+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Blackhat Training (https://hackforums.net/forumdisplay.php?fid=405)
+----- Forum: Reverse Engineering (https://hackforums.net/forumdisplay.php?fid=229)
+----- Thread: Decompiled VB6 code - need help with finding what it calculates (/showthread.php?tid=5901351)
Pages: Pages
1
2
Decompiled VB6 code - need help with finding what it calculates - Kufe - Oct 30, 2018
I hope someone can help me with this problem, because I am struggling for 4 days (and a few nights) with this one... I decompiled some small VB6 app which checks for license online. It goes to specific url (.php?id=XXXXXX - where XXXX is some generated HW ID) and returns string with 3 parameters (divided with |). I can use host file to change DNS and use my own returned parameters, but I have a problem with 3rd parameter, because I don't know what it should be. The first parameter has to be OK, second is any name (it's just used to display Welcome NAME), third is the one causing me problems - it's some number I think (usually 3 digit). So returned text is something like OK|Mike|701.
*Solved, thank you AbakBarama.
RE: Decompiled VB6 code - need help with finding what it calculates - John Doe 5726 - Oct 30, 2018
Would be easier if you sent full binary, your decompiled code makes little sense, also, you should just NOP out the license check instead of bothering to replicate a server response.
RE: Decompiled VB6 code - need help with finding what it calculates - Kufe - Oct 30, 2018
I don't know how at VB6. It's easy with C# or .NET but here I was only able to decompile with VB decompiler (can modify code and rebuild exe). Full exe is available here - mega.nz/#!KrgkxYIa!4Ipvua_31eV_CsTnqzz4uixRej-6KThmb_9zmTVrKwE
RE: Decompiled VB6 code - need help with finding what it calculates - John Doe 5726 - Oct 30, 2018
(Oct 30, 2018 02:14 AM)Kufe Wrote: I don't know how at VB6. It's easy with C# or .NET but here I was only able to decompile with VB decompiler (can modify code and rebuild exe). Full exe is available here - mega.nz/#!KrgkxYIa!4Ipvua_31eV_CsTnqzz4uixRej-6KThmb_9zmTVrKwE
Do you have an example of a valid server response with the corresponding HWID?
Can you send it?
RE: Decompiled VB6 code - need help with finding what it calculates - Kufe - Oct 30, 2018
(Oct 30, 2018 02:19 AM)John Doe 5726 Wrote: Do you have an example of a valid server response with the corresponding HWID?If you send 9A979599C66D9D9D996E9F9A20203356300 returned value is OK|User|703
Can you send it?
I think there is something done with second part of that number (20203356300), because first part even if I change in my register it still works.
RE: Decompiled VB6 code - need help with finding what it calculates - John Doe 5726 - Oct 30, 2018
(Oct 30, 2018 02:31 AM)Kufe Wrote: If you send 9A979599C66D9D9D996E9F9A20203356300 returned value is OK|User|703
I think there is something done with second part of that number (20203356300), because first part even if I change in my register it still works.
When you try with your hijacked server response and another PC, the number 703 does not work, right?
RE: Decompiled VB6 code - need help with finding what it calculates - Kufe - Oct 30, 2018
It does work.
Also 65976A69686C686365686C6639573726000 correct returned number is 1149.
Also same number for 686C6070626D689B966B9B9439573726000, so I guess the only important part of number where 1149 is generated is 39573726000.
RE: Decompiled VB6 code - need help with finding what it calculates - John Doe 5726 - Oct 30, 2018
(Oct 30, 2018 03:35 AM)Kufe Wrote: It does work.
Also 65976A69686C686365686C6639573726000 correct returned number is 1149.
Also same number for 686C6070626D689B966B9B9439573726000, so I guess the only important part of number where 1149 is generated is 39573726000.
So what is the problem if it does work?
What could that value be?
Does the program have an expiration date? Several plans for which features are locked/unlocked?
RE: Decompiled VB6 code - need help with finding what it calculates - vercenta - Oct 30, 2018
just find out what is accessing the memory of 703
RE: Decompiled VB6 code - need help with finding what it calculates - Kufe - Oct 30, 2018
(Oct 30, 2018 03:41 AM)John Doe 5726 Wrote: So what is the problem if it does work?
What could that value be?
Does the program have an expiration date? Several plans for which features are locked/unlocked?
When it works all is fine. I'm not sure if there is any expiration date - probably not. I just can't figure out how it calculates this number.
(Oct 30, 2018 03:41 AM)Lost Doggy Wrote: just find out what is accessing the memory of 703
How can I do that? I posted code in my first post, but the problem is that I don't know how app checks value if it's correct when it gets it.
RE: Decompiled VB6 code - need help with finding what it calculates - John Doe 5726 - Oct 30, 2018
(Oct 30, 2018 03:46 AM)Kufe Wrote: When it works all is fine. I'm not sure if there is any expiration date - probably not. I just can't figure out how it calculates this number.
How can I do that? I posted code in my first post, but the problem is that I don't know how app checks value if it's correct when it gets it.
I'm not on x86 so I can't spin up a Windows VM and debug your app, so you want to figure out what the value is when the program already works?
RE: Decompiled VB6 code - need help with finding what it calculates - Kufe - Oct 30, 2018
Yes, I want to know how app does the check, so 3. returned web parameter (1st and 2nd are not important) is received (example: 1149) and than app does the check. If it's wrong number (example: any other number as 1149) it displays error, if it's correct number it displays Welcome message. And from looking the code it has to be generated by second part of HW ID (example 39573726000) - it's information from disk if I am correct (first part if generated by register MachineGuid value - but I changed that and app still worked while checking the returned number).
RE: Decompiled VB6 code - need help with finding what it calculates - vercenta - Oct 30, 2018
maybe 703 isn't that relevant lol?? doesn't seem to serve too much purpose of security
if the program accepted 703 two weeks ago and it does still today then it's probably fine
RE: Decompiled VB6 code - need help with finding what it calculates - Kufe - Oct 30, 2018
(Oct 30, 2018 03:59 AM)Lost Doggy Wrote: maybe 703 isn't that relevant lol?? doesn't seem to serve too much purpose of security
if the program accepted 703 two weeks ago and it does still today then it's probably fine
Each computer gets different number returned. It's based on sent HWID.
RE: Decompiled VB6 code - need help with finding what it calculates - vercenta - Oct 30, 2018
do 0-65535 until it works ; )