Jeff(jas)Analysis of a NewB gone wild..Question#1Sat Nov 7 17:35:31 1998 HiYa all!!!Hi Sandman!!! Project 3 11/7/98Upon first opening program you recieve a Nag Screen: that says:About Unistall (<<-Author Mispelled,click tounge thrice) Manager Version 2.601)You may use it for 30 days...ectWhen clicking on the Okay button you get: another nag screen telling you HOW MANY DAYS you have left.2)This one states: This product is licensed to: UNREGISTERED VERSION3)"You are on the day ( 1 )(counting down from install date) of your 30 day evaluation period."Okay button: takes you to a Wizard for taking snapshot of your drive;Cancel takes you to yet another annoying Help file nag screen.Upon opening program and clicking on the Register button in the nag screen you see:Registration name& Registration keyFilling these out and hitting the okay button; result in an error box popping:4)"Sorry not a correct reg key."Looking at the above numbered lines I thought that I had identified Four different areas to search for in W32dasm...1) You may use it for 30 days.2)This product is licensed to: UNREGISTERED VERSION.3)You are on the day...(of your 30 day evaluation)4) "Sorry not a correct reg key."However (frustratingly) each of my text searches brought back the Sorry "NOT FOUND"... (?)This REALLY threw me! I thought I was doing well at this point; NOT FOUND!!!Would this indicate that this text is located in another file other than uninstall.exe...???I'll look into it of course...but newB status limits my understanding and search capabilities.Next I thought I would go into the Registry and look around; but then I thought...RegMon would tell me exactly WHERE the directory was located so I use RegMon first.I then closed up and loaded Unistall into Regmon; Seeing it is referenced by the Word Uninsman...I then clicked on the Events menu and then the Filter optionIn filter box; I type in uninsmanin lower case lettersand click applyI then click on menu; EventsClear screenI am now ready to open up Uninstall Manager and have ONLY its functions displayed.Having done so I see several events that are "Not Found"1) Is:Uninsman QueryValEx 0xc51d4544C:UMUninsman.ini NOT FOUNDActually I see it has listed this twice...I do not know what QueryValEx meansI do not know the significance of the numbers...0x51d4544 eitherI do know though at this point that there SHOULD be an ".ini file" that this program is going to get some information from...But WHERE is this info. located and stored at for retrieval...? (Got ME)2) I also see that:Uninsman QueryValEx CurrentSoftwareNoktasoftwareUninstall ManagerReg.......is not found...Here in this Reg directory will be stored your Reg key; or registration information...(?; I think so)I now know WHERE Uninstall Manager directory is located in the Registry so I open Regedit and I scroll to and thru above addresss...and...all the listed directories are present...except...the Reg folder...it has NOT been installed...Not been created as yet.So I now know 9of course) that the program has missing information that has not been recorded; Assumption is that when correct Registration Key is inputted that these files (.ini & Reg directory) will be retrieved and Filled in with correct data...I once again go back into w32dasm and type in 'search' box:.iniOh-ho; item found here:Slot.ini 0045228cUninaman.ini referenced from 00432f93(c) & 00452fa8 (c)Note: see ini data below...slot=)(we are not suppossed to go into Ice yet; so this will wait until I gets some ducks into a row...(you line the ducks (cardboard) up in a gallery and take shoots at them)I then decided at this point to experiment:I open the Uninstall Manager directory in Explorer; and I CREATE a text file called "Uninsman.ini"...I leave it empty; and I then open up Uninstall Manager and the Nag screen pops; I check the .ini file I created...it is empty.I click on the Okay button; I then check .ini file; still empty;I click on various options repeatedly checking the ini file; empty.I then CLOSE the program; UPON opening the ini file I made ... I now find this inside of the ini file:[Settings]Recycle=1Autocomp=1Showfi=1Dntsie=1Dntsne=1incgid=0Left=168nw=80sw=50lw=130dw=50slot=1Width=498Height=382Max=0[Slot]Slot1=Slot2=Slot3=I do not know What this stuff is; I do not know WHERE it was CALLED from... I played around with a few of the values and nothing seemed to change much...Max=0 changed to Max=1 changes your window from minimized to maximized...I thought that the Slot= was probably significant but the values I have put in have changed nothing as yet...also everything in the "settings" colume has a value except "incgid=0"; I changed this also and found nothing that I recognized as a change in the program.[Slot]Slot1=Slot2=Slot3=I thought that this above would hold Reg name and reg key; but thats only 2 values; none of these worked when I typed in fake values; I had hoped by filling something in and running the program maybe an ERROR box would pop telling me something was wrong; and that 'something' would lead me to another idea;Nope.Okay obviously this data was 'gotten' from somewhere...Do I have a tool that will trace it???I'm not sure.So I'm going to delete the ini file and re-create one; then open FileMon and possibly Win-Expose and then re-run the program and see if one of these 'captures' where this data is coming FROM.I myself don't recognize anything in FileMon telling me Where the data might be coming FROM...All I see that MIGHT be something is at line # 577:Uninsman Write C:UMUninsman.ini Success offset 26 lenght 1Got me???? I have no idea what this means.Okay I try Win-Expose:I seem to get a few MORE things 'Not Found' then I did in RegMon and FileMon...( still greek to me; No offense)Uninsman QueryValue ROOT Retrieves type and data for value key Not foundUninsman QueryValueEx CurrentsoftwareMSWin|currentversionexplorerSetkey...returns a value for a key.......Not foundUninsman QueryValueEx CurrentsoftwareMicrosoftWindowsCurrent versionPoliciesExplorerNoSetFolderOkay; I checked the above and NONE of the directories on the end; ie: SetKey; & NoSetFolder...have been CREATED as yet...Still gathering info:Back to dasm:This registration info, is illegal. No need to pirate this software...0045bfae jne 0045bfc2Days passed:refernenced by 0045aa7e(c)& Register (? button?) referneced by 0045c578:Well thats about it for today...will add to this tommorrow.Stay tuned for regularly updated versions of my criminological references as I swipe ideas from other posters...I hear the 'wife' calling and it doesn't sound good...Jeffreeeeeeeeeeeeeeeeeeey!Cya JeffGeneral Analysis by The Sandman , Sat Nov 7 20:52 Addtional Input by jeff , Sun Nov 8 04:12