SVQuestions 4 6Tue Dec 8 05:48:51 1998 Hi everybodyFirst thanks Sandman for your very great work !!!Question 4 : Here is the OpenKey for your name and code.:004039F5 8D442408 lea eax, dword ptr [esp+08]* Possible StringData Ref from Data Obj ->"4D" |:004039F9 8B0DF4C64000 mov ecx, dword ptr [0040C6F4]:004039FF 8B542404 mov edx, dword ptr [esp+04]:00403A03 50 push eax:00403A04 C744240C00020000 mov [esp+0C], 00000200 <- Size of a good key.:00403A0C 68F8C64000 push 0040C6F8 <- The value of the key is stored :00403A11 6A00 push 00000000 here after the call.:00403A13 6A00 push 00000000:00403A15 51 push ecx:00403A16 52 push edx* Reference To: ADVAPI32.RegQueryValueExA, Ord:00E1h |:00403A17 FF1580E54000 Call dword ptr [0040E580]:00403A1D 8BF0 mov esi, eax:00403A1F 8B4C2404 mov ecx, dword ptr [esp+04]:00403A23 51 push ecx* Reference To: ADVAPI32.RegCloseKey, Ord:00C2h |:00403A24 FF157CE54000 Call dword ptr [0040E57C]:00403A2A 85F6 test esi, esi:00403A2C 7407 je 00403A35........... continued:00403A35 E806000000 call 00403A40 <- call to the fonction where :00403A3A 5E pop esi real code is generated and compared to the key.------------------------------------------------Where it compare ::00403BAD 8B45EC mov eax, dword ptr [ebp-14]:00403BB0 68F8C74000 push 0040C7F8 <- Code "read.class" tppabs="http://disc.server.com/read.class" from key:00403BB5 50 push eax <- Real code "!* Reference To: MSVCRT40._mbscmp, Ord:02ECh |:00403BB6 FF158CE94000 Call dword ptr [0040E98C] <- Compare fonction:00403BBC C745FCFFFFFFFF mov [ebp-04], FFFFFFFF:00403BC3 83C408 add esp, 00000008:00403BC6 83F801 cmp eax, 00000001Question 6:The key is 200h long.First 100h is for the name and folowed by the code.The first part of the code start with the famous string "8267-".The next char is generated with the lenght of your name divide by 0Ch.The rest of the divide is incremented to point at a char in the other famous string"YMA19X@24$Z%"Exemple: name of 14 chars, divide by 12 , rest is 2.The next code char is A (fisrt char is position 0, A is position 2)The others chars is ??? not yet etudied:-).Excuse my poor english :-(.SV