craking bng phng php dng STACK <by Computer_angel>

craking bng phng php dng STACK <by

Computer_angel>

- W 32

***

2
-

3
>>>>>>> T t c cc d
d

Borland Delphi ).

u c th s d
B
hi n thng bo th cch thc s c ph

W
B
B

i v i cc
n

Homepage : http://www.audio-recorder.net
Soft : Audio Recorder Deluxe v2.2.36
Cracked File : ard.exe (Microsoft Visual C++ 6.0)
-

7
)

)
W

QUOTE
0012D8D8 0017030C hOwner = 0017030C (class='#32770',
0012D8DC 004E6758 Text = "Incorrect code"
0012D8E0 004E6448 Title = "Help"
0012D8E4 00000030 Style = MB_OK|MB_ICONEXCLAMATION|M
0012D8E8 00000000 LanguageID = 0 (LANG_NEUTRAL)
0012D8EC 004993A2 ? USER32.MessageBoxA ard.0049939C
0012D8F0 0017030C hOwner = 0017030C (class='#32770',
0012D8F4 004E6758 Text = "Incorrect code"
0012D8F8 004E6448 Title = "Help"
0012D8FC 00000030 Style = MB_OK|MB_ICONEXCLAMATION|M
0012D904 0041B21B ? ard.00499374 ard.0041B216

QUOTE
0012D8EC 004993A2 ? USER32.MessageBoxA ard.0049939C

49939

QUOTE
0049939C |. FF15 68365300 CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; \MessageBoxA
004993A2 |. 5E POP ESI ; <== Set BreakPoint here

8
B
B

)
QUOTE
0041B20C . 68 48644E00 PUSH ard.004E6448 ; ASCII "Help"
0041B211 . 68 58674E00 PUSH ard.004E6758 ; ASCII "Incorrect code"
0041B216 > E8 59E10700 CALL ard.00499374

4 B2

QUOTE
0041B20C . 68 48644E00 PUSH ard.004E6448 ; ASCII "Help"
0041B211 . 68 58674E00 PUSH ard.004E6758 ; ASCII "Hmbnqqdbs bncd"
0041B216 > E8 59E10700 CALL ard.00499374

2-

3
Homepage : http://www. ipmonitor.tsarfin.com
Soft : IPMonitor - Version 4.8 (Build 804)
Cracked File : IPMonitor.exe (Micorsoft Visual C++ 7.0 Method2 )
-

rsoft Visual C++ 7.0 Method2

)

)
W

QUOTE
0012DAF0 77D6649A ? USER32.MessageBoxExA USER32.77D66495 0012DAEC
0012DAF4 0012030E hOwner = 0012030E ('Register IPMonitor',class='#32770'
0012DAF8 00423B80 Text = "Incomplete or incorrect information."
0012DAFC 008C2678 Title = "dum_"
0012DB00 00000030 Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL

0012DB04 00000000 LanguageID = 0 (LANG_NEUTRAL)

0012DB08 7C1DCD91 ? USER32.MessageBoxA mfc71.7C1DCD8B
0012DB0C 0012030E hOwner = 0012030E ('Register IPMonitor',class='#32770'
0012DB10 00423B80 Text = "Incomplete or incorrect information."
0012DB14 008C2678 Title = "dum_"
0012DB18 00000030 Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL
0012DC44 00417BE1 ? <JMP.&mfc71.#1123> dum_.00417BDC

QUOTE
0012DB08 7C1DCD91 ? USER32.MessageBoxA mfc71.7C1DCD8B

8B

QUOTE
7C1DCD8B FF15 4016147C CALL DWORD PTR DS:[<&USER32.MessageBoxA>>;
USER32.MessageBoxA
7C1DCD91 85FF TEST EDI,EDI ; <== Set BreakPoint here

8
B

8
)

QUOTE
00417BD5 6A 00 PUSH 0
00417BD7 68 803B4200 PUSH dum_.00423B80 ; ASCII "Incomplete or incorrect information."
00417BDC E8 77240000 CALL <JMP.&mfc71.#1123>
00417BE1 5F POP EDI

22
Homepage : http://www.genie-soft.com
Soft : Genie Backup Manager v4.0 b920
Cracked File : GBManager.exe (Microsoft Visual C++ 6.0)
-

)
W

QUOTE
0012DDF4 0032020E hOwner = 0032020E ('Register Genie Backup Mana
0012DDF8 00AE2CB8 Text = "Incorrect ****** Number"
0012DDFC 00AE2558 Title = "Genie Backup Manager"
0012DE00 00000010 Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
0012DE04 00000000 LanguageID = 0 (LANG_NEUTRAL)
0012DE08 73DD9CCB ? USER32.MessageBoxA MFC42.73DD9CC5
0012DE0C 0032020E hOwner = 0032020E ('Register Genie Backup Mana
0012DE10 00AE2CB8 Text = "Incorrect ****** Number"
0012DE14 00AE2558 Title = "Genie Backup Manager"
0012DE18 00000010 Style = MB_OK|MB_ICONHAND|MB_APPLMODAL

