I am trying to learn to reverse Engineering , i am very new and my English is very Poor... .I wanting to make this exercise , but can't it , because not receive the hWnd identified from the MessageBox ,it is empty ....

The screenshot from they enter image description here

My screenshot enter image description here

I have to want to make this exercise with Ollydbg and Immunty Debugger , but without result... .I working with a Windows 7 , inside a VirtualBox . Here Speak what HWND do , what i don't Understande because all crackme.exe which i Downloaded have this parameter NULL. Can Please anybody help me and with easy Words explain me how to solve this Problem , Thanks!

  • Do you conclude the HWND handle to be 0 just from Immunity not showing its value at the call site? Judging from the code this is inside a window proc and I do not see a way for the passed HWND handle to be NULL there, GetDlgItemTextA would fail in that case anyway. Have you checked [ebp+8] manually? – Johann Aydinbas Apr 29 '18 at 14:53
  • Thanks for your answer! , i am veryyy new with debugging.... , i have to thought that are a NULL , because HWND have neither value.... i am not a student from IT , can you please tell me , how does to check [ebp+8] manually ? – 567hz Apr 29 '18 at 15:57

a hWnd to a MessageBox can be NULL

if you give NULL as an arg it measns the MessageBox is NonModal

NonModal means you can keep working with the parent application without having to dismiss the MessageBox

which version of ollydbg are you using if it was v 1.0 it came with a default commandline plugin (alt + f1) where you can type [ebp+8] and get the result

enter image description here

if you are using v 2.0 use ctrl+g on the respective panes

if you want to view in dump select dump pane first and then hit ctrl+g type in [ebp+8] and follow expression

or you can use the address relative to option in stack to have a visual

enter image description here

do not use the executable from octopuslabs it is probably trojanned the exe from crackmes.cf appears to be 1 kb less than that of octopuslabs exe

anyway at [ebp+8] you wont get the same handle as in the tutorial it will be different for each invocation just because you have a different handle does not matter

C:\lafarge2>ls -R
crackme.exe  octo

filehash.py  getoctocrackme.bat

C:\lafarge2>cat octo\getoctocrackme.bat
wget -c hxxp://BEWARE_MALWARE_octopuslabs.io/legend/files/tuts/R4ndom_tutorial_22.zip
C:\lafarge2>cd octo

Length: 1555447 (1.5M) [application/zip]
Saving to: 'R4ndom_tutorial_22.zip'

C:\lafarge2\octo>e:\7z\7z.exe e R4ndom_tutorial_22.zip

Everything is Ok
Files: 7

C:\lafarge2>fc crackme.exe octo\crackme.exe
Comparing files crackme.exe and OCTO\CRACKME.EXE
000000CE: 04 05

0000095F: 79 C9
C:\lafarge2>octo\filehash.py crackme.exe

C:\lafarge2>octo\filehash.py octo\crackme.exe

an extra section

C:\lafarge2>dumpbin /nologo octo\crackme.exe | tail -n 5 & dumpbin /nologo crackme.exe | tail -n 5
        8000 .data
        1000 .r4nd
        1000 .rdata
        B000 .rsrc
        4000 .text

        8000 .data
        1000 .rdata
        B000 .rsrc
        4000 .text
  • Veryyyyyyy Thanks! , my Ollydbg version is v 1.0 , i had to doing as you tell , command line + (Alt+F1) , it is 7EFDE000 .Can you please help me forward .... – 567hz Apr 30 '18 at 14:01
  • Why can not receive identical Window as the exercise ?? – 567hz Apr 30 '18 at 14:42
  • i don't know what exercise the link you posted is to a tutorial and appears to have some trojan (hideme) trying to infect the visitor post relevent parts to what you did and where you are stuck – blabb Apr 30 '18 at 14:49
  • I will to do all exercise from the page ,I have to download the program from here crackmes.cf/users/lafarge/lafarges_crackme_2 , for me who not to have a clue , this exercise is gut , because it speak every step..... – 567hz Apr 30 '18 at 15:08
  • what is your opinion what i should to do?? – 567hz Apr 30 '18 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.