Posted by Cray_Z on 1/15/2000, 4:35 am
, in reply to "Cray_Z's Thread"
206.168.243.195
I. Easy tasks I.1 What do you find when you look at target at first. Look what you find, when you look at the program, at the helpfile or somewhere else. Be sure not to use *any* tools yet, only look directly at the program.
What I find is this: Upon opening the program, a nag screen comes up telling us that this is a 30 day trial, and there are three buttons--Evaulate (which takes us into the program), Purchase... (which gives us information on how to buy the program. You can also bring this up by going to 'How to Register...' under 'Help'.), and Register... (which takes us to where we enter our name, company, and key code.) When we enter the wrong key code, we are told that "The key does not match license owner." When we hit ok, we are taken back to the nag screen. Going to 'About Acoustica' under 'Help' brings up a box that, among other things, tells us that the program is unregistered.
I.2 Do you find anything interested in the W32Dasm disassembly? Now you can use a deadlisting from your favourite disassembler and look for suspicious stuff.
Upon disassembling with W32Dasm, I find these interesting string data items:
String Resource ID=09052: "Time remaining : " <0041b33e, 00401b71b>
String Resource ID=09094: "Day %d of your 30 days trail period." <0042c90d>
"Registered to " <004468e8>
"RegisterInfo" <0042cb3c, 0042cb6c, oo42cb9b, 004468ab, 004468d2, 00446ab6, 00446ae2, 00446b09>
"Software\Acon AS\Acoustica\2.0\" <=========which didn't seem interesting until I looked at the prog with Regmon <004139f3>
"The evaluation period has expired." <00446e8a>
"The key does not match license " <00446fab, 004472cf>
"Time" <004244a2, 004246b0, 00440ed9>
"Unregistered" <0042cd0c, 0044678b>
"Your license is registered. Thank " <00446f79, 004472aa>I also found these interesting imported functions:
KERNEL32.DosDateTimeToFileTime <004806d3, 0048aff6>
KERNEL32.FileTimeToDosDateTime <0047f00d, 0048067a, 0048b014>
KERNEL32.FileTimeToLocalFileTime <0047effc, 0048065f, 0048b01a>
KERNEL32.GetDateFormatA <0048414c, 00484172, 0048074>
KERNEL32.GetLocalTime <0048af1e, 0048af4a, 0048af82, 0048b0bc>
KERNEL32.GetSystemInfo <0047b2db, 0048b0ec>
KERNEL32.GetSystemTimeAsFileTime <00446c03, 0048b0f2>
KERNEL32.GetTickCount <0041b57b, 0041b5d7, 0048b0fe>
KERNEL32.GetTimeZoneInformation <0048ade1, 0048b104>
KERNEL32.LocalFileTimeToFileTime <004806ea, 0048b15e>
KERNEL32.SetFileTime <004806ff, 0048b1e2>
USER32.KillTimer <00412a12, 00412a61, 00412ad3, 00412b5d, 0045536c, 0048b6d0>
USER32.SetTimer <00412b1c, 00412ba8, 004540fc, 0048b7ae>
USER32.UnregisterClassA <0046d636, 0048b7f6>Being pretty new to the cracking world, I don't know which ones of these I should worry about and which ones I shouldn't, so I'm just taking notes on all of them.
I.3 What kind of window is the "Wrong-serial"-"messagebox" really? As you will see later the window that says "Wrong serial" is no Messagebox, but another kind of window.
I have no idea how to figure this one out.
I.4 Where does the program store its Registration information? In the registry, in a file, in the EXE itself - where?
I don't really know how to figure this one out either. Please give me some help here.
I.5 Where does the program store how many days are left? Same as above
Ya, same as above. I don't know how to go about figuring this out. Please help!