Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   crc32 help needed? (https://forum.exetools.com/showthread.php?t=8903)

The Day Walker! 01-14-2006 12:16

crc32 help needed?
 
3 Attachment(s)
pals... patching an ocx control...

but found that it has a crc32 check, if i change a single bit of code,

the entire control stops working....

control:- aresize.ocx (vbgold.com)

peid shows:- 1.jpg

in w32dasm at that location:- 2.jpg

and when, i saw the last bytes of the file in hex i found this:- 3.jpg

what does these last bytes indicate... r they the crc32 for the file??

m new 2 crc32,,,, needed help in patching it...

thanx

TDW {RES}

MaRKuS-DJM 01-14-2006 17:11

load your target app that uses the ocx into your debugger and try to break on CreateFileA. normally you should be near the CRC-check then. and also watch stack if it is the correct file.

adaptor 01-14-2006 18:39

In case of 'in-memory-check' :
1) Patch one needed byte of code and put memory breakpoint on it.
2) Let programm continue and watch where it breaks, probably it will be near CRC check.

Unforgiv3N 01-15-2006 06:15

1.Open PEiD+KryptoAnalyzer Plugins (i know that should use "C" in "K"rypto but that's name of it, that's that! :D )
2.Drag your .ocx file into it. (because PEiD Never Shell .ocx files)
3.in Plugins Section, Select theKryptoAnalyzerPlugins then it will show you the CRC32 and depending on your target you can replace it with NOPs. in same cases it worked.

I wrote it for new friends want to know how you did detect CRC32 on this OCX

The Day Walker! 01-15-2006 12:52

@ Unforgiv3N

krypto analyser showed me that the ocx has crc32.... checkout the images

that i have attached above,,,,, everything is specified.....

and for the nopping thing.. ill give it a try...

thanx

TDW {RES}

hjwyq 01-16-2006 14:53

sorry

It cann't run in my mathine!

when loader,my system halted!why?
win2k sp4

but i think when you can step in,or you can got rid of CRC.
GOOD LUCK


All times are GMT +8. The time now is 11:57.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX