DomnickQuestion 4 .... 4D KeyTue Dec 8 01:35:59 1998 Fist of all let me start by saying that I know a lot of what I found has some significance, but I can't make heads or tails of it so maybe I can pass on a train of though to someone that can do something with it. Here it goes:First of all, Like Jeff, I already had a DWord key called 4D under the branch HKEY_LOCAL_MACHINESOFTWARE4Developer rawler, but I think that I know why... I'll explain why later. When I looked inside my 4D key, its contents were very large, in fact I couldn't see it all until I did a Modify and saw that at line number 0000 were the contents 'Domnick' and further down at line 0100 was '123456'. These were the values that I had been testing with, prior to reading question 4-6. How did they get there? ... Well I put a BPX on 'GetWindowTextA' and pressed the 'Unlock' button on the register screen and SoftICE popped up. After F-11 out and quite a few f-10's (27 I think) I came to the line:014F:00403D81 MOV EAX,[EAX] When I viewed EAX after this line it 'Domnick' from the register window. Also of note (although probably irrelevant) after stepping through the line00403D83 PUSH 0040C918I pressed 'd 0040C918' I saw UNREGISTERED USER. Anyhow, later on down the way I came to:00403DCE TEST EAX,EAX00403DD0 JZWhen I toggled the zero flag (R FL Z) and then cleared my break points and exited out of SoftICE, I was presented with a window that said, "Welcome to the REGISTERED version of registry crawler. Please restart registry crawler so that all limitations are removed." When I pressed OK, the window for the registry crawler program still said unregistered version, and when I restarted the program, I was presented with the friendly old nag screen and limit of 10 bookmarks.Upon further investigation, I found that at line00403E1B MOV 0040C6F4moved the value '4D' into EAX. This has to do w/ Registry crawler creating a key in the Windows Registry, but other than what I mentioned here, I am lost. I hope this information helps someone. I am off to find out what I can using W32DASM.