Eternal Bliss
My answers
Sun Dec 6 11:08:54 1998


Question 1. Where in the System Registry does this program store it's default program settings?.

i) It stores the settings in [HKEY_LOCAL_MACHINESoftware4Developer rawler]
ii) Deleting this key cause the prog to revert to trial version if it was registered because an entry is placed in the key after it is registered. A DWORD ("4D") is entered. The value of "4D" is in hex.
("4D" is seen in the StringData reference in W32DASM AT :00403E16 and :004039F9)


Question 2. Where does this program store it's 'days left..' counter?.

i) I think it is in a hidden file named Rcw.d98 because when the 30 days is up, the file is deleted and the prog will not run unless valid reg info is entered. The file is referenced when it is in it's shareware state every time it starts.
ii) After it is registered, Rcw.d98 is not referenced. Inside the file, there is a 6 digit number. But I couldn't decipher it. Mine was 729635
(RCW.D98 is seen in the StringData reference in W32DASM at :00402D52)


Question 3. What are the Main protection systems employed by this program? Example, is it protected with:- Nag screens,Serial protected,hidden Registration Screen, rippled/restricted functions,Time Limited,Indirect Code Addressing,Self-Modifying Code,Dongle etc etc.

i) Splash screen (saying trial version) with options: unlock, reg online, reg later, reg by mail etc.
ii) Closing the splash will allow you to go to main prog with UNREGISTERED VERSION on titlebar.
iii) After 30 days, you will have to register to run the program else it will exit after the registration box.
iv) Turning clock back won't help. (So I was stuck) Couldn't revert back to shareware version after 30 days up. I tried to uninstall, reinstall, search through registry to delete the keys but nothing helps.
v) You have to enter a User Name and a Registration Code. Then press Unlock.
vi) If you enter the correct code, you will be told to close RegCrawler and restart to remove all limitations. (But I did not have the chance to find out what limitations 'cos I had triggered the 30 days protection and can't run the program without registering)
vii) the Reg code always starts with "8267-" and is seen in the StringData reference in W32DASM at :00403AAB)

* Do not advance the clock 30 days to see the effect unless you know how to revert it back and has seen the changes in Rcw.d98. * (I didn't) 8(


Question 4. What (if any) 'interesting' files are used by this program?. Ignore the normal windows system files such as .DLL's, .SYS etc.

i) Rcw.d98



Other interesting StringData references:
i) "Failed to record registration" at :00403E43
ii) "REGISTERED User" at :00403E65
iii) "Registered Version" at :00403C5A
iv) "Thank you very much for trying " at :00403D03
v) "This is an UNREGISTERED version" at :0040309A
vi) "UNREGISTERED Registry Crawler" at :00402551
vii) "UNREGISTERED User" at :00403E96
viii) "UNREGISTERED USER" at :00403CF3
ix) "Welcome to the REGISTERED version" at :00403E6A (this is shown if you enter the correct info)
x) "YMA19X@24$Z%" at :00403A9F and :00403B81