Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   Trying to break on a WM_LBUTTONUP within a DELPHI app (https://forum.exetools.com/showthread.php?t=18720)

Stingered 03-25-2018 04:50

Trying to break on a WM_LBUTTONUP within a DELPHI app
 
Trying to catch a registration dialog so I can RE the keygen algo, but I cannot seem to be able to break on the dialog. It's a Delphi app, and using conventional methods in OllyDBG and/or x64DBG gets me nothing. I've tried hard-code BO in user32.dll and a windows message break point. Anyway, basically just you just load up the open windows handles in OllyDBG or X64DBG and break on the button command. Doesn't work though.

Any ideas?

[edit]

Tried using IDR and it crashes every single time.

Thx

niculaita 03-25-2018 20:02

it s a fake delphi app
that was compiled this mode only to deceive reverser

Stingered 03-26-2018 00:15

Quote:

Originally Posted by niculaita (Post 112772)
it s a fake delphi app
that was compiled this mode only to deceive reverser

I see your point. However, everything identifies as Embarcadero Delphi.

https://www.davidesperalta.com/appbuilder/

ionioni 03-26-2018 01:07

Quote:

Originally Posted by Stingered (Post 112773)
I see your point. However, everything identifies as Embarcadero Delphi.

https://www.davidesperalta.com/appbuilder/

yellow is onOK procedure

Apuromafo 03-29-2018 10:26

use IDA open analize and and export a map...
use idr, only open and export a map

in x64dbg use (plugin https://github.com/x64dbg/x64dbg/wiki/Plugins)
[Download] SwissArmyKnife by Nukem: x64dbg utility for linker map files, diff files, peid/ida signatures, and code signature generation.

for import map

in normal x64dbg, try to use labels for guide

br, Apuromafo

sendersu 03-29-2018 14:28

Quote:

Originally Posted by Apuromafo (Post 112812)
use IDA open analize and and export a map...
use idr, only open and export a map

in x64dbg use (plugin https://github.com/x64dbg/x64dbg/wiki/Plugins)
[Download] SwissArmyKnife by Nukem: x64dbg utility for linker map files, diff files, peid/ida signatures, and code signature generation.

for import map

in normal x64dbg, try to use labels for guide

br, Apuromafo

IDR is enough (if Delphi is not very modern)
the rest is not required

Levis 03-29-2018 16:14

You should try to locate address of VCL Component's procedure and break there (depend on which one you're looking for). IDA/IDR should be great, but i simply prefer PE Explorer because It's lightweight. Got success with old Delphi versions

sendersu 03-29-2018 18:59

IDR has the brilliant feature - shows/locates any control handler routine like a charm.


All times are GMT +8. The time now is 20:31.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX