|
Tutorial Cracking :
Access Password Recovery
|
Target : Access Password Recovery
Tool : OllyDebug DeFixeD
Exe Info PE
Tools yang bagus buat cracking password database microsoft access.
Buka APR.exe dengan Exe Info PE.
"MS Visual Basic 5.0-6.0"
Load APR.exe di OllyDebug.
Langsung cari Referenced Text Strings dengan kata "invalid"
Ketemunya :
00448851 MOV DWORD PTR SS:[EBP-B4],004052C8 UNICODE "The registration that you have entered is Invalid! Please contact the programmer."
Klik dua kali.
0044880D 8B3D 44114000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaVa>; MSVBVM60.__vbaVarDup
00448813 B9 04000280 MOV ECX,80020004
00448818 894D 9C MOV DWORD PTR SS:[EBP-64],ECX
0044881B B8 0A000000 MOV EAX,0A
00448820 894D AC MOV DWORD PTR SS:[EBP-54],ECX
00448823 8D95 34FFFFFF LEA EDX,DWORD PTR SS:[EBP-CC]
00448829 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
0044882C 8945 94 MOV DWORD PTR SS:[EBP-6C],EAX
0044882F 8945 A4 MOV DWORD PTR SS:[EBP-5C],EAX
00448832 C785 3CFFFFFF>MOV DWORD PTR SS:[EBP-C4],00405370 ; UNICODE "Invalid Registration Number!"
0044883C C785 34FFFFFF>MOV DWORD PTR SS:[EBP-CC],8
00448846 FFD7 CALL EDI ; <&MSVBVM60.__vbaVarDup>
00448848 8D95 44FFFFFF LEA EDX,DWORD PTR SS:[EBP-BC]
0044884E 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]
00448851 C785 4CFFFFFF>MOV DWORD PTR SS:[EBP-B4],004052C8 ; UNICODE "The registration that you have entered is Invalid! Please contact the programmer."
Trace kodenya keatas.
0044879A FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
004487A0 83C4 30 ADD ESP,30
004487A3 66:85FF TEST DI,DI
004487A6 74 65 JE SHORT 0044880D
Dialamat "004487A6" kode "JE SHORT 0044880D"
Ganti dengan :
Kode "JNZ SHORT 0044880D"
Simpan perubahannya.
Jalankan programnya terus register sesukamu.
28/03/10
|