Joseph
Task #3 finished
Sat Dec 19 06:05:52 1998


Greetings to you all,

Task #2 was successfully finished and now I bid Farrell to task #3. All the time spent looking around for the answer for task #2 paid handsomely in facilitating finding the answer for task#3.
Let me give you a brief description of what I did to arrive at a correct answer relatively in a short time.

Using W32dasm and the listing it produced, I came across a procedure where bytes are compared and al set to 00 or 01 according to the result of the comparisons. I made a good note of this procedure which starts at 403c04. Here is the important part of this function:

00403C53 5A pop edx
:00403C54 83E203 and edx, 00000003
:00403C57 7422 je
00403C7B 00403C5D 38D9 cmp cl, bl
:00403C5F 7541 jne 00403CA2
:00403C61 4A dec edx
:00403C62 7417 je 00403C7B
:00403C64 38FD cmp ch, bh
:00403C66 753A jne 00403CA2
:00403C68 4A dec edx
:00403C59 8B0E mov ecx, dword ptr [esi]
:00403C5B 8B1F mov ebx, dword ptr [edi]
:00403C5D 38D9 cmp cl, bl
:00403C5F 7541 jne 00403CA2
:00403C61 4A dec edx
:00403C62 7417 je 00403C7B
:00403C64 38FD cmp ch, bh
:00403C66 753A jne 00403CA2
:00403C68 4A dec edx
:00403C69 7410 je 00403C7B
:00403C6B 81E30000FF00 and ebx, 00FF0000
:00403C71 81E10000FF00 and ecx, 00FF0000
:00403C77 39D9 cmp ecx, ebx
:00403C79 7527 jne 00403CA2

Depending on the value in edx, the comparison is from 1 to 3 bytes each time the function is called. One set of comparison that attracted my attention was one comparing 3732 in ebx and 3732 in ecx.. These two bytes acquired great significance when I found the same two bytes were in msffs.dll at locations fa and f9. After I succeeded in un-registering CYT and running it as unregistered, I examined these locations and found that they held a new value in these locations, 36 in f9 and 38 in fa. Very interesting indeed. Also I notice that this procedure was called fro several location in the program and every call was followed by a je or jne instruction.

With this information acquired I needed to find a good place where this comparison will be useful to our purposes, so I took a look at the area labeled "Register" in the program's listing which starts at 444a8e. Where I found the following segment of code:

00444B2E 8D45F8 lea eax, dword ptr [ebp-08]
:00444B31 50 push eax
:00444B32 8D4DE4 lea ecx, dword ptr [ebp-1C]
:00444B35 A1089D4400 mov eax, dword ptr [00449D08]
:00444B3A 8B00 mov eax, dword ptr [eax]
:00444B3C 8B8004020000 mov eax, dword ptr [eax+00000204]
:00444B42 8B8018010000 mov eax, dword ptr [eax+00000118]
:00444B48 BA04000000 mov edx, 00000004
:00444B4D 8B30 mov esi, dword ptr [eax]
:00444B4F FF560C call [esi+0C]
:00444B52 8B45E4 mov eax, dword ptr [ebp-1C]
:00444B55 B902000000 mov ecx, 00000002
:00444B5A BA06000000 mov edx, 00000006
:00444B5F E894F1FBFF call 00403CF8
:00444B64 8D55E4 lea edx, dword ptr [ebp-1C]
:00444B67 B81B000000 mov eax, 0000001B
:00444B6C E8971FFCFF call 00406B08
:00444B71 8B55E4 mov edx, dword ptr [ebp-1C]
:00444B74 8B45F8 mov eax, dword ptr [ebp-08]
:00444B77 E888F0FBFF call 00403C04
:00444B7C 741B je 00444B99
:00444B7E A1089D4400 mov eax, dword ptr [00449D08]
:00444B83 8B00 mov eax, dword ptr [eax]
:00444B85 E8625EFEFF call 0042A9EC
:00444B8A 8B55FC mov edx, dword ptr [ebp-04]

I found a call is made to the procedure I described above at location 444b77, so I traced through the call until it arrived at:
00403C5D 38D9 cmp cl, bl
:00403C64 38FD cmp ch, bh
And what was but the old 3732 which apparently is constant and the 3638 wich was brought from smffs.dll. As expected this comparison leaves al =0, thus there will not be no jump at 444b7c, and this will have taken us to the unregistered program, but changing the instruction at 444b7c from je to jne caused the program to run as registered with out any complaints.

To make this change permanent, I noted the offset location of this instruction and fired the hexeditor and 74 to 75 and saved the program with a backup of the original.

Best regards,

Joseph