I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for stringreferences. The compare looks like that:

cmp byte ptr ds:[eax+0x1620], 0x0

The address contained in eax is always a different one, which makes it hard to set a breakpoint on the compared address. I already tried to track back eax, but that obviously results in hours of work without any result.

Does anybody know a technique to get the part in the disassembly where the program decides whether I am registered or not?

Thanks in advance.

Btw. I am not asking for a crack. I often come across compares like that, and they always discourage me because I don't know what to do there.

Sorry for the broken English.

  • I doubt you will get an answer to your question, as piracy is not condoned here. Even if that company went out of business, this still a borderline question :( The answer isn't hard anyway, you could just have a quick google search. Commented Apr 13, 2022 at 10:38
  • You are right. I changed the text to a crackme. Could you please tell me the answer if it isn't hard to find. I tried google search for hours and the only recommendations were memory or hardware breakpoints, which obviously won't work here.
    – Gero B.
    Commented Apr 13, 2022 at 11:13
  • Hardware breakpoints on memory access is the correct answer. I suspect that the address here, is from another module. You can follow it in dump and then check in what module it is located (using the Memory Map tab). Commented Apr 13, 2022 at 12:15
  • Okay thanks! It breaks at the right spot but still only sometimes as i already assumed because the address is dynamic. Is there anyway to prevent that?
    – Gero B.
    Commented Apr 14, 2022 at 6:54
  • You haven't event told me if that's another module... I can only guess what's going one here.. Probably it is due to ASLR, so check the "dll can move" flag (that, if set, will relocate the executable at random). Please be more specific and clear with your questions, otherwise I can only give you a guess. Commented Apr 14, 2022 at 8:12


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.