Posted by MrE on 1/17/2000, 5:54 am
128.109.131.47
Hello, fellow-crackers
My answers for task 2:
2.4. Code for Unregistered Unregistered is AC200-52856.
2.5. As for the patch: The proggy first gets registry keys and compares them for right serial.
.text:00446E53 push edi
.text:00446E54 call ComparationRout
.text:00446E59 pop ecx
.text:00446E5A test al, al
.text:00446E5C jz short loc_0_446E6F
.text:00446E5E mov eax, [ebp+var_2EC]
.text:00446E64 mov large fs:0, eax
.text:00446E6A jmp loc_0_4472FC
.text:00446E6F ; -------------------------------------------------------------
.text:00446E6F
.text:00446E6F loc_0_446E6F: ; CODE XREF: sub_0_446C
.text:00446E6F push edi
.text:00446E70 call ExpiredAlready
.text:00446E75 pop ecx
.text:00446E76 test al, al
.text:00446E78 jnz loc_0_447027
So we can patch by noping jz short loc_0_446E6F at 00446E5C. That's 2 bytes. But we can do even
better if patch the CompareRout itself to return true value. This can be done in 1 byte ;). It returns value by the following code:
83 e0 01 and eax, 1
We can easily transform this into
83 c8 01 or eax, 1Regards, MrE