![]() |
|
#28
|
|||
|
|||
|
so i think this is doing something like xoring the first byte at that address where the exception is occuring, and as because registration is bypassed by xoring but our licence is still invalid so i get exception?
also this is wrapped by a loop and later one more loop to decrypt another function!! dont know how i can validate the licence keys! here: Code:
push ebx mov ebx,dword ptr ds:[eax] xor ebx,dword ptr ds:[edx] mov dword ptr ds:[ecx],ebx mov ebx,dword ptr ds:[eax+4] xor ebx,dword ptr ds:[edx+4] mov dword ptr ds:[ecx+4],ebx mov ebx,dword ptr ds:[eax+8] xor ebx,dword ptr ds:[edx+8] mov dword ptr ds:[ecx+8],ebx mov eax,dword ptr ds:[eax+C] xor eax,dword ptr ds:[edx+C] mov dword ptr ds:[ecx+C],eax pop ebx ret Last edited by 0xall0c; 03-04-2020 at 15:51. Reason: added more info |
|
|