Results 1 to 3 of 3

Thread: quite strange app behaviour

  1. #1
    NikDH
    Guest

    quite strange app behaviour

    Tried to crack an app which gives me some problems in patching it
    I found with no peoblems the points to patch and what to put in to make the prog works ok
    But when i try to apply any kind of patch and relaunch the prog i get a streange DialogBox telling me the app isnt correctly initialized
    The most strange thing is that the prog hasnt any kind of CRC check (at my sight) and when i load it with symbol loader (which always stops at the ep of the prog when prog isnt patched) it shows me that dialog again
    The dialog seems to appear before the prog has been executed and the same thing happens when i try to patch one of the dll of the prog and happens when i change the name to the prog too
    Looking at the language of the text of the dialog, it which isnt english like the language of the prog but its italian like the language of my os, it should be a system dialog and not prog related one
    But why does it appear every time i try to change something in the exe or its dll (file name too)?
    I'm under win2k should be realted to that prog?
    Tnx
    NikDH
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    aimless
    Guest
    Hullo,

    NT/2K runs checks on each exe/dll in terms of CHECKSUMS. Always!

    So, though you have checked the CRC, you must NOT have checked the CHECKSUM.

    Do that, rectify it, and mostly, it should disappear.

    If it still does not, get a resource editor, and try dumping the resources. Alternatively, try dumping the strings seen in the dialog.

    If they are present there, then the protection is not defeated. If they are not there, its the OS Checksum.

    Have Fun,
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  3. #3
    Yado
    Guest
    Hi
    nice problems i'll wait you on our irc channel

    byez.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. Armadillo App strange Mem-behaviour ?
    By SKiLLa in forum OllyDbg Support Forums
    Replies: 2
    Last Post: October 18th, 2005, 15:37
  2. SoftIce strange behaviour
    By robson in forum The Newbie Forum
    Replies: 13
    Last Post: December 25th, 2004, 21:50
  3. Very strange behaviour
    By Firestream in forum Bugs
    Replies: 3
    Last Post: January 15th, 2003, 10:34
  4. strange program behaviour
    By NikDH in forum Malware Analysis and Unpacking Forum
    Replies: 1
    Last Post: January 19th, 2002, 11:59
  5. Odd softice behaviour
    By matthew in forum Malware Analysis and Unpacking Forum
    Replies: 1
    Last Post: December 17th, 2001, 12:26

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •