Bonjour,
J'ai lu et regardé avec intérêt les cours proposées par Daemon.
j'ai essayé d'appliquer ca sur ce logiciel tropix.cirad.fr mais pas moyen de trouver les codes sérials.
Quelqu'un pourrrait t'il me filer un coup de main ?
P.
CPU Disasm
Address Hex dump Command Comments
007513B0 /$ 53 PUSH EBX
007513B1 |. 80EA 01 SUB DL,1 ; Switch (cases 0..4, 4 exits)
007513B4 72 0E JB SHORT 007513C4
007513B6 74 32 JE SHORT 007513EA
007513B8 FECA DEC DL
007513BA 74 1B JE SHORT 007513D7
007513BC 4A DEC EDX
007513BD 80EA 02 SUB DL,2
007513C0 72 28 JB SHORT 007513EA
007513C2 EB 37 JMP SHORT 007513FB
007513C4 |> 6A 00 PUSH 0 ; Case 0 of switch Tropix.7513B1
007513C6 33C9 XOR ECX,ECX
007513C8 |. BA 08147500 MOV EDX,00751408 ; ASCII " >> Registration successful"
007513CD |. 8B40 14 MOV EAX,DWORD PTR DS:[EAX+14]
007513D0 |. 8B18 MOV EBX,DWORD PTR DS:[EAX]
007513D2 |. FF53 0C CALL DWORD PTR DS:[EBX+0C]
007513D5 |. 5B POP EBX
007513D6 |. C3 RETN
007513D7 |> 6A 00 PUSH 0 ; Case 2 of switch Tropix.7513B1
007513D9 |. 33C9 XOR ECX,ECX
007513DB |. BA 30147500 MOV EDX,00751430 ; ASCII " >> Still in evaluation"
007513E0 |. 8B40 14 MOV EAX,DWORD PTR DS:[EAX+14]
007513E3 |. 8B18 MOV EBX,DWORD PTR DS:[EAX]
007513E5 |. FF53 0C CALL DWORD PTR DS:[EBX+0C]
007513E8 |. 5B POP EBX
007513E9 |. C3 RETN
007513EA |> 6A 00 PUSH 0 ; Cases 1, 3, 4 of switch Tropix.7513B1
007513EC |. 33C9 XOR ECX,ECX
007513EE |. BA 54147500 MOV EDX,00751454 ; ASCII " >> Registration failed"
007513F3 |. 8B40 14 MOV EAX,DWORD PTR DS:[EAX+14]
007513F6 |. 8B18 MOV EBX,DWORD PTR DS:[EAX]
007513F8 |. FF53 0C CALL DWORD PTR DS:[EBX+0C]
007513FB |> 5B POP EBX ; Default case of switch Tropix.7513B1
007513FC \. C3 RETN
007513FD 00 DB 00
007513FE 00 DB 00
007513FF 00 DB 00
00751400 . FFFFFFFF DD FFFFFFFF
00751404 . 1D000000 DD 0000001D
00751408 . 20 20 20 3E 3 ASCII " >> Registrati" ; ASCII " >> Registration successful"
00751418 . 6F 6E 20 73 7 ASCII "on successful"
00751425 00 DB 00
00751426 00 DB 00
00751427 00 DB 00
00751428 . FFFFFFFF DD FFFFFFFF
0075142C . 19000000 DD 00000019
00751430 . 20 20 20 3E 3 ASCII " >> Still in e" ; ASCII " >> Still in evaluation"
00751440 . 76 61 6C 75 6 ASCII "valuation"
00751449 00 DB 00
0075144A 00 DB 00
0075144B 00 DB 00
0075144C . FFFFFFFF DD FFFFFFFF
00751450 . 19000000 DD 00000019
00751454 . 20 20 20 3E 3 ASCII " >> Registrati" ; ASCII " >> Registration failed"
00751464 . 6F 6E 20 66 6 ASCII "on failed"
0075146D 00 DB 00
0075146E 00 DB 00
0075146F 00 DB 00
CPU Disasm
Address Hex dump Command Comments
0075A038 . 55 PUSH EBP
0075A039 . 8BEC MOV EBP,ESP
0075A03B . 83C4 F0 ADD ESP,-10
0075A03E . B8 306E7500 MOV EAX,00756E30
0075A043 . E8 20E1CAFF CALL 00408168
0075A048 . E8 6B67ECFF CALL 006207B8
0075A04D . 85C0 TEST EAX,EAX
0075A04F . 0F85 4D010000 JNE 0075A1A2
0075A055 . A1 F0C47600 MOV EAX,DWORD PTR DS:[76C4F0]
0075A05A . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0075A05C . 0FB740 44 MOVZX EAX,WORD PTR DS:[EAX+44]
0075A060 . 66:A3 2861770 MOV WORD PTR DS:[776128],AX
0075A066 . A1 F0C47600 MOV EAX,DWORD PTR DS:[76C4F0]
0075A06B . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0075A06D . 66:BA F5FF MOV DX,0FFF5
0075A071 . E8 4A17D3FF CALL 0048B7C0
0075A076 . B8 BCA17500 MOV EAX,0075A1BC ; ASCII "Tropix7"
0075A07B . E8 8866ECFF CALL 00620708
0075A080 . 68 C4A17500 PUSH 0075A1C4 ; /String = "Mutexes created"
0075A085 . E8 CAE6CAFF CALL <JMP.&kernel32.OutputDebugStringA> ; \KERNEL32.OutputDebugStringA
0075A08A . 33C9 XOR ECX,ECX
0075A08C . B2 01 MOV DL,1
0075A08E . A1 B46A7500 MOV EAX,DWORD PTR DS:[756AB4]
0075A093 . E8 6CA3D2FF CALL 00484404 ; [Tropix.00484404
0075A098 . A3 2C617700 MOV DWORD PTR DS:[77612C],EAX
0075A09D . 33C0 XOR EAX,EAX
0075A09F . 55 PUSH EBP
0075A0A0 . 68 8DA17500 PUSH 0075A18D
0075A0A5 . 64:FF30 PUSH DWORD PTR FS:[EAX]
0075A0A8 . 64:8920 MOV DWORD PTR FS:[EAX],ESP ; Installs SE handler 75A18D
0075A0AB . 68 D4A17500 PUSH 0075A1D4 ; /String = "Splash created"
0075A0B0 . E8 9FE6CAFF CALL <JMP.&kernel32.OutputDebugStringA> ; \KERNEL32.OutputDebugStringA
0075A0B5 . A1 2C617700 MOV EAX,DWORD PTR DS:[77612C]
0075A0BA . E8 45FED2FF CALL 00489F04
0075A0BF . A1 2C617700 MOV EAX,DWORD PTR DS:[77612C]
0075A0C4 . 8B10 MOV EDX,DWORD PTR DS:[EAX]
0075A0C6 . FF92 8C000000 CALL DWORD PTR DS:[EDX+8C]
0075A0CC . E8 8F65ECFF CALL 00620660 ; [Tropix.00620660
0075A0D1 . 8B15 F4BA7600 MOV EDX,DWORD PTR DS:[76BAF4]
0075A0D7 . 8802 MOV BYTE PTR DS:[EDX],AL
0075A0D9 . A1 78BF7600 MOV EAX,DWORD PTR DS:[76BF78]
0075A0DE . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0075A0E0 . E8 973DD3FF CALL 0048DE7C
0075A0E5 . A1 78BF7600 MOV EAX,DWORD PTR DS:[76BF78]
0075A0EA . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0075A0EC . 33D2 XOR EDX,EDX
0075A0EE . E8 715CD3FF CALL 0048FD64
0075A0F3 . A1 78BF7600 MOV EAX,DWORD PTR DS:[76BF78]
0075A0F8 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0075A0FA . BA ECA17500 MOV EDX,0075A1EC ; ASCII "Tropix"
0075A0FF . E8 3038D3FF CALL 0048D934 ; [Tropix.0048D934
0075A104 . 8B0D 50C07600 MOV ECX,DWORD PTR DS:[76C050]
0075A10A . A1 78BF7600 MOV EAX,DWORD PTR DS:[76BF78]
0075A10F . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0075A111 . 8B15 A43F7400 MOV EDX,DWORD PTR DS:[743FA4]
0075A117 . E8 783DD3FF CALL 0048DE94
0075A11C . 8B0D 28BC7600 MOV ECX,DWORD PTR DS:[76BC28]
0075A122 . A1 78BF7600 MOV EAX,DWORD PTR DS:[76BF78]
0075A127 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0075A129 . 8B15 080B7200 MOV EDX,DWORD PTR DS:[720B08]
0075A12F . E8 603DD3FF CALL 0048DE94
0075A134 . 8B0D 98BD7600 MOV ECX,DWORD PTR DS:[76BD98]
0075A13A . A1 78BF7600 MOV EAX,DWORD PTR DS:[76BF78]
0075A13F . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0075A141 . 8B15 BC247400 MOV EDX,DWORD PTR DS:[7424BC]
0075A147 . E8 483DD3FF CALL 0048DE94
0075A14C . 6A 00 PUSH 0 ; /Arg2 = 0
0075A14E . 68 E8030000 PUSH 3E8 ; |Arg1 = 3E8
0075A153 . E8 005BD8FF CALL 004DFC58 ; \Tropix.004DFC58
0075A158 . A1 2C617700 MOV EAX,DWORD PTR DS:[77612C]
0075A15D . E8 FAFBD2FF CALL 00489D5C
0075A162 . 33C0 XOR EAX,EAX
0075A164 . 5A POP EDX
0075A165 . 59 POP ECX
0075A166 . 59 POP ECX
0075A167 . 64:8910 MOV DWORD PTR FS:[EAX],EDX
0075A16A . 68 94A17500 PUSH 0075A194
0075A16F /> A1 2C617700 MOV EAX,DWORD PTR DS:[77612C]
0075A174 |. E8 5FA8CAFF CALL 004049D8
0075A179 |. A1 F0C47600 MOV EAX,DWORD PTR DS:[76C4F0]
0075A17E |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
0075A180 |. 0FB715 286177 MOVZX EDX,WORD PTR DS:[776128]
0075A187 |. E8 3416D3FF CALL 0048B7C0
0075A18C \. C3 RETN ; Jump to 75A194
0075A18D $^ E9 22B0CAFF JMP 004051B4 ; SE handling routine
0075A192 .^ EB DB JMP SHORT 0075A16F
0075A194 > A1 78BF7600 MOV EAX,DWORD PTR DS:[76BF78]
0075A199 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
0075A19B . E8 2C3ED3FF CALL 0048DFCC
0075A1A0 . EB 0A JMP SHORT 0075A1AC
0075A1A2 > E8 1166ECFF CALL 006207B8
0075A1A7 . E8 D066ECFF CALL 0062087C
0075A1AC > E8 C3B5CAFF CALL 00405774
0075A1B1 . 0000 ADD BYTE PTR DS:[EAX],AL
0075A1B3 . 00FF ADD BH,BH
0075A1B5 FF DB FF
0075A1B6 FF DB FF
0075A1B7 FF DB FF
0075A1B8 07 DB 07
0075A1B9 00 DB 00
0075A1BA 00 DB 00
0075A1BB 00 DB 00
0075A1BC . 54 72 6F 70 6 ASCII "Tropix7",0 ; ASCII "Tropix7"
0075A1C4 . 4D 75 74 65 7 ASCII "Mutexes created",0 ; ASCII "Mutexes created"
0075A1D4 . 53 70 6C 61 7 ASCII "Splash created",0 ; ASCII "Splash created"
0075A1E3 00 DB 00
0075A1E4 . FFFFFFFF DD FFFFFFFF
0075A1E8 . 06000000 DD 00000006
0075A1EC . 54 72 6F 70 6 ASCII "Tropix" ; ASCII "Tropix"
0075A1F2 00 DB 00
007515BF . 50 PUSH EAX ; /FileName
007515C0 . E8 3F71CBFF CALL <JMP.&kernel32.LoadLibraryA> ; \LoadLibraryA
0012F088 01A9C798 \FileName = "C:\Program Files\Tropix 7\crdchkreg.dll"
0012F08C 0012F608 Pointer to next SEH record
0075165D > 68 84197500 PUSH Tropix.00751984 ; /ProcNameOrOrdinal = "CheckRegStatus"
00751662 . 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] ; |
00751665 . 50 PUSH EAX ; |hModule
00751666 . E8 B16FCBFF CALL <JMP.&kernel32.GetProcAddress> ; \GetProcAddress
Scanning -> C:\Program Files\Tropix 7\crdchkreg.dll
File Type : 32-Bit Dll (Subsystem : Win GUI / 2), Size : 445952 (06CE00h) Byte(s) | Machine: 0x14C (I386)
Compilation TimeStamp : 0x50894FFD -> Thu 25th Oct 2012 14:43:09 (GMT)
[TimeStamp] 0x50894FFD -> Thu 25th Oct 2012 14:43:09 (GMT) | PE Header | - | Offset: 0x00000108 | VA: 0x00400108 | -
[File Heuristics] -> Flag #1 : 00000000000001001100000100100001 (0x0004C121)
[Entrypoint Section Entropy] : 6.22 (section #1) ".itext " | Size : 0x838 (2104) byte(s)
[DllCharacteristics] -> Flag : (0x0000) -> NONE
[SectionCount] 8 (0x8) | ImageSize 0x76000 (483328) byte(s)
[Export] ModuleName: crdchkreg.dll | Functions: 6 | Names: 6 | OrdBase: 1
[Export] 100% of function(s) (6 of 6) are in file | 0 are forwarded | 6 code | 0 data | 0 uninit data | 0 unknown |
[...]
[!] TurboPower OnGuard detected
[CdKeySerial] found "Serial Number" @ VA: 0x00071112 / Offset: 0x00068512
[CdKeySerial] found "SerialNumber" @ VA: 0x0007116B / Offset: 0x0006856B
[CompilerDetect] -> Borland Delphi
- Scan Took : 0.249 Second(s) [0000000F9h (249) tick(s)] [244 of 577 scan(s) done]
CPU Disasm
Address Hex dump Command Comments
00752270 00 DB 00
00752271 00 DB 00
00752272 00 DB 00
00752273 00 DB 00
00752274 /$ 55 PUSH EBP ; Tropix.00752274(guessed void)
00752275 |. 8BEC MOV EBP,ESP
00752277 |. 83C4 F8 ADD ESP,-8
0075227A |. 53 PUSH EBX
0075227B |. 56 PUSH ESI
0075227C |. 8BF1 MOV ESI,ECX
0075227E |. 8955 FC MOV DWORD PTR SS:[LOCAL.1],EDX
00752281 |. 8BD8 MOV EBX,EAX
00752283 |. 8B45 FC MOV EAX,DWORD PTR SS:[LOCAL.1]
00752286 |. E8 313BCBFF CALL 00405DBC ; [Tropix.00405DBC
0075228B |. 33C0 XOR EAX,EAX
0075228D |. 55 PUSH EBP
0075228E |. 68 0C237500 PUSH 0075230C
00752293 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00752296 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP ; Installs SE handler 75230C
00752299 |. 8B43 0C MOV EAX,DWORD PTR DS:[EBX+0C]
0075229C |. 33C9 XOR ECX,ECX
0075229E |. B2 01 MOV DL,1
007522A0 |. FF50 2C CALL DWORD PTR DS:[EAX+2C]
007522A3 |. 8945 F8 MOV DWORD PTR SS:[LOCAL.2],EAX
007522A6 |. 33C0 XOR EAX,EAX
007522A8 |. 55 PUSH EBP
007522A9 |. 68 EF227500 PUSH 007522EF
007522AE |. 64:FF30 PUSH DWORD PTR FS:[EAX]
007522B1 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP ; Installs SE handler 7522EF
007522B4 |. 8B4B 10 MOV ECX,DWORD PTR DS:[EBX+10]
007522B7 |. BA 24237500 MOV EDX,00752324 ; ASCII "{D8DEB266-C625-4870-B53E-C74EB73DF3FF}"
007522BC |. 8B45 F8 MOV EAX,DWORD PTR SS:[LOCAL.2]
007522BF |. E8 200DF0FF CALL 00652FE4
007522C4 |. 8BCE MOV ECX,ESI
007522C6 |. 8B55 FC MOV EDX,DWORD PTR SS:[LOCAL.1]
007522C9 |. 8B45 F8 MOV EAX,DWORD PTR SS:[LOCAL.2]
007522CC |. 8B18 MOV EBX,DWORD PTR DS:[EAX]
