Posted by the snake on 1/16/2000, 4:36 pm
62.0.162.247
I couldn't take part of task 1 since i'm a RJC
(Religious Jewish Cracker), and it was Saturday, so, i'll try to do my
best in task 2 and to help as i can.i will start with II.2 : bypass the time check, this will give us the
solution to how to remove the nag screen in one patch. (II.1)if you change your date ahead, you will get the message :
"The evaluation period has expired." if you look for this string in
w32dasm, i comes from only 1 location :
:00446E54 E81BFCFFFF call 00446A74
:00446E59 59 pop ecx
:00446E5A 84C0 test al, al
:00446E5C 7411 je 00446E6F
:00446E5E 8B8514FDFFFF mov eax, dword ptr [ebp+FFFFFD14]
:00446E64 64A300000000 mov dword ptr fs:[00000000], eax
:00446E6A E98D040000 jmp 004472FC
:00446E6F 57 push edi
:00446E70 E847FDFFFF call 00446BBC
:00446E75 59 pop ecx
:00446E76 84C0 test al, al
:00446E78 0F85A9010000 jne 00447027
:00446E7E 8B5766 mov edx, dword ptr [edi+66]
:00446E81 8B02 mov eax, dword ptr [edx]
:00446E83 6A00 push 00000000
:00446E85 6831A04900 push 0049A031* Possible StringData Ref from Data Obj ->"The evaluation period has expired."
|
:00446E8A 680EA04900 push 0049A00E
:00446E8F 8B500C mov edx, dword ptr [eax+0C]the call at 446e70 is the one to check days left, nop'ing it will
show like "..59 days of 30..", but...
if you don't jump at location 00446E5C this will pass the days check
and the nag screen at start-up.
just change je 00446E6F to je 00446E5E (to the next line) then the
program will jump to "jmp 004472FC"
why ? cause the nag screen is created at location 0044708F and you've
just bypassed it !!!II.3 - name and company in about screen :
we will start with the error message that we get when the wrong key
is entered : "The key does not match license "
if we llok in w32dasm we can see it 2 times. take a look a few lines
above this string and you'll see that it comes there from a conditional
jumps. in both cases, we see the same call is being executed before
the jumps :
:00446F62 57 push edi
:00446F63 E80CFBFFFF call 00446A74
:00446F68 59 pop ecx
:00446F69 84C0 test al, al
:00446F6B 7432 je 00446F9F
and the second one :
:00447293 57 push edi
:00447294 E8DBF7FFFF call 00446A74
:00447299 59 pop ecx
:0044729A 84C0 test al, al
:0044729C 7425 je 004472C3Now, if you go to this call, to location 00446A74, you will see that it's
called from 4 (!!) places....
* Referenced by a CALL at Addresses:
|:00446774 , :00446E54 , :00446F63 , :00447294
|
:00446A74 55 push ebp
:00446A75 8BEC mov ebp, esp
:00446A77 81C4A0FEFFFF add esp, FFFFFEA0
:00446A7D 53 push ebx
:00446A7E 56 push esiset break point in softice in those 4 location and run the program.
the first break will be at start up at location 00446E54.
change je 00446E6F to je 00446E5E and you passed the first check.click on the help/about and here comes the second on at 00446774.
change jne 00446868 to jmp 00446868 and you have your name in the about.II.3 - find serial for Unregistered, Unregistered :
:00446B91 E8DA880300 call 0047F470
:00446B96 83C40C add esp, 0000000C
:00446B99 8D9510FFFFFF lea edx, dword ptr [ebp+FFFFFF10]
:00446B9F 52 push edx
:00446BA0 8D8DA0FEFFFF lea ecx, dword ptr [ebp+FFFFFEA0]
:00446BA6 51 push ecxset break point on 00446BA6 and type in softice "d ecx"
you will see in location 0073F5E4 (on my comp, can be different
on yours, look in the date window :AC200-52856
II.5 - best patch foe all cases :
:00446774 E8FB020000 call 00446A74
:00446779 59 pop ecx
:0044677A 84C0 test al, al
:0044677C 0F85E6000000 jne 00446868
:00446782 66C785FCFDFFFF0800 mov word ptr [ebp+FFFFFDFC], 0008
change 0F85E6000000 jne 00446868
to 0F84E6000000 jz 00446868
:00446E54 E81BFCFFFF call 00446A74
:00446E59 59 pop ecx
:00446E5A 84C0 test al, al
:00446E5C 7411 je 00446E6F
:00446E5E 8B8514FDFFFF mov eax, dword ptr [ebp+FFFFFD14]
:00446E64 64A300000000 mov dword ptr fs:[00000000], eaxchange 00446E5C 7411 je 00446E6F
to 00446E5C 7400 je 00446E5Ethat's all we need. since the program puts our name and company in
the registry even if it's wrong (found it thru task 1), we validate it
with this 2 changes, at start-up and in the about screen.this is how i found the best way to make the program fully registered
with only changing 2 bytes...the snake