Colin
Questions 1-4
Sun Dec 6 10:13:31 1998


Question 1) It looks like the Program settings are set in HKLM/Software/4Developers/Rcrawler/Settings? Two interesting settings here Matchcase 0x00000000 (0) and Matchstring 0x00000000 (0). Will it change these to another figure when registered?
Question 2)Don,t know yet.
Question 3)At a glance it says on the first screen that the prog is limited.(Crippled/restricted functions), Time limited to 30 day trial, in Wdsam we see some indirect code addressing in the routines at these string data references. Here are some interesting ones UNREGISTERED VERSION, REGISTERED VERSION, Registery results - Generated, Registered User.
Question 4) Using 'Filemon' you see references to C:/Windows/Applog/Rcrawler.~~c (lgc)? and C:/Windows/Rcw.d98. This file is interesting it only has the number 729648 in it. Can we assume this is part of the serial? In Wdsam we see strange references to string data "YMA19X@24$Z%" and "8267-". Could this be the prefix for the number in the RCW.D98 file? No! it tried it. But worth further investigation. I noticed there is a string ref to RCW.D98 in Wdsam.

I also noticed that in 'Regmon'there is an entry HKLM/Software/4Developers/Rcrawler/4D and that it was not found. I went and created it and then back to the prog. to enter user name and reg code. It still showed that it could not find it. In Wdsam there is also a string data ref to '4D' could this be the routine that creates and enters something in it? If you folow this routine in Wdsam it connects to the routine with the string data ref 'YMA19X@24$Z%'(actually two routines for this sting data ref one at 00403A9f and one at 00403B81) and '8267-'. This routine, I think, leads into the Registered User routine. This is also the area of indirect calls. I notice that there are a lot of calls to lines that jump to dword ptr [0040e8xx]. I counted 11. But there is another area that calls heaps more, stopped counting at 21.
Sorry thats all I got after a quick look its 1.00 AM in this part of the world. I need some zzz's.

Cop u later.

Colin