ItShO
August 6th, 2006, 10:04
i'm a VERY NOOB on Cracking, so don't kill me even if the stuff is too simple :-)
i've a small proggie, that been edited by the autor to work on xp.
after 5 hours of analyzing i figure out this:
-=-=-=
getinformation
(get windows version)
if XP go to _xp
...
...
_xp:
if file USERXP is not exist goto _next
(that means that the user is not registered)
...
_next:
{doing some nasty calc about Harddrive serial number, put Calc1 as param1}
00401530 |.PUSH EAX ; eax=calc1 as ParameterBlock
00401531 |.LEA EAX,DWORD PTR SS:[EBP-334]
00401537 |.PUSH EAX ; dll file name
00401538 CALL DWORD PTR DS:[<&KERNEL32.LoadModule>; LoadModule
...
...
Leave
-=-=-=-=
2 questions:
A. even if i bp on loadmodule, and presses F8, when i click on view->
i don't see the new module loaded !.
(while i DO see it on the file->attach as new process with pid 08ec)
so, can i change the api function ? is it correct way ? what can i change it to ?
i tried changing it to CreateProcess
(because m$ said on MSDN that:
)
but nothing appear.
B. if i try to dbg only the loaded dll alone (with loadll of olly), it runs & ends without prompting a thing. so, how can i put the Calculated number manually when i load the dll ?
p.s.
i'm not asking for a crack ! just tell me if i'm doing something wrong.
i've a small proggie, that been edited by the autor to work on xp.
after 5 hours of analyzing i figure out this:
-=-=-=
getinformation
(get windows version)
if XP go to _xp
...
...
_xp:
if file USERXP is not exist goto _next
(that means that the user is not registered)
...
_next:
{doing some nasty calc about Harddrive serial number, put Calc1 as param1}
00401530 |.PUSH EAX ; eax=calc1 as ParameterBlock
00401531 |.LEA EAX,DWORD PTR SS:[EBP-334]
00401537 |.PUSH EAX ; dll file name
00401538 CALL DWORD PTR DS:[<&KERNEL32.LoadModule>; LoadModule
...
...
Leave
-=-=-=-=
2 questions:
A. even if i bp on loadmodule, and presses F8, when i click on view->
i don't see the new module loaded !.
(while i DO see it on the file->attach as new process with pid 08ec)
so, can i change the api function ? is it correct way ? what can i change it to ?
i tried changing it to CreateProcess
(because m$ said on MSDN that:
Quote:
Loadmodule Note This function is provided only for compatibility with 16-bit versions of Windows. Applications should use the CreateProcess function |
)
but nothing appear.
B. if i try to dbg only the loaded dll alone (with loadll of olly), it runs & ends without prompting a thing. so, how can i put the Calculated number manually when i load the dll ?
p.s.
i'm not asking for a crack ! just tell me if i'm doing something wrong.