Acid_Cool_178
presents he's

#11  Tutorial

 

For Hellforge

This Text Are Only Ment To Edcucational Purpose And Not To Be Used Illegaly, I Take No Response For Illegal Use Of This Text. Move On On Your Risc.

Athour Information
E-mail acid_cool_178@hotmail.com
Age 17
Web Page http://acidcool.cjb.net/
Date March 2K
Member in Hellforge Flying Horse Cracking Force
Groups Web Page Hellforge Login FHCF Login

 

Program Infromation
Name Crackme 3 by Fr1c
CrackMe3.exe
Athour Fr1c
Where to Downlaod The Crmper Crew
Size 13KB
Tools used W32Dasm Downlaod At
1. Player Tools
2. Programmer Tools
What kind of a program Crackme Shareware
   
Skill Easy Not so easy Hard X-pert
       

 

Information about the Protection I

This crackme got one file outside the crackme3.exe and are comparing it with the real serial

Before we start

Nothing to say

The Process

Fire up Crackme3.exe in W32Dasm and goto REFS-->String Data References
Dubbleclick on Registred and now you can see this code.

* Possible StringData Ref from Code Obj ->"REGISTERED"
|
:00402848 68A01E4000 push 00401EA0                         <-- You will land here
:0040284D 8B8D58FFFFFF mov ecx, dword ptr [ebp+FFFFFF58]
:00402853 8B11 mov edx, dword ptr [ecx]

Scroll up and you can see this

:0040281B 0F848E000000 je 004028AF
change to
:0040281B 909090909090 je 004028AF
And you have patched the crackme

But we won't do that.

Scroll more up and you can see this.

* Possible StringData Ref from Code Obj ->"98765432112345"         <-- The Code
|
:004027F7 C745947C1E4000 mov [ebp-6C], 00401E7C
:004027FE C7458C08800000 mov [ebp-74], 00008008

Well, now we now's the code, scroll more up and you can sse this code.

* Possible StringData Ref from Code Obj ->"crackme3.key"
|
:004027B2 68541E4000 push 00401E54
:004027B7 6A01 push 00000001

Well, just create one file called crackme3.key and write 98765432112345 and save the file
run the crackme and it's registred

Ending

Well, my first keycheck with no help :)

Information about the Protection II

This Crackme hace the filename and the code saved as strings. Not bad :)

Greetings

LaZaRuS, Wajid, Borna Janes, ManKind, Eddie Van Camper, ACiD BuRN, KoRnFLeX, Eternal_Bliss, Potsmoke, DiABLO. Torn@do, ^AlX^ and all the other i have forgotten