xylitol's InjectMe #2
| Download InjectMe_#2.zip, 105 kb (password: crackmes.de) Browse contents of InjectMe_#2.zip InjectMe #2 by Xylitol
Difficulty: 1 - Very easy, for newbies | Send a message to xylitol » View profile of xylitol » |
Solutions
Solution by HackBlat10190, published 05. oct, 2012; download (109 kb), password: crackmes.de or browse.
HackBlat10190 has rated this crackme as awesome.
Solution by JoKa, published 18. sep, 2008; download (101 kb), password: crackmes.de or browse.
JoKa has not rated this crackme yet.
Solution by costy, published 18. sep, 2008; download (206 kb), password: crackmes.de or browse.
costy has rated this crackme as awesome.
The submission of solutions is closed.
Discussion and comments
| Xspider 16. Sep 2008 | that's what we was waiting for :D let's try it then ^^ |
|---|---|
| costy 16. Sep 2008 | I really like code injection. I hope you will write an expert version in witch cracker need to insert a function that make sometingh iparticular for example show a picture and play a sound. Sorry about my English I hope it's clear. Good idea xylitol! |
| obnoxious 17. Sep 2008 | costy,xspider long time no see......... |
| EvOlUtIoN 17. Sep 2008 | I posted a solved executable yesterday, maybe it was not good to do, so it was deleted, but it is very very simple because imports can also be added, replaced or aòso you can get address is some different ways. Took about 3 minutes to do. |
| Ox87k 17. Sep 2008 | Agree with Evo, you can simply add an import (MessageBox or GetProcAddress) To get the handle of the dll you can use the import GetModuleHandleA (already imported) So.. many way to solve it ;) |
| JoKa 17. Sep 2008 | I simply changed 2 in comctl32.dll in original file to 3, and created dll with exported InitCommonControls procedure. It must work, but it doesn't. When I debug into deep of user32.dll (from MessageBoxA) I come to call of ntdll.RtlFindActivationContextSectionString which results 0 in crackme but not 0 in my sample program calling the same function of dll. I have no idea. Will try run under WINE. |
| JoKa 17. Sep 2008 | It works under WINE, but does not work under Win XP SP2. Will try on my old WinME installation. |
| JoKa 18. Sep 2008 | It works on WinME. |
| EvOlUtIoN 18. Sep 2008 | I made a more simple solution... I taken InitCommonControls which is totally useless in the program, and changed it to MessageBoxA (of course i changed also dll name). After it i gained also space to inject the messagebox since 5 bytes at the start of code was free. |
| JoKa 18. Sep 2008 | I don't agree with the fact, that InitCommonControls is totally useless in the program. I don't know the reason but on my WinXP SP2, patched exe doesn't work without this call. |
| HMX0101 18. Sep 2008 | The messagebox can be called without adding imports, just using GetModuleHandleA as 0x87k said ;) |
| yomshleeshee 19. Sep 2008 | Good one. Demonstrates importing really well. n00b question though. What's the difference between this and your first one, such that when I try and jmp at the original entry point and put the messagebox code somewhere else, as in Sinok's solution (well explained btw) to your 1st inject me it doesn't work. But when I put the code at the end in the area with just "00" and move the entry point, it works. What's the difference? Hi btw. New here. Been working crackmes here for a week or so. very nice. |
| costy 19. Sep 2008 | @yomshleeshee The difference is that the first crackme already use MessageBoxA to show a message. So the import table of the program (the import table is the list of function used) already contains MessageBoxA. This one is different becouse the original crackme doesn't contains MessageBoxA in its Import Table. |
| yomshleeshee 19. Sep 2008 | @costy Thanks! BTW I really enjoy the dialog and way you guys explain these solutions. Helps learning RE a lot. Keep it up! |
| EvOlUtIoN 24. Sep 2008 | I have WinXP sp2 and all works well without initcommoncontrols call. Also i made lots of asm programs all without initcommoncontrols and all worked. Maybe you can need it but it is not important, just set OEP in another place and add an import as alreadyu described. Anyway it is also simple to use other imports to get address of messageboxa, it is also possible to get address without using api's at all. |
| JoKa 25. Sep 2008 | I think the problem is not in InitCommonControls call, but in importing comctl32.dll In original crackme: NOP InitCommonControls call Run. DialogBox appears NOP InitCommonControls call and remove comctl32.dll from Import. Run. DialogBox doesn't appear. |
| JoKa 25. Sep 2008 | I suppose that RT_MANIFEST resource requires something in comctl32.dll (DllMain). 1. Original crackme: DialogBox appears 2. 1 + NOP InitCommonControls call: DialogBox appears 3. 2 + remove comctl32.dll from import: DialogBox doesn't appear (for me) 4. 3 + remove RT_MANIFEST (24) resource: DialogBox appears @Evolution: I removed RT_MANIFEST resource from your patched exe and now it works on my WinXP SP2 too. |
| ShadowRayzz 25. Sep 2008 | I liked it (xm module too :D) the first one was easy and this second one is just a lil harder but still sweet, waiting for the 3rd :D |
| EvOlUtIoN 26. Sep 2008 | I removed comctl32 and dialogbox appears perfectly equal to original. |
| EvOlUtIoN 26. Sep 2008 | i'm on winxp sp2 too |
| madmaurice 18. Jul 2010 | easy. you dont even need to codecave :P |
| madmaurice 18. Jul 2010 | @Joka why using an external library? its much easier @costy it worked for me without an additional import. i just had to assemble an MessageBoxA call and add my title and text. |
| DJ1hAD0 21. Feb 2013 | It's really funny!!! Tnx to Author!!! Also, I add WinExec function from Kernel32.dll in this crackme:) Now the calc.exe starts with injectme:) I think that this small crackme is very useful for my little damaged brain=) |
You may leave your comment, thoughts and discuss this crackme with other reversers here.
Acting childish will not be tolerated.
HTML and such will be left as-is, so don't try.