PedroFinished task 3Fri Dec 18 19:06:26 1998 I ran the program and then typed in 1234567 for the name and 1234567 for the serial. That appears to be a minimum for both of these fields because as soon as I had typed in 7 chars in each the registered button became available.I set a bpx hmemcpy then pressed f12 7 times then followed the ret's back with f10 until I got to this bit of code.:0043F9EE 8B45FC mov eax, dword ptr [ebp-04]:0043F9F1 50 push eax ;our bogus serial:0043F9F2 8D55F8 lea edx, dword ptr [ebp-08]:0043F9F5 8B83F8010000 mov eax, dword ptr [ebx+000001F8]:0043F9FB E8B4D6FDFF call 0041D0B4 ;this call generates the serial:0043FA00 8B55F8 mov edx, dword ptr [ebp-08] ;edx = the correct serial:0043FA03 58 pop eax:0043FA04 E8FB41FCFF call 00403C04 ;this call check to see if regged:0043FA09 752E jne 0043FA39 ;NOP this jne and you can type ;in anything in to be registered :0043FA0B A1209B4400 mov eax, dword ptr [00449B20]:0043FA10 8B00 mov eax, dword ptr [eax]:0043FA12 E8D5AFFEFF call 0042A9ECActually I thought this would be a bit harder after the torment I went through in task 2 :)Pedro