| View previous topic :: View next topic | 
	
	
		| Author | Message | 
	
		| Boon Cheater
 
  Reputation: 0 
 Joined: 13 Jan 2009
 Posts: 29
 Location: Latvia
 
 | 
			
				|  Posted: Sun Mar 22, 2009 4:03 am    Post subject: Another pretty easy crackme |   |  
				| 
 |  
				| Hello , everyone! This section seems to be quite quiet lately. 
 So here's a small/simple crackme.
 It's made in assembler so you won't have to spend hours digging through garbage code.
 
 The goal is  to make it accept any password. It will seem like thirty seconds of work , but after you patch it the obvious way there will be a surprise for you
  |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| Zand Master Cheater
 
 ![]() Reputation: 0 
 Joined: 21 Jul 2006
 Posts: 424
 
 
 | 
			
				|  Posted: Sun Mar 22, 2009 7:44 am    Post subject: |   |  
				| 
 |  
				| surprise!  |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| Boon Cheater
 
  Reputation: 0 
 Joined: 13 Jan 2009
 Posts: 29
 Location: Latvia
 
 | 
			
				|  Posted: Sun Mar 22, 2009 7:49 am    Post subject: |   |  
				| 
 |  
				| Good job, everyone!  
 Last edited by Boon on Mon Mar 23, 2009 12:22 am; edited 1 time in total
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| DoomsDay Grandmaster Cheater
 
  Reputation: 0 
 Joined: 06 Jan 2007
 Posts: 768
 Location: %HomePath%
 
 | 
			
				|  Posted: Sun Mar 22, 2009 8:44 am    Post subject: |   |  
				| 
 |  
				| I patched the following: 0040120D: JMP 0040109D
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| GIORA Grandmaster Cheater
 
 ![]() Reputation: 0 
 Joined: 05 Jun 2006
 Posts: 575
 
 
 | 
			
				|  Posted: Sun Mar 22, 2009 7:57 pm    Post subject: |   |  
				| 
 |  
				| Cracked! |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| Boardwalk30 Cheater
 
 ![]() Reputation: 0 
 Joined: 01 Mar 2009
 Posts: 30
 
 
 | 
			
				|  Posted: Sun Mar 22, 2009 9:11 pm    Post subject: |   |  
				| 
 |  
				|  	  | Zand wrote: |  	  | surprise!  | 
 
 
 
 hmm.. what exactly did you change to do it? i downloaded ur cracked version and compared it to the original and found absolutely no differences in ollydbg (and yet yours works and original doesnt)
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| Zand Master Cheater
 
 ![]() Reputation: 0 
 Joined: 21 Jul 2006
 Posts: 424
 
 
 | 
			
				|  Posted: Mon Mar 23, 2009 2:22 am    Post subject: |   |  
				| 
 |  
				|  	  | Boardwalk30 wrote: |  	  |  	  | Zand wrote: |  	  | surprise!  | 
 
 
 
 hmm.. what exactly did you change to do it? i downloaded ur cracked version and compared it to the original and found absolutely no differences in ollydbg (and yet yours works and original doesnt)
 | 
 
 That's the surprise! : >
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| DoomsDay Grandmaster Cheater
 
  Reputation: 0 
 Joined: 06 Jan 2007
 Posts: 768
 Location: %HomePath%
 
 | 
			
				|  Posted: Mon Mar 23, 2009 5:43 am    Post subject: |   |  
				| 
 |  
				| EB 00 Is the surprise. |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| ElitestFX Expert Cheater
 
 ![]() Reputation: 0 
 Joined: 01 Nov 2007
 Posts: 218
 
 
 | 
			
				|  Posted: Mon Mar 23, 2009 9:41 am    Post subject: |   |  
				| 
 |  
				| I suppose this patch may be considered as messing with the thread. Looks like the thread constantly writes EB 16 to 40109B. This will make it write EB 00. 402044 -> EB 00
 
 This patches the call.
 401096 -> EB 05 90 90 90
 
 This patches inside the call.
 401208 -> E9 90 FE FF FF
 -=or=-
 40120D -> E9 8B FE FF FF
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| Boon Cheater
 
  Reputation: 0 
 Joined: 13 Jan 2009
 Posts: 29
 Location: Latvia
 
 | 
			
				|  Posted: Mon Mar 23, 2009 9:45 am    Post subject: |   |  
				| 
 |  
				| The thread rule is there just so people don't nop the createthread call. |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| dnsi0 I post too much
 
 ![]() Reputation: 0 
 Joined: 04 Jan 2007
 Posts: 2674
 
 
 | 
			
				|  Posted: Mon Mar 23, 2009 9:49 am    Post subject: |   |  
				| 
 |  
				| How about I patch it and goto WriteProcessMemory and change the first line to RETN 14? it works the same way. |  | 
	
		| Back to top |  | 
	
		|  | 
	
		|  |