Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 03-25-2018, 04:50
Stingered Stingered is offline
Banned User
 
Join Date: Dec 2017
Posts: 257
Rept. Given: 0
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 296
Thanks Rcvd at 181 Times in 90 Posts
Stingered Reputation: 3
Trying to break on a WM_LBUTTONUP within a DELPHI app

Trying to catch a registration dialog so I can RE the keygen algo, but I cannot seem to be able to break on the dialog. It's a Delphi app, and using conventional methods in OllyDBG and/or x64DBG gets me nothing. I've tried hard-code BO in user32.dll and a windows message break point. Anyway, basically just you just load up the open windows handles in OllyDBG or X64DBG and break on the button command. Doesn't work though.

Any ideas?

[edit]

Tried using IDR and it crashes every single time.

Thx

Last edited by Stingered; 03-25-2018 at 11:56.
Reply With Quote
  #2  
Old 03-25-2018, 20:02
niculaita's Avatar
niculaita niculaita is offline
Family
 
Join Date: Jun 2011
Location: here
Posts: 1,475
Rept. Given: 1,009
Rept. Rcvd 95 Times in 65 Posts
Thanks Given: 5,429
Thanks Rcvd at 508 Times in 359 Posts
niculaita Reputation: 95
it s a fake delphi app
that was compiled this mode only to deceive reverser
__________________
Decode and Conquer
Reply With Quote
The Following User Says Thank You to niculaita For This Useful Post:
Stingered (03-26-2018)
  #3  
Old 03-26-2018, 00:15
Stingered Stingered is offline
Banned User
 
Join Date: Dec 2017
Posts: 257
Rept. Given: 0
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 296
Thanks Rcvd at 181 Times in 90 Posts
Stingered Reputation: 3
Quote:
Originally Posted by niculaita View Post
it s a fake delphi app
that was compiled this mode only to deceive reverser
I see your point. However, everything identifies as Embarcadero Delphi.

https://www.davidesperalta.com/appbuilder/
Reply With Quote
  #4  
Old 03-26-2018, 01:07
ionioni ionioni is offline
Friend
 
Join Date: Jul 2016
Posts: 80
Rept. Given: 8
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 124
Thanks Rcvd at 154 Times in 49 Posts
ionioni Reputation: 3
Quote:
Originally Posted by Stingered View Post
I see your point. However, everything identifies as Embarcadero Delphi.

https://www.davidesperalta.com/appbuilder/
yellow is onOK procedure
Reply With Quote
The Following User Says Thank You to ionioni For This Useful Post:
Stingered (03-26-2018)
  #5  
Old 03-29-2018, 10:26
Apuromafo Apuromafo is offline
Family
 
Join Date: Nov 2010
Location: Chile
Posts: 116
Rept. Given: 69
Rept. Rcvd 26 Times in 12 Posts
Thanks Given: 345
Thanks Rcvd at 169 Times in 61 Posts
Apuromafo Reputation: 26
use IDA open analize and and export a map...
use idr, only open and export a map

in x64dbg use (plugin https://github.com/x64dbg/x64dbg/wiki/Plugins)
[Download] SwissArmyKnife by Nukem: x64dbg utility for linker map files, diff files, peid/ida signatures, and code signature generation.

for import map

in normal x64dbg, try to use labels for guide

br, Apuromafo
Reply With Quote
The Following User Says Thank You to Apuromafo For This Useful Post:
Stingered (03-30-2018)
  #6  
Old 03-29-2018, 14:28
sendersu sendersu is offline
VIP
 
Join Date: Oct 2010
Posts: 1,305
Rept. Given: 337
Rept. Rcvd 237 Times in 127 Posts
Thanks Given: 340
Thanks Rcvd at 652 Times in 357 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
Quote:
Originally Posted by Apuromafo View Post
use IDA open analize and and export a map...
use idr, only open and export a map

in x64dbg use (plugin https://github.com/x64dbg/x64dbg/wiki/Plugins)
[Download] SwissArmyKnife by Nukem: x64dbg utility for linker map files, diff files, peid/ida signatures, and code signature generation.

for import map

in normal x64dbg, try to use labels for guide

br, Apuromafo
IDR is enough (if Delphi is not very modern)
the rest is not required
Reply With Quote
  #7  
Old 03-29-2018, 16:14
Levis Levis is offline
Family
 
Join Date: Mar 2012
Location: The Earth
Posts: 44
Rept. Given: 76
Rept. Rcvd 42 Times in 13 Posts
Thanks Given: 31
Thanks Rcvd at 51 Times in 23 Posts
Levis Reputation: 42
You should try to locate address of VCL Component's procedure and break there (depend on which one you're looking for). IDA/IDR should be great, but i simply prefer PE Explorer because It's lightweight. Got success with old Delphi versions
__________________
My Personal Blog:http://ltops9.wordpress.com
Reply With Quote
The Following User Says Thank You to Levis For This Useful Post:
Stingered (03-30-2018)
  #8  
Old 03-29-2018, 18:59
sendersu sendersu is offline
VIP
 
Join Date: Oct 2010
Posts: 1,305
Rept. Given: 337
Rept. Rcvd 237 Times in 127 Posts
Thanks Given: 340
Thanks Rcvd at 652 Times in 357 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
IDR has the brilliant feature - shows/locates any control handler routine like a charm.
Reply With Quote
The Following User Says Thank You to sendersu For This Useful Post:
Stingered (03-30-2018)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
why I can't break zaratustra General Discussion 3 10-01-2004 17:28


All times are GMT +8. The time now is 23:36.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )