[crackme] Hard Core Poly Protection ( it's Very Hard to CRACK )

[Gladiator]

Hi every body.

This is the Nested Poly Protection. They Mixed .

Write a tutorial ,If Crack it.

Note:

Don't try to find Password Just Patch it.

Thanx.

[Teddy Rogers]

The [crackme] tag has been added to your topic title.

Please remember to follow and adhere to the topic title format - thankyou!

[This is an automated reply]

[Gladiator]

I'm Sorry .

[quosego]

Pretty ugly patch by me... Should be more checks for the right place in the execryptor VM.

There are easier ways.. but I at least wanted not too patch the delphi compare..

Or feed the correct password from the beginning.

As for a tut, check the end of the entrypoint procedure.. There's my code.. bp it and check it..

A well should work the first time don't try it too often.. it might/will crash..

Type anything you want it should always say you pass..

And the pw of course is: nima.nikjoo@gmail.com

Checking for the 3 parts of the email and finally the email as a whole..

http://willhostforfood.com/access.php?fileid=45499

q.

Edited December 15, 2008 by quosego

[Gladiator]

Thanks , You are very good and Specialist in Reverse Eng.

But what about Difficultly ? Easy - Medium or Really Hard ?

[quosego]

If you're not into poly/obfu it's prolly quite hard..

If you are.. or just do a quick fix it's reasonably easy..

q.

[Gladiator]

Thank you .

is there any MUP about Solving Poly/Obfu ?

This is My Crackme but i can't Crack it ! ( i need Paper or MUP , Please )

[quosego]

To begin with you know the solution just by looking at delphi strings.. Therefore you can simply code something at the start of the check to feed the correct answer.. (though not a very skilful solution) Also the first three checks use the standard delhpi compare and are for each poly the same.. Both the second and third are obvious the obfu is simple and the solution obvious, eg nop the jumps.

For the execryptor ones you of course gotta deal with something a lot more complex.. You can't just nop a jump..

You can however feed the execryptor obfu the correct value when exitting the delphi compare function when being in the second check. This has to be done with great care (when doing this is execryptor code and not in delphi code) since execryptor uses certain instructions multiple times..

You cannot do this for the 4th last check since the delphi compare is not used.. You can however once again hook certain instuction in the execryptor VM/obfu and feed them the correct values. (for instance the one I used had the correct value in edx and the wrong one in eax.. Simply creating something that checks for the correct time (which I did very generically resulting in an ugly patch ) and then patching the execryptor VM at that time (move edx into eax) will solve it..

Also you could just patch the delphi compare to always exit with a true value passing the first three checks. And code a message box over the last function that says "you pass". Since you can deduce what the function must do.

The most elegant one imho is the patching of the execryptor code and the other poly conditonal jumps.. Since in real life this usually the only way.. (defenitely not always.)

q.

Edited December 16, 2008 by quosego

[Gladiator]

Thanx

[2days]

be curious, See also.

[Gladiator]

Thank you.

[diginode]

pls help for newbie step by step... thanks.

[Gladiator]

Unpacking VM is Private in crackers world , try your self.

[Sp1d3rZ]

quosego U R ALSO GREAT MAN. Ok Let me wanna try

Edited February 4, 2009 by Sp1d3rZ

[anonim]

Unpacking VM is Private in crackers world , try your self

very bad answer.

when u asked for guidance, some gave you,

now,

it might be your doom to do so with the others.

atleast, show them the meaning of what being sayed..

or this "world" is just for those like you who would like to keep getting, but not share at all, some solidated world for the Elite

on the other hand,it might be that, your tutorials will just reflect another side of that attitude which would not make them of any meaning

at all.

looser.

Edited February 5, 2009 by anonim