The relocated code in the SecuROM section is this: 00db2ebd (05) 68 bbcb4a00 PUSH 0x4acbbb 00db2ec2 (05) e8 598ba4ff CALL 0x7fba20 00db2ec7 (01) 90 NOP 00db2ec8 (01) 50 PUSH EAX 00db2ec9 (01) 9c PUSHF 00db2eca (01) 53 PUSH EBX 00db2ecb (01) 9c PUSHF 00db2ecc (06) 8b1d 202ddb00 MOV EBX, [0xdb2d20] 00db2ed2 (01) 51 PUSH ECX 00db2ed3 (06) 8b0d 58014000 MOV ECX, [0x400158] 00db2ed9 (02) d3c3 ROL EBX, CL 00db2edb (01) 59 POP ECX 00db2edc (01) 9d POPF 00db2edd (03) 871c24 XCHG [ESP], EBX 00db2ee0 (01) 90 NOP 00db2ee1 (01) 54 PUSH ESP 00db2ee2 (05) 68 702cdb00 PUSH 0xdb2c70 00db2ee7 (05) b8 b983dae8 MOV EAX, 0xe8da83b9 00db2eec (01) 90 NOP 00db2eed (05) 35 590a82e8 XOR EAX, 0xe8820a59 00db2ef2 (01) 90 NOP 00db2ef3 (01) eb DB 0xeb 00db2ef4 (02) ffd0 CALL EAX 00db2ef6 (01) 57 PUSH EDI 00db2ef7 (04) 8b7c24 04 MOV EDI, [ESP+0x4] 00db2efb (02) 03c7 ADD EAX, EDI 00db2efd (04) 894424 04 MOV [ESP+0x4], EAX 00db2f01 (01) 5f POP EDI 00db2f02 (01) 90 NOP 00db2f03 (01) 58 POP EAX 00db2f04 (03) c1e9 00 SHR ECX, 0x0 00db2f07 (01) 9d POPF 00db2f08 (03) 870424 XCHG [ESP], EAX 00db2f0b (02) 6a 00 PUSH 0x0 00db2f0d (04) 8d4424 08 LEA EAX, [ESP+0x8] 00db2f11 (01) 50 PUSH EAX 00db2f12 (03) ff51 0c CALL [ECX+0xc] 00db2f15 (03) 8d1424 LEA EDX, [ESP] 00db2f18 (01) 52 PUSH EDX 00db2f19 (08) c74424 04 40000000 MOV DWORD [ESP+0x4], 0x40 00db2f21 (05) 68 8bcb4a00 PUSH 0x4acb8b 00db2f26 (01) 90 NOP 00db2f27 (01) 90 NOP 00db2f28 (05) 68 674ca66e PUSH 0x6ea64c67 00db2f2d (01) 9c PUSHF 00db2f2e (08) 817424 04 47f6d96e XOR DWORD [ESP+0x4], 0x6ed9f647 00db2f36 (01) 90 NOP 00db2f37 (01) 9d POPF 00db2f38 (01) 58 POP EAX 00db2f39 (02) ffd0 CALL EAX 00db2f3b (02) 85c0 TEST EAX, EAX 00db2f3d (02) 74 5a JZ 0xdb2f99 00db2f3f (04) 8b4424 08 MOV EAX, [ESP+0x8] 00db2f43 (04) 8b4c24 0c MOV ECX, [ESP+0xc] 00db2f47 (04) 0facc8 14 SHRD EAX, ECX, 0x14 00db2f4b (03) c1e9 14 SHR ECX, 0x14 00db2f4e (01) 50 PUSH EAX 00db2f4f (01) 50 PUSH EAX 00db2f50 (02) 8bff MOV EDI, EDI 00db2f52 (05) b8 f09d5800 MOV EAX, 0x589df0 00db2f57 (03) c1e5 00 SHL EBP, 0x0 00db2f5a (01) 54 PUSH ESP 00db2f5b (05) 68 9f2cdb00 PUSH 0xdb2c9f 00db2f60 (02) ffd0 CALL EAX 00db2f62 (02) 8d00 LEA EAX, [EAX] 00db2f64 (04) 394424 04 CMP [ESP+0x4], EAX 00db2f68 (01) 58 POP EAX 00db2f69 (01) 58 POP EAX 00db2f6a (02) 76 3e JBE 0xdb2faa 00db2f6c (04) 8b5424 18 MOV EDX, [ESP+0x18] 00db2f70 (04) 8b4c24 1c