Results 1 to 9 of 9

Thread: Doing it without softice

  1. #1
    blink4me
    Guest

    Question Doing it without softice

    Hi,

    I have searched and found nothing about this topic in particular. I have a prog that seems to be an exe created by installshield. The extractor is InstallShield Self-Extractor. Normaly, you would just run it and then take the ins/inx and that was extracted to a temp dir. But this installshield, does not extrac its stuff, it asks for a pw before extracting. I tried dissambling it with w32dasm and ida and found myself completly lost in the code. I looked at a few jumps before the call to MessageBoxA (the pw is invalid...) but cant figure it out. Could somebody explain to how I could possibly reverse this without softice. There was one topic that kind of was about this stuff but they used softice. Appreciate your help.

    J
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    blink4me
    Guest

    If it can help

    If it can help, I could post the code. I cannot seem to find a section wich looks like something I have seen before, like a test, cmp and jne.

    J
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  3. #3
    foxthree
    Guest

    Target???

    Hmmm... based on the information given, we can't even pretty much lift our little finger

    Moral: Post the Target URL and I'll take a look...

    Signed,
    -- FoxThree
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    blink4me
    Guest
    Ok, I will post the "link" where you can get the package and the decompiled code.

    You can get Train Dispatcher 3 and Track Builder 3 Installs.
    http://www.signalcc.com/train3/downloads.html

    If you like the games you sould buy them, very interesting games.
    J

    *I only posted the W32DASM Code cause with IDA the file is too big.
    Attached Files Attached Files
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  5. #5
    take a peek at 004014c1... or possibly even more interesting the call at 004023FD... not sure about that one though

  6. #6
    foxthree
    Guest

    2 seconds job with SICE :)

    This is some dumb password protection, no doubt. Took less than 2 secs. under SICE. Look at 0040C7B0 to get the actual "unencrypted" password. [4xx5x2]

    Signed,
    -- FoxThree
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  7. #7
    blink4me
    Guest

    I know

    I know this is so simple in sice but I am on XP here and I cant run softice so I can only do it by dead listing. Thanks for the hint anyway.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  8. #8
    deuce
    Guest
    there are other debuggers than SoftIce... check out WinDbg, it works fine on XP
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  9. #9
    blink4me
    Guest
    I have windbg I find it hard to work with but you say that you can actually break on APIs in windbg? I had no idea of that. Cool, will look into that, thanks man.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. to softice or not to softice
    By WaxfordSqueers in forum Tools of Our Trade (TOT) Messageboard
    Replies: 19
    Last Post: December 31st, 2007, 17:41
  2. softice help
    By god in forum The Newbie Forum
    Replies: 13
    Last Post: January 23rd, 2006, 00:53
  3. softice help
    By PETER in forum Tools of Our Trade (TOT) Messageboard
    Replies: 2
    Last Post: September 11th, 2002, 06:31
  4. softice
    By skyman in forum Tools of Our Trade (TOT) Messageboard
    Replies: 2
    Last Post: March 21st, 2002, 01:52
  5. softice
    By Dan in forum Tools of Our Trade (TOT) Messageboard
    Replies: 1
    Last Post: October 30th, 2001, 00:33

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •