The first part of this tutorial is identical to the previous (Finding the correct serial
). Let's repeat it.
First of all, you have to download OllyDbg
, my favorite Windows debugger and copy EasyCrack.exe (in directory \Help\EasySerial\) to a working directory.
At first, start EasyCrack. A nice dialog box will appear, enter your name and a serial (for example 123456) and click OK button. Harrr... "Entered serial is incorrect!"
Now, start OllyDbg and open EasyCrack.exe. It will take a moment. You will see a screen like this:
I won't explain you what is Stack, Registers opcode and so. You should look at some assembler tutorial and you will learn it. Move your mouse to Assembly listing and right click on it. A popup menu will appear. Choose "Search for" and "Binary String". In new dialog type in ASCII edit box: "Entered serial" (a part of "Entered serial is incorrect!" message) and click OK. Assembly listing window will move to the message. Now you have to right-click on the line with 'ASCII: "Entered serial i"', select "Find references to" and "Selected address". A new window will appear with references to the message. The first reference is what we need, so double-click on it. Assembly listing window will bring you right to the place in code, where MessageBox is created.
Take look at this commented piece of code:
If you look at the piece of code above, you know what we are going to patch. Yes, it is the JNZ (Jump if Not Zero - Jump if not equal) instruction. We want to invert the logic of algorithm by replacing the instruction with JE (Jump if Equal). So, double click at the "JNZ SHORT EASYCRAC.00401BE0" command. Dialog box will appear:
Replace JNZ to JE and press "Assemble" button. Now is the exe patched (in memory). Right-click on the patched line and select "Copy to executable file". A new window called "File" will appear. Right-click on it, select "Save to file", choose a filename and a new, patched exe will be created.
If you run it, you can type any name and any serial and a "Thank you for registering" window will appear.