Jump to content
Tuts 4 You

[crackme] Crack me #1 By Genoc!de


hibernator

Recommended Posts

hibernator

Just take NOP......the API MessageBox

It is further promotion, than a crackme.

Thanks

Yup , but there is a quicker way than NOPing :crazy:. Any other ideas would be greately appreciated.

I am a still a newbie though :elvis: . Thanks :cc_chinese:

Edited by genocide
Link to comment

The same with NikolayD, no nag! I know 2 method is nop and change push 0 to push 1.

Another can be used but when you know how the message is called

Edited by kakamail
  • Like 1
Link to comment
hibernator

Whoa , whoa !! I don't know how that happened :cryss: Everything ran as expected on my computer :disgust:. This piece of code was supposed to give the nag "invoke MessageBox,hWnd, addr Remove, addr NAG, MB_APPLMODAL " :doh: Thanks :)

The same with NikolayD, no nag! I know 2 method is nop and change push 0 to push 1.

Another can be used but when you know how the message is called

I am sorry but I still can't figure out the cause of the problem :cry:. Here is the source code . You may want to compile it yourself and run again :elvis:

Link to comment
DeadAndGone

I can't compile the source because i don't have a compileren installed yet.

But, (im not sure), it seems you should invoke the messagebox at WndProcedure at initializing.

  • Like 1
Link to comment
C0M3ND4D0R

Thank you for providing the source.....

I have not had much time to analyze despite being written in MASM, I do not use WinASM. I use RadASM.

so try:

LRESULT CALLBACK WndProcedure (HWND hWnd, uMsg UINT, WPARAM wParam, lParam LPARAM);

create a return...NAG was not removed, will give a return FALSE, to stop the application.

if( NAG )

return FALSE

can be an alternative.

Hug

Link to comment

the place where you call MessageBox is wrong (message can not be displayed due the fact that at this moment there is no valid handle of the window)

if you call it from:


.ELSEIF eax==WM_CREATE invoke MessageBoxA,hWnd, addr Remove, addr NAG, MB_APPLMODAL ; My nag screen!

here you got what you want, at least i hope. :D

Edited by sama
  • Like 1
Link to comment
Teddy Rogers

The [crackme] tag has been added to your topic title.

Please remember to follow and adhere to the topic title format - thankyou!

[This is an automated reply]

Link to comment

if wana remove only with Nop or FNOP

004013B5 D9D0 FNOP

004013B7 D9D0 FNOP

004013B9 D9D0 FNOP

004013BB D9D0 FNOP

004013BD D9D0 FNOP

004013BF D9D0 FNOP

004013C1 D9D0 FNOP

004013C3 D9D0 FNOP

004013C5 D9D0 FNOP

004013C7 D9D0 FNOP

maybe in fact maybe work better with other push before (push 0) or changing maybe to a push 0 to push 40

  • Like 1
Link to comment
  • 4 months later...

Well, back after quite some time :) Thanks goes to all. I think an elegant way to remove MBs is to open by CFF Explorer and change the "MessageBoxA" to "GetMessageA". :cool2: Read it somewhere in ARTeams ezine ;)

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...