Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   tips? (https://forum.exetools.com/showthread.php?t=1333)

NE1 08-20-2002 18:57

tips?
 
Hi, I am trying to reverse the protection a program (GU1TAR PR0 3), and have hit a road block.
The protection works like this:
Name and 15 digit Serial number.
Name is read in and a checksum is calculated from the name.
The Serial is read in and checked using the following format.
((1st digit + 2nd digit) * checksum from name) mod 10 = 11th digit
((3rd digit + 4th digit) * checksum from name) mod 10 = 12th digit
((5th digit + 6th digit) * checksum from name) mod 10 = 13th digit
((7th digit + 8th digit) * checksum from name) mod 10 = 14th digit
((9th digit + 10th digit) * checksum from name) mod 10 = 15th digit
Now using the above, and the checksum from whatever name I use, it is easy to calculate a serial that passes the check. Many different Serial numbers would work. Problem is only one is the correct one. Now if I just use any serial number that passes the above requirements, the program accepts it, continues to load, saying that it is registed to whatever name I used, but then exits without any messages (a serial number that failed the above checks would prompt with invalid liscence and let you try again).
Anyway, it is obvious that there is another check somewhere that puts further restrictions on the format of the serial, but with no messages, etc, I am having trouble locating where this is done.
Has anyone dealt with a similair protection scheme, that might be able to offer some tips as to what to look for.

Vox Humana 08-21-2002 01:42

Only a suggestion
 
If the program spontaneously exits, most probably it will call ExitProcess or TerminateProcess. BPX on them, then check the stack.
Hope it helps

xobor 08-21-2002 18:38

also maybe BPM RW on memory location where your serial resides can help you

regards

NE1 08-27-2002 03:45

Thanks for the suggestions. I was able to find what I need to, by using PostExitMessage, and have since completed reversing the protection scheme.


All times are GMT +8. The time now is 08:04.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX