Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > Reverse Code Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 12-04-2012, 06:40 AM
mr.smart mr.smart is offline
Member
 
Join Date: Apr 2011
Posts: 13
Default Noob Prob with reversing a setup with serial protection

Hello together,

i've a target wich a protected setup exe. The setup need a serial for install. Now beginns my prob.
If i start the setup in olly, then the setup runs and create a new process for installing and serial protection.
I found no interesting strings or calls and when i set a breakpoint on getdlgitemtexta nothing happens.

I look for the new process and attach the second setup.exe, but i dont found anything to use for set a breakpoint.

May here is anybody who can help me and tell me how i can start, the rest i want do by my own hands. But here i need a lil bit help to start my reversing.

Programm: Sp4re P4rts Catalog for F0rklifts - non public

Thx @all.

Target link via pm.

Result from Protection ID:
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 109712 (01AC90h) Byte(s)
-> File Appears to be Digitally Signed @ Offset 019A00h, size : 01290h / 04752 byte(s)
[File Heuristics] -> Flag : 00000000000001001100000000000100 (0x0004C004)
[-= Installer =-] InstallShield v9.0.0.333 Setup Module
- Scan Took : 0.719 Second(s)

Regards

Last edited by mr.smart : 12-04-2012 at 07:18 AM.
Reply With Quote
  #2  
Old 12-04-2012, 09:26 AM
BfoX BfoX is offline
Senior Member
 
Join Date: Aug 2007
Posts: 2,251
Send a message via ICQ to BfoX Send a message via MSN to BfoX Send a message via Yahoo to BfoX
Default

try to search two md5 hash - first from your wrong password, second - from installer... and use 74/75 tricks and obtain the happy =)
__________________
... Either you work well or you work much ....
Reply With Quote
  #3  
Old 12-04-2012, 10:50 AM
mr.smart mr.smart is offline
Member
 
Join Date: Apr 2011
Posts: 13
Default

Quote:
Originally Posted by BfoX View Post
try to search two md5 hash - first from your wrong password, second - from installer... and use 74/75 tricks and obtain the happy =)
Thx i will try the md5 hash, please explain 74/75 tricks. Sry for this noob question.

Regards
mr.smart
Reply With Quote
  #4  
Old 12-04-2012, 12:09 PM
sparpacillon sparpacillon is offline
Senior Member
 
Join Date: Aug 2007
Posts: 210
Default

bfox suggested to find the md5 of original password and yours and change the conditional jump to make it accepted.
jz/jnz (75/75 are the opcodes for that istructions)

btw i don't know if exist anymore password protected setup that does not cipher their content with password (making useless the trick above)
Reply With Quote
  #5  
Old 12-04-2012, 04:12 PM
mr.smart mr.smart is offline
Member
 
Join Date: Apr 2011
Posts: 13
Default

Thx for the info and i will try it at weekend.

I will post my result here, may i will have a few questions more.

Thx again and nice evening.

Regards
Reply With Quote
  #6  
Old 12-05-2012, 03:54 PM
mr.smart mr.smart is offline
Member
 
Join Date: Apr 2011
Posts: 13
Default Solved

Thx for all answers, Problem solved.

It was InstallShield and i used a small tool for decompiling.

Regards
mr.smart
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2021, Jelsoft Enterprises Ltd.