Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


ReverseMe

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming -> Crackmes
View previous topic :: View next topic  
Author Message
equalofheaven
Grandmaster Cheater
Reputation: 23

Joined: 16 May 2008
Posts: 734

PostPosted: Wed Sep 03, 2008 5:17 pm    Post subject: ReverseMe Reply with quote

Objective:
Stop the nags.
Rules:
No nopping.

_________________
Skype: RivalSpade
Krsna wrote:
When sensible men cease to see different identities due to different material bodies & he sees how beings are expanded everywhere, he attains to the Brahman conception
Back to top
View user's profile Send private message AIM Address Yahoo Messenger MSN Messenger
zeroc0de
Cheater
Reputation: 0

Joined: 31 Aug 2008
Posts: 32

PostPosted: Wed Sep 03, 2008 6:33 pm    Post subject: Reply with quote

Lol, right...

00402009 - EB 68
Back to top
View user's profile Send private message
equalofheaven
Grandmaster Cheater
Reputation: 23

Joined: 16 May 2008
Posts: 734

PostPosted: Wed Sep 03, 2008 10:22 pm    Post subject: Reply with quote

zeroc0de wrote:
Lol, right...

00402009 - EB 68


No doing that either! ;_;

_________________
Skype: RivalSpade
Krsna wrote:
When sensible men cease to see different identities due to different material bodies & he sees how beings are expanded everywhere, he attains to the Brahman conception
Back to top
View user's profile Send private message AIM Address Yahoo Messenger MSN Messenger
athiwatc
Advanced Cheater
Reputation: 0

Joined: 22 Sep 2007
Posts: 58

PostPosted: Thu Sep 04, 2008 2:11 am    Post subject: Reply with quote

can you change jump to some other value if you can i just cracked it
Back to top
View user's profile Send private message
Symbol
I'm a spammer
Reputation: 0

Joined: 18 Apr 2007
Posts: 5096
Location: Israel.

PostPosted: Thu Sep 04, 2008 9:20 am    Post subject: Reply with quote

You know we can replace just replace NOPs with shit like EB 00 (jump 2 bytes, to the next address, "EB 00" is 2 bytes) or 50 58 (push eax, pop eax) or if you need to patch an odd number of bytes, things like like stc/clc (Set Carry flag, Clear Cary flag) or use inc/dec instruction on a register that isn't in used...

Anyway, there are infinite possible combinations to reverse this without using NOP nor EB 68 at some address...
Back to top
View user's profile Send private message
SunBeam
I post too much
Reputation: 65

Joined: 25 Feb 2005
Posts: 4021
Location: Romania

PostPosted: Thu Sep 04, 2008 9:25 am    Post subject: Reply with quote

Here's a detailed analysis, if you want, although it's a simple mind-blowing target..

1) Olly -> Run app -> Pause -> Alt+F9 -> Click "OK" -> we land @ 402058

2) Scroll up, find start of function -> ShowMsgBox() = 401FA0 -> F2 on it -> F9 -> we break after clicking "OK"

3) Check stack:

$ ==> > 66051FB3 RETURN to MSVBVM60.66051FB3
$+4 > 0015F769 ASCII "[email protected]"
$+8 > 0012FB94
$+C > 00401C85 prjRever.00401C85
$+10 > 0015F7B0
$+14 > 00401C30 prjRever.00401C30

401C85 works pretty much like a switch-case, picking the function to execute and adjusting stack.

00401C85 816C24 04 47000000 SUB DWORD PTR SS:[ESP+4],47
00401C8D E9 0E030000 JMP 00401FA0

00401C92 816C24 04 4F000000 SUB DWORD PTR SS:[ESP+4],4F
00401C9A E9 21040000 JMP 004020C0
00401C9F 816C24 04 37000000 SUB DWORD PTR SS:[ESP+4],37
00401CA7 E9 D4040000 JMP 00402180
00401CAC 816C24 04 3B000000 SUB DWORD PTR SS:[ESP+4],3B
00401CB4 E9 77060000 JMP 00402330 ;
00401CB9 816C24 04 4B000000 SUB DWORD PTR SS:[ESP+4],4B
00401CC1 E9 1A080000 JMP 004024E0
00401CC6 816C24 04 43000000 SUB DWORD PTR SS:[ESP+4],43
00401CCE E9 FD0C0000 JMP 004029D0

You can see all main program functions above Wink Take it as a suggestion..


Last edited by SunBeam on Thu Sep 04, 2008 10:26 am; edited 1 time in total
Back to top
View user's profile Send private message
zeroc0de
Cheater
Reputation: 0

Joined: 31 Aug 2008
Posts: 32

PostPosted: Thu Sep 04, 2008 10:07 am    Post subject: Reply with quote

Bruce Lee wrote:
zeroc0de wrote:
Lol, right...

00402009 - EB 68


No doing that either! ;_;


That is not a NOP, like specified.

Good one, Sunbeam.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming -> Crackmes All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites