Search found 317 matches

hi seven!

ltns Cool

Great work highenergy,
I hope you had some fun with this crackme Smile

I will see if I can dig up the original tutorial (maybe the source code) and submit it on the site. I already promised bor0 I wo ...

Almost everything you deducted so far is correct, but there is no error in the algorithm afaik.
00220205 ^ 75 F2 JNZ SHORT 002201F9 ; this is looks like conditional jump but actually ...

Hello highenergy,

I'm still around Cool

Unfortunatly I don't get around to create new material for the site, or even maintain it properly...

I keep the site up because it has some great mater ...

Isn't the UPX source code available on the web? You could have a look at how the "upx -d" option works.

http://upx.sourceforge.net/download/upx-3.03-src.tar.bz2 (C++)

Otherwise take a look at th ...

Nice explanation stingduk, I forgot all about your precious tool!

Detten WHERE ARE YOU you Seem to be adept at doing a disaapearing Act

I visit Efnet #biw now and then, but not daily Sad

I c ...

Do you really need to have the code behind the jmp table in the same section?
If so, this is something I never tried. Still a couple of possible pointers :

All entries in the import redirect table ...

Do you mean while linking, or when you fiddle with the PE header manually?

I think you best start with newbie crackmes, those small programs are much easier to start with, and they have a tutorial written for them in most cases.

There are 2 things to be done :

1) Change the program from console to windows application.
Use a WinMain function instead of the regular main.

2) Call the DialogBox() function to display a dial ...

If you try my crackme 5 first, it might be somewhat easier to understand. It is written in assembly so its leaner code.

i tried find some help at location 40B114.
AL is added to

I didn't really notice this part of your post the first time I responded, so here is a little general information concerning your questio ...

If you search the dump for all places where the flag [40B114] is used, you find the addresses you mentioned, but also an interesting one at address [0040130A] ...

Check it out, try to figure out wh ...

You might want to search where this byte value is set to 1 in your dumped file, and see what calculation code triggers this value to be set to 1.

And a clear hint would be that some 'user input' is ...

The crackme isn't the regular stuff you would expect, its a bit more original Wink

It is hard to give any hints without giving away the solution.

You already found the good guy message, so you shoul ...