Results 1 to 5 of 5

Thread: How Can you remove it's CRC?

  1. #1
    Peter
    Guest

    Unhappy How Can you remove it's CRC?

    I tring to remove Cachex for Internet Explorer 4.0 CRC,but it is very hard. Who can help me? If you how to remove it's CRC?
    Thanks!
    softwrae down address:http://www.mwso.com
    Have some for it tutor?
    Please tell me ok?
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Tech
    Guest
    I know this sounds dumb but I'm only starting out: whats crc ? some kind of protection ?
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  3. #3
    Hi Tech,

    CRC = "cyclic redundancy check". The CRC is an algorithm used to detect changes in a file. It is not a protection scheme per se, though it may be used as such. When not applied to a software protection, the CRC may serve as a form of error checking (ie. to detect data corruption). When applied to a protection, it will be used to deter casual patching of an .exe or .dll. The algorithm may be as simple as summing up all the bytes in the file and comparing it to a correct value, or it may be substantially more complex, being performed only on critical portions of the file. The vulnerability of the CRC is that the program must typically open and read itself using an API like CreateFileA or MapViewOfFile. These API's along with the other win32 file I/O functions (ie. OpenFile, ReadFile, _hread, _lseek...ect) are the attack points when seeking to disable a CRC. Obviously an API monitor will be invaluable in this type of situation. BTW, +Spath has an excellent article describing the CRC algorithm...Should be easy to locate on +Tsehp's site with a quick search.

    Hope this answers your question.

    Cheers
    Clandestiny

  4. #4
    tsehp
    Guest
    an easy trick to locate where the crc check is :
    make sice break before the crc occurs, just do a single bpmb on your patched instruction. When the protection needs to check the bytes, it will trigger sice just at this address. then you have to reverse the crc to see where the final value is compared.

    lots of tutorials for this, I remember in some old asprotect ones.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  5. #5
    Tech
    Guest
    thanks Clandestiny, i've actually come across crc before without knowing it. I think it was in Regview(http://www.regview.com/) but whenever I patched the exe it said it was corrupt after I ran it. I got it working in the end tho...
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. remove the nag in this exe.
    By GRIMPMASTER in forum The Newbie Forum
    Replies: 6
    Last Post: October 3rd, 2007, 08:28
  2. Why remove my thread?
    By Limee AKA Lamer in forum Malware Analysis and Unpacking Forum
    Replies: 2
    Last Post: September 4th, 2004, 08:34
  3. how to remove Alt+tab protection ?
    By highfly in forum The Newbie Forum
    Replies: 5
    Last Post: December 21st, 2003, 06:52
  4. Is it possible to remove DMA from a program?
    By Aquatic in forum The Newbie Forum
    Replies: 10
    Last Post: March 27th, 2003, 03:18
  5. Who can remove the VB5's Nag? HELP!!
    By Unregistered in forum Malware Analysis and Unpacking Forum
    Replies: 1
    Last Post: October 18th, 2001, 03:54

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •