Axman v3.00 Beta 3
Introduction |
Greetings and welcome to the noble art of reverse engineering!
Tools required |
Numega SoftIce
Target's URL |
http://www.wwnet.com/~dfend/download.htm
Essay |
Step1 Run the register process.
Step2 Start SoftIce and place a breakpoint on BPX GetWindowTextA
Step3 Return to axman and press 'OK'
and SoftIce
breaks due to BPX USER32! GetWindowTextA
Step4 Press 'F11'
Step5 Press 'F5' twice.
Step6 You should land here................
USER32! GetWindowTextA
:BFF61718 B1A7
MOV CL , A7 <= Here!
:BFF6171A 55
PUSH EBP
Step7 Scroll down to..................
:00405965 8D4C2410
LEA ECX , [ESP+10]
=> Fake Code!
Step8 Trace down in the code to....................
:0040597A 50
PUSH EAX => Fakecode!
:0040597B 51
PUSH ECX => Company
:0040597C 52
PUSH EDX => Username!
:0040597D 8D4C241C
LEA ECX , [ESP+1C] => Company!
Step9 Go to................
:00405986 E8E5F9FFFF CALL 00405370
step into
this call with 'F8'
Step10 At............
:00405377 8D442400
LEA EAX , [ESP+00] => Fakecode!
Step11 Go to........
:00405382 52
PUSH EDX => Company!
:00405383 50
PUSH EAX => Username!
Step12 Go into the CALL at...........
:00405384 E857000000
CALL 004053E0
Step13 Trace down until you see............
:00405549 51 PUSH ECX
If
you dump ecx, you will see eight of the nine numbers that will form our
valid
serial!
Step14 Now goto.......
:00405551 8BAC2420010000 MOV EBP , [ESP+00000120]
did
you see what happend when you stept over the CALL 00405630
???
Yes, the final number of our valid serial was added!
This means that our serial now is almost complete, all that is left is
to split
the numbers in three parts with three numbers in each part.
Like this: xxx-xxx-xxx
Step15 Goto............
:0040555F 55 PUSH EBP
dump ebp!.......what do you see?.....right nothing!!
Now step over the CALL at............
:00405560 FF1520254100 CALL [00412520]
what do
you see..?.....you should see: xxx
Step16 And at............
:0040559D 55
PUSH EBP =>
xxx-
Step17 When you step over: CALL [00412524]
you will see => xxx-xxx
Step18 and at.........
:004055DB
55
PUSH EBP => xxx-xxx-
Step19 Now trace down in the code until you see.......
:004055E9 885D0B MOV [EBP + 0B] , BL
dump
ebp and you will get the final valid serial, this is the serial that will
register the
software!
Step20 At..............
:00405615
5D
POP
EBP => Valid serial!
Step21 And at...........
:00405391
8A10
MOV DL
, [EAX] => Valid serial!
Ok!...........i think we quit here, but before you try the serial i
would like to show you one last thing
so if you go back to ' Step8 '
and the trace down to..............
:0040599B 8BCE MOV ECX , ESI => Valid serial!!
So if you only want a serial, the cracking time would be ca: 15sec.
Final Notes |
| BACK |