Jeff
My solution
Fri Dec 18 14:04:02 1998


Hi all

Most of what i write is no news to the majority; so I try to write my answers up in a helpBloze context for those newbys that are having trouble knowing where to bpx; where to stop f-12-ing, ect...
Remember our answers are archived and many newbys down the road can learn from detailed explanations...so once again...here goes my short story...

Of course if already reg-ed you must remove the 4 files previously discussed.



(I had already entered & used the value Pirate Copy...now I wanted to use my own name to see if there was a constant value assigned to the output of letters...I found that there is...the letter 'a' in jas...matches the letter value 'a' in Pirate Copy...and other tests I did...So there is a difinite pattern for letter values)

On opening program you will see that your register key is disabled.
Once again we have a key that will be enabled when the proper key character 'lenght' is met...
My 3 letter name once again gave me a moment to reflect on our last lesson...
having entered 3 letters and filled the reg code box with numbers did not enable key...So I knew that the amount of #'s had to have been met or exceeded...that left my name...I added several XXXXX's...when I reached 7 characters the reg button was enabled...okay; with 7 letters in my name I now started filling in the reg code area...at the 7th number the key became enabled...okay...7 letters for name and 7 #'s for reg code...

Since the question is:

Task 3. Since many newbies tend to prefer patching their target programs rather than try and sniff out it's *real*
serial number, task 3 is to see if we can locate the conditional jump that, if nop'd out, will allow CYT to be fully
registered, regardless of what serial number we use.


Since I have a very hard time SEEING or knowing what it is I am looking at in dasm; and the task did not say i could not legally use ice; (Note: You can use Dasm to do your changes or nopping but I am not familiar with dasms operating system to do so) so I used ice to track down my change...

fill in info;
Bpx hmemcpy; x; click reg button; f-11 once ; f-12 6 times; land here;
at 00432c36...pop..esi...You are now in the CYT!Code...but we do not stop here...we continue until we have met up with the RET instruction...<<--still inside CYT code; now f-12 4 more times...land here...(0041d07f...RET); now we F-10 into this return....we land at 0041d0df...now f-10 4 more times to the next RET you see there...and f-10 thru it...Now we are INSIDE the code area we want that checks the reg box info...

At this point be sure to disable your hmemcpy bpx or a certain call is going to throw you out of the code when you hit it...
type bd 00<<--00 is the # in THIS case that has been assigned to the hmemcpy function; to see this simply type bl; bl will list anyall breakpoints that you have set and their assigned #s...we only set one; and it is assigned the # 00...

Okay;

We have landed at 0043f9ee; f-10-ing and checking each line number you will soon see that our fake serial is being brought up...hummm...are we going to find a cmp with the real # close by......???
At this point I always f-8 into every CALL to see if there is a calculation routine; or if I have missed it; if there is at least a Compare of the fake to the REAL...having found such a compare inside call 00403c04; I noted several tests and jumps ect...changing these; for me at least did not give good results...however...a strange thing kept saying something to me...after returning FROM this CALL there was an IMMMEDIATE JNZ line...Jump if not equal...this was telling me...the compare has been done and this is the CHECK...
Well; I KNOW its NOT EQUAL; so this is the one I am going to try...

At this point I think; okay; I have read the Sandmans tutes; He says NOPs are not always the best way to go because programers can input some kind of check system to see if any nops have been added; if so the program can register; but upon re-opening it can do a second check; note the extra nops and revert back to Unregistered or tampering...
So I want to avoid 9090 when I can...

The Sandman has taught that in most cases changing to EB will tell the program to jump weather equal to, or not equal to....So this is how I did it...

I am now sitting on line 0043fa09
Type in 'e'(no quotes) 0043fa09 (enter)
when you do this you will see that your data box has changed and your cursor is now flashing & resting on the # '