vladimir
my short solving-suggestion-->
Sat Dec 19 11:12:49 1998


Hi everyone,

First I thought it would be very easy to find the jump.
Loaded WDasm and tryed out the StrRefs, entry "Registered"...
But as far as i traced in the coding, i couldn´t find the
position where the jump SANDMAN´s talking about is written.

So I remembered a few hints. that where given to me from
BITABIX a few day´s ago- i was trying to crack a application
called W95optimal20 ( finally i found two way´s, but that´s not interesting now)

Here´s what i did to solve TASK3:

Cause of the behaviour CYT when minimizing i figured out,
that this is an Delphi-lang. proggie ( maybe i´m not right,
but i thought it)
So I remembered BITABIX words of a breakpoint you could
set in SI, called HMEMCPY... ( actually don´t know if it
works only on delphi..)

So I started CYT and pushed the "REGISTER" button.

Then I entered a few letters in the name-field, and
a few numbers in the registration code-field.

DO NOT HIT THE REGISTER BUTTON YET!

Then i went to SoftIce ( STRG-D ) and entered
BPX HMEMCPY at the prompt

Hitting F5 brought me back to CYT´s dialogue...

The next step was pushing `register`- and there was SI
again.

Twelve hit´s on F12 ( suggestion from BB, he explained there
will be the point where no return msg. would be), and i
found me on a code-position where i found

:0043FA04 E8FB41FCFF CALL 00403C04
:0043FA09 752E JNZ 0043FA39 ( in WDasm JNE )

So I figured out that the call would be the check-routine
´serial good/bad`and the Jump brings you to the SORRY-
...doesn´t match -nag

Back to windoz, i started HIEW, went to 0043FA09, and
changed 75 2E to 90 90 ( nopped it ).

The next time i started my crk-copy and entered that what
CYT want´s me to in the registration-area->
BINGO
it was registered.

Hope my explanations will help you a little bit,
sometimes i could not write in english that what
i exactly want to say...

greetz

vlad