OLLYDBG FOR 64 BIT PROGRAM HOW TO
OLLYDBG FOR 64 BIT PROGRAM 32 BIT
OLLYDBG FOR 64 BIT PROGRAM CODE

Lets follow the code (step over, f8):Īs you can see, the jump (JE) wasn’t hit and we are going to execute the function located at 0x13F169968. This usually means the function we are in is inside a thread, which matches the behaviour of the nag screen. If you put a breakpoint on there and resume (F9) the program, you notice that the breakpoint is actually getting hit within a second. Okay, lets get back to our only useful find: It could be some testing code or just there to brainfuck reversers but as long as the code won’t get executed we can leave it there and have no worries about it. If tried figuring out what that function is used for, but I noticed it isn’t executed at all. You might already have seen due the bytes between the last 2 addresses are minimal that they are really close to eachother: Although we have 2 more strings to check, so lets continue. Note that the JE instruction jumps over a call, which could be the function where the nagscreen is located: call 13F169968. Oh! That looks alright, it seems like call 13F136D20 is the method to parse the license key, meaning that the JE 13F197D3B afterwards will decide whether the license is valid or not, interesting. This looks like the function is trying to find any of the allowed file formats. To move on, lets search for ‘rarkey’, these are my results (yours should be the same except for the addresses): This will pop up a list of all occuring strings in the WinRAR.exe module. Right click -> Search For -> String References. Lets take ‘rarkey.key’.Īttach your debugger to the WinRAR process and make sure you are in the winrar.exe module. This tells us the target hash multiple license formats, which we can and will exploit. So, I fired up Google and started looking for license keys and I found out that if you purchase a key, you will get a file named ‘rarkey.key’ or ‘rarreg.txt’. I couldn’t find any register form, just some buttons that led me to the purchase page.

OLLYDBG FOR 64 BIT PROGRAM 32 BIT

I’ll be using 圆4dbg, but if you are on 32 bit and you are using Olly the steps shouldn’t differ that much (the debuggers are very look a like).įirst, we start again by analyzing the target, I don’t really want to activate it as that would probably take a lot longer and besides, I just want to get rid of the nag screen. Olly can’t handle 64 bit applications and if you try to load the 64 bit WinRAR to Olly it will probably notice you about how it couldn’t load the file. Now 32 bit applications runs fine on 64 bit but not vice versa. WinRAR has a 32 and 64 bit installer, whereas the previous target (Internet Downloader Manager) only has a 32 bit installer. The reason different architectures (32/64bit) requires different debuggers is because of the distribution of our target. Ow if you are on 32bit you can use OllyDBG, if you are on 64bit you need to use another debugger. That’s why I decided to reverse engineer it and write a tutorial upon it. I was storing some files on my webserver and my WinRAR license was past its due date (like a really long time) and the nag screen annoyed me as fuck.

OLLYDBG FOR 64 BIT PROGRAM HOW TO

Today I’ll be showing you how to crack WinRAR. Advanced Ethical Hacking Institute in Pune

Ollydbg for 64 bit program