QUOTE
0012DE08 73DD9CCB ? USER32.MessageBoxA MFC42.73DD9CC5

8
QUOTE
0045DC33 . E8 407E0700 CALL <JMP.&MFC42.#858>
0045DC38 . 51 PUSH ECX

QUOTE
0045DC1A . E8 01400500 CALL GBManage.004B1C20 ; \GBManage.004B1C20
0045DC1F . 85C0 TEST EAX,EAX
0045DC21 . 74 45 JE SHORT GBManage.0045DC68 ; <=== JMP out of NAG if Serrial is Correct

3-

Homepage : http://www.imtoo.com
Soft : ImTOO CD Ripper 1.0.4
Cracked File : cdripper.exe (Microsoft Visual C++ 6.0 [Debug])
-

6
)

)
W

**** Sau khi quay t

stack of main thread :

QUOTE
Address Stack Procedure / arguments Called from Frame
0012EB70 77D43C6B Includes 7FFE0304 USER32.77D43C69 0012EBA4
0012EB74 77D4B406 USER32.WaitMessage USER32.77D4B401 0012EBA4
0012EBA8 77D4D9AA USER32.77D4B279 USER32.77D4D9A5 0012EBA4
0012EBD0 77D662F4 USER32.77D4D8F6 USER32.77D662EF 0012EBCC
0012EE88 77D65D77 ? USER32.SoftModalMessageBox USER32.77D65D72 0012EE10
0012EF5C 77F6379E ntdll.77F78C4E ntdll.77F63799 0012EF58

QUOTE
0012EE88 77D65D77 ? USER32.SoftModalMessageBox USER32.77D65D72 0012EE10

77 65 72

QUOTE
77D65D72 E8 19000000 CALL USER32.SoftModalMessageBox
77D65D77 66:837E 2C 00 CMP WORD PTR DS:[ESI+2C],0 ; <== Set BreakPoint here

8
B

8
7

QUOTE
004615F4 . 68 9C4E5300 PUSH cdripper.00534E9C ; |Arg1 = 00534E9C ASCII "Invalid registration
info!"
004615F9 . E8 1E240700 CALL cdripper.004D3A1C ; \cdripper.004D3A1C

4-

geBoxA :

2
B

4 - 5.0

)
W

stack of main thread :

QUOTE
0012F8B8 77D43C6B Includes 7FFE0304 user32.77D43C69 0012F8E8
0012F8BC 004561D4 <JMP.&user32.WaitMessage> up-gdb_.004561CF 0012F8E8
0012F8EC 004559A0 ? up-gdb_.00456100 up-gdb_.0045599B 0012F8E8
0012F910 00452C70 up-gdb_.00455984 up-gdb_.00452C6B 0012F960

***
QUOTE
0012F910 00452C70 up-gdb_.00455984 up-gdb_.00452C6B 0012F960

2 96

QUOTE
00452C69 > /8B03 MOV EAX,DWORD PTR DS:[EBX]
00452C6B . |E8 142D0000 CALL up-gdb_.00455984
00452C70 . |8B03 MOV EAX,DWORD PTR DS:[EBX] ; <== Set BreakPoint here
00452C72 . |80B8 8C000000>CMP BYTE PTR DS:[EAX+8C],0

00452C79 . |74 0F JE SHORT up-gdb_.00452C8A

00452C7B . |8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00452C7E . |C780 34020000>MOV DWORD PTR DS:[EAX+234],2
00452C88 . |EB 14 JMP SHORT up-gdb_.00452C9E
00452C8A > |8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00452C8D . |83B8 34020000>CMP DWORD PTR DS:[EAX+234],0
00452C94 . |74 08 JE SHORT up-gdb_.00452C9E
00452C96 . |8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00452C99 . |E8 26FDFFFF CALL up-gdb_.004529C4
00452C9E > |8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00452CA1 . |8B80 34020000 MOV EAX,DWORD PTR DS:[EAX+234]
00452CA7 . |85C0 TEST EAX,EAX
00452CA9 .^\74 BE JE SHORT up-gdb_.00452C69

B
B

QUOTE
00452CAB . 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX ; <== Set BreakPoint here
00452CAE . 6A 00 PUSH 0

8
7

QUOTE
0050F58A |. E8 29FCFFFF CALL up-gdb_.0050F1B8
0050F58F |. 84C0 TEST AL,AL
0050F591 |. 74 5B JE SHORT up-gdb_.0050F5EE <=== JMP out of NAG if Serrial is Correct

Link: http://www.ddth.com/showthread.php/40325-craking-b%E1%BA%B1ng-ph%C6%B0%C6%A1ngph%C3%A1p-d%C3%B9ng-STACK#ixzz1pwgkvSib