|
Tutorial Cracking :
Automatic Wallpaper Changer v4.7.53
|
Target : Automatic Wallpaper Changer v4.7.53
Tool : OllyDebug DeFixeD
Exe Info PE
AWC is designed to be a one stop shop for displaying images as your desktop wallpaper. You can simply display your photos on your desktop or create spectacular wallpapers by merging your images with the background of your choice using powerful alpha-blended fades.
Buka AWC.exe dengan Exe Info PE.
MS Visual Basic 5.0-6.0
Load AWC.exe di OllyDebug.
Langsung cari Referenced Text Strings dengan kata "invalid"
Ketemunya :
0048828E PUSH 004217C0 UNICODE "Invalid Registration data"
Klik dua kali.
00488275 66:833D E2474>CMP WORD PTR DS:[4D47E2],0
0048827D 74 2A JE SHORT 004882A9
0048827F 83EC 10 SUB ESP,10
00488282 A1 8C464D00 MOV EAX,DWORD PTR DS:[4D468C]
00488287 8BD4 MOV EDX,ESP
00488289 B9 08000000 MOV ECX,8
0048828E 68 C0174200 PUSH 004217C0 ; UNICODE "Invalid Registration data"
Trace kodenya keatas.
00487DE5 E8 06CCFFFF CALL 004849F0
00487DEA 8B1D FC124000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaFr>; MSVBVM60.__vbaFreeStrList
00487DF0 66:8BF0 MOV SI,AX
.
.
.
00487E09 FF15 5C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObjList
00487E0F 83C4 18 ADD ESP,18
00487E12 66:85F6 TEST SI,SI
00487E15 0F84 5A040000 JE 00488275
00487E1B 66:833D E2474>CMP WORD PTR DS:[4D47E2],0
00487E23 74 2A JE SHORT 00487E4F
Beri breakpoint dialamat "00487DE5".
Run Ollynya atau F9.
Isi registernya trus klik ok.
Olly akan break dialamat "00487DE5".
00487DE5 E8 06CCFFFF CALL 004849F0
Step Into ollynya atau F7
004849F0 55 PUSH EBP
Trace kodenya kebawah.
Trace kodenya perlahan sampai :
00484AB8 8BD0 MOV EDX,EAX
EAX=0018DF2C, (UNICODE "C7-36-B3-CD-01-52-43-B1-D9-7D-ED-77-79-07-4C-A1")
EDX=001698E0
Lisense kodenya : C7-36-B3-CD-01-52-43-B1-D9-7D-ED-77-79-07-4C-A1
Enjoy....!!!
22/03/10
|