Page 2 of 2 FirstFirst 12
Results 16 to 18 of 18

Thread: Need help in this crackme (delphi project)

  1. #16
    Registered User cRk's Avatar
    Join Date
    Apr 2003
    Location
    out of hell
    Posts
    152
    cuPegasus your comment make me thing you did reply in some arrogant way. i never said your way was wrong and it will do the same job.. but i'm always open minded to share knowledge + new ideas

    ZaiRoN this is how Dede get the info about the Forms.. and where begins, where Ends..

    on 0042F784 (6A00) begin the form of the messageboxa....

    look in reverse order with your hex editor, in this case i used HexWorkshop in hex value, look for 84F74200

    and you'll find --->

    636B110084F742000A466F726D437265
    ck....B..FormCreate

    means that's the RVA for the begin of that form.....

    to kill the form we can change or point the rva of the form/begin to other RVA where indicated other function like exit.. or C3 or something else

    with your hex editor you should see something like this also

    636B10007CF742000965786974436C69
    ck..|.B..exitClick

    7CF74200 = 42F77C00 and gives the exit command when you have pressed the Exit button

    just change 84F74200 for 9CF74200 and see what happends!

    9CF74200 = 42F79C00 (C3) = End/Return of Form

    Best Regards!

  2. #17
    Red wine, not vodka! ZaiRoN's Avatar
    Join Date
    Oct 2001
    Location
    Italy
    Posts
    922
    Blog Entries
    17
    Hi cRk,
    hmmm, maybe I misunderstood you but what do you mean by 'form'? The initial nag it's not a form, it's only a simple message box.
    on 0042F784 (6A00) begin the form of the messageboxa....
    42F784 is the initial address of the routine that is called when the FormCreate event happens...

    ciao,
    ZaiRoN

  3. #18
    Registered User cRk's Avatar
    Join Date
    Apr 2003
    Location
    out of hell
    Posts
    152
    Quote Originally Posted by ZaiRoN
    Hi cRk,
    hmmm, maybe I misunderstood you but what do you mean by 'form'? The initial nag it's not a form, it's only a simple message box.42F784 is the initial address of the routine that is called when the FormCreate event happens...

    ciao,
    ZaiRoN
    Sure! but usually delphi app. call/make Form in this way and not just the main Form, in this case it is a messageboxa

Similar Threads

  1. I need help with an odd delphi exe
    By james in forum The Newbie Forum
    Replies: 13
    Last Post: September 13th, 2009, 11:10
  2. delphi for newbie help
    By m.albert in forum The Newbie Forum
    Replies: 9
    Last Post: May 10th, 2005, 21:11
  3. Ice License (delphi)
    By Slider in forum The Newbie Forum
    Replies: 6
    Last Post: July 26th, 2004, 12:51
  4. help on delphi
    By m.albert in forum The Newbie Forum
    Replies: 8
    Last Post: September 11th, 2002, 22:40
  5. can anybody help me for reversing delphi
    By erdem2001 in forum Malware Analysis and Unpacking Forum
    Replies: 0
    Last Post: December 1st, 2001, 06:38

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •