Ripping from v0!d keygenme 1

[sendersu]

Hi Zeocrack
I've analyzed your code, the culprit looks like comes from ripped code
it is the assembly instruction

mov ebp, temp

which is overwriting value of register ebp (which is used when you call any WinAPI + passing some local variable

eg in your case - after you damaged correct ebp value you are calling afterwards this:

invoke SetDlgItemText,hWnd,ID_OUTPUT,addr buffer

and it translates to the following asm code:

CPU Disasm
Address Hex dump Command Comments
004012DE |. 68 1E314000 PUSH OFFSET 0040311E ; /Text = "Z-K25494-2549"
004012E3 |. 6A 65 PUSH 65 ; |ControlID = 101.
004012E5 |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hDialog
004012E8 |. E8 AB000000 CALL ; \USER32.SetDlgItemTextA

and the crash is on the line which is trying to use the (damaged) value of EBP register...


usually app should not use EBP as data register, so either do not use it (use another one), or if you need to use it - do the push ebp ... change ebp + math ...pop ebp