Posted by ChiquititaIL on 1/17/2000, 4:36 pm
192.117.152.71
Solutions for task2:
=============
First I start from the easy task;
TASK II.4:
------------
If you read my previous thread, you surely know I recommened there on
lstrcmpa as the best execute breakpoint. Thats beacause Acoustica use
lstrcmpa fuction to compare your dummy serial with the real one.
So breakpoint there will reveal the cache, by the followings steps:
1. Restart acoustica and run the register dialog.
2. Register your self with dummy details("Unregistered");
Type any string you wish as code key.
Don't click [OK] yet.
3. fire up SoftICE(CTRL+D) and insert break point on lstrcmpa;
: bpx lstrcmpa
4. Return to acoutica(F5 or G or CTRL+D) and click [OK]
5. SoftICE should popup in lstrcmpa routine, if not try again.
Look at lstrcmpa routine code, you should see(6 lines forward)
two far pointers pushes to the stack:
PUSH DWORD PTR[ECX+24] --> the dummy serial
PUSH DWORD PTR[ECX+20] --> the real serial
that pushed values are pointers to the real serial and our dummy.
Go to those statements(F10) check for the values of the pointers,
and make memory dump by them(d);
You should see the real serial at pattern AC200-######;
for "Unregistered":AC200-54259