CrackMe3
Another gui-based crackme written in visual studio 2017 win32 api.
Objectives:
- Remove the 2 nag screens – one at startup and one at close of program.
- In the About screen – change status to Registered.
Link: https://crackinglessons.com/crackme-3/
Software
The software had 2 nag screens while opening the program and when closing it. And about page showed unregistered
Detect It Easy
Using DIE software I found the entry point.
EntryPoint = ImageBase + AddressOfEntryPoint --> 0x00401370
x32dbg
Removing nag screens
Using x32dbg and animate over funcitonality, I found the command that calls the nag screen.
The highlighted lines were simply opening nag screens.
So I removed them and set them to nop.
Now to find closing nag screen we can do two things. We can check intermodular calls and filter for MessageBox or we can pause the program and check for call stack. I checked intermodular calls.
And second messagebox was the closing nag.
Simply deleted it and set to nop.
Registering user
To show registered message on about page, we can again do two things. We can check intermodular calls and filter for MessageBox or we can pause the program and check for call stack. I checked intermodular calls.
First messagebox was the one checking for registration.
Simply patched it.
Then exported it.
And we are registered.