Die wichtigsten Bps^^
RegQueryValueExA
getdlgitemtexta
getwindowtexta
lstrcmpA
GETWINDOWSLONG
vbaStrCmp
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
WritePrivateProfileIntA
messageboxa
CreateWindowEX
destroywindow
getlocaltime" und "gettickcount" calls, die werden gern benutzt um 'ne trial rückwärts zu zählen.
eine andere möglichkeit ist die trialzeit in milisekunden umzurechenen und nach dem wert zu suchen...
z.B. push 1000h = 1000 millisekunden = 1 sekunde
3000 dec = 3 Sekunden.
0BB8 hex = 3 Sekunden.
Reading & Writing Files
-----------------------
These are generic calls to read/write to a file, usually binary in nature:
ReadFile
WriteFile
more on locating file accesses:
SetFilePointer
GetSystemDirectory
GetSystemDirectoryA
These are the most common calls to read/write from/to a *.ini file
or a file of similar format.
for 16-bit win apps:
GetPrivateProfileString
GetPrivateProfileInt
WritePrivateProfileString
WritePrivateProfileInt
for 32-bit win apps:
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
WritePrivateProfileIntA
Interrupt info:
_____________
file accesses (A couple by YOSHi)
bpint 21 if (ah==3d)
bpint 2f if (ah==01)
The Registry
------------
Create or delete a new key in the registry:
RegCreateKey
RegDeleteKey
RegCreateKeyA
RegDeleteKeyA
Read a value from the currently open registry key:
RegQueryValue
RegQueryValueA
Open or close a registry key:
RegCloseKey
RegOpenKey
RegCloseKeyA
RegOpenKeyA
Dialog Boxes
------------
Get text or integer from a dialog box edit:
GetWindowText
GetDlgItemText
GetWindowTextA
GetDlgItemTextA
GetDlgItemInt
Open a message box, usually one that says "invalid registration":
MessageBox
MessageBoxA
MessageBoxExA
MessageBeep
and other ways to display text...
SENDMESSAGE
WSPRINTF
Time & Date
-----------
These get the time and date
GetSystemTime
GetLocalTime
SystemTimeToFileTime
oder GetTickCount
Generating a Window
---------------------
createwindow
createwindowexa
showwindow
bitblt (a type of memory move, similar to hmemcpy)
CD-ROM Calls (Donated by: +-=Riddler=-+)
----------------
GetDriveType (if eax=5 then it is a cdrom check)
GetDriveTypeA
GetDriveType Return Function codes:
Value Meaning
0 Drive Cannot Be determined
1 Root Dir Does not exist
2 DriveRemoveable
3 A Fixed Disk (HardDrive)
4 Remote Drive(Network)
5 Cd-Rom Drive
6 RamDisk
GetLogicalDrives
GetLogicalDrivesA
GetLogicalDriveStrings
GetLogicalDriveStringsA
OTHER CDROM INFORMATION
Wen man kein error message bekommt mal versuchen auf fvbaStrCmp zu Breaken!
fvbaStrCmp
fvbaStrCmp
showwindow
showwindow
Delphi programme!
destroywindow
bei delphi startnags is destroywindow immer nen netter breakpoint.
CreateWindowEX
CreateWindowEX
Such im Olly nach der bad Meldung.
Du findest darüber einen JNZ, und darüber einen Call in dem in ca.90%aller Fälle die ser**al Routine stattfindet.
In den gehst du rein (rechte Maustaste Follow).
Du findest einen push ebp und setzt nen BP drauf(Breakpoint).
Nun startest du das Prog, gibst deine Daten ein(Einzelplatz Lizenz), und Olly breakt.
Nun stepst du mit F8 durch den Code(beachte rechts oben das Fensterlein im Olly), und bald hast du die Trophäe!
CreateWindowEX
destroywindow
getlocaltime" und "gettickcount" calls, die werden gern benutzt um 'ne trial rückwärts zu zählen.
eine andere möglichkeit ist die trialzeit in milisekunden umzurechenen und nach dem wert zu suchen...
z.B. push 1000h = 1000 millisekunden = 1 sekunde
3000 dec = 3 Sekunden.
0BB8 hex = 3 Sekunden.
1) Data Type Conversion:
i) __vbaI2Str Converts a String to Byte or Integer
ii)__vbaI4Str Converts a String to Long
iii)__vbar4Str Converts a String to Single
iv)__vbar8Str Converts a String to Double
v) VarCyFromStr (for VB6. You have to have OLEAUT32.DLL in your WINICE.DAT)String to Currency
vi) VarBstrFromI2 (for VB6. You have to have OLEAUT32.DLL in your WINICE.DAT)Integer to String:
2) Moving Data
i) __vbaStrCopy - Copies a String to memory - same as Windows' API HMEMCPY
ii) __vbaVarCopy - Copies a Variant to memory
iii) __vbaVarMove - Copies a Variant to memory
3) Mathematical
i) __vbavaradd - Add two Variants
ii) __vbavarsub - Subtract two Variants
iii) __vbavarmul - Multiply two Variants
iv) __vbavaridiv - Divide two Variants to get an Integer
v) __vbavarxor - XOR
4) Miscellaneous
i) __vbavarfornext - Used in codes where there is a For... Next... Statement (Loop)
ii) __vbafreestr
iii) __vbafreeobj
iv) __vbastrvarval - Get the value from a specific location in a String
v) multibytetowidechar
vi) rtcMsgBox - Shows the message box - same as Windows' API messagebox/a/exa
vii) __vbavarcat - Joins 2 Variants together
viii) __vbafreevar
ix) __vbaobjset
x) __vbaLenBstr - Gets string length
xi) rtcInputBox - Shows a Visual Basic Input Box - same as window's API getwindowtext/a, GetDlgItemtext/a
xii) __vbaNew - shows a dialogue box - same as Windows' API Dialogbox
xiii) __vbaNew2 - shows a dialogue box - same as Windows' API Dialogboxparam/a
xiv) rtcTrimBstr - trims a string
5) Comparisons
i) __vbastrcomp - Compares two strings - Same as Window's API lstrcmp
ii) __vbastrcmp - Compares two strings - Same as Window's API lstrcmp
iii) __vbavartsteq - Compares two variants
iv)__vbaFpCmpCy - Compares Floating point to currency. sp; - Compares Floating point to currency
![[HaBo]](/styles/default/logoklein.png){kind=small}
