Project VI Thursday, 04-Feb-99 15:33:56
It is clear that the program takes the registration number from the name you type in. Perhaps the number is created with the help of advapi32.dll, user32.dll or kernel32.dll because there are some processes that seems like being connected with it. program: Memory game 95 type of protection: name and code start program files used: windows\system\commdlg.dll windows\system\comdlg32.dll windows\system\winspool.drv windows\system\shell32.dll memory\memo95.exe uses registry: HKCU\Control Panel\* HKCR\CLSID (OpenKey) HKCU\Software\Microsoft\Windows\CurrentVersion\ Explorer (CreateKey) HKLM\Software\Microsoft\Windows\CurrentVersion\ Explorer (CreateKey) HKCU\Software HKCU\Software\Kertes Gábor\Memory game 95\* HKCU\Software\Kertes Gábor\Memory game 95\ Settings\Registration code (QueryValueEx) HKLM\Software\Microsoft\Windows\CurrentVersion \SubVersionNumber (QueryValueEx) opening register screen files used: memory\memo95.exe uses registry: - try to register (name Pirate Copy and code 11111111 typed): files used: memory\memo95.exe Disambling with W32Dasm imported functions: kernel32.dll user32.dll gdi32.dll comdlg32.dll winspool.drv advapi32.dll shell32.dll comctl32.dll Import Module 006: ADVAPI32.dll Addr:00036BB6 hint(00D9) Name: RegOpenKeyExA Addr:00036BC6 hint(00E1) Name: RegQueryValueExA Addr:00036B96 hint(00C2) Name: RegCloseKey Addr:00036BA4 hint(00C6) Name: RegCreateKeyExA Addr:00036BFE hint(00C9) Name: RegDeleteKeyA Addr:00036BDA hint(00EC) Name: RegSetValueExA Addr:00036BEC hint(00CB) Name: RegDeleteValueA search for "registr" there are some lines like this * Possible Reference to String Resource ID=612**: "REGISTRATION NAME" * Possible Reference to String Resource ID=612**: "REGISTRATION CODE" * Possible StringData Ref from Data Obj ->"Registration" * Possible Reference to String Resource ID=612**: "Sorry, the registration code does not match! Try again or Ca" in the imported functions in connection with "A" there is often spoken of processes that perhaps are conected with the register process. (i.e. GetStringTypeA CompareStringA RegisterClassA) perhaps the "A" has a close connection to the registration number. information found in order.txt Registration name will be used to create the code, and will appear on the About dialog after registration (Can be the same as Name)) information found in the help file the registration code is a 16 digit hex code Your registration code is good for only that name you specified in your order. Fenston |
Fenston: Project VI (04-Feb-99 15:33:56) |
|
Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.