costy's EnableME
| Download enableme.zip, 3 kb (password: crackmes.de) Browse contents of enableme.zip Try to enable it.
Difficulty: 1 - Very easy, for newbies | Send a message to costy » View profile of costy » |
Solutions
Solution by Xspider, published 11. jul, 2008; download (417 kb), password: crackmes.de or browse.
Xspider has not rated this crackme yet.
Solution by simonzack, published 10. jul, 2008; download (7 kb), password: crackmes.de or browse.
simonzack has not rated this crackme yet.
Solution by br0ken, published 10. jul, 2008; download (1093 kb), password: crackmes.de or browse.
br0ken has not rated this crackme yet.
Solution by xylitol, published 10. jul, 2008; download (1453 kb), password: crackmes.de or browse.
xylitol has rated this crackme as boring crap.
The submission of solutions is closed.
Discussion and comments
| Bispoo 09. Jul 2008 | Solved, will write and post solution soon... As always, VB crackmes are really easy :) |
|---|---|
| MACH4 09. Jul 2008 | Won't upload a solution for this (to easy) but, can you explain what you meant by; 'But if you enable it the program does't want to start.'? |
| Bispoo 09. Jul 2008 | Thats easy MAch4, if u analyse the code on a certain procedure theres a check, and if it fails the program crash... thats what he meant. :) |
| MACH4 09. Jul 2008 | Well all i did was enable the button and it ran ok! |
| br0ken 09. Jul 2008 | Maybe author should have used JMP instead of CMP -> JNZ? |
| costy Author 09. Jul 2008 | @Everybody I modified the program with Vb Reformer 3.9 Free in order to enable the button. The modified version crashes on my pc. Ok I wanna be onest. I made a simple program with VB with a disabled button. Then I enabled the button with Vb Reformer 3.9 Free Edition. I compared the two different exe. One byte is different. So I add a test: If the byte is modified it should crash. I think MACH4 used a different version of Vb Reformer and something doesn't work. @Bispoo You founded the check. So can you write a little solution about it. Have you used Vb Reformer?? What version?? @br0ken Could you explain better?? I manualy added some code in asm to the crackme. This extra code performs the check. I think there is no error in my code. |
| xylitol 09. Jul 2008 | juste change '0' by a '1' in hexa code and the buton is ok... |
| MACH4 09. Jul 2008 | @costy No error in your code! Saving a binary with some tools seem to alter some code and the check fails, That's all I can think of for now! It could be related to using inline asm in vb programs, I'm not sure! |
| Bispoo 09. Jul 2008 | @costy , i sent you a message on how i've done it :) i didnt use vb reformer |
| costy Author 09. Jul 2008 | @Bispoo I don't understand why your solution wasn't approved. @Moderators Could you explain why Bispoo's solution wasn't approved?? I think it's ok. It enabled the button and than removed the check. ??????? |
| br0ken 09. Jul 2008 | Yes, i realised this now. MACH4 is right. Using JMP will not start the cme at all. Silly me :P Maybe cme modified with vbreformer higher than v3.9 will have value 0 instead of 0xFF (in my case). That's probably why the check fails if you use versions above 3.9. |
| Bispoo 09. Jul 2008 | @costy My solution wasnt approved because i dont explain that good what i do, you might understand it but other people don't, i have to explain 'why' i do it , and not how i do it :) |
| TiGa 10. Jul 2008 | costy is complaining, again, what a surprise. The person who gets his solution rejected is explained the reasons why. It's not necessary to explain those reasons publicly every time. |
| simonzack Moderator 10. Jul 2008 | solution sent, waiting for approval |
| AloneInTheDark 10. Jul 2008 | Sorry for question , but i modified the program with Vb Reformer 3.9 Free in order to enable the button, but the modified version crashes on my pc. Where I can find other version of Reformer ? Tnk |
| costy Author 10. Jul 2008 | @AloneInTheDark It's not necessary to downlaod a new version of Vb Reformer. Just find the check and patch it. |
| obnoxious 10. Jul 2008 | i cant seem to use vbreformer. each time i open an exe in vbreformer i get an error msg "pas unexecutable vb4-5-6" |
| AloneInTheDark 10. Jul 2008 | Hi costy, with ollydbg ? It is good for Visual Basic? tnk |
| MACH4 10. Jul 2008 | Hey costy,Why don't you change the rules! Increase the difficulty by one and change the solution to explain why solution don't work! ;-) Anyway, I think I found whats happening, VbReformer is mis-reading the in-line asm so the check doesn't get performed on that byte. it also creates several other changes in the new file it compiles. Hex programs are more clinical and only changes the bytes without recompiling. |
| DigitalAcid 10. Jul 2008 | I'm using VB Decompiler Lite 0.4 and it works. It does what it says, decompiling :). Weird, when I remove the check, it gives an exception after showing a "nag" that wasn't there before O.o. |
| AloneInTheDark 10. Jul 2008 | @DigitalAcid Tnk for suggestion :) |
| AloneInTheDark 10. Jul 2008 | @DigitalAcid I have try VB Decompiler Lite 0.4 but where I can change property of Commond1.Enabled .... ? tnk |
| MACH4 10. Jul 2008 | Well, I made two identical dialogs, one with the button enabled and one without, then in winhex did a binary compare and there are many differences between them! @costy how did you only find one byte difference? |
| xylitol 10. Jul 2008 | @M4XH4 you just need HexDecCharEditor (or another hexa editor) VB Decompiler Pro HDB Converter (or calc.exe) in VB Decompiler, Enabled = 0 'false look the height you have for example '1337' convert it to hexa you have: '539' reverse it you have 39 05, search in the editor hexa the bouton name 'enable me and click me' search your '39 05' and normaly you see after '00' just remplace by '01' save as.. ho yeah the bouton work 8) vb reformer is only for win speed, like the 'old' method |
| MACH4 10. Jul 2008 | @xylitol, tnks for the explanation, yes i know! What I was trying to get at is that a modified file saved with different tools produce quite different binaries! So the injected asm test ends up pointing to some irrelevant byte. Still don't know why! damned vb6... |
| costy Author 10. Jul 2008 | @ obnoxious Are you sure you are opening a vb application? it'strange that vb reformer says "pas unexecutable vb4-5-6". Anyway my crackme is a 99% Visual Basic pplication + 1% asm manually added in the compiled file. My Vb Reformer open it correctly. @ AloneInTheDark Yes. OllyDbg is ok. There are some kind of debugger like SamrtCheck for Visual Basic Application but It is not so usefull with this crackme becouse the check is added manually in asm in the compiled exe. @MACH4 I don't want to change the rules becouse some peole surely have already posted a solution. I hope that sometimes explain the check in the solution to help less experienced crackers. @DigitalAcid The NAG?? Ah! I understood!! I added the check in asm in the crackme. I needed some space to put the check so when I compiled the crackme in the form1_load there is MsgBox(something). So the compiled unmodified exe will display the message box. I removed the message box to put the check in asm. Now with your modification it seems that the Message Box is still alive. :-) @ MACH4 I made a version the version with the disabled button. Then I modified this version with Vb Reformer 3.9 Free. Only a byte change. I think if you use another tool there can be a lot of differences. |
| Xspider 10. Jul 2008 | i was late :'( |
| spawnermax 12. Jul 2008 | hi,my first vb solved...nice ;) |
You may leave your comment, thoughts and discuss this crackme with other reversers here.
Acting childish will not be tolerated.
HTML and such will be left as-is, so don't try.