Cracking Projects For Newbies

Re: My solutions for Task 2
Thursday, 04-Feb-99 14:37:30
    193.159.5.128 writes:

    My solutions for task 2 are:

    1. The best solution (in my opinion) is to NOP(HEX-code: 909090909090) out the jne at
    address 40B744 (HEX-offset: AB44h). When we changed this, the next start we recognize,
    that M.G.95 accepts every serial#, but it doesn't stay registered, when we restart it.
    A register dialog pops up, where we should enter our serial#. To make this vanish, we
    change the jump at adress 405C47 (HEX-offset: 5047h) from je to jne (HEX-code:
    0F85434010000; can anybody tell me the hex-code to make this jump an unconditioned jmp?).

    2. As mentioned above there are two patches to be made.

    3. There could be a check if we have changed the MEMO95.EXE file. Another problem might
    be that the program checks the serial# every minute or something like this and kicks
    us out if we only have patched the two offsets I metioned above (Never seen such a
    program, yet).

    4. Actually I encountered no problems when patching the code, but there's one strange thing
    I saw in W32Dasm. There is a hardcoded string saying 'The program has been modified!'.
    Normally this is the error message when a CRC-check has discovered that the file has been
    modified. This check doesn't work in M.G.95 or the string is only a fake.

    Now I quit to play my 'registered' version of M.G.95 for a while. ;-)

    Bye.

    LaZaRuS

    LaZaRuS


Message thread:

LaZaRuS: My solutions for Task 1 (03-Feb-99 12:14:39)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.