MOV ECX, [ESP+0x1c] 00db2f74 (04) 0facca 14 SHRD EDX, ECX, 0x14 00db2f78 (05) 68 cbcb4a00 PUSH 0x4acbcb 00db2f7d (05) e8 9e8aa4ff CALL 0x7fba20 00db2f82 (03) c1e9 14 SHR ECX, 0x14 00db2f85 (01) 50 PUSH EAX 00db2f86 (05) b8 e0895800 MOV EAX, 0x5889e0 00db2f8b (01) 54 PUSH ESP 00db2f8c (01) 90 NOP 00db2f8d (05) 68 c92cdb00 PUSH 0xdb2cc9 00db2f92 (02) ffd0 CALL EAX 00db2f94 (02) 3bd0 CMP EDX, EAX 00db2f96 (01) 58 POP EAX 00db2f97 (02) 76 11 JBE 0xdb2faa 00db2f99 (05) 68 dbcb4a00 PUSH 0x4acbdb 00db2f9e (05) e8 7d8aa4ff CALL 0x7fba20 00db2fa3 (06) 81c4 40030000 ADD ESP, 0x340 00db2fa9 (01) c3 RET 00db2faa (01) 56 PUSH ESI 00db2fab (01) 57 PUSH EDI 00db2fac (01) 50 PUSH EAX 00db2fad (01) 9c PUSHF 00db2fae (03) 8d6d 00 LEA EBP, [EBP+0x0] 00db2fb1 (05) b8 908b5800 MOV EAX, 0x588b90 00db2fb6 (01) 54 PUSH ESP 00db2fb7 (05) 68 242ddb00 PUSH 0xdb2d24 00db2fbc (02) ffd0 CALL EAX 00db2fbe (01) 9d POPF 00db2fbf (03) c1ef 00 SHR EDI, 0x0 00db2fc2 (03) 870424 XCHG [ESP], EAX 00db2fc5 (05) 68 9bcb4a00 PUSH 0x4acb9b 00db2fca (01) 9c PUSHF 00db2fcb (06) 8d05 70a8a749 LEA EAX, [0x49a7a870] 00db2fd1 (05) 35 5012d849 XOR EAX, 0x49d81250 00db2fd6 (01) 9d POPF 00db2fd7 (02) ffd0 CALL EAX 00db2fd9 (05) 68 ebcb4a00 PUSH 0x4acbeb 00db2fde (05) e8 3d8aa4ff CALL 0x7fba20 00db2fe3 (05) 68 00010000 PUSH 0x100 00db2fe8 (04) 8d5424 4c LEA EDX, [ESP+0x4c] 00db2fec (01) 52 PUSH EDX 00db2fed (05) 68 fbcb4a00 PUSH 0x4acbfb 00db2ff2 (05) e8 298aa4ff CALL 0x7fba20 00db2ff7 (05) 68 17080000 PUSH 0x817 00db2ffc (01) 56 PUSH ESI 00db2ffd (02) ffd7 CALL EDI 00db2fff (02) 85c0 TEST EAX, EAX 00db3001 (02) 74 7e JZ 0xdb3081 00db3003 (01) 50 PUSH EAX 00db3004 (01) 9c PUSHF 00db3005 (05) 68 4ae4ec07 PUSH 0x7ece44a 00db300a (03) 8d6d 00 LEA EBP, [EBP+0x0] 00db300d (03) 83ec 04 SUB ESP, 0x4 00db3010 (07) c70424 55a96d10 MOV DWORD [ESP], 0x106da955 00db3017 (05) 68 f55ced5a PUSH 0x5aed5cf5 00db301c (01) 54 PUSH ESP 00db301d (05) 68 512ddb00 PUSH 0xdb2d51 00db3022 (03) c1ee 00 SHR ESI, 0x0 00db3025 (05) 68 d81fa724 PUSH 0x24a71fd8 00db302a (07) 813424 3896ff24 XOR DWORD [ESP], 0x24ff9638 00db3031 (01) 58 POP EAX 00db3032 (01) 90 NOP 00db3033 (02) ffd0 CALL EAX 00db3035 (01) 90 NOP 00db3036 (03) c1e9 00 SHR ECX, 0x0 00db3039 (01) 51 PUSH ECX 00db303a (03) c1fa 00 SAR EDX, 0x0 00db303d (04) 8b4c24 04 MOV ECX, [ESP+0x4] 00db3041 (02) 2bc1 SUB EAX, ECX 00db3043 (02) 8bc8 MOV ECX, EAX 00db3045 (01) 56 PUSH ESI 00db3046 (04) 8b7424 0c MOV ESI, [ESP+0xc] 00db304a (03) c1fb 00 SAR EBX, 0x0 00db304d (02) 33ce XOR ECX, ESI 00db304f (02) 8bf1 MOV ESI, ECX 00db3051 (01) 52 PUSH EDX 00db3052 (04) 8b5424 14 MOV EDX, [ESP+0x14] 00db3056 (02) 03f2 ADD ESI, EDX 00db3058 (01) 90 NOP 00db3059 (04) 897424 14 MOV [ESP+0x14], ESI 00db305d (01) 5a POP EDX 00db305e (03) c1e9 00 SHR ECX, 0x0 00db3061 (01) 5e POP ESI 00db3062 (01) 59 POP ECX 00db3063 (03) c1ea 00 SHR EDX, 0x0 00db3066 (01) 58 POP EAX 00db3067 (01) 58 POP EAX 00db3068 (01) 58 POP EAX 00db3069 (01) 9d POPF 00db306a (03) 870424 XCHG [ESP], EAX 00db306d (07) 8d8424 4c010000 LEA EAX, [ESP+0x14c] 00db3074 (01) 50 PUSH EAX 00db3075 (05) 68 18080000 PUSH 0x818 00db307a (01) 56 PUSH ESI 00db307b (02) ffd7 CALL EDI 00db307d (02) 85c0 TEST EAX, EAX 00db307f (02) 75 13 JNZ 0xdb3094 00db3081 (01) 5f POP EDI 00db3082 (05) 68 0bcc4a00 PUSH 0x4acc0b 00db3087 (05) e8 9489a4ff CALL 0x7fba20 00db308c (01) 5e POP ESI 00db308d (06) 81c4 40030000 ADD ESP, 0x340 00db3093 (01) c3 RET 00db3094 (01) 50 PUSH EAX 00db3095 (01) 90 NOP 00db3096 (01) 9c PUSHF 00db3097 (05) b8 ec3b9718 MOV EAX, 0x18973bec 00db309c (01) 54 PUSH ESP 00db309d (01) 90 NOP 00db309e (05) 68 7f2ddb00 PUSH 0xdb2d7f 00db30a3 (05) 35 1ca6cf18 XOR EAX, 0x18cfa61c 00db30a8 (03) c1e8 00 SHR EAX, 0x0 00db30ab (02) ffd0 CALL EAX 00db30ad (01) 9d POPF 00db30ae (03) 870424 XCHG [ESP], EAX 00db30b1 (04) 8d4c24 4c LEA ECX, [ESP+0x4c] 00db30b5 (01) 51 PUSH ECX 00db30b6 (07) 8d9424 50010000 LEA EDX, [ESP+0x150] 00db30bd (01) 52 PUSH EDX 00db30be (02) 6a 00 PUSH 0x0 00db30c0 (05) 68 abcb4a00 PUSH 0x4acbab 00db30c5 (01) 9c PUSHF 00db30c6 (05) b8 d7eb166a MOV EAX, 0x6a16ebd7 00db30cb (05) 35 f751696a XOR EAX, 0x6a6951f7 00db30d0 (01) 9d POPF 00db30d1 (01) eb DB 0xeb 00db30d2 (02) ffd0 CALL EAX 00db30d4 (05) e9 909b6fff JMP 0x4acc69 This is the code as it looks after SecuROM has molested it. We were impressed that ViTALiTY was able to crack an executable with this feature so we decided to take a closer look. OH MY GOD! 004ACB80 B8 00000000 MOV EAX,0 004ACB85 C3 RETN What a sophisticated fix. Seems ViTALiTY have decided that this routine is not important and since they were unable to rebuild the original code they simply inserted a "MOV EAX,0; RETN" which means that the entire routine is now disabled.