John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just a serial bus emulator, what we can controll over an interface, or simulate processes via C++ code w/ his dll. A fun little application. I wanted to obtain a copy for myself, and I've emailed the required stuff to myself. The surprise came then. If I try to run the program outside of the school environment, it simply just throws me out with an error message, states that I don't have permission to run that software, then it exits. Hm. The next day, we had lessons with that teacher, and I've asked about the program. He was glad that "finally somebody tried that." He told me, that I'm free to test the program till it's limits, and If I manage to run it on my laptop, he could reward me with some good grades. Next, he told some informations about the program for the whole class: - We're talking about a 64bit process. It does not check for the DLL, but it checks for "something", and if that something is found, then the program will start. If not, a simple error message will be shown, then the process terminates. Also, the program only check for once, not anymore till the program has stopped.

So, I've got home with my new informations collected, then fired up x64dbg and IDA to see what's going on. I was able to find only the messageBox(W) generation. Before that it check's for a "test al,al". if it's equal, it jumps to a adress, but it only returns a "nop", and the messagebox pops.

I've tried to search for string references, like some hard coded file location, or registry entries, also the messagebox's text, but with no luck. Nothing found yet.

enter image description here

So at the moment, here I am. How should I move forward about patching the check, If I don't even know what am I searching for at the first place? Of course, they do not teach reverse engineering at school, but we're free to do anything at our free time, and if it gives some results, it's rewarded.

Any ideas?

Thanks, John.

  • Why don't you set a break point on test al, al and manually set the zero-flag to one - the program will continue down the JE path bypassing the messagebox and presumably continuing with the rest of the application. – user15338 Nov 2 '17 at 16:12
  • I'd say that the check is earlier in the program's instructions. This jump only skips "OR DWORD PTR SS:[RBP+E8], 100000]", which is referencing one of the parameters to MessageBoxA. Thats my hunch. Good luck! – Samson Nov 2 '17 at 22:45
  • 3
    Would you mind sharing the binary? – dsasmblr Nov 3 '17 at 3:20
  • 1
    I'd suggest you to go inside the call (where you break) there are chances that everything you need is before the ret, I'm not sure we can help you based only on your screenshot. Tip: Instead of breaking on MessagBoxA try to break on ExitProcess for example or whatever function is called to kill the process. – Soufiane Tahiri Nov 3 '17 at 15:17
  • I'd set a breakpoint on the MessageBox (there are multiple, although MessageBoxA will usually work) function, run the program and wait for it to break at the breakpoint. Now you can follow the stacktrace to see where the MessageBox was called and from there eventually find the condition that causes the MessageBox to show. – Jevgeni Geurtsen Nov 10 '17 at 11:38

As the application is written in Delphi I would recommend to run the binary through IDR (Interactive Delphi Recorder). This tools has a better understanding of Delphi and VCL internals and can then produce and .idc file that you can load into Ida Pro. You'll have (mostly) correct function and symbol naming which makes reading the code much easier. Then execute up to to the messagebox and check the call stack to see where you came from. Possibly check might be IP adress, domain name, computername (does it follow some naming convention) etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.