by Vizion
(18 September 1997)

---

Courtesy of Fravia's page of reverse engineering

---

Well, A visual basic 5 target (without strings) with a quiver protection, very well reversed by Vizion, even if, as usual with protectionists that are NOT careful enough, you could have directly searched insie the dead listing the strings: "MSVBVM50.rtcMsgBox" and "cmp ax, 000A"

---

 :::: TARGET

 TTFPlus 3.3 32-bit demo (url : www.wmsoftware.com)



 :::: TOOLS 

 W32Dasm 8.9, SoftIce for NT 3.01, UltraEdit-32 4.40b



 :::: PROTECTiON

 Quiver protection (see +ORC, lesson 4.1). Internal counter. 

 The demo counts the number of times you select a font you like to see.



 :::: REMARK(s)

 You will need to change winice.dat for this crack. Open winice.dat in your

 favorite text editor and add the next line,



 EXP=:\\msvbvm50.dll



 Save the file and restart your computer if SoftIce is loaded.



 :::: FiND THE COUNTER

 Like always, I start with loading the target in W32Dasm. The first thing I

 noticed was that there were no String References. Pretty annoying if you

 ask me. If you take a look at the list of .dll files that are used you'll

 see only one :



  MSVBVM50.DLL aka. Microsoft Visual Basic Virtual Machine 5.0 (I think)



 Ok, this is quite new, and I haven't seen any tutorials on a VB5 program.

 Due to the lack of String References and the usage of only one .dll file

 we need a "new" approach to crack this baby, I suggest you sit down and

 start thinking about the way to crack this target...



 Well I came up with the following idea.



 Start the target and select several times a font, after 10x clicking you'll

 get the nag screen telling you... well read it :). The problem is that you

 need to restart the target if you want to use it some more.



 Back in W32Dasm, take a look at the imported functions from the .dll,



 Addr:0F0D3109 hint(0000) Name: __vbaStrBool

 Addr:0F01A5AE hint(0000) Name: __vbaExitProc

 Addr:0F0239B1 hint(0000) Name: __vbaFileCloseAll

 Addr:0F023FA0 hint(0000) Name: __vbaOnError

 Addr:0F04F618 hint(0000) Name: __vbaObjSet

 Addr:0F0CF404 hint(0253) Name: rtcMsgBox                    



 (c) Vizion 1997. All rights reversed


You are deep inside fravia's page of reverse

engineering, choose your way out:







homepage 

 links

 anonymity

+ORC students' essays tools

cocktails 


academy database 

antismut search_forms mail_fravia




is reverse engineering legal?