Anti Smartcheck

Thursday, August 07 2008 @ 06:07 PM CEST

Contributed by: planethax

Level : newbie

Well I am an EXTREME NOOB!!!

I ran across an issue while exploring a crackme.
I opened the Crackme in Numega's SmartCheck;
Ran it and Smartcheck closed.
I repeated the numerous times ;)

So, it must be some kind of Anti SmartCheck coding I figure, but how to get around it?

Well, I found the Tutorials here and searched other places without finding a solution.

Anyways, here it is, very simple.

1, After determining there is an Anti SmartCheck, Open App up in Olly
2, Do a text string search for "SmartCheck"
3, Locate the offender
4, Follow offender in the dump, (we see what the app is searching for)
5, NOW, in the Dump, select any letter of "Numega Smartcheck" press any letter key, a pop up comes, now change the search string.
ie, change "Numega SmartCheck" to something like
Mummma StormChest"
Chances are, when app is looking for this, it will not find it and continue.
Save to Executable, save file (use backup name) now, reopen in SmartCheck and Run!!!
Ahhhhhah!!!!!! App doesn't close.

(Not sure if this will work for all, but has worked for me on several ocassions now.)

Thanx for reading.

1 comments



http://www.reversing.be/article.php?story=20080807180757839