Hello and welcome back.
Now that we have already enabled the register button, we can try to register.
So we type in "user" and any random numbers.
When we hit Enter, we hit the register button.
We get this error message: "Wrong serial."
And then when you click OK, it gives us this nag.
So the next goal is to get rid of this—this nag over here.
So in order to do that, we need to open this program with -dbg and then search for where in the code
this nag comes from.
So just remember the string here: "Get rid."
We are going to search for this string in the -dbg.
So let's open our -dbg
now.
Let's close this.
And then open the crackme.
Me?
And then search for "Get rid."
So we right-click here, Search for > Current Module > String References.
And then we filter out the string
"Get rid."
And we found it here.
"Get rid of this."
So this is the one we want.
Let's go to that address by clicking on anywhere in this line.
And you will see that the string is found at this memory address.
And then just above it, we see a jump that can bypass it.
So could it be so simple that we can just do a surface patch to reverse this jump?
We can try.
So let's just put a breakpoint here to test it out. Toggle.
And now we run.
And then we come here. We enter any username and any number.
And we hit Register.
Hit OK.
It hits our breakpoint.
So now it hits our breakpoint.
We want to test whether or not we can just simply jump over this bad message.
So at the moment, if you click on this, you will see that jump is not taken.
That means it's not going to jump; it's going to go straight and show this bad message.
So in order to test to reverse this jump for testing purposes, before we patch it, we can toggle the
zero flag.
Now is zero.
So we toggle it to one.
So now it's going to jump over.
Jump is taken.
So let's step over.
So it has jumped over this bad message.
Let's jump over this call.
This is a call which shows this string.
So now we run all the way, and we come here and see we have successfully bypassed the bad message.
So now we can patch this to make it permanent.
So to patch this, we are going to reverse the jump.
So this is a jump equal.
We want it to jump irrespective of whatever condition.
So we can assemble a jump here—an unconditional jump.
So we can just put a comment just for our understanding.
"Jump this."
OK. Now we assemble a jump.
We press spacebar and convert this.
Make sure you check "Keep size" and "Fill with NOPs" in case the size is smaller.
After we assemble, so we put JMP.
And instruction—same size.
So we click OK.
And now we assemble the jump there, so we can patch it.
Now, File.
Patch File.
Patch, and then select it and give it a new name with "-1" at the back.
Click Save.
Click OK.
Now you can test it out.
We close everything and we try our new patch.
And there you go.
Our patch is running.
So now we open.
Now we key in our username and type in any password.
Hit Register, click OK, and the nag screen is gone.
So it is working.
So this is how we can do a surface patch to bypass—to get rid of a nag screen.
So that's all for this video.
I'll see you in the next one where we will solve the remaining challenges.
Thank you for watching.