the 75 to BE on both offsetsand saved and backup. Well I fired up my program and entered the u/pw,but it didnt give me a successful registration or the bad registration code message box,but it did still say demo version.

I went ahead and tried the game out and it was still in demo mode after 10 chess moves no more hints where given and you cant move less then 1 sec at a time. So I figured I made some progress in my first crack at this reverse engineering stuff. Well the next thing in his tut 1 was to search the registry for the file because either the serial is stored in a the registry or a file. Well this program didnt have nothing in the registry like the program he was training in the tut with. I did a complete search in the registry of the main files in the program folder and nothing came up. So that was as far as tut 1 could help me with this especially since setting a breakpoint on RegQueryValueExA was the next step. I also realized there is a file I need either a regfile or inf that holding the u/pw combo,but after searching the program folder and opening every file none had anything i could figure would help.

Tut 2-This is where I needed to start because this program being tested is a vb7 like the one I was working with and didnt need unpacking. Anyway I made another copy of the main exe(....2.exe) and opened it with ollydbg and did a right click search for all ref text strings. I found the string that was the error message so I double clicked it, and it took me to the code in the main program. From there the tut searched for TEST EAX,EAX above the error message. So I searched for the that about 13 lines above the error message and set a breakpoint on it like in the tut. Once I set the bpx on it and hit f9 to run the program ask for u/pw as normal. The program goes to the error box for incorrect username/pw so I click ok, and it takes me back to entering the u/pw(sheesh). In his tut it suppose to have broke somewhere after entering the u/pw or atleast after clicking ok on the error box. Well it didnt do neither one. So I tried to figure out how he knew what test eax that he needed by comparing all the code before and after his with mine. Needless to say none of it look the same so i did what may be wrong.

I started from that test eax,eax and starting going up to ever test eax,eax with a jump one to two lines beneath it from that point. Well after 13 bpx I finally found the test eax that I needed,and it broke after I pressed ok on the error box for wrong u/pw. So now I was in line with the tut again I figured,and hey I felt good finding out that little piece of work. From there tut 2 was useless cause just by happened his serial was right there in ecx and edx after his bpx. So I was on my own with nothing but time to have fun and figure some things out.

I remebered in another tut that I can hit f8 in olly to do step on a particular code to see whats it doing. So I went back to that test eax, eax and hit (f9) then once I got to the bpx f8 just to see what will happen(after I restarted the whole ollydbg with the bpx still on the test eax). It would not go no farther cause it wanted a u/pw so i entered that. Well evertime I hit f8 I would look in the eax register since most tuts I read always have the password there,but I also looked for any jumps while pressing f8. Every I came to a jump if it was jnz or jne I would right click them and choose edit-binary-and switch them to 74(JE) and of course if it was je i would leave it je. Well I did this like 27 times and eventually started getting acsii in eax register window. I wrote down anytime there was anything thing in the window,but it was never what I put in the u/pw box. Then after like 36 times of hitting f8 it stopped again and would not go no farther. So I clicked on the program and to my surprise there was a box that said registred toblank) and the name of the company,but it didnt say demo version or nothing anymore. So again progress, and to my great surprise once the program started it was not in demo mode at all I started playing the computer a chess game, and before after 10 moves no hint was given,but now that option was still there. I clicked help and about and no registration box came up and the registered "to" field was still blank.

At this point I am totally confused because I didnt know the username and password used to activate the program. I closed down olly and everything mad cause I thought I missed something. So I remembered that I wrote down the acsii on notepad as they came up so I tried them on the original program. Once I opened up the original program it went straight to the registrered to(blank box) and started right up registered! So I thought maybe i used olly on the original and not the copy. So i opened up the copy and same thing already registred. Now i am totally confused how this happened. So i went to the registry to see if for some reason now the program have registry values so i searched the whole registry and theres nothing there still for the program. Now im mad and very confused and restart my computer thinking afterwards it may have something in the registry. Well once I go to the program folder there was a new file in there called lastgame.dat to my surprise. Mainly because that file is the only reference file in olly and wdsam,but it was never in the folder I even did a search on my computer for it and nothing came up. Well i right clicked it and chose properties, and it was modified 2 min ago which was once i restarted my computer. Now i fell out my chair cause im totally lost on how this files gets there and realize this file is the one that most likely hold the u/pw. I open with ultraedit and it has one line with this:

