rendered paste bodyThe relocated code in the SecuROM section is this:
00db2ebd (05) 68 bbcb4a00 PUSH 0x4acbbb
00db2ec2 (05) e8 598ba4ff CALL 0x7fba20
00db2ec7 (01) 90 NOP
00db2ec8 (01) 50 PUSH EAX
00db2ec9 (01) 9c PUSHF
00db2eca (01) 53 PUSH EBX
00db2ecb (01) 9c PUSHF
00db2ecc (06) 8b1d 202ddb00 MOV EBX, [0xdb2d20]
00db2ed2 (01) 51 PUSH ECX
00db2ed3 (06) 8b0d 58014000 MOV ECX, [0x400158]
00db2ed9 (02) d3c3 ROL EBX, CL
00db2edb (01) 59 POP ECX
00db2edc (01) 9d POPF
00db2edd (03) 871c24 XCHG [ESP], EBX
00db2ee0 (01) 90 NOP
00db2ee1 (01) 54 PUSH ESP
00db2ee2 (05) 68 702cdb00 PUSH 0xdb2c70
00db2ee7 (05) b8 b983dae8 MOV EAX, 0xe8da83b9
00db2eec (01) 90 NOP
00db2eed (05) 35 590a82e8 XOR EAX, 0xe8820a59
00db2ef2 (01) 90 NOP
00db2ef3 (01) eb DB 0xeb
00db2ef4 (02) ffd0 CALL EAX
00db2ef6 (01) 57 PUSH EDI
00db2ef7 (04) 8b7c24 04 MOV EDI, [ESP+0x4]
00db2efb (02) 03c7 ADD EAX, EDI
00db2efd (04) 894424 04 MOV [ESP+0x4], EAX
00db2f01 (01) 5f POP EDI
00db2f02 (01) 90 NOP
00db2f03 (01) 58 POP EAX
00db2f04 (03) c1e9 00 SHR ECX, 0x0
00db2f07 (01) 9d POPF
00db2f08 (03) 870424 XCHG [ESP], EAX
00db2f0b (02) 6a 00 PUSH 0x0
00db2f0d (04) 8d4424 08 LEA EAX, [ESP+0x8]
00db2f11 (01) 50 PUSH EAX
00db2f12 (03) ff51 0c CALL [ECX+0xc]
00db2f15 (03) 8d1424 LEA EDX, [ESP]
00db2f18 (01) 52 PUSH EDX
00db2f19 (08) c74424 04 40000000 MOV DWORD [ESP+0x4], 0x40
00db2f21 (05) 68 8bcb4a00 PUSH 0x4acb8b
00db2f26 (01) 90 NOP
00db2f27 (01) 90 NOP
00db2f28 (05) 68 674ca66e PUSH 0x6ea64c67
00db2f2d (01) 9c PUSHF
00db2f2e (08) 817424 04 47f6d96e XOR DWORD [ESP+0x4], 0x6ed9f647
00db2f36 (01) 90 NOP
00db2f37 (01) 9d POPF
00db2f38 (01) 58 POP EAX
00db2f39 (02) ffd0 CALL EAX
00db2f3b (02) 85c0 TEST EAX, EAX
00db2f3d (02) 74 5a JZ 0xdb2f99
00db2f3f (04) 8b4424 08 MOV EAX, [ESP+0x8]
00db2f43 (04) 8b4c24 0c MOV ECX, [ESP+0xc]
00db2f47 (04) 0facc8 14 SHRD EAX, ECX, 0x14
00db2f4b (03) c1e9 14 SHR ECX, 0x14
00db2f4e (01) 50 PUSH EAX
00db2f4f (01) 50 PUSH EAX
00db2f50 (02) 8bff MOV EDI, EDI
00db2f52 (05) b8 f09d5800 MOV EAX, 0x589df0
00db2f57 (03) c1e5 00 SHL EBP, 0x0
00db2f5a (01) 54 PUSH ESP
00db2f5b (05) 68 9f2cdb00 PUSH 0xdb2c9f
00db2f60 (02) ffd0 CALL EAX
00db2f62 (02) 8d00 LEA EAX, [EAX]
00db2f64 (04) 394424 04 CMP [ESP+0x4], EAX
00db2f68 (01) 58 POP EAX
00db2f69 (01) 58 POP EAX
00db2f6a (02) 76 3e JBE 0xdb2faa
00db2f6c (04) 8b5424 18 MOV EDX, [ESP+0x18]
