downloadbrowseWinFan's WinFan's TrainerMe

Download trainerMe.zip, 220 kb (password: crackmes.de)
Browse contents of trainerMe.zip

After you start this CrackMe, you have 120 seconds until it closes. You are allowed to load into any debugger and pause the application (NO PATCHING).
Your task is to write a trainer which sets the seconds left to a user defined value.

Have fun! ;-)

Difficulty: 3 - Getting harder
Platform: Windows
Language: Borland Delphi

Published: 23. Jul, 2009
Downloads: 547

Rating

Votes: 3
Crackme is boring.

Rate this crackme:

Send a message to WinFan »

View profile of WinFan »

Solutions

Solution by Adminka, published 28. jul, 2009; download (5 kb), password: crackmes.de or browse.

Adminka has rated this crackme as nothing special.

Solution by DoomsDay, published 28. jul, 2009; download (278 kb), password: crackmes.de or browse.

DoomsDay has rated this crackme as quite nice.

The submission of solutions is closed.

Discussion and comments

EvOlUtIoN
25. Jul 2009
what is the meaning of trainer indeed?
WinFan
Author
25. Jul 2009
http://en.wikipedia.org/wiki/Cheating_(video_games)#Trainers

Basically, it's a program which changes addresses or code in other applications while they are running. This is often used by gamers to manipulate games.

You can look in the solutions of my other TrainerMe which i wrote some time ago.
A3PIK
25. Jul 2009
Good Crackme , That's very Difficult , because I'm beginner !! Help me To Solve it
Tnx brO
IMPosTOR
26. Jul 2009
Its very easy to make patch,loader,Trainers and change timer value, dec,inc , ...
to moderator : level = 3 ???

0044E48F 4A DEC EDX
WinFan
Author
26. Jul 2009
Sorry, but that's not really what you had to do. A valid solution is a program that changes the amount of time left while the application is running. Replacing DEC EDX by NOP will just stop the countdown.
IMPosTOR
27. Jul 2009
ya you rigth.
each time you run the application address changed in memory.
and we can find correct address here.just some sniffer.

0044E1D3 |. 8B3490 MOV ESI,DWORD PTR DS:[EAX+EDX*4] ; eax+edi*4

Get edi value * 4 + eax = correct value. chang it to other value.

and its not so simple i think Difficulty is correct. ;)
WinFan
Author
27. Jul 2009
Hehe, and address not just changes every time you run it, but also every second, when the timer changes the value ;-)
IMPosTOR
27. Jul 2009
hehe , so i can nop your function and set my function to set timer.
i think it's allow.
Adminka
27. Jul 2009
To IMPosTOR:
It's simplier. No need to set timer by yourself. It has a count.
SaintDogbert
28. Jul 2009
Question.. can the trainer load WinFan itself or must it also be able to function if it is executed after WinFan?
WinFan
Author
28. Jul 2009
It should work if its executed after the target. Of course, if the way you manipulate it is the same, you can also have it loaded youself.
WinFan
Author
28. Jul 2009
Well done, nice solutions!

You may leave your comment, thoughts and discuss this crackme with other reversers here.
Acting childish will not be tolerated.
HTML and such will be left as-is, so don't try.