wK…¦²Íøê˝:Û'5à…ñ¾ù—ô5{ÍŒçDâG5E2>yð…èw”[`ì¸;RA°0ðçÇ

I dont know what that is but sure its encoded with the u/pw somewhere in it. So as asked to tell everything I done there it is. Now any help in figuring out this file will be greatly appreciated. I used Peek11 to extract text from the file and all it came up with was G5e2.

Aaaaaaghhhhh!

Ok I edited the post to the best I could. Is this better? Can I received help now?

TrainingDay:

After editing your long, rambling Reply, at Kayaker's direction, it is now at least something approaching a posting meeting the requirements of our Rules. However, has it not occurred to you that it really has nothing specific to do with the subject you first posted about "bpx lstrcmp" and "Olly", and that you did NOT respond to my direction that you should SEARCH, YOURSELF, for the answer to that question and post your findings here?

How about you demonstrate that you can follow the directions which were given and post what you found about THAT question, before you ask for more detailed help, otherwise you appear to simply be attempting "avoidance" of the instructions you were given.

Regards,

tell me... those hundreds of words...are they worth it? jmi?

just help him out..or leave him alone... whats the problem???

train: tried to use anyof the well known plugins? or the strg+l command??

regards,

I did not ask him for hundred of words. I asked him to demonstrate that he was following our Rules about searching for an answer before asking a question. The original question was limited, and so should have been his response. Then he avoided my directions that he do a search for the answer for the question he originally asked and, instead, posted a different long and rambling question.

The purpose of the original comments and the follow-ups, are to attempt to inform new posters who ignore the Rules in the FAQ, that we do take those Rules seriously and we expect them to be followed. Otherwise, his post would have simply been removed. In other words, it was an object lesson, not entirely about the Poster.

Regards,

Really it has everything to do with my original question because I was FOLLOWING TUTS FROM YOUR LINKS AT THE BOTTOM OF THE PAGE! Really I dont know what high horse you on,but like stated above it have to be easier to say,"That file appeared because..." then to rample on and on about did you search. Like I would spend all the time writing excuse me typing all that if I didnt first search for the answer so I wouldnt have to ask you. Last mentioned my post most likely will be deleted so be it, but thats the price I pay for coming here thinking I could receive quality help, and not bashing every post. I assume you think this is the only reversion forum and most likely it is or most likely is the best forum as far as knowledge,but I rather go somewhere else then to put up with a bunch of 12 year old thinking they something. I have to atleast say I appreciate all the searching and reading it did do here to help me reverse my first program. I simply asked why that file appeared after doing so and the meaning of its content thats all. Arrogance is not going to get you to far.

Hi!

JMI is WAAAAAAAYYYYY older than that. ;p

/Manko

Howdy,

12 year olds just flame because they can.
The old cranky bastard bitches because he wants you to learn.

You all need to stop taking it personally when JMI requests you to show some effort. Why is this so hard to understand ????

The number one rule is: show some effort.
and I dont mean "I searched and I could not find"..........

This rule will NEVER be changed. If you can not show some effort then your question is nothing more than a crack request.

NOW, stop being a bunch of whiney little pussies and step up.

-OBC-

>The number one rule is: show some effort.
>and I dont mean "I searched and I could not find"..........

He didn't search but he showed the effort to post what he did.Isn't that enough?????

>I don't want anyone answering this guy's question until he responds with information about the results of his own search.

Arrogance pays

Once again esther you are apparently trying to earn another trip to the halls of the "uninvited."

Since TrainingDay deleted his first post's contents after my second post, you obviously don't know what was going on, or just don't care.

It is simply foolish for you to make comments about character traits you proclaim in your signature your find noteworthy in yourself.

Regards.