|
Tutorial Cracking : SysTools Excel to vCard Converter v1.3
|
Target :
SysTools Excel to vCard Converter v1.3
Tool :
OllyDebug Defixed
Exe Info PE
People having advanced tools like Palmtops and mobile devices like iPhone, Blackberry wanted to import their Excel contacts to these devices directly.
Considering these needs, SysTools decided to come up with such a software tool that can convert Excel to vCard,
which is a standard format used by many email client applications like Lotus Notes etc and other devices like Palm, mobile etc.
VCF is the extension for vCard. Excel to VCF converter tool a single software with multiple benefits.
Untuk memastikan proteksi softwarenya, langsung cek dengan Exe Info PE.
"MS Visual Basic 5.0-6.0 EXE"
Buka file Excel2vCardv1.3.exe dengan OllyDebug DeFixeD.
Langsung cari "Referenced Text Strings"
Masukkan kata "demo".
Jangan lupa hilangkan tanda di case sensitive dan tandai entire scope.
Kita berada dialamat
0042037D MOV DWORD PTR SS:[EBP-200],00410B24 UNICODE "The demo version have limitation of 5 contacts export only."
Klik dua kali dialamat diatas
00420343 > \B9 0A000000 MOV ECX,0A
00420348 . B8 04000280 MOV EAX,80020004
0042034D . 898D B8FEFFFF MOV DWORD PTR SS:[EBP-148],ECX
00420353 . 898D C8FEFFFF MOV DWORD PTR SS:[EBP-138],ECX
00420359 . 898D D8FEFFFF MOV DWORD PTR SS:[EBP-128],ECX
0042035F . 8D95 F8FDFFFF LEA EDX,DWORD PTR SS:[EBP-208]
00420365 . 8D8D E8FEFFFF LEA ECX,DWORD PTR SS:[EBP-118]
0042036B . 8985 C0FEFFFF MOV DWORD PTR SS:[EBP-140],EAX
00420371 . 8985 D0FEFFFF MOV DWORD PTR SS:[EBP-130],EAX
00420377 . 8985 E0FEFFFF MOV DWORD PTR SS:[EBP-120],EAX
0042037D . C785 00FEFFFF>MOV DWORD PTR SS:[EBP-200],00410B24 ; UNICODE "The demo version have limitation of 5 contacts export only."
Trace kodenya keatas.
Lihat pada alamat dibawah ini :
00420301 . FF15 88104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFileC>; MSVBVM60.__vbaFileClose
00420307 . 83BD 2CFFFFFF>CMP DWORD PTR SS:[EBP-D4],5
0042030E . 74 33 JE SHORT 00420343
00420310 . 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
00420313 . 6A 00 PUSH 0
00420315 . 52 PUSH EDX
Dialamat "0042030E" kode "JE SHORT 00420343" diganti "NOP"
Trus simpan dan keluar dari OllyDebug.
Pakai Hex Editor untuk menghilangkan tulisan Demo Version pada program.
Buka Hex Workshop trus load Excel2vCardv1.3.exe
Cari text string "Demo Version".
Ketemu dioffset :
Hex : 44656D6F2056657273696F6E : Demo Version
Ganti dengan
Hex : 46756C6C2056657273696F6E : Full Version
Simpan dan keluar dari Hex Editor.
SEMPURNA......
07/10/11
|