Posted by Bonkers on 1/15/2000, 7:03 am
216.41.50.219
I have been working on this for a few hours gathering some info, I commented on each of the first 5 easy tasks. Here is the stuff: I.1
I find that you can click the register button after you startup the program and if you type in stuff randomly it does pop up a bad guy box.
Bad Reg Box - Title: Acoustica Text: The key does not match license owner.
I also see that it is a 30 day trial. It seems to start on day 0 so it may actually be 31 days.
I find that if I set my date ahead 31 days that it says day 30 out of 30 so it is a 31 day trial.
If I set the date one day farther it pops up a box.
Eval Over Box - Title: Acoustica Text: The evaluation period has expired.
When you hit ok the reg box comes up and if you hit cancel it just quits the program and pops up the buy help file section.
The same happens if the date is set back.
If I put my date back to the original day I also see that it goes back to day 0 so it doesn't keep a record anywhere that the program has been expired.I.2
Interesting String Ref Uses:
* Possible StringData Ref from Data Obj ->"The key does not match license "
->"owner."
* Possible StringData Ref from Data Obj ->"Your license is registered. Thank "
->"you for your purchase of Acoustica "
->"2.0."* Possible Reference to Dialog: DialogID_03E8, CONTROL_ID:00C7, "Unregistered"
* Possible StringData Ref from Data Obj ->"Unregistered"
* Possible StringData Ref from Data Obj ->"Registered to "
:00446F63 E80CFBFFFF call 00446A74 ;Call to a reg check routine
:00446F68 59 pop ecx
:00446F69 84C0 test al, al ;Test to see if al == 0
:00446F6B 7432 je 00446F9F ;If al == 0 then it's not a good reg
This code jumps to the bad place, but if not it says it's good.
I have not checked it out but it looks like 446a74 checks to see if the reg is good or not and reports with a box to the user.
I see calls to 446a74 in other places in the code so it lead me to think that the reg code is checked every time it needs to see if the program is regged, for the about box and stuff like that.I.3
From a quick browse in wdasm and then verifying it in sice, I see that the messagebox just uses the MessageBoxExA call instead of the normal MessageBoxA call.
I have also noticed that if you look for string refs for this message box, you see them in two places. One of them looks like a decoy, the one at 4472cf looks like the real one and the one at 446fab looks like a decoy or some such since it is never run by sice.I.4
Reg info is put in HKEY_CURRENT_USER\Software\Acon AS\Acoustica\2.0\RegisterInfo under the values Company, Key, and Name no matter if it is right or wrong once you click register on the reg box.I.5
When searching for how the program stores how many days there are left in the evaluation, i found that the dumbasses made a typo after my search for "trial period" came up negative in the disasm listing except in the dialog refs. Now unless there is something new called a trail period, they are just dumb.
I see that there is nothing being stored in the registry or any ini files or anything so i take a closer look.
With a little digging I find that in the exports there is GetFileTime.
I search for GetFileTime and see one use, with IDA I see that it is in a BC lib function which I have no ref for but it is called __dos_getftime so I can guess the function. This is called by another lib function and then in turn by the program and if you trace around a bit you come to 446c74 where the days remaining is put into memory at 4a8df6 and checked to see if it's over 30 and the 2 dates come from GetLocalTime( Current time ) and GetFileTime( Time installed ). If you wanted to crack the 30 days this is where it would be done but that's not what we wanna do right now.