1

I'm in the process of patching a crackme so that I get recognized as registered without the need of a serial key.

Finding the function that checks for the validity of the key and patching it so that it always returns a success value was a piece of cake. But when I launched the exe, surprise : We noticed an attempt to crack this program, shutting down..

I'm thinking that there's somewhere a call to ReadProcessMemory or a more simple fopen/fread that computes an integrity sum and checks it with an hardcoded value.

What I would like to do, with IDA, is find where these system functions are called. Is this even possible ? I tried debugging the application, but there seem to be anti-debugger techniques as the crackme instantly exits.

Any suggestion appreciated. I'm using IDA Pro 6.6.

  • 2
    You can read memory directly, without ReadProcessMemory, like this: *(BYTE*) 0xC0DE, which totally bypasses RPM breakpoints. Your best bet is to put a hardware breakpoint (on read) on the address you modified and check what's reading it. – rev Sep 11 '15 at 18:18
  • I see. I'll get around the anti debugging techniques and see what I can do then, thanks for the suggestion ! – Ely Sep 14 '15 at 11:08
1

Place a read breakpoint on the memory you patched to find out what instructions are accessing it, that should lead you to some sort of checksum function or comparison to the file on disk. Then you can patch this check as well.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.