Posted by HaQue on 1/22/2000, 12:41 am
, in reply to "TASK I"
203.56.239.115
Greeting everyone! I arrived quite late and the first and second tasks are virtually
covered, but here are my solutions to TASK II.1 &II.2 anyway as
an excersise to help myself.I want to thank Lazarus, sandman and all the solution posters for
the time & devotion to the reversing community. There are some
very intelligent minds gathered here, It makes me realise how much
I still have to learn, while inspiring me to do just that.Thanks to hobgoblin, ShAdE, Joseph, Eternal Bliss & countless
others that have helped make alot of things clearer to me.
Even though I figured out most of the solutions myself,
other posts have aided me completing my answers to the point
that I understand the code, and I believe them to be
correct answers.kind regards,
HaQue
=========================================================
II.1 Try to get rid of the nagscreen
Find a patch that removes the nagscreen
(the one that appears at startup.
---------------------------------------------------------The check to see if it registered or not is by a CALL
to 00446A74.there are 4 calls to this:
00446774 - to see what to put in the "About" dialog
00446E54 - on startup I think
00446F63 - When checking as the key is entered
00447294 - the same as the third? will check later.concentrating on the code around the second one, this is
what I found.
:00446E54 E81BFCFFFF call 00446A74 <------"is it regged?"
:00446E59 59 pop ecx
:00446E5A 84C0 test al, al
:00446E5C 7411 je 00446E6F <------ jmps if bad
:00446E5E 8B8514FDFFFF mov eax, dword ptr [ebp+FFFFFD14]
:00446E64 64A300000000 mov dword ptr fs:[00000000], eax
:00446E6A E98D040000 jmp 004472FC <-------taking this jmp will give
unlimited uses.
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
00446E5C(C):00446E6F 57 push edi
:00446E70 E847FDFFFF call 00446BBC <-------checks registry info
:00446E75 59 pop ecx to see if days are up
:00446E76 84C0 test al, al
:00446E78 0F85A9010000 jne 00447027 <-------goes to the startup nag
:00446E7E 8B5766 mov edx, dword ptr [edi+66] <--from here down gives
:00446E81 8B02 mov eax, dword ptr [edx] the eval expired msg.
:00446E83 6A00 push 00000000* Possible StringData Ref from Data Obj ->"Acoustica"
|
:00446E85 6831A04900 push 0049A031
* Possible StringData Ref from Data Obj ->"The evaluation period has expired."Here is the code that the jump at 00446E78 goes to:
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446E78(C)
|
:00447027 84DB test bl, bl
:00447029 0F84C1020000 je 004472F0 <--if this is not taken, the
nagscreen appears.
The reason I patch it here is not to intervene with the rest of the checks. The
task was to remove the nagscreen only, not defeat the time check.=========================================================
II.2 Change your date and bypass the "Evaluation
period expired" nag.
Find a patch that makes the program never expire.
---------------------------------------------------------
I found the answer to this while trying task 1.
:00446E54 E81BFCFFFF call 00446A74 <----- the "is it regged" check
:00446E59 59 pop ecx
:00446E5A 84C0 test al, al
:00446E5C 7411 je 00446E6F <----- jmp if it isnt, else continue.
:00446E5E 8B8514FDFFFF mov eax, dword ptr [ebp+FFFFFD14]
:00446E64 64A300000000 mov dword ptr fs:[00000000], eax
:00446E6A E98D040000 jmp 004472FC <---jmps to running the proggie &
over the bad msgbox etc..* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446E5C(C)
|
:00446E6F 57 push edi
:00446E70 E847FDFFFF call 00446BBC <-- looks at the registry to see if
:00446E75 59 pop ecx days are up.
:00446E76 84C0 test al, al
:00446E78 0F85A9010000 jne 00447027 <---we patched the code in this
jump to get rid of startup nag
:00446E7E 8B5766 mov edx, dword ptr [edi+66]
:00446E81 8B02 mov eax, dword ptr [edx]:00446E83 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"Acoustica" <-- title of messagebox for
"eval expired"
:00446E85 6831A04900 push 0049A031so if we nop out the je at 00446E5C it will go straight
to running the program. No nags, No time limits.