Phil
Solution
Fri Dec 18 15:06:24 1998


Task 3
Okay...I found two ways to register this program. One using S-ice and the other Wdasm.

First with S-ice:
I tried all the common breakpoints, getwindowtexta, getdlgitemtexta...but none worked so I resorted to 'hmemcpy'. I started up CYT and entered 'Pirate Copy' and '1234567' note: your name and serial number has to be atleast 7 characters long, pressed register and s-ice opened. I pressed 'F12' seven times until I landed in the program, CYT!CODE... and then F10 a couple of times until I came to CS:0043F9EE.

*Snip

cs:0043F933 mov eax,[ebp-04] -your name
...
cs:0043F9FB call 0041d0b4 -get real serial
mov edx,[ebp-08] -real serial
...
call 00403c04 -compare real to fake
cs:0043FA09 jnz 0043fa39 -jump if...
...

so you just have to nop out the 'jnz' at cs:0043FA09 to have the program register with any name/serial.

Second with WDasm:
I started up WDasm and loaded up CYT. I then opened up the 'String Data Reference' and looked for anything that might be of interest. The only thing worth checking out was the word 'Registered'. So I clicked on that and landed at cs:0043F4F9 but found nothing interesting there, so I clicked on 'Registered' again hoping there might be another area. And there was, cs:00444BAD.

*Snip

...
:00444B77 call 00403c04 -compare real to fake
:00444B7C je 00444b99 -jump to goodguy if equal
...

*Referenced by a (U)nconditional...
|:00444B7C (C)
|
:00444B99 mov byte ptr [004a811], 01 -register the program
...

*Possible StringData..."Registered" -YOU LAND HERE

:00444BAD mov edx,00445030
:00444BB2 call 0041d0e4
...

I then loaded up 'Psedit' and change 'jz' at cs:00444B7C to 'jnz' and the program registered itself without the need of a name or serial.

That's about it...