Help-Inline Patching ASPACK 2.12(System Mechanic 4.0h)

Seems to me like your trying to patch it after its already started its unpacking procedure, meaning those address's dont actually exist in the executable so OllyDBG is unable to write the changes, my best guess anyway.

Just change the 00C704F4 75 08 JNZ SHORT SysMech4.00C704FE
to jump to your custom code then, jump back when it's executed.


Edit: Here's my solution.

00C704F4 E9 073E0100 JMP SysMech4.00C84300
00C704F9 90 NOP
00C704FA 90 NOP

00C84300 C605 25644D00 7C MOV BYTE PTR DS:[4D6425],7C
00C84307 ^E9 F2C1FEFF JMP SysMech4.00C704FE

Thank you both Mr.Anonymous and SvensK for ur help

Svensk i'l try ur solution and hopefully it will work

Regards,

It's even easier to serial fish this baby. Took a few minutes.

Name: SvensK [pH]
Serial#: 74758-S4565-4654558635

Now you don't have to patch the exe at all. Enjoy

Hi,
It seems u use the point-H method but i when i used the same method it didn't show me the real serial only shows me the fake serial i enter..strange. So thats why i opted to patch it. Anywayz i did learn how to inline patch ASPACK
Thanks

Regards,

Simply put a breakpoint at: 004D6486 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]

Press F8 once and the correct serial# is pushed to EAX and is shown at the top row in the Registers window.

I found the serial earlier today too Ferrari, this is how I found it:

Point H & Call stack didn't seem to help with this program, so I used by a bit of lateral thinking for a solution, and in this case it fucking worked!!!, in fact I got a serial when I thought I'd just be finding where to crack the trial, don't know how well it will work on other targets, with long routines it may pay to press ctrl & F8 to bring up the evaluation screen sooner:


F8 till evaluation screen opens, happens at:

006966D4 . E8 B7F3FFFF CALL SysMech4.00695A90

Restart, F8 till above, then F7, then F8 till evaluation screen opens, happens here:

00695AD6 |. E8 81F0FFFF CALL SysMech4.00694B5C

Restart, Trace with F8, then F7, then F8 till above, then F7 into, code here looks more interesting, some tests, so lets trace into some of these calls, and see which ones are worth a breakpoint:

This one looks like it tests for past crackers and serial cracks, lets not bother with this for now:

00694B7E . E8 D919E4FF CALL SysMech4.004D655C


This one just seems to check whether it is a first run, I don't think we will bother with that:

00694B9F . E8 1817E4FF CALL SysMech4.004D62BC


This one looks real prommising, has strings mentioning serials:

00694BBA > E8 ED17E4FF CALL SysMech4.004D63AC


This one deals with the trial period, and when it expires, lets not worry about this for now:

00694BE2 . E8 6D15E5FF CALL SysMech4.004E6154

The evaluation screen opens in this call, so let us not look any further.


So let us put a breakpoint on 004D63AC, and restart program in Olly, and run until evaluation screen comes up, enter your name and fake serial, and the bad cracker message comes up, oh bugger it didn't break, you think you are back to the drawing board, but when you hit ok to this message, Olly does break here:


004D63AC /$ 55 PUSH EBP

Now look in the memory dump window, we can see our fake details, and a valid serial for your username is shown at 0012F894, for Pompeyfan it is 71686-S4670-0635881907

If I hadn't grabbed a serial, I would have investigated the trial and first run calls, to try and kill the trial.