00db2f70 (04) 8b4c24 1c MOV ECX, [ESP+0x1c]
00db2f74 (04) 0facca 14 SHRD EDX, ECX, 0x14
00db2f78 (05) 68 cbcb4a00 PUSH 0x4acbcb
00db2f7d (05) e8 9e8aa4ff CALL 0x7fba20
00db2f82 (03) c1e9 14 SHR ECX, 0x14
00db2f85 (01) 50 PUSH EAX
00db2f86 (05) b8 e0895800 MOV EAX, 0x5889e0
00db2f8b (01) 54 PUSH ESP
00db2f8c (01) 90 NOP
00db2f8d (05) 68 c92cdb00 PUSH 0xdb2cc9
00db2f92 (02) ffd0 CALL EAX
00db2f94 (02) 3bd0 CMP EDX, EAX
00db2f96 (01) 58 POP EAX
00db2f97 (02) 76 11 JBE 0xdb2faa
00db2f99 (05) 68 dbcb4a00 PUSH 0x4acbdb
00db2f9e (05) e8 7d8aa4ff CALL 0x7fba20
00db2fa3 (06) 81c4 40030000 ADD ESP, 0x340
00db2fa9 (01) c3 RET
00db2faa (01) 56 PUSH ESI
00db2fab (01) 57 PUSH EDI
00db2fac (01) 50 PUSH EAX
00db2fad (01) 9c PUSHF
00db2fae (03) 8d6d 00 LEA EBP, [EBP+0x0]
00db2fb1 (05) b8 908b5800 MOV EAX, 0x588b90
00db2fb6 (01) 54 PUSH ESP
00db2fb7 (05) 68 242ddb00 PUSH 0xdb2d24
00db2fbc (02) ffd0 CALL EAX
00db2fbe (01) 9d POPF
00db2fbf (03) c1ef 00 SHR EDI, 0x0
00db2fc2 (03) 870424 XCHG [ESP], EAX
00db2fc5 (05) 68 9bcb4a00 PUSH 0x4acb9b
00db2fca (01) 9c PUSHF
00db2fcb (06) 8d05 70a8a749 LEA EAX, [0x49a7a870]
00db2fd1 (05) 35 5012d849 XOR EAX, 0x49d81250
00db2fd6 (01) 9d POPF
00db2fd7 (02) ffd0 CALL EAX
00db2fd9 (05) 68 ebcb4a00 PUSH 0x4acbeb
00db2fde (05) e8 3d8aa4ff CALL 0x7fba20
00db2fe3 (05) 68 00010000 PUSH 0x100
00db2fe8 (04) 8d5424 4c LEA EDX, [ESP+0x4c]
00db2fec (01) 52 PUSH EDX
00db2fed (05) 68 fbcb4a00 PUSH 0x4acbfb
00db2ff2 (05) e8 298aa4ff CALL 0x7fba20
00db2ff7 (05) 68 17080000 PUSH 0x817
00db2ffc (01) 56 PUSH ESI
00db2ffd (02) ffd7 CALL EDI
00db2fff (02) 85c0 TEST EAX, EAX
00db3001 (02) 74 7e JZ 0xdb3081
00db3003 (01) 50 PUSH EAX
00db3004 (01) 9c PUSHF
00db3005 (05) 68 4ae4ec07 PUSH 0x7ece44a
00db300a (03) 8d6d 00 LEA EBP, [EBP+0x0]
00db300d (03) 83ec 04 SUB ESP, 0x4
00db3010 (07) c70424 55a96d10 MOV DWORD [ESP], 0x106da955
00db3017 (05) 68 f55ced5a PUSH 0x5aed5cf5
00db301c (01) 54 PUSH ESP
00db301d (05) 68 512ddb00 PUSH 0xdb2d51
00db3022 (03) c1ee 00 SHR ESI, 0x0
00db3025 (05) 68 d81fa724 PUSH 0x24a71fd8
00db302a (07) 813424 3896ff24 XOR DWORD [ESP], 0x24ff9638
00db3031 (01) 58 POP EAX
00db3032 (01) 90 NOP
00db3033 (02) ffd0 CALL EAX
00db3035 (01) 90 NOP
00db3036 (03) c1e9 00 SHR ECX, 0x0
00db3039 (01) 51 PUSH ECX
00db303a (03) c1fa 00 SAR EDX, 0x0
00db303d (04) 8b4c24 04 MOV ECX, [ESP+0x4]
00db3041 (02) 2bc1 SUB EAX, ECX
00db3043 (02) 8bc8 MOV ECX, EAX
00db3045 (01) 56 PUSH ESI
00db3046 (04) 8b7424 0c MOV ESI, [ESP+0xc]
00db304a (03) c1fb 00 SAR EBX, 0x0
00db304d (02) 33ce XOR ECX, ESI
00db304f (02) 8bf1 MOV ESI, ECX
00db3051 (01) 52 PUSH EDX
00db3052 (04) 8b5424 14 MOV EDX, [ESP+0x14]
00db3056 (02) 03f2 ADD ESI, EDX
00db3058 (01) 90 NOP
00db3059 (04) 897424 14 MOV [ESP+0x14], ESI
00db305d (01) 5a POP EDX
00db305e (03) c1e9 00 SHR ECX, 0x0
00db3061 (01) 5e POP ESI
00db3062 (01) 59 POP ECX
00db3063 (03) c1ea 00 SHR EDX, 0x0
00db3066 (01) 58 POP EAX
00db3067 (01) 58 POP EAX
00db3068 (01) 58 POP EAX
00db3069 (01) 9d POPF
00db306a (03) 870424 XCHG [ESP], EAX
00db306d (07) 8d8424 4c010000 LEA EAX, [ESP+0x14c]
00db3074 (01) 50 PUSH EAX
00db3075 (05) 68 18080000 PUSH 0x818
00db307a (01) 56 PUSH ESI
00db307b (02) ffd7 CALL EDI
00db307d (02) 85c0 TEST EAX, EAX
00db307f (02) 75 13 JNZ 0xdb3094
00db3081 (01) 5f POP EDI
00db3082 (05) 68 0bcc4a00 PUSH 0x4acc0b
00db3087 (05) e8 9489a4ff CALL 0x7fba20
00db308c (01) 5e POP ESI
00db308d (06) 81c4 40030000 ADD ESP, 0x340
00db3093 (01) c3 RET
00db3094 (01) 50 PUSH EAX
00db3095 (01) 90 NOP
00db3096 (01) 9c PUSHF
00db3097 (05) b8 ec3b9718 MOV EAX, 0x18973bec
00db309c (01) 54 PUSH ESP
00db309d (01) 90 NOP
00db309e (05) 68 7f2ddb00 PUSH 0xdb2d7f
00db30a3 (05) 35 1ca6cf18 XOR EAX, 0x18cfa61c
00db30a8 (03) c1e8 00 SHR EAX, 0x0
00db30ab (02) ffd0 CALL EAX
00db30ad (01) 9d POPF
00db30ae (03) 870424 XCHG [ESP], EAX
00db30b1 (04) 8d4c24 4c LEA ECX, [ESP+0x4c]
00db30b5 (01) 51 PUSH ECX
00db30b6 (07) 8d9424 50010000 LEA EDX, [ESP+0x150]
00db30bd (01) 52 PUSH EDX
00db30be (02) 6a 00 PUSH 0x0
00db30c0 (05) 68 abcb4a00 PUSH 0x4acbab
00db30c5 (01) 9c PUSHF
00db30c6 (05) b8 d7eb166a MOV EAX, 0x6a16ebd7
00db30cb (05) 35 f751696a XOR EAX, 0x6a6951f7
00db30d0 (01) 9d POPF
00db30d1 (01) eb DB 0xeb
00db30d2 (02) ffd0 CALL EAX
00db30d4 (05) e9 909b6fff JMP 0x4acc69
This is the code as it looks after SecuROM has molested it.
We were impressed that ViTALiTY was able to crack an executable with this feature so we
decided to take a closer look.
OH MY GOD!
004ACB80 B8 00000000 MOV EAX,0
004ACB85 C3 RETN
What a sophisticated fix. Seems ViTALiTY have decided that this
routine is not important and since they were unable to rebuild the
original code they simply inserted a "MOV EAX,0; RETN" which means
that the entire routine is now disabled.