Thread: Crypto or not?
View Single Post
  #6  
Old 11-19-2004, 04:16
dyn!o's Avatar
dyn!o dyn!o is offline
Friend
 
Join Date: Nov 2003
Location: Own mind
Posts: 214
Rept. Given: 1
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 8
Thanks Rcvd at 0 Times in 0 Posts
dyn!o Reputation: 1
The fragment you posted doesn't calculate CRC32. If PEID has detected its signature then it should give you the reference offset (address) too. Compare the referenced address with the listing area and if it doesn't mach (it shouldn't indeed) then just disassemble the referenced pointer and verify if it's not a mistake or fake signature.

I will repeat the following suggestion: put a breakpoint on 0x419065, take ECX as the late data pointer and substract few bytes (76 decimal? strange value... or maybe its multiplicity? that would give you at least even value) - you should see the result of discussed loop and then I suggest to put a memory access breakpoint on the first byte of the result. You should be a step ahead from revealing the "secret" (or maybe am I dreaming? ).

If you won't try - you don't win.

Good luck and regards.

Last edited by dyn!o; 11-19-2004 at 04:21.
Reply With Quote