Simson
String references
Mon Nov 9 16:51:27 1998



My take om the prog using W32dasm
1) Stringsearch: Some strings in the about box seem not to be in the dissassembly. On the other hand
there are some very strange strings. Encrypted? String "Programmed by" can be found.
It is followed by an strange string. It is not hard to guess that is encryption of the authors name. Then comes
"c) 1997 -1998". Then references to registry entry. Then some more encrypted strings.

2) Decryption: Looking at the encrypted strings I guess that ( stands for space character. That
and authors name gives key to decrypting strings. First string after registry references is "Thank you for registering..." Then comes "You are on the day" and "of your 30 day ...". Then "Your trial period is finished".

3) Looking at jumps: Program must decide which text to display in the about box. Now on 45BBEC
there is a cmp followed by a jump which bypasses the registry references and "thank you .." and lands above the "You are .." If you follow that jump there are more cmps and jumps which can take you to "Your trial period..". One of those cmps compares with the number 1F = 31 and is followed by jump if not below.

Preliminary conclusion: The crucial cmp seems to be the one on 45BBEC. It is a comparision of a memory value with 1.
There are a number of things that can be tried. But I stop here.

simson