Exetools  

Go Back   Exetools > General > Community Tools

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #2  
Old 11-14-2019, 02:19
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 905
Rept. Given: 68
Rept. Rcvd 660 Times in 278 Posts
Thanks Given: 64
Thanks Rcvd at 3,819 Times in 717 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
Some info on how you could modify this to also work for Full version:
seems that under full version the only different thing is a dword which come after site_code:

uint32_t ToBeHashed[2];
ToBeHashed[0] = site_code; // we need site code for decoding
ToBeHashed[1] = 0xA264D581; // this should be changed

You should grab it from target program:
Here is the first PC Guard check serial length:
009CA211 83F9 23 CMP ECX,23
009CA214 9C PUSHFD
009CA215 EB 01 JMP SHORT 009CA218

and this will move in eax the dword which should be fixed:
009CA74F 8B85 10B74100 MOV EAX,DWORD PTR SS:[EBP+41B710]
009CA755 60 PUSHAD
009CA756 E8 03000000 CALL 009CA75E
009CA75B 83EB 0E SUB EBX,0E
009CA75E EB 01 JMP SHORT 009CA761
How you should trace PC Guard: if you are after the actual check you should set a breakpoint before where current call get called; - restart Olly (not bother on trying to fallow jumps), you will also see some loop: just set breakpoint on exit door.
Reply With Quote
The Following User Gave Reputation+1 to CodeCracker For This Useful Post:
Mahmoudnia (11-14-2019)
The Following 3 Users Say Thank You to CodeCracker For This Useful Post:
dj-siba (04-06-2020), kallegaul (11-14-2019), Mahmoudnia (11-14-2019)
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 21:07.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )