Axman v2.21
Written by McCodEMaN
Introduction |
Greetings and welcome to the noble art of reverse engineering!
Tools required |
Numega SoftIce v3.22
Target's URL |
http://www.wwnet.com/~dfend/download.htm
Essay |
Step1 Run Axman.exe an choose: [Agree and Register].
Step2 Type in:
name: McCodEMaN
Company: TRES2000
Reg. key: 1234567890
Step3 Start softice and place a breakpoint on BPX HMEMCPY, then
return to axman and press
[OK].
SoftIce breaks
due to BPX KERNEL! HMEMCPY.
Step4 Press 'F11' once.
Step5 Ok, let`s think.....
The program
has three fields that shall contain user info. is the program processing
these
user info. all
at the same time?....or is the program processing one field at the time.
Let´s
go for: one field at the time!.......
Step6 Press 'F5' twice!
Step7 Ok, now trace down to .....................
:004026AC 50 PUSH EAX
dump
eax => our fake code!
Step8 Go to.......................
:0026B0 50 PUSH EAX
dump
eax => Saves Company info!
Step9 Now trace down to.....
:004026B7 50 PUSH EAX
dump eax => Saves our username!
Yes, we
are almost at the finish line now, we are only going to find the little
serial.
Step10 Press 'F10' until you get a nag named: Axman-
Error 400
This nag
will tell you that you entered wrong reginfo.
Ok, why
did we get this nag???............Yes that`s correct, we have missed the
valid
serial and left the reg.process!
Step11 Go back to Step 9...... :004026B7 50
PUSH EAX
Step12 Ok, now we know that the valid serial is located somewhere
between step9 and
the address that gave us the Error message!
But where could it be?...do you want to know what i think??!!
I think you should try the first CALL after.... :004026B7
Step13 If you take one step down in the code you will see a CALL right!!?
it`s located
at .......
:004026B8 E886000000
CALL 00402743
step into
this call (stand on the call and press 'F8').
Step14 Trace down to..........
:0040275B 8D45E8
LEA EAX , [EBP-18]
LEA "load effective address offset" and what do you find if you dump eax?
Yes, there it is....the valid serial we have been looking for!!
xxx-xxx-xxx
Step15 Ok, go to...................
:00402761 50 PUSH EAX => Saves valid serial!
And here
is the PUSH...!
Step16 When you understand how i found the valid serial and understand
this reg.process, you
can type bc * to remove the active bp!
Final Notes |
| BACK |