
Teleport Pro v1.29 (Build949)
Written by McCodEMaN
Introduction |
Greetings and welcome to the noble art of reverse engineering!
Tools required |
Numega SoftIce v3.2x
Target's URL |
http://www.tenmax.com
Essay |
Step1 Run the reg.process.
Step2 Start SoftIce and place a bp on BPX GetWindowTextA, return
to Teleport and press
[OK].
Step3 Press 'F5' twice.
Step4 Press 'F11' to leave the funktion.
Step5 You should land here...........
:0044AA48 FF1518644600
CALL [USER32!GetWindowTextA]
:0044BCC6 8B4D10
MOV ECX , [EBP + 10]
Step6 Trace down through the code, until you see........
:00443A38 8B4DF4
MOV ECX , [EBP - 0C] => Fake serial!
Step7 Keep on tracing down, until you see......
:00425994 3BC3 CMP EAX , EBX
If you now type:
? EAX => Fake serial!
Step8 Ok, we are close to the solution, keep going to.................
:004259AC 3945EC CMP [EBX - 14] , EAX
Ok, type:
? EAX => Valid serial!
Hm, we got the valid serial, but what if we like to choose our own serial?
well in that case we have to find the routine and cross the border!
Let`s try........
Step9 At....................
:004259B0 753A JNZ 004259EC
You have
to make a jump to next address or else you will miss the routine!
So type in: r eip=004259B2 and press [Enter].
Step10 Ok, do you see the CALL at..........
:004259D6 CALL
0044C19E ?
Step over the it and Wham!........You fake serial works as a valid!!!
Please Note! If you of some reason should like to use letter`s the JZ
at
............... :0042599B JZ will jump to
bad! So you should r eip over it!
Final Notes |