Sorry, I'm quite new to assembly, and I'm trying to make the code bellow return true:

.text:1000E3E0 ; =============== S U B R O U T I N E =======================================
.text:1000E3E0 ; bool __thiscall LicenseChecker::LicenseCheckerPlugin::hasValidLicense(LicenseChecker::LicenseCheckerPlugin *__hidden this)
.text:1000E3E0                 public ?hasValidLicense@LicenseCheckerPlugin@LicenseChecker@@QAE_NXZ
.text:1000E3E0 ?hasValidLicense@LicenseCheckerPlugin@LicenseChecker@@QAE_NXZ proc near
.text:1000E3E0                                         ; DATA XREF: .rdata:off_10024D68o
.text:1000E3E0                 mov     eax, [ecx+0Ch]
.text:1000E3E3                 mov     al, [eax+20h]
.text:1000E3E6                 retn
.text:1000E3E6 ?hasValidLicense@LicenseCheckerPlugin@LicenseChecker@@QAE_NXZ endp
.text:1000E3E6 ; ---------------------------------------------------------------------------

On a "crackme". I heard somewhere that 1 returns true, but no idea on how to do it. I searched the web, but I simply couldn't understand what to do. I'm used to high-level programming languages, so assembly confuses me a lot. Sorry for asking for such a simple thing.

  • can you provide the program containing this function? – julian Feb 2 '17 at 18:53
  • @SYS_V Sorry, I didn't see your comment at the time. I formatted my PC, so I think I don't have it anymore. – GabrielTK Dec 19 '17 at 3:27

Very easy.

  1. Check out the calling conventions that your binary follows;

  2. Patch* with a mov of 1 to the register used for return values (most likely to be rax variant) before the return instruction : mov rax, 1;

  3. Your function should return 1 all the time, regardless of whatever happens before the return instruction;

(*) Patching can be done manually using a hex editor or you can use OllyDBG or any tool that permits such transformations (check the web ;) ).

This is a simple and concise answer. If you wish more details, let me know.

  • 3
    It doesn't look like 64-bit code to me. – usr2564301 Feb 2 '17 at 21:42
  • Sure, but does it matter? It's a proper answer to a very clear question. And, I have CLEARLY specified a : rax VARIANT (been there all the time, no edit). – yaspr Feb 3 '17 at 7:38
  • 2
    mov eax,1 is also fine x64 code and will zero the higher part of rax anyway. – mrexodia Feb 3 '17 at 9:09
  • I agree, but I see it as a detail :) – yaspr Feb 3 '17 at 9:20
  • It may not be such a trivial detail for someone "I'm quite new to assembly". It's a tiny change – just change mov rax, 1 to mov eax, 1. (Looking at the current return value, it could even be just mov al, 1.) – usr2564301 Feb 3 '17 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.