Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Crackme Yay

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming -> Crackmes
View previous topic :: View next topic  
Author Message
Buggy
Advanced Cheater
Reputation: 0

Joined: 04 Jan 2008
Posts: 72
Location: Republic of Korea (South Korea)

PostPosted: Tue Sep 09, 2008 6:06 am    Post subject: Crackme Yay Reply with quote

Hi guyz this is a crackme that is a little bit a simple and packed with F*G can be unpACKED with P*iD G***r*c unp**k* (easy and also hint : You use this tool if you wanna see what a program is compiled/protected with.
however, this crackme is simple and easy. Hope you guys have happy ,fun sizzlin' crackin' with this crackme!

edit : i recode it some codes so try this one.. some things unpatched

_________________

[img]
<a><img></a>[/img]
iroo sooo hooooot


Last edited by Buggy on Tue Sep 09, 2008 8:43 am; edited 1 time in total
Back to top
View user's profile Send private message
SunBeam
I post too much
Reputation: 65

Joined: 25 Feb 2005
Posts: 4022
Location: Romania

PostPosted: Tue Sep 09, 2008 7:01 am    Post subject: Reply with quote

You mean FSG and PEiD Generic unpacke (yes, you made a typo - missing "r")? Smile

001301D1 FF63 0C JMP DWORD PTR DS:[EBX+C]

Break, F7 and you're at OEP. Dump and fix IAT with ImpREC or w.e. A suggestion, don't use obvious replies in those message boxes. You leave too many hints..

EDIT: Just so you know, your app doesn't run on my OS if execute normally. I can however bypass the gay ZwQuerySysInfo(hDebugObject) check..

133E30 - RET

--

Stack SS:[0012FB60]=001861A4, (UNICODE "What so proudly we hail'd at the twillight's last gleaming")

--

001346A8 . FF15 7C101300 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCmp>] ; MSVBVM60.__vbaStrCmp

$ ==> > 001863A4 |Arg1 = 001863A4
$+4 > 001861A4 \Arg2 = 001861A4

--

0013477B . 50 PUSH EAX
0013477C . 51 PUSH ECX
0013477D . 8D55 C0 LEA EDX,DWORD PTR SS:[EBP-40]
00134780 . 53 PUSH EBX
00134781 . 52 PUSH EDX
00134782 . C745 C0 08000000 MOV DWORD PTR SS:[EBP-40],8
00134789 . FF15 58101300 CALL DWORD PTR DS:[<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox

c0ngrat5 ?


Last edited by SunBeam on Tue Sep 09, 2008 7:22 am; edited 1 time in total
Back to top
View user's profile Send private message
Buggy
Advanced Cheater
Reputation: 0

Joined: 04 Jan 2008
Posts: 72
Location: Republic of Korea (South Korea)

PostPosted: Tue Sep 09, 2008 7:20 am    Post subject: Reply with quote

hmm i'm using stupid vista home premium but it works well sometimes it tells me failed to do something and thanks for suggestion and actually i worried about that a little bit too kk but i didn't apply it kkk
_________________

[img]
<a><img></a>[/img]
iroo sooo hooooot
Back to top
View user's profile Send private message
SunBeam
I post too much
Reputation: 65

Joined: 25 Feb 2005
Posts: 4022
Location: Romania

PostPosted: Tue Sep 09, 2008 7:22 am    Post subject: Reply with quote

See solution above Smile
Back to top
View user's profile Send private message
Buggy
Advanced Cheater
Reputation: 0

Joined: 04 Jan 2008
Posts: 72
Location: Republic of Korea (South Korea)

PostPosted: Tue Sep 09, 2008 7:26 am    Post subject: Reply with quote

did you mean that
'c0ngrat5' was the serial? nope!


hmmm. also i gotta try another APIs that is really compatiable(is the spelling correct?) with every windows..

_________________

[img]
<a><img></a>[/img]
iroo sooo hooooot
Back to top
View user's profile Send private message
SunBeam
I post too much
Reputation: 65

Joined: 25 Feb 2005
Posts: 4022
Location: Romania

PostPosted: Tue Sep 09, 2008 7:40 am    Post subject: Reply with quote

No, I mean if I got to that string, then obviously I know the serial. Read the clues in post #2 Smile
Back to top
View user's profile Send private message
Zand
Master Cheater
Reputation: 0

Joined: 21 Jul 2006
Posts: 424

PostPosted: Tue Sep 09, 2008 7:48 am    Post subject: Reply with quote

It doesn't run on my system, even with 133e30 patched... (unpacked)
Back to top
View user's profile Send private message
SunBeam
I post too much
Reputation: 65

Joined: 25 Feb 2005
Posts: 4022
Location: Romania

PostPosted: Tue Sep 09, 2008 7:56 am    Post subject: Reply with quote

Uhm, debug it lol. It doesn't open still, because if pass is wrong, it jumps to vbaEnd T_T.. D'oh.. You don't even have a CHANCE to write a pass T_T.. And he asks me for the pass.. pfft T_T..

LEARN TO CODE. NOT IN VB!
Back to top
View user's profile Send private message
Zand
Master Cheater
Reputation: 0

Joined: 21 Jul 2006
Posts: 424

PostPosted: Tue Sep 09, 2008 8:02 am    Post subject: Reply with quote

No chance to write a pass? Is there a GUI? I still can't get it open. I hear a system error sound and then it closes, looks like it doesn't even get past the vb main..
Back to top
View user's profile Send private message
Buggy
Advanced Cheater
Reputation: 0

Joined: 04 Jan 2008
Posts: 72
Location: Republic of Korea (South Korea)

PostPosted: Tue Sep 09, 2008 8:38 am    Post subject: Reply with quote

Hmm maybe my oversense made these problems ..
next time i should not patch entry point and stuffz...
And also it has its main form, too. i cant look for the problem still

_________________

[img]
<a><img></a>[/img]
iroo sooo hooooot
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming -> Crackmes All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites