1

I'm in the process of patching a crackme so that I get recognized as registered without the need of a serial key.

Finding the function that checks for the validity of the key and patching it so that it always returns a success value was a piece of cake. But when I launched the exe, surprise : We noticed an attempt to crack this program, shutting down..

I'm thinking that there's somewhere a call to ReadProcessMemory or a more simple fopen/fread that computes an integrity sum and checks it with an hardcoded value.

What I would like to do, with IDA, is find where these system functions are called. Is this even possible ? I tried debugging the application, but there seem to be anti-debugger techniques as the crackme instantly exits.

Any suggestion appreciated. I'm using IDA Pro 6.6.

Improve this question
2
  • 2
    You can read memory directly, without ReadProcessMemory, like this: *(BYTE*) 0xC0DE, which totally bypasses RPM breakpoints. Your best bet is to put a hardware breakpoint (on read) on the address you modified and check what's reading it.
    – rev
    Sep 11, 2015 at 18:18
  • I see. I'll get around the anti debugging techniques and see what I can do then, thanks for the suggestion !
    – Ely
    Sep 14, 2015 at 11:08

1 Answer 1

Reset to default
1

Place a read breakpoint on the memory you patched to find out what instructions are accessing it, that should lead you to some sort of checksum function or comparison to the file on disk. Then you can patch this check as well.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.