Page 1 of 2 12 LastLast
Results 1 to 15 of 24

Thread: in_memoriam_of_+FRAVIA

  1. #1
    Musician member evaluator's Avatar
    Join Date
    Sep 2001
    Posts
    1,489
    Blog Entries
    1

    in_memoriam_of_+FRAVIA

    i had suspended idea for Guess-me toy.
    when i read +Fravias swansong, i remembered this idea &
    planned to build this crackme for him as gift..
    but so quick cames death..

    so it is now only In_Memoriam.

    You should trace & watch this guess-me in debugger. (i put INT3 for catch)

    1. So you must guess, what it means..
    2. if you guess, then exact "object" name need! (need some proof in that space..)
    Attached Files Attached Files

  2. #2
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,124
    Blog Entries
    5
    OK, I'm a sucker. I counted the spacing on the stack between CS(0x1B) values (84,3,5,3,55,3,5,3,.....). I converted them to binary and tried to rearrange them. I even squinted my eyes and stared at the stack display to see if I could see a big "+F" or something... zip, nada, nothing, diddly-squat. Some cryptic cypher? Morse Code?

    The order of the PE sections are "backwards". fs:[0] is wiped. Neither seem to be significant.

    Anybody else got ideas?

  3. #3
    Musician member evaluator's Avatar
    Join Date
    Sep 2001
    Posts
    1,489
    Blog Entries
    1
    as of PE-order, it is RosAsm compiled executable.
    FS:0 fiped for rid exception on INT3.
    that all not matters.

    >>You should trace & watch this guess-me in debugger. (i put INT3 for catch)
    that all you need. 2 or 3 time. than imagine, what it means..

  4. #4
    watched it, but have no idea
    I suppose it's simple, but didn't get it at all
    all I see is it jumps in one place for a while, then jumps at another,
    but that might just be olly's window not being big enough...

  5. #5
    melvill
    Guest
    Hi Guys

    I see a lot of JMP's, a lot of RET's and a lot of 004060.. on Stack starting on 0012F684 ending 0012FFC0. Is there something hidden ?
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  6. #6
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,124
    Blog Entries
    5
    Quote Originally Posted by melvill View Post
    Is there something hidden ?
    Presumably, but not code per se, what you see is what you get. I haven't figured it out yet either

  7. #7
    It's a piano on the stack, I guess.
    Unfortunately I know nothing about these do, mi, sol, etc
    and can't to name the melody

  8. #8
    Musician member evaluator's Avatar
    Join Date
    Sep 2001
    Posts
    1,489
    Blog Entries
    1
    neviens.. they all are so far from F+...
    show to someone how knows "disasm"

  9. #9
    OK, can anybody "disasm" this one (attached)?
    Attached Files Attached Files

  10. #10
    Well, that is either Gounod's Ave Maria or the C Major Prelude from Bach's Well Tempered Clavier, Book 1. They both have the same arpeggiated figure, the Gounod version just adds a melody on top of it. My guess is that the Gounod version is the intended "target" though the Bach is just as appropriate. Now my curiosity is stirred so I will have to look at the original guessme and check it out for myself

    EDIT: By the way, there are a two wrong notes in the tune, will try to look at the crackme in the near future to figure out if the "errors" are in the guessme or in the interpretation. But still, pretty cool!
    Last edited by xenakis; June 3rd, 2009 at 19:33.
    I have nothing to say and I am saying it and that is poetry as I need it.
    -John Cage

  11. #11
    Musician member evaluator's Avatar
    Join Date
    Sep 2001
    Posts
    1,489
    Blog Entries
    1
    wrong 2 notes > disasm-failure :)

    yo, neviens, you wrote:
    Unfortunately I know nothing about these do, mi, sol, etc

    and now than give us assembled midi-file?!

  12. #12
    melvill
    Guest
    As someone said " only are blind who does not want to see " I icluded. So many F's and B's and D's the hint of the swansong, Mute Swan...

    it's the madness of the reversecode always bytes
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  13. #13
    there is a possibility for know who song is? I think only a musician can do this.

    ricnar

  14. #14
    Shaddy
    Guest
    Quote Originally Posted by Ricardo Narvaja View Post
    there is a possibility for know who song is? I think only a musician can do this.

    ricnar

    After disasm the "piano" concept, and build little .midi. I think the music is Mahler "Adagietto".

    Reggards,

    Shaddy.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  15. #15
    Shaddy
    Guest

    Mahler - Adagietto

    Here is that I mean...

    Adagietto - Mahler (.mid)

    http://www.8notes.com/school/midi/french_horn/mahler_adagietto.mid

    Reggards,

    Shaddy.
    Last edited by Shaddy; June 12th, 2009 at 07:34.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •