crackmes.de's patchit by sas0

Author:
crackmes.de

Language:
Assembler

Upload:
2018-03-25 10:52

Download

Platform:
DOS

Difficulty:
1.0

Quality:
4.0

Arch:
x86

Downloads:
20

Size:
792 B

Writeups:
1

Comments:
1

Description

This crackme has been imported from crackmes.de. The original author is sas0.

Comments (1)
Writeups (1)

You must be logged in to post a comment

nightxyz on 2023-08-03 09:19: I used Debugx for disassembly and used hexworkshop for patching. I traced every instruction by using T key inside debugx. I choosed 32-bit registers by typing "rx" inside debugx. I arrived the location where "Nop this isn't the right msg" string displaying code via 09h function of int 21h. Address was 0088h. Then i used -d command for memory dump to the screen. Other good message "Good work you did it" address was 006E. I noted these addresses. I restarted the program and i traced with -t command and realized that xor'ing , adding , ror'ing mechanism 4 bytes 4 inside "CALL 0087". This is the decryption function. Before it leaves function (0087h) , last operation : it adds 30393632h to the eax value , then ror 4 times and xor with 48AC697Bh. Last dword was : D12CD6CA ; it stores this in EAX. 30393632 ; it adds this constant. ------------ 01660CFC it rors 4 times. C01660CF ; result is. 48AC697B ;xor with this constant value. -------------- 88BA09B4 ; result is. BA 88 means = mov dx,0088 (note that zero section is in previous 4 bytes block). B4 09 means = mov ah,09 88 is bad string address. So i changed it with 6E and reversed the mathematic. 6EBA09B4 48AC697B xor constant. ------------- 261660CF result. rol 4 times. 61660CF2 ;result. 30393632 ; subtract this constant. ------------------------------------ 312CD6C0 ; result. Finally , using HexWorkShop i changed the bytes and saved. Totally only 2 bytes changed at offset 027C CA D6 2C D1 old value. C0 D6 2C 31 new value.

You must be logged in to submit a writeup

Solution by crackmes.de on :
This solution has been imported from crackmes.de. The original author is bi0w0rm. The password of the archive is "crackmes.de"

Download

crackmes.one

crackmes.one

crackmes.de's patchit by sas0