PDA

View Full Version : Hard Nag


nullcode
October 22nd, 2012, 08:32
Hello!
I am reversing a console that has a nag implemented through asm. It calls it via GetProcAddress & GetModuleHandleA.


Code:

not very useful


First time i see this kind of nagscreen.

I tried jmping the nag screen but it crashes the program.


Thanks

Kayaker
October 22nd, 2012, 17:00
You did well to remove the target link yourself, however you left the target name in the code you posted. I removed the code as well, not so much because it also violates the rules but because that bunch of HexRays output was of no use to anyone.

That said, the first question is easy, what API did GetProcAddress return? Also, how is the GetModuleHandle return value being used?

I took a look at some of your other pastebin code you deleted. There's one call to GetProcAddress(hModule, esp).
Then a whole bunch of calls to an unknown function in the form of Function(hModule, random_hex_byte,..).

What does this unknown function do with the random hex byte and hModule value? Does it lead to further GetProcAddress calls? If so, it may be Api Hashing going on to get the addresses of other functions that might have nothing to do with the nag. If you tried jumping the whole call, yes it will likely crash.

You need to step through everything more carefully, taking note of what real API's are being called, and try to isolate the nag screen function itself.

The most interesting thing you could do to start with is to find and understand the Api Hash routine, if indeed that is what the code is doing.

nullcode
October 22nd, 2012, 19:49
if i try to NOP two calls works in IDA Pro. But when i patch it in hex it runs for few secs then exits :S

Code:

loc_44CD01:
push 42040h
lea eax, [esp+288h+var_284]
push eax
lea eax, [esp+28Ch+var_204]
push eax
push 0
push 1F9h
mov eax, ds:dword_464FC4
push eax
call @<removed>@zqGf6kby$qqsxuiui ; <removed>:zqGf6kby(uint,uint)
call eax
dec eax //nag happens here
mov ds:dword_4650D0, eax
jmp short loc_44CD62

Kayaker
October 23rd, 2012, 03:02
Quote:
[Originally Posted by Kayaker;93504]You did well to remove the target link yourself, however you left the target name in the code you posted. I removed the code as well, not so much because it also violates the rules but because that bunch of HexRays output was of no use to anyone.


Hmm, I find out now that one of our other moderators was the one who removed the target link from your original post, as well as the target name you left in your second post, even after reading my comment about how that violates our rules about naming commercial targets for the purposes of asking specific details about cracking them. You obviously didn't read the FAQ that's in big letters in your sig before or after posting.

That said, again, you're still posting relatively useless code for anyone to make any sense of to help you. You need to understand the code, not just blindly nop instructions hoping the problem will go away. That's why I asked the questions I did, to try to guide you to comprehending the code so you could find an intelligent place to patch.

Doesn't matter, forget it. If you don't show more effort this thread goes away.

nullcode
October 23rd, 2012, 04:31
I tried everything it either crashes or exits right after execution. Too hard for me i guess.

I got it to work in either Olly or IDA Pro. But it exits fast after patching it.

Code:
loc_44CC51:
mov eax, off_45F668
cmp byte ptr [eax], 0
jmp loc_44CD62

squidge
October 24th, 2012, 07:16
Quote:
[Originally Posted by nullcode;93514]I got it to work in either Olly or IDA Pro. But it exits fast after patching it.
and why do you think that is?

What do you think is the difference between an in-memory patch and an on-disk patch?

How could the application detect that it has been modified?

nullcode
October 24th, 2012, 07:30
I don't know I just compile the Delphi test console app with a trial library.

Nothing special.

nullcode
October 24th, 2012, 10:19
Patched it myself

Had to do a bit of analyzing first. Was a simple MOV EBX,1

But thanks!