께께께께께께께께께께께께께께께께께께께께께께께께께께께� 께 ____ __ __ 께賞 께 / _/_ _ __ _ ___ ____/ /____ _/ / 께 幡� 께 _/ // ' \/ ' \/ _ \/ __/ __/ _ `/ / 께 � � 께 /___/_/_/_/_/_/_/\___/_/ \__/\_,_/_/ 께 � � 께 ____ __ __ 께 � � 께 / __ \___ ___ _______ ___ ___/ /__ ____ / /____께 � � 께 / /_/ / -_|_- 4032A5 .... ... ... ... blahblah 0167:004032a5 a144564000 mov eax,[00405644] 0167:004032aa 50 push eax 0167:004032ab ff15a0634000 call [KERNEL32!LocalLock] ahhh, LocalLock, I know what it does: "The LocalLock function locks a local memory object and returns a pointer to the first byte of the object's memory block." We do slowly but at least we DO com closer to our routine... =) 0167:004032b1 50 push eax 0167:004032b2 8bf8 mov edi,eax 0167:004032b4 53 push ebx 0167:004032b5 a104504000 mov eax,[00405004] 0167:004032ba 6a0d push 0d 0167:004032bc 50 push eax 0167:004032bd ff15d8644000 call [USER32!SendMessageA] Again a sendmessage. Get into sice, type "wmsg 0d": 000D WM_GETTEXT great! look it up in the API reference: "An application sends a WM_GETTEXT message to copy the text that corresponds to a window into a buffer provided by the caller." WM_GETTEXT wParam = (WPARAM) cchTextMax; // number of characters to copy lParam = (LPARAM) lpszText; // address of buffer for text Return Values: The return value is the number of characters copied. hmmm, we need the length AND a pointer to a buffer as return values... have a look at the API reference (once again ;), then at address 4032b1. Eax is the pointer to the buffer, at line 4032b2 it is copied to edi. And it won't be changed as i figured out! After SendMessageA we have edi==pointer to buffer and eax==return value of SendMessageA==length of buffer. Followed by some code, that will write this buffer to a file: 0167:004032c3 ff75fc push dword ptr [ebp-04] 0167:004032c6 57 push edi 0167:004032c7 ff3540564000 push dword ptr [00405640] 0167:004032cd ff1564634000 call [KERNEL32!_hwrite] 0167:004032d3 3b45fc cmp eax,[ebp-04] 0167:004032d6 7442 jz 0040331a great.here we got to insert a jump to our code somewhere. i think we'll take the line at 4032C7, gonna insert the jump to our code (remember, our location was 404E9C). Of course, we got to restore the overwritten bytes inside our code again. Our jump needs 5 bytes, so the "push dword ptr [00405640]" instruction has to be resotored again. Press F5 (GOTO) then type ".4032C7", then F3 "EDIT" and finally F2 to switch to ASM. Enter "jmp 4E9C" press return, then "nop" and return, then escape. Then press F9 and our jump is done. Now we'll code the "encryption". We are at 4032CD now, that's where we got to jump back to. Jump to the cave, where we'll add this code by pressing F5 and typing ".404E9C". Now remember, edi was a pointer to the textbuffer and eax the size of the buffer in bytes. So we'll make an easy 'encryption', you may write your own, mine is rather cheap, a simple XOR plus a ROL instruction ;) pushad ;save registers xchg eax, ecx ;ecx=size of buffer lamecrypt: xor b,[edi],'d' ;remember: edi is a pointer to our buffer, rol b,[edi],cl ;some lame encryption nop ;some nops for further changes nop nop nop nop nop nop nop inc edi ;increment pointer to buffer (next char) loop lamecrypt ;loop until ecx=0 -> end of buffer popad ;restore registers push d,[00405640] ;remember? we have to restore the overwritten ;push instruction from 4032C7 !! jmp 32CD ;we got to jump back to the code at 4032CD OK, we are still at 404E9C. Press F3, then F2 and enter the code above. The label "lamecrypt" is located at 404E9E, so you won't type "loop lamecrypt", you'll type "loop 4E9C". Finally press F9 and we have finished the encryption-code. We have finished now, at least part 1, i need to learn for a maths test now, maybe i'll update this essay tomorrow. Included are my modified version and my orginial version of notepad. Greetings fly out to: no specific order. ultraschall, cardenal mendoza, kaparo, flwright, ratso, haldir, lightdruid, ganjaman, telcofix, whataduck, tornado, hutch, masta, notty, knotty, kwazy webbit, secret, iczelion, bisoux, MisterE, mr nop, neural noise, lazarus, peegee, random, daze, the anti xryst, acid burn, azzyrian, decline, blind angel, keyboard junky, reverend x, DnNuke, Gizmo, viny, volatility, alpine, promothee, sat0r, fli7e, targ0n, Ridlexx, novatrix, TomTom, WarezPup, Weazel, visionz, kaai, MagicRaph, sepulcrum, MVD, sn00pee, sinn0r and all who contribute to the reversing spirit ;) Group/chan greets: all blizzard members, everyone in #win32asm, #cracking, #elitereversers, #reversing4newbies, #immortaldescendants, #digital.factory, #hellforge, and #learn2crack. I would be pleased to get some feedback, catch me on irc or mail to: defiler@elitereversers.deZE=-1>0042FCA3 C60700