Jump to content
Tuts 4 You
Sign in to follow this  
Scale

Visual Basic Dissambling

Recommended Posts

Scale

i have vb 5 / 6 app which runs a code after a random period of time.

im trying to find the timmer now i tryed smartcheck but it doesnt want to run it becuase of a acces violation.

i know a part of the code that gets executed after the timer runs out so i tought ill goto the start of that code and backtrack but it gets calleed from a jump (bunch of same jumps around but to others codes) but olly can t find a reference to the jump so i cant back track it :(

any tips , sugentions welcome.

Share this post


Link to post
Teddy Rogers

Simple way, set a breakpoint at the beginning of the routine you want Olly to break at. When it breaks press spacebar and enter, "retn", then press F7 or F8 and Olly will take you to the previous routine rather than the jump table you are seeing...

Ted.

Share this post


Link to post
Scale

so what if it aint call'ed but jumped to then u wouldnt return.

But thats prolly my paranoia speaking cheers ill try it :)

Share this post


Link to post
Scale

Ok another problem the program takes the MD5 on a picture.

So i trow the app into PEiD use kanal

as result i get:

md5 :: 0009fc06 :: 0049fc06

So i goto 0049fc06 goto the top of the code put a breakpoint.

So then the program breaks i edit the picture and resume the program but then it knows i modifyed it.

Im totaly confused now :dunno:

Share this post


Link to post
Scale

Sorry cant seem to edit my old post:

I figured it out there was an crc check as well this was used to check the intergerty of the app itself i tought that was its soul purpose but it seems it wasnt :P

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×
×
  • Create New...