Tools: WKTVBDebugger
Target: Here
|
|
Out beloved new brand debugger provides a cool function called BranchX Refs,
this cool feature provides us with a list of all the branches done by the
current procedure, the one specified at the top part of the disassembly screen
Proc: 4043DCh-4048Eh, this belongs to
the procedure start address and ending address. So we're gonna check the branches
for this procedure.
4.- Click on Analize BranchX Refs.You will see a list containing the following:
00404404h : BranchF 00404410h
0040442Fh : BranchF 00404442h
00404461h : BranchF 00404474h
00404493h : BranchF 004044A6h
004044C5h : BranchF 004044D8h
004044F7h : BranchF 0040440Ah
00404529h : BranchF 0040443Ch
0040455Bh : BranchF 0040446Eh
0040458Dh : BranchF 004044A0h
004045BFh : BranchF 004044D2h
004045F1h : BranchF 00404404h
00404623h : BranchF 00404436h
00404655h : BranchF 00404468h
00404687h : BranchF 0040449Ah
004046B9h : BranchF 004044CCh
004046EBh : BranchF 00404401h
00404720h : BranchF 00404436h
00404755h : BranchF 0040446Bh
0040478Ah : BranchF 004044A0h
004047BFh : BranchF 004044D5h
004047F4h : BranchF 0040440Ah
00404829h : BranchF 0040443Fh
0040485Eh : BranchF 00404474h
00404893h : BranchF 004044A9h
004048B7h : BranchF 004043E3h
The first number belong to the address were the opcode gets executed, and the next part is the Branch itself and it's jump address, the jumps are sorted so we can see that we have a lot of branches here. Curiously the distante between this jumps are 35h or 32h bytes, so we could be pretty sure that the code executed between each jump is quite similar. Lets try to put a BPX on the last one, wait, why the last one?, Good question, the answer is easy, we're going to see it the last branch is the one that decides the whole thing, i mean the bad guy good guy check. To do this right click above the last branch (a context menu appears) select BreakPoint On/Off to set a bpx on this jump. Close the dialog box and press Go! (F5).
5- The bpx takes effect we're here now:
|
|
Pretty cool as you can see, we're on line 4048B7, and the debugger says that the Branch is going to be taken. Check the next lines of code, the app is doing something with a nice message at 004048C8 you can see 'You have solved it...', does is look as a god guy/bad guy check? Clearly it is ;) ok so you've three options
A) Invert the jump, that's not very clever because if you get with the correct combination the Branch will be taken.
B) Delete the BranchF at 4048B7. To make the proggy continue the flow without jumping. This is not possible because P-Code does not have a NOP instruction.
C) The last option is the most complicated one but os the right one. Let me first explain how the BranchX instruction works. It takes de value from the top of the stack (ESP) and test if the dword there is TRUE (in VB TRUE = -1 = FFFFFFFh).
According to this:
BranchF will
jump if the stack value is 0h
BranchT will jump if the stack values is FFFFFFFh=-1
The opcode for BranchF is 1Ch and for
BranchT is 1Dh, but we don't need this now we need to change the stack value
in a manner that BranchF always get -1. How we can do this?
Let's see what we have before the jump:
004048B5: 33 EqVarBool
This opcode test the equality of two boolean vars and pushes -1 or 0 to the stack according to the comparision result. This opcode belongs to the second set of opcodes (Lead0).
Well maybe we can find and instruction that pushes and inmediate value to the stack, but to do this we need to use only 2 bytes because that's the size of EqVarBool opcode. Checking the opcode list we can see and instruction with the same size that says:
F4h LitI2_Byte
For those of you that are not very used to P-Code mnemonics prefix Lit means "Literal" and is used to load and save literal values to the stack. The format of this opcode is like this:
F4 XXh
Where XXh is and inmediate value to push to the stack, and wich value we need ? You're right -1 of FFh if you prefer :) so we're gonna patch the EqVarBool. In fact this opcode pushes a DWORD not a BYTE Value so it's all we need for our porpouses.
6- Open the Memory Dumper and enter the address for the EqVarBool (4048B5). You'll see the opcodes in memory, the first ones are FBh 33h (EqVarBool) so let's patch it. Double click on the fist memory line (the one with the FBh 33h) now change this two bytes by F4h FFh (LitI2_Byte -1).
7- Remove the BPX by double clicking on the BranchF line, and press F5, now enter any check box combination and press Check. Surprise! You've cracked it :).