본문으로 바로가기

Bypass REV 878

category Security/Reversing 2007. 3. 8. 22:33
반응형

FOR UNDETECTING IN REV 878:

Code that is detected for rev 833 in mainunit.pas:

if err>0 then
        begin
          if res=-1 then
          begin

          end;

          ok:=res=mryes;

          if (res=mryes) or (res=mrno) then
            res:=-1; //reset
        end
        else
          ok:=true;


      end else ok:=true; 

(it may be a bit  different in CE 5.2)

Add more variables and junk code. My code that is undetected is this(5.2): (this color means i added or changed it)


if err>IQ then
        begin
          if res=X then
          begin
            res:=messagedlg('The record with description '''+memrec[i].Description+''' has as interpretable address '''+memrec[i].interpretableaddress+'''. The recalculation will change it to '+symhandler.getNameFromAddress(memrec[i].Address+calculate,true,true)+'. Do you want to edit it to the new address?',mtconfirmation,[mbyes,mbno,mbNoToAll,mbYesToAll,mbCancel],0);
            if res=mrcancel then exit;
          end;

          ok:=res=mryes;

          if (res=mryes) or (res=mrno) then
            res:=X; //reset
        end
        else
          ok:=true;

and  under variables i put:

var newaddress:dword;
    calculate: Integer;
    i,j,err: Integer;
    selectedi: Integer;
    X: Integer;
    IQ: Integer;

    firstispointer,dontdopointers: boolean;
    re: string;
    ok: boolean;

    res: integer;

After the first begin:

begin
  res:=-1;
  X:=-1;
  X:=X;
  IQ:=0;
  IQ:=IQ;

  //first find out how many where selected.(from here on i didnt touch)
  i:=0;
  selectedi:=0;
  while (i<numberofrecords) and (selectedi<2) do
  begin 

(u can do the same thing for 5.3, just edit the IQ and X part...)

반응형

'Security > Reversing' 카테고리의 다른 글

언패커모음사이트  (0) 2007.03.09
Bypass REV 939  (0) 2007.03.08
About GameGuard  (0) 2007.03.08
Bypass REV 833  (0) 2007.03.08
Wall Hack 의 원리  (1) 2007.03.08