|
|
|
|
#1
07-01-2004, 21:32
|
|||
|
|||
 here it is some part of the code (P-Code) disasembled ... now it's possible to analyze the keyfile routine and possible to reverse without license
|
|
#2
07-01-2004, 21:50
|
|||
|
|||
|
and here are all TweakXP Resources i got using VBReformer
 for knowledge and studies purposes only!
|
|
#3
07-02-2004, 00:05
|
|||
|
|||
|
look closely here at image2, I think you'll know that 401380 seems like a good oep; not 40137a.
and image1 shows that ordinal at 1094 is referencing memory below than usual in regards to visual basic interepretation; it's not in the usual memory 77xxxxxx areas. @Crk, you are very good, but I want to show the facts. 
Last edited by BetaMaster; 07-02-2004 at 00:17.
|
|
#4
07-02-2004, 09:00
|
|||
|
|||
|
look closely here at image2, I think you'll know that 401380 seems like a good oep; not 40137a.
sure.. but i never said 40137a was a good OEP .. i just used to get the IAT then i wrote back 401380 to Imprec wich Insert good OEP automatically .. or you can do it by hand/manually since at the right place OEP should be only contain 909090.. data .. Imprec interprete this as invalid OEP .. but if you wrote as OEP where the last JMP API call is Imprec will read this place as valid OEP and will find almost all correct API jumps for IAT
|
|
#5
07-02-2004, 15:42
|
|||
|
|||
|
Yes DLLFunctionCall is the function that will be missing from the IAT on a dump with imprec. Also it checks for special.dll that is also imulated by the wrapper, 1 function exported SVKP_KillDebugger, so if it doesnt find this it makes an error and exits. Last one to get into the code is the call to CryptVerifySignature, if you see that file in the main directory "tweak-xp3.val" this is a prehashed value from MS crypto that checks your dumped file, so make a dll with the SVKP_KillDebugger exported, when it loads and calls this just patch the call to CryptVerifySignature to return 1. Now you can run the app and look for the reg procedure. Also OEP 401364 "push 401A68", "Call ThunRTMain".
Last edited by mtw; 07-02-2004 at 15:49.
|
|
#6
07-02-2004, 20:00
|
|||
|
|||
|
mtw would you share how to do this ? do you have it (the EXE)
running already? please. share here source or your .dll solution for this one.. we all want to see this app. finished and running Regards
|
|
#7
07-02-2004, 20:24
|
|||
|
|||
|
Ooops!! sorry Crk, I didn't notice that you have used 1380 as oep in your second dumped exe, my mistake.
and I also hope that mtw share with us a working solution to this proggy, not that I like the program itself, but rather to show it tp TotalIdea.I think they deserve it.
|
 |
| Thread Tools | |
| Display Modes | |
|
|
Hybrid Mode
