DC After HD Bypass
Hey guys, after a few hours trying to bypass the DC, I got
to this function:
It doesn't have a local call/jmp and hooking it didn't help either.
I tried logging the caller's address but in C.E it didn't had anything.
Tried byte patching some addresses too.
Can anyone help me?
Thanks.
to this function:
Function
Code:
10182730 53 PUSH EBX 10182731 56 PUSH ESI 10182732 6A FF PUSH -0x1 ; /Arg2 = FFFFFFFF 10182734 8BF1 MOV ESI,ECX ; | 10182736 . 6A 48 PUSH 0x48 ; |Arg1 = 00000048 10182738 . B9 90F61C11 MOV ECX,Dumped.111CF690 ; | 1018273D . E8 9EF30C00 CALL Dumped.10251AE0 ; \Dumped.10251AE0 10182742 . 6A FF PUSH -0x1 ; /Arg2 = FFFFFFFF 10182744 . 6A 4A PUSH 0x4A ; |Arg1 = 0000004A 10182746 . B9 90F61C11 MOV ECX,Dumped.111CF690 ; | 1018274B . E8 90F30C00 CALL Dumped.10251AE0 ; \Dumped.10251AE0 10182750 . 33DB XOR EBX,EBX 10182752 . 53 PUSH EBX 10182753 . 53 PUSH EBX 10182754 . 53 PUSH EBX 10182755 . 53 PUSH EBX 10182756 . 6A 41 PUSH 0x41 10182758 . E8 43D3FFFF CALL Dumped.1017FAA0 1018275D . A1 D4B41511 MOV EAX,DWORD PTR DS:[0x1115B4D4] 10182762 . 8A80 8DE90000 MOV AL,BYTE PTR DS:[EAX+0xE98D] 10182768 . 83C4 14 ADD ESP,0x14 1018276B . 3AC3 CMP AL,BL 1018276D 0F85 82000000 JNZ Dumped.101827F5 10182773 . 399E D8A80200 CMP DWORD PTR DS:[ESI+0x2A8D8],EBX 10182779 . 75 0C JNZ SHORT Dumped.10182787 1018277B . 3AC3 CMP AL,BL 1018277D . 75 76 JNZ SHORT Dumped.101827F5 1018277F . 399E D4A80200 CMP DWORD PTR DS:[ESI+0x2A8D4],EBX 10182785 . 74 36 JE SHORT Dumped.101827BD 10182787 > E8 14ECFDFF CALL Dumped.101613A0 1018278C . 83F8 2E CMP EAX,0x2E 1018278F . 74 25 JE SHORT Dumped.101827B6 10182791 . 3D BF000000 CMP EAX,0xBF 10182796 . 74 1E JE SHORT Dumped.101827B6 10182798 . 3D D2000000 CMP EAX,0xD2 1018279D . 74 17 JE SHORT Dumped.101827B6 1018279F . 399E DCA80200 CMP DWORD PTR DS:[ESI+0x2A8DC],EBX 101827A5 . 74 08 JE SHORT Dumped.101827AF 101827A7 . 391D 60E31C11 CMP DWORD PTR DS:[0x111CE360],EBX 101827AD 75 46 JNZ SHORT Dumped.101827F5 101827AF > 53 PUSH EBX 101827B0 . 53 PUSH EBX 101827B1 . 53 PUSH EBX 101827B2 . 6A 04 PUSH 0x4 101827B4 . EB 35 JMP SHORT Dumped.101827EB 101827B6 > 53 PUSH EBX 101827B7 . 53 PUSH EBX 101827B8 . 53 PUSH EBX 101827B9 . 6A 05 PUSH 0x5 101827BB . EB 2E JMP SHORT Dumped.101827EB 101827BD > 3AC3 CMP AL,BL 101827BF . 75 34 JNZ SHORT Dumped.101827F5 101827C1 . 399E D8A80200 CMP DWORD PTR DS:[ESI+0x2A8D8],EBX 101827C7 . 75 2C JNZ SHORT Dumped.101827F5 101827C9 . 399E D4A80200 CMP DWORD PTR DS:[ESI+0x2A8D4],EBX 101827CF . 75 24 JNZ SHORT Dumped.101827F5 101827D1 . 381D 23E21C11 CMP BYTE PTR DS:[0x111CE223],BL 101827D7 . 53 PUSH EBX 101827D8 . 53 PUSH EBX 101827D9 . 53 PUSH EBX 101827DA . 74 07 JE SHORT Dumped.101827E3 101827DC . 68 EC000000 PUSH 0xEC 101827E1 . EB 08 JMP SHORT Dumped.101827EB 101827E3 > 881D FCE11C11 MOV BYTE PTR DS:[0x111CE1FC],BL 101827E9 . 6A 26 PUSH 0x26 101827EB > 6A 2C PUSH 0x2C ; |Arg1 = 0000002C 101827ED . E8 AE3DFFFF CALL Dumped.101765A0 ; \Dumped.101765A0 101827F2 . 83C4 14 ADD ESP,0x14 101827F5 > 8B56 08 MOV EDX,DWORD PTR DS:[ESI+0x8] 101827F8 . 8B42 08 MOV EAX,DWORD PTR DS:[EDX+0x8] 101827FB . 8D4E 08 LEA ECX,DWORD PTR DS:[ESI+0x8] 101827FE . 899E D8A80200 MOV DWORD PTR DS:[ESI+0x2A8D8],EBX 10182804 . 899E D4A80200 MOV DWORD PTR DS:[ESI+0x2A8D4],EBX 1018280A . 899E DCA80200 MOV DWORD PTR DS:[ESI+0x2A8DC],EBX 10182810 . 5E POP ESI 10182811 . 5B POP EBX 10182812 . FFE0 JMP EAX
It doesn't have a local call/jmp and hooking it didn't help either.
I tried logging the caller's address but in C.E it didn't had anything.
Tried byte patching some addresses too.
Can anyone help me?
Thanks.
Originally Posted by dreek1
