Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 09-01-2018, 16:18
rcer rcer is offline
Friend
 
Join Date: Dec 2008
Posts: 171
Rept. Given: 5
Rept. Rcvd 9 Times in 8 Posts
Thanks Given: 6
Thanks Rcvd at 30 Times in 22 Posts
rcer Reputation: 9
Understood, but I have never dealt with CRC checking routines, so can you give me a hint as how do I find the dll or executable which checks the CRC?
Reply With Quote
  #2  
Old 09-02-2018, 03:59
eAGLe_eYe eAGLe_eYe is offline
Family
 
Join Date: Aug 2012
Posts: 113
Rept. Given: 8
Rept. Rcvd 54 Times in 12 Posts
Thanks Given: 6
Thanks Rcvd at 20 Times in 11 Posts
eAGLe_eYe Reputation: 54
Quote:
Originally Posted by rcer View Post
Understood, but I have never dealt with CRC checking routines, so can you give me a hint as how do I find the dll or executable which checks the CRC?
search all Exitprocess call in exe with olly,bookmarks all call,run exe its stop on exitprocess call.its most likely your crc check routine.
Reply With Quote
The Following 2 Users Say Thank You to eAGLe_eYe For This Useful Post:
niculaita (09-02-2018), tonyweb (09-02-2018)
  #3  
Old 09-02-2018, 13:01
ahmadmansoor's Avatar
ahmadmansoor ahmadmansoor is offline
Coder
 
Join Date: Feb 2006
Location: Syria
Posts: 1,047
Rept. Given: 517
Rept. Rcvd 374 Times in 142 Posts
Thanks Given: 380
Thanks Rcvd at 416 Times in 119 Posts
ahmadmansoor Reputation: 300-399 ahmadmansoor Reputation: 300-399 ahmadmansoor Reputation: 300-399 ahmadmansoor Reputation: 300-399
Quote:
Originally Posted by eAGLe_eYe View Post
search all Exitprocess call in exe with olly,bookmarks all call,run exe its stop on exitprocess call.its most likely your crc check routine.
First, it is an x64 target so ollyDbg will not work , you need x64dbg.
did you check if it is packed -if yes you will see that the target has many calls out of the .text section with many anti-debug checks -
what you need ( as I remember) is dll inject and huck some API before you use HW-BP to bypass anti-debug, then you apply ur patches.
__________________
Ur Best Friend Ahmadmansoor
Always My Best Friend: Aaron & JMI & ZeNiX
Reply With Quote
The Following 5 Users Say Thank You to ahmadmansoor For This Useful Post:
eAGLe_eYe (09-02-2018), gsaralji (09-02-2018), niculaita (09-02-2018), TechLord (09-02-2018), tonyweb (09-02-2018)
  #4  
Old 09-02-2018, 17:29
rcer rcer is offline
Friend
 
Join Date: Dec 2008
Posts: 171
Rept. Given: 5
Rept. Rcvd 9 Times in 8 Posts
Thanks Given: 6
Thanks Rcvd at 30 Times in 22 Posts
rcer Reputation: 9
Well it looks that I have a lot of studying to do, and learn about anti-debug checks, API hooking and dll injecting, because i don't have a clue
Reply With Quote
  #5  
Old 08-08-2019, 00:36
rcer rcer is offline
Friend
 
Join Date: Dec 2008
Posts: 171
Rept. Given: 5
Rept. Rcvd 9 Times in 8 Posts
Thanks Given: 6
Thanks Rcvd at 30 Times in 22 Posts
rcer Reputation: 9
Quote:
Originally Posted by ahmadmansoor View Post
First, it is an x64 target so ollyDbg will not work , you need x64dbg.
did you check if it is packed -if yes you will see that the target has many calls out of the .text section with many anti-debug checks -
what you need ( as I remember) is dll inject and huck some API before you use HW-BP to bypass anti-debug, then you apply ur patches.
Unfortunately I have been too busy with other things to do my homework about dll inject and API hooking
Reply With Quote
  #6  
Old 09-14-2019, 17:08
rcer rcer is offline
Friend
 
Join Date: Dec 2008
Posts: 171
Rept. Given: 5
Rept. Rcvd 9 Times in 8 Posts
Thanks Given: 6
Thanks Rcvd at 30 Times in 22 Posts
rcer Reputation: 9
Hi kangalooj, a while back you sent me a PM asking me if I needed help with reversing Agilent. When I lnoticed your PM, I was already degraded to friend, so I lost the right to PM you. Is there another way I can contact you?
Reply With Quote
  #7  
Old 09-15-2019, 17:23
rcer rcer is offline
Friend
 
Join Date: Dec 2008
Posts: 171
Rept. Given: 5
Rept. Rcvd 9 Times in 8 Posts
Thanks Given: 6
Thanks Rcvd at 30 Times in 22 Posts
rcer Reputation: 9
Hi kangalooj

maybe you can contact me on [email protected]
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Flexlm 7.2 LIC file use on Flexlm 9.2 display error -73 ? hanzi General Discussion 9 07-05-2006 18:51


All times are GMT +8. The time now is 02:48.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )