I'm having trouble getting this one (or any one!). I've set breakpoints on "vbastrcomp", learning the ropes of OllyDbg. There's suppossed to be a comparision of the two strings and the password laid out nicely about this call. There's not. Eeerm. Let's type what I have. This is above the call :

00726345 . FF15 28144000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMove>] ; MSVBVM60.__vbaStrMove


What's this mean? Is the serial somewhere inside? and this before hand :

00726311 . FF15 D0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj

Please avoid capslocked thread title if you don't want to glow the FAQ in the dark..

You say your program supposedly compare the good serial and the one you entered with "vbaStrCmp".
But it only happens in really weak software and beginner crackmes..

I know you say that you're learning the ropes of OllyDbg, but VB apps *generally* are not a good starting point for doing this. You should read some tutorials on VB apps. (Not to mention the forum rules..)

As for the: "What's this mean?" it is an API call for a VB function. If you punch it in (Your favourite search engine), you will be able to find all the definitions/structures of them.

Also, if you KNOW that it's a direct comparison and KNOW it is using the vbastrcomp function, then you can set a bp on every call and then click the "register" button or whatever. Olly will break on the call that you need, and if it's a direct compare, you're just a stack location or register away from the correct serial. If it 'generates' a code, you're just a 90 or an EB away from success.

~Personmans

Microsoft Debugger is *quite* good for VB Apps. And its free, btw.

Have Phun