Results 1 to 4 of 4
  1. #1
    Corrupt99's Avatar
    Join Date
    Jul 2014
    Gender
    male
    Posts
    3
    Reputation
    10
    Thanks
    0
    My Mood
    Confused

    Have trouble reverse engineering to bypass

    I have been playing around with reverse engineering. It is true I don't know how to program, but I have been going through a lot of the olly tuts on youtube. So I understand a little about JMP, JNZ, JNE, JE, JZ, CMP, MOV, CALL and some other functions. I understand a little about how to read the registers. I have this program that I have been having problems with reverse engineering on it. I am trying to bypass the serial. I have set a breakpoint just before the nag screen pops up. The nag screen pops after after a 'call' is made to an address inside a system file. I know I can't change anything in a system file. The call is made to the Kernel32.HeapCreate, then from there to the ntdll. Then the nag screen pops up. During all the checks for a registration key it hops around in quite a few system files. I tried to NOP this call, but get errors. So the program HAS to make this call. I have tried to see where in the original program the registration process is located but to me it just seems like everything is ran through the system files that I can't touch.


    <edit> For anybody trying to help I do have teamspeak availability to talk on with you. I'm not trying to get someone to reverse this program for me, but to help give me a better understanding of what is going on.
    Last edited by Corrupt99; 07-14-2014 at 06:08 PM.

  2. #2
    somewhatpro's Avatar
    Join Date
    May 2014
    Gender
    male
    Posts
    317
    Reputation
    38
    Thanks
    29
    My Mood
    Daring
    Kernel32.HeapCreate is for memory allocation (like when you do in C++ char *pchar = new char[size];)

    So, my quick guess is that, when that function is called (Kernel32.HeapCreate), at that point it is preparing a new char array (string) to put the serial on.

  3. #3
    Corrupt99's Avatar
    Join Date
    Jul 2014
    Gender
    male
    Posts
    3
    Reputation
    10
    Thanks
    0
    My Mood
    Confused
    So do I need to look even before all that happens? You're meaning so by this time it has already done a check for an existing registration and is already in the process of the nag screen that pops up. In the nag screen is another button to click on before I try to enter a registration code.

  4. #4
    divjeet's Avatar
    Join Date
    May 2016
    Gender
    male
    Posts
    3
    Reputation
    10
    Thanks
    0
    My Mood
    Aggressive
    HI IM LOOKING FOR SOME HELP ON REVERSE ENDINEERING.IM USING OLLYDBG TO BYPASS A LOCAL SOFTWARE I HAVE SEEN MANY VIDEOS ON YOUTUBE BUT EHAT THEY TEACH AND WHAT I AM IN IS VERY DIFFERENT I CAN NOT FIND BINARY STRINGS NOR I CANT FING INTERMODULAR CALL .I USED PIED TO DETECT AND IT SAYS "microsoft Visual C++ 7.0 Method2 [Overlay]". I HAVE TRIED TO UPLOAD THE SCREENSHOT LINK BUT IM NOT AUHORIZED TO DO SO.ANY HELP ON THIS??

    [http]COLON//iDOTimgurDOTcom/HBMY6waDOT[PNG]
    http[COLON]//i[DOT]imgur[DOT]com/hdpUIMc[DOT]png
    Last edited by divjeet; 05-01-2016 at 12:52 AM.

Similar Threads

  1. Replies: 12
    Last Post: 07-10-2012, 06:35 PM
  2. Replies: 2
    Last Post: 08-19-2009, 01:01 AM
  3. having trouble with my sig
    By Paroxysm in forum Suggestions, Requests & General Help
    Replies: 6
    Last Post: 04-11-2008, 02:10 PM
  4. Reverse Engineering!
    By Jeckels in forum WarRock - International Hacks
    Replies: 13
    Last Post: 11-06-2007, 09:45 PM