|
Tutorial Cracking :
ALZip v7.52
|
Target : ALZip v7.52
Tool : OllyDebug DeFixeD
Exe Info PE
ALZip is the best multi-format compression utility you can get. With support for 36 file formats including ZIP, ACE, RAR, LZH, and many more, ALZip is designed for real-world users, making file and archive management easy and convenient for beginners and professionals alike.
Buka ALZip.exe dengan Exe Info PE.
"Borland Delphi ( 2.0 - 7.0 ) 1992 - www.borland.com"
Ei.....iiit, tungggu dulu!!!
Bukan file ALZip.exe yang jadi masalahnya... tapi MLLA.dll
Load MLLA.dll di OllyDebug.
Langsung cari Referenced Text Strings dengan kata "trial"
Ketemunya :
6200236C PUSH 62014C64 ASCII "NoRegisterTrial"
Klik dua kali.
62002258 E8 13F2FFFF CALL 62001470
6200225D 83C4 14 ADD ESP,14
62002260 83F8 03 CMP EAX,3
62002263 74 54 JE SHORT 620022B9
62002265 385C24 17 CMP BYTE PTR SS:[ESP+17],BL
.
.
.
620022AE 51 PUSH ECX
620022AF 68 5C4C0162 PUSH 62014C5C ; ASCII "Later"
620022B4 E9 B8000000 JMP 62002371
620022B9 8B8424 BC0000>MOV EAX,DWORD PTR SS:[ESP+BC]
620022C0 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+24]
620022C4 8B5424 28 MOV EDX,DWORD PTR SS:[ESP+28]
620022C8 50 PUSH EAX
620022C9 51 PUSH ECX
620022CA 52 PUSH EDX
620022CB 68 504C0162 PUSH 62014C50 ; ASCII "Authorized"
620022D0 8D5C24 6C LEA EBX,DWORD PTR SS:[ESP+6C]
.
.
.
62002355 83F8 01 CMP EAX,1
62002358 75 2C JNZ SHORT 62002386
6200235A 8B9424 BC0000 MOV EDX,DWORD PTR SS:[ESP+BC]
62002361 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+24]
62002365 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20]
62002369 52 PUSH EDX
6200236A 50 PUSH EAX
6200236B 51 PUSH ECX
6200236C 68 644C0162 PUSH 62014C64 ; ASCII "NoRegisterTrial"
Dianalisa sebentar.....!!!!
Cari cari HOT SPOT buat patch!
Dialamat "62002263" kode "JE SHORT 620022B9"
Ganti dengan :
Kode "JMP 620022B9"
Dialamat "62002358" kode "JNZ SHORT 62002386"
Ganti dengan :
Kode "JMP 62002386"
Simpan perubahannya.
18/03/10
|