Grade 2 Session 4

BPK Keylogger Detector

http://www.blazingtools.com/bpk.html


---------------------------
Registration error
---------------------------
Registration code or user name is invalid. Please check all fields and try again!
---------------------------
OK
---------------------------

open Ollydbg as administrator
open Antispy.exe
Goto View--> Executable Modules
Select .exe file among all the files
run the app from the play button above
right click the screen
search for---> all referenced text string
right click --> search text
copy paste the error message
put the break point at the starting of the bracket of the error message
enter the UserName and Password
enter the breakpoint


EAX 0018EB1C ASCII "FWWKQINGUCOTNEXY"
ECX 0018EB2B
EDX 00000059
EBX 00000001
ESP 0018EB08
EBP 0018EB78
ESI 76B92B7A kernel32.lstrcatA
EDI 000502A0
EIP 00404A04 antispy.00404A04
C 0  ES 002B 32bit 0(FFFFFFFF)
P 1  CS 0023 32bit 0(FFFFFFFF)
A 0  SS 002B 32bit 0(FFFFFFFF)
Z 1  DS 002B 32bit 0(FFFFFFFF)
S 0  FS 0053 32bit 7EFDD000(FFF)
T 0  GS 002B 32bit 0(FFFFFFFF)
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00000246 (NO,NB,E,BE,NS,PE,GE,LE)
ST0 empty -??? FFFF 00000066 00660066
ST1 empty -??? FFFF 00000000 00083600
ST2 empty -??? FFFF 00000000 00010000
ST3 empty 301.99999324977397920
ST4 empty 1.0000000000000000000
ST5 empty 1.0000000000000000000
ST6 empty 16.000000000000000000
ST7 empty 16.000000000000000000
               3 2 1 0      E S P U O Z D I
FST 4020  Cond 1 0 0 0  Err 0 0 1 0 0 0 0 0  (EQ)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1



Key Is ---> FWWKQINGUCOTNEXY


YQ7XW-QPT6C-RRXC7-233QF-VF7TY --> mASTER Key For All XP only



SMAC --> MAC Changing/spoofing tool

https://smac.soft32.com/

---------------------------
SMAC 2.0
---------------------------
Invalid Registration ID.
---------------------------
OK
---------------------------


Text strings referenced in SMAC:.text, item 4818
 Address=0046709B
 Disassembly=PUSH SMAC.0042DD24
 Text string=UNICODE "200"


UNICODE "67BF-89E7-00E6-56C1-1F07"



Text strings referenced in SMAC:.text, item 4816
 Address=00466F4E
 Disassembly=MOV DWORD PTR SS:[EBP-E8],SMAC.00432498
 Text string=UNICODE "Invalid Registration ID."
Text strings referenced in SMAC:.text, item 5103
 Address=0048BCF6
 Disassembly=PUSH SMAC.00438AB8
 Text string=UNICODE "-375M-3932-563F-4967"
SMC2U

SMC2U-375M-3932-563F-4967




---------------------------
SMAC 2.0
---------------------------
Invalid Registration ID entered.
---------------------------
OK
---------------------------



004874EF   . C785 58FFFFFF >MOV DWORD PTR SS:[EBP-A8],SMAC.00438A48  ;  UNICODE "This product has been successfully registered."

004874EF




---------------------------
SMAC 2.0
---------------------------
This product has been modified and will shutdown.
---------------------------
OK
---------------------------



004874EF   C785 58FFFFFF 48>MOV DWORD PTR SS:[EBP-A8],SMAC01.00438A4>; UNICODE "This product has been successfully registered."