007522CE |. FF53 58 CALL DWORD PTR DS:[EBX+58]
007522D1 |. 33C0 XOR EAX,EAX
007522D3 |. 5A POP EDX
007522D4 |. 59 POP ECX
007522D5 |. 59 POP ECX
007522D6 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
007522D9 |. 68 F6227500 PUSH 007522F6
007522DE |> 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
007522E1 |. 8B10 MOV EDX,DWORD PTR DS:[EAX]
007522E3 |. FF52 44 CALL DWORD PTR DS:[EDX+44]
007522E6 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
007522E9 |. E8 EA26CBFF CALL 004049D8
007522EE \. C3 RETN
007522EF $^ E9 C02ECBFF JMP 004051B4 ; SE handling routine
007522F4 .^ EB E8 JMP SHORT 007522DE
007522F6 /. 33C0 XOR EAX,EAX
007522F8 |. 5A POP EDX
007522F9 |. 59 POP ECX
007522FA |. 59 POP ECX
007522FB |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
007522FE |. 68 13237500 PUSH 00752313
00752303 |> 8D45 FC LEA EAX,[EBP-4]
00752306 |. E8 3136CBFF CALL 0040593C
0075230B \. C3 RETN ; Jump to 752313
0075230C $^ E9 A32ECBFF JMP 004051B4 ; SE handling routine
00752311 .^ EB F0 JMP SHORT 00752303
00752313 /> 5E POP ESI
00752314 |. 5B POP EBX
00752315 |. 59 POP ECX
00752316 |. 59 POP ECX
00752317 |. 5D POP EBP
00752318 \. C3 RETN
00752319 00 DB 00
0075231A 00 DB 00
0075231B 00 DB 00
0075231C . FFFFFFFF DD FFFFFFFF
00752320 . 26000000 DD 00000026
00752324 . 7B 44 38 44 45 42 32 ASCII "{D8DEB266-C625-4" ; ASCII "{D8DEB266-C625-4870-B53E-C74EB73DF3FF}"
00752334 . 38 37 30 2D 42 35 33 ASCII "870-B53E-C74EB73"
00752344 . 44 46 33 46 46 7D ASCII "DF3FF}"
0075234A 00 DB 00
0075234B 00 DB 00
0075234C /$ 55 PUSH EBP ; Tropix.0075234C(guessed void)
0075234D |. 8BEC MOV EBP,ESP
0075234F |. 83C4 F8 ADD ESP,-8
00752352 |. 53 PUSH EBX
00752353 |. 56 PUSH ESI
00752354 |. 8BF1 MOV ESI,ECX
00752356 |. 8955 FC MOV DWORD PTR SS:[LOCAL.1],EDX
00752359 |. 8BD8 MOV EBX,EAX
0075235B |. 8B45 FC MOV EAX,DWORD PTR SS:[LOCAL.1]
0075235E |. E8 593ACBFF CALL 00405DBC ; [Tropix.00405DBC
00752363 |. 33C0 XOR EAX,EAX
00752365 |. 55 PUSH EBP
00752366 |. 68 E4237500 PUSH 007523E4
0075236B |. 64:FF30 PUSH DWORD PTR FS:[EAX]
0075236E |. 64:8920 MOV DWORD PTR FS:[EAX],ESP ; Installs SE handler 7523E4
00752371 |. 8B43 0C MOV EAX,DWORD PTR DS:[EBX+0C]
00752374 |. 33C9 XOR ECX,ECX
00752376 |. B2 01 MOV DL,1
00752378 |. FF50 2C CALL DWORD PTR DS:[EAX+2C]
0075237B |. 8945 F8 MOV DWORD PTR SS:[LOCAL.2],EAX
0075237E |. 33C0 XOR EAX,EAX
00752380 |. 55 PUSH EBP
00752381 |. 68 C7237500 PUSH 007523C7
00752386 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00752389 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP ; Installs SE handler 7523C7
0075238C |. 8B4B 10 MOV ECX,DWORD PTR DS:[EBX+10]
0075238F |. BA FC237500 MOV EDX,007523FC ; ASCII "{D8DEB266-C625-4870-B53E-C74EB73DF3FF}"
00752394 |. 8B45 F8 MOV EAX,DWORD PTR SS:[LOCAL.2]
00752397 |. E8 480CF0FF CALL 00652FE4
0075239C |. 8BCE MOV ECX,ESI
0075239E |. 8B55 FC MOV EDX,DWORD PTR SS:[LOCAL.1]
007523A1 |. 8B45 F8 MOV EAX,DWORD PTR SS:[LOCAL.2]
007523A4 |. 8B18 MOV EBX,DWORD PTR DS:[EAX]
007523A6 |. FF53 54 CALL DWORD PTR DS:[EBX+54]
007523A9 |. 33C0 XOR EAX,EAX
007523AB |. 5A POP EDX
007523AC |. 59 POP ECX
007523AD |. 59 POP ECX
007523AE |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
007523B1 |. 68 CE237500 PUSH 007523CE
007523B6 |> 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
007523B9 |. 8B10 MOV EDX,DWORD PTR DS:[EAX]
007523BB |. FF52 44 CALL DWORD PTR DS:[EDX+44]
007523BE |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
007523C1 |. E8 1226CBFF CALL 004049D8
007523C6 \. C3 RETN
007523C7 $^ E9 E82DCBFF JMP 004051B4 ; SE handling routine
007523CC .^ EB E8 JMP SHORT 007523B6
007523CE /. 33C0 XOR EAX,EAX
007523D0 |. 5A POP EDX
007523D1 |. 59 POP ECX
007523D2 |. 59 POP ECX
007523D3 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
007523D6 |. 68 EB237500 PUSH 007523EB
007523DB |> 8D45 FC LEA EAX,[EBP-4]
007523DE |. E8 5935CBFF CALL 0040593C
007523E3 \. C3 RETN ; Jump to 7523EB
007523E4 $^ E9 CB2DCBFF JMP 004051B4 ; SE handling routine
007523E9 .^ EB F0 JMP SHORT 007523DB
007523EB /> 5E POP ESI
007523EC |. 5B POP EBX
007523ED |. 59 POP ECX
007523EE |. 59 POP ECX
007523EF |. 5D POP EBP
007523F0 \. C3 RETN
007523F1 00 DB 00
007523F2 00 DB 00
007523F3 00 DB 00
007523F4 . FFFFFFFF DD FFFFFFFF
007523F8 . 26000000 DD 00000026
007523FC . 7B 44 38 44 45 42 32 ASCII "{D8DEB266-C625-4" ; ASCII "{D8DEB266-C625-4870-B53E-C74EB73DF3FF}"
0075240C . 38 37 30 2D 42 35 33 ASCII "870-B53E-C74EB73"
0075241C . 44 46 33 46 46 7D ASCII "DF3FF}"
00752422 00 DB 00
00752423 00 DB 00
00752424 . 70247500 DD 00752470
00752428 . 00000000 DD 00000000
0075242C . 00000000 DD 00000000
00752430 . 00000000 DD 00000000
00752434 . 00000000 DD 00000000
00752438 . 00000000 DD 00000000
0075243C . 00000000 DD 00000000
00752440 . 00000000 DD 00000000
00752444 . 70247500 DD 00752470
00752448 04 DB 04
00752449 00 DB 00
0075244A 00 DB 00
0075244B 00 DB 00
0075244C . 84114000 DD 00401184
00752450 . 284C4000 DD 00404C28 ; Entry point of procedure
00752454 . 344C4000 DD 00404C34 ; Entry point of procedure
00752458 . 384C4000 DD 00404C38 ; Entry point of procedure
0075245C . 3C4C4000 DD 00404C3C
00752460 . 304C4000 DD 00404C30 ; Entry point of procedure
00752464 . 70494000 DD 00404970 ; Entry point of procedure
00752468 . 8C494000 DD 0040498C ; Entry point of procedure
0075246C . C8494000 DD 004049C8 ; Entry point of procedure
00752470 . 14 DB 14
00752471 . 54 44 65 70 65 6E 64 ASCII "TDependenciesFac" ; ASCII "TDependenciesFactory"
00752481 . 74 6F 72 79 ASCII "tory"
00752485 8D40 00 LEA EAX,[EAX]
00752488 /$ 55 PUSH EBP ; Tropix.00752488(guessed void)
00752489 |. 8BEC MOV EBP,ESP
0075248B |. 51 PUSH ECX
0075248C |. 53 PUSH EBX
0075248D |. 8955 FC MOV DWORD PTR SS:[EBP-4],EDX
00752490 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00752493 |. E8 2439CBFF CALL 00405DBC ; [Tropix.00405DBC
00752498 |. 33C0 XOR EAX,EAX
0075249A |. 55 PUSH EBP
0075249B |. 68 CD247500 PUSH 007524CD
007524A0 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
007524A3 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP ; Installs SE handler 7524CD
007524A6 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
007524A9 |. B2 01 MOV DL,1
007524AB |. A1 7C206500 MOV EAX,DWORD PTR DS:[65207C]
007524B0 |. E8 33FCEFFF CALL 006520E8
007524B5 |. 8BD8 MOV EBX,EAX
007524B7 |. 33C0 XOR EAX,EAX
007524B9 |. 5A POP EDX
007524BA |. 59 POP ECX
007524BB |. 59 POP ECX
007524BC |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
007524BF |. 68 D4247500 PUSH 007524D4
007524C4 |> 8D45 FC LEA EAX,[EBP-4]
007524C7 |. E8 7034CBFF CALL 0040593C
007524CC \. C3 RETN ; Jump to 7524D4
007524CD $^ E9 E22CCBFF JMP 004051B4 ; SE handling routine
007524D2 .^ EB F0 JMP SHORT 007524C4
007524D4 /> 8BC3 MOV EAX,EBX
007524D6 |. 5B POP EBX
007524D7 |. 59 POP ECX
007524D8 |. 5D POP EBP
007524D9 \. C3 RETN
007524DA 8BC0 MOV EAX,EAX
007524DC /$ 55 PUSH EBP ; Tropix.007524DC(guessed Arg1,Arg2,Arg3,Arg4)
007524DD |. 8BEC MOV EBP,ESP
007524DF |. 51 PUSH ECX
007524E0 |. 53 PUSH EBX
007524E1 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
007524E4 |. 8BDA MOV EBX,EDX
007524E6 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
007524E9 |. E8 CE38CBFF CALL 00405DBC ; [Tropix.00405DBC
007524EE |. 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]
007524F1 |. E8 1656CBFF CALL 00407B0C ; [Tropix.00407B0C
007524F6 |. 33C0 XOR EAX,EAX
007524F8 |. 55 PUSH EBP
007524F9 |. 68 45257500 PUSH 00752545
007524FE |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00752501 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP ; Installs SE handler 752545
00752504 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00752507 |. 50 PUSH EAX ; /Arg5
00752508 |. FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |Arg4
0075250B |. FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |Arg3
0075250E |. 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C] ; |
00752511 |. 50 PUSH EAX ; |Arg2
GROUPF a écrit:Que veux tu dire par La source du protector étant dispo, y a plus qu'à?
Quest ce que je fais avec la source du protector ? et ou je la trouve ?
J'ai bien trouvé un truc qui ressemble à un Serial mais à prioro faut aussi trouver le bon login :
[!] TurboPower OnGuard detected
[CdKeySerial] found "Serial Number" @ VA: 0x00071112 / Offset: 0x00068512
[CdKeySerial] found "SerialNumber" @ VA: 0x0007116B / Offset: 0x0006856B
0075183A | E8 25 6D CB FF | call <tropix.FreeLibrary> |
0075183F | 0F B6 55 F7 | movzx edx,byte ptr ss:[ebp-9] |
00751843 | 8B 45 F8 | mov eax,dword ptr ss:[ebp-8] |
00751846 | E8 65 FB FF FF | call <tropix.sub_7513B0> | Va indiquer le status (enregistrer ou pas)
007513B0 | 53 | push ebx | Ensuite va indiquer le status (registrer ou pas)
007513B1 | 80 EA 01 | sub dl,1 | Si EDX = 3 ça passe
007513B4 | 72 0E | jb tropix.7513C4 |
007513B6 | 74 32 | je tropix.7513EA |
007513B8 | FE CA | dec dl |
007513BA | 74 1B | je tropix.7513D7 |
007513BC | 4A | dec edx |
007513BD | 80 EA 02 | sub dl,2 |
007513C0 | 72 28 | jb tropix.7513EA |
007513C2 | EB 37 | jmp tropix.7513FB |
007513C4 | 6A 00 | push 0 |
007513C6 | 33 C9 | xor ecx,ecx |
007513C8 | BA 08 14 75 00 | mov edx,<tropix.sub_751408> | 751408:" >> Registration successful"
007513CD | 8B 40 14 | mov eax,dword ptr ds:[eax+14] |
007513D0 | 8B 18 | mov ebx,dword ptr ds:[eax] | ebx:"T\vr"
007513D2 | FF 53 0C | call dword ptr ds:[ebx+C] |
007513D5 | 5B | pop ebx | ebx:"T\vr"
007513D6 | C3 | ret |
00751726 | FF D3 | call ebx | ebx:CheckRegStatus
00751728 | 88 45 F7 | mov byte ptr ss:[ebp-9],al | Mise du status AL=> 1 si mauvais
0075172B | 80 7D F7 03 | cmp byte ptr ss:[ebp-9],3 |AL doit contenir 3 pour être bon
crackme40 a écrit:Le serial a l'air d'etre en rapport a une valeur calculer dans la base de registre (fonction GetMachineID)
GROUPF a écrit:Je trouve pas l'adresse du sérial et l'offset. Est ce qu'on peux y accéder depuis Olly ?
Est ce que dans le cas ou il y a des libraries, il faut aller regarder à l'adresse mémoire du fichier exe ou du module dll ?
Utilisateurs parcourant ce forum: Aucun utilisateur enregistré et 6 invités