| @HempDay420 breakpoint on DLL load. once helper.dll is loaded navigate to the start of the .text section in the debugger memory map, breakpoint there. |
==> |
| Like everyone else I can't solve this, those changing esp vars seem completely random, so how could one possibly generate a key? I took a single run, calculated the value produced those three pointers and wrote a brute-forcer. No luck. Perhaps there aren't any "anti-debugging" tricks in this, but there may be something altering these values when being debugged. My last ditch effort is to alter the code to print to console the sum value of the three pointers to see if the sum is static when not being debugged. |
==> |
| What's the solution gnitargetnisid? |
==> |
| Good encryption-based crackme. I patched the file since following the encryption got boring ;) |
==> |