The old game is suitable for beginners to practice, nothing encrypted.
As usual, look for main first, the logic is all in there.
code
Find the corresponding string.
jz to jmp to bypass detection.
Second warning
xref lookup (insert_disc is this string)
stuck in a loop, so return 1 directly
The test game is now ready to run.
Some summary.
Blasting generally gives priority to modifying the non-library functions called within if to
The reasons are as follows.
- there may be an error popup in the function, messageboxA and then return 0, trigger if(! return ), the program exits. So it is safest to kill the whole function.
- If the function call is removed, i.e. call is changed to nop * N, eax (the register where the return value is stored) will be difficult to solve, and the front stack needs to be removed manually. (Stack balancing)
Exceptions.
- judgment function is, for example, strcmp, that modify the trouble (write empty function and then manually change a little annoying), then take out if judgment (that is, jz/jnz changed to jmp/nop, depending on the branch) to see the decompile after the change, whether it is correct.
- determine the function internal incidentally initialized something. For example, read the registry. Another bunch of things written in the registry, namely environment variables. That.... It is not recommended to crack this kind of up, directly modify the registry is simpler. If you have to crack it, you can manually replace the return value of the RegQuery-related function with the path/value written in the text paragraph, and then assign it to the corresponding variable. The amount of work is much more than a simple jump.
某些 gal 会把存放在 Document 里，这个函数也许有用。
https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulefilenamea
适合逆向的：
强制从光盘启动 / 强制插光盘
原因：不会缺失信息。信息都在硬盘上。
新手流程：去壳（老 gal 一般没壳），找报错字符串，找调用点，看 return，判断如何修改并爆破，patch 回去确认效果。
发现学了逆向让我对汇编理解加深
然后深入理解了 c/cpp（
以及一部分 rust（
比如为什么 rs 默认 &str / String
因为 str 编译后在 .data 段，那是指针去指（
为什么返回 String，不然就寄了（，因为栈会弹掉。
包括 eax 寄存器（
mov eax，1 ret
爆破专用
