Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


easy crackme

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming -> Crackmes
View previous topic :: View next topic  
Author Message
Buggy
Advanced Cheater
Reputation: 0

Joined: 04 Jan 2008
Posts: 72
Location: Republic of Korea (South Korea)

PostPosted: Sun Feb 10, 2008 4:46 am    Post subject: easy crackme Reply with quote

i didn't add any anti debugging thing.

_________________

[img]
<a><img></a>[/img]
iroo sooo hooooot
Back to top
View user's profile Send private message
Zand
Master Cheater
Reputation: 0

Joined: 21 Jul 2006
Posts: 424

PostPosted: Sun Feb 10, 2008 5:44 am    Post subject: Reply with quote

Code:
5.1157,283,770,368Bytes


Hm.
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 198

Joined: 25 Jan 2006
Posts: 8516
Location: 127.0.0.1

PostPosted: Sun Feb 10, 2008 1:59 pm    Post subject: Reply with quote

Ok first thing this does is checks to see if your volume of the drive is the same as the hard coded one which 99.9% of the time for everyone it wont be. So you can patch that here:

Code:
0040684A      50            PUSH EAX
0040684B      68 18364000   PUSH Copy_of_.00403618                   ;  UNICODE "1234129413"
00406850      FF15 8C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>;  MSVBVM60.__vbaStrCmp


EAX contains your actual drive volume, so just patch the push of the hardcoded on to push EAX also:

Code:
0040684A      50            PUSH EAX
0040684B      50            PUSH EAX
0040684C      90            NOP
0040684D      90            NOP
0040684E      90            NOP
0040684F      90            NOP
00406850      FF15 8C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>;  MSVBVM60.__vbaStrCmp


This will bypass that check and load the form. You could also hook GetVolumeInformationA as that is what is being called. Which is being called here:

Code:
004067A9   .  50            PUSH EAX
004067AA   .  E8 8DCBFFFF   CALL Copy_of_.0040333C


Next the password on the form. The annoying part with this one is that the program closes when you get the wrong password. Your drive information is pulled for the bytes it can hold and compared to the textbox here:

Code:
004064BC   .  50            PUSH EAX
004064BD   .  FF15 8C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>;  MSVBVM60.__vbaStrCmp


Anyway the password looks to just be the capacity of your harddrive in bytes with 5.1 added to the front, and the word Bytes to the end without any spaces. So just open My Computer right click on your C:/ and write in:

5.1<total space (capacity)in bytes>Bytes

So for example my drive is currently:

Capacity: 60,003,381,248 bytes

So I would enter:

5.160,003,381,248Bytes

Then you get the congrats message.

_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
woodbine
Grandmaster Cheater
Reputation: 0

Joined: 28 Sep 2007
Posts: 899

PostPosted: Sun Feb 10, 2008 2:29 pm    Post subject: Reply with quote

Zand wrote:
Code:
5.1157,283,770,368Bytes


Hm.


Guess this Crackme is pretty big.

_________________
Funny Picture Of The Week:



Back to top
View user's profile Send private message
Buggy
Advanced Cheater
Reputation: 0

Joined: 04 Jan 2008
Posts: 72
Location: Republic of Korea (South Korea)

PostPosted: Mon Feb 11, 2008 1:05 am    Post subject: Reply with quote

Well the password must be

OS Version & Capacity.

_________________

[img]
<a><img></a>[/img]
iroo sooo hooooot
Back to top
View user's profile Send private message
xMurtaghx
I post too much
Reputation: 1

Joined: 13 Apr 2008
Posts: 3611
Location: Gayville, South Dakota, 57031, United States of America

PostPosted: Mon Apr 14, 2008 5:52 pm    Post subject: Reply with quote

that code is old im sure
_________________

Scania- Lvl 117 DK✔

WE WILL MISS GMS!
Back to top
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger
HolyBlah
Master Cheater
Reputation: 2

Joined: 24 Aug 2007
Posts: 446

PostPosted: Tue Apr 15, 2008 3:40 am    Post subject: Reply with quote

That topic is old, so stop bump it.
Back to top
View user's profile Send private message
Buggy
Advanced Cheater
Reputation: 0

Joined: 04 Jan 2008
Posts: 72
Location: Republic of Korea (South Korea)

PostPosted: Tue Apr 15, 2008 3:44 am    Post subject: Reply with quote

xMurtaghx wrote:
that code is old im sure

hmm i was surprised when my topic was replied by another person newly..
so i tried to read and you said : strange crackme and this .. ---...
anyone can i rep- him??...

_________________

[img]
<a><img></a>[/img]
iroo sooo hooooot
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 198

Joined: 25 Jan 2006
Posts: 8516
Location: 127.0.0.1

PostPosted: Tue Apr 15, 2008 4:00 am    Post subject: Reply with quote

Buggy wrote:
xMurtaghx wrote:
that code is old im sure

hmm i was surprised when my topic was replied by another person newly..
so i tried to read and you said : strange crackme and this .. ---...
anyone can i rep- him??...


Hes banned anyway for spamming, so just ignore him. Smile

_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
Buggy
Advanced Cheater
Reputation: 0

Joined: 04 Jan 2008
Posts: 72
Location: Republic of Korea (South Korea)

PostPosted: Tue Apr 15, 2008 5:23 am    Post subject: Reply with quote

Wiccaan wrote:
Buggy wrote:
xMurtaghx wrote:
that code is old im sure

hmm i was surprised when my topic was replied by another person newly..
so i tried to read and you said : strange crackme and this .. ---...
anyone can i rep- him??...


Hes banned anyway for spamming, so just ignore him. Smile


ah-ha! Red card means banned, right?? and he spammed in a lot of section ... LOL

_________________

[img]
<a><img></a>[/img]
iroo sooo hooooot
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 198

Joined: 25 Jan 2006
Posts: 8516
Location: 127.0.0.1

PostPosted: Tue Apr 15, 2008 9:43 am    Post subject: Reply with quote

Yeah, the red box under someones name/avatar means they are banned.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming -> Crackmes All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites