Tutorial Number 22 Written by Etenal Bliss Email: Eternal_Bliss@hotmail.com Website: http://crackmes.cjb.net http://surf.to/crackmes Date written: 31st May 1999 Program Details: Name: Crack Me! #1 Author: DaRkShAdOw Language: Visual Basic 4 Tools Used: Softice Cracking Method: Code Sniffing Viewing Method: Use Notepad with Word Wrap switched on Screen Area set to 800 X 600 pixels (Optional) __________________________________________________________________________ About this protection system This CrackMe contains a hardcoded code which is 12 characters long. It doesn't use the 2 common breakpoints (__vbaStrComp and __vbaVarTstEq) to check the input. _________________________________________________________________________ About the tutorial For this tutorial, I'll only be using Softice. And when I say "d eax", do it without the quotes. And since this is a VB program, there are a lot of "rubbish" codes while tracing. I'll only be showing the relevant parts. When you traced through it yourself, don't expect it to be that clear. 8P _________________________________________________________________________ Softice First, run the CrackMe. You will be told that the code is 12 char long. So, enter any 12 chars. I chose "123456789012" Then, we have to choose the breakpoints to use. Because it is a VB program, I have tried using __vbaStrComp and __vbaVarTstEq. Both of which are the commonest bp used to break into a VB prog. But in this CrackMe, although __vbaStrComp does break, the function is not used to compare the input. So, no point in trying them. Well, we have to have a bp right?? Another bp that is possible is multibytetowidechar. This function will change a string to s.t.r.i.n.g and is common as well. Not sure why VB has to do this for a string, but maybe microsoft wants a reason to make big and bloated programs. 8P Anyway, set the bp by typing "bpx multibytetowidechar" If you don't click on any button, the bp will still break. But to get into the location where the compare is done, we must click on the "Go!, let's see if your code number is correct!!!" button. You will break on the function. Press F12 to go out of it and back to the code that called the function. I've pasted a bit of the codes below. :0F738BC1 FF1500C27B0F CALL [KERNEL32!MultiByteToWideChar] :0F738BC7 8BD8 MOV EBX,EAX <