shellwolf Posted September 5, 2008 Share Posted September 5, 2008 enjoy it.CrackMe01.rar Link to comment Share on other sites More sharing options...
DrPepUr Posted September 5, 2008 Share Posted September 5, 2008 Please follow and adhere to the topic title format - thank-you! Link to comment Share on other sites More sharing options...
shellwolf Posted September 5, 2008 Author Share Posted September 5, 2008 Please follow and adhere to the topic title format - thank-you!ok.thank you Link to comment Share on other sites More sharing options...
SunBeam Posted September 5, 2008 Share Posted September 5, 2008 Most anti-debug tricks use SEH handlers and stuff from other protectors Good stuff, but not hard to skip if you check the stack Anyway, point is.. I found "A Martian!" (check up on ECX with hardcoded value). Not gonna say where to look Link to comment Share on other sites More sharing options...
shellwolf Posted September 5, 2008 Author Share Posted September 5, 2008 Most anti-debug tricks use SEH handlers and stuff from other protectors Good stuff, but not hard to skip if you check the stack Anyway, point is.. I found "A Martian!" (check up on ECX with hardcoded value). Not gonna say where to look GOOD! some anti is hide in function,so if u know it is a function of anti,just change returnvalue to false,then u will skip it.or u can nop it. i will post several crackmes that i had post in bbs.pediy.com before.Welcome to test . Link to comment Share on other sites More sharing options...
SunBeam Posted September 6, 2008 Share Posted September 6, 2008 (edited) I didn't NOP or change anything. Let me show you what I mean tE!Lock PUSH DWORD PTR FS:[EAX] MOV DWORD PTR FS:[ESP],EAX ^ Makes the SEH handler in stack, to skip your code I would only need to break on SEH Well, need to also patch those Context copies from ring0 to ring3 VMProtect PUSHFD/POPFD INT3 Classic Edited September 6, 2008 by SunBeam Link to comment Share on other sites More sharing options...
shellwolf Posted September 6, 2008 Author Share Posted September 6, 2008 (edited) I didn't NOP or change anything. Let me show you what I mean thanku. what OS you use?winxp or win2003? Edited September 6, 2008 by shellwolf Link to comment Share on other sites More sharing options...
SunBeam Posted September 6, 2008 Share Posted September 6, 2008 XP SP2 Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now