CrackMe8
This crackme is for learning how to put hardware breakpoints on memory addresses and then patch it to register the program.
Link: https://crackinglessons.com/crackme-8/
Software
It was a simple software showing UN-REGISTERED.
Detect It Easy (die)
Using DIE software I found the entry point.
EntryPoint = ImageBase + AddressOfEntryPoint --> 0x00402254
x32dbg
I first opened string reference searcher.
Then searched for UN-REGISTERED string, and found an address.
Then analyzing the logic I understood that it checks for some value then jumps.
First Way (JMP Patch)
The command JE jumps and does not execute below commands so we can not see REGISTERED status.
I simply updated it to JMP next address which is simply doing nothing so we become registered.
Second Way (Memory Patching)
We can also set a breakpoint on memory access and update the memory which causes ZF to be 1 and eventually causes JE command to be executed.
Whenever there is a JMP command, we can be sure there must be a test or cmp command above it which sets ZF. So at first I found the CMP command.
Then followed the address on memory dump.
Then set an hardware breakpoint to analyze if this is the address that causes ZF to be 1.
After making sure address is right, I edited the binary to be 1 which causes ZF to be 0 so JE is never executed.
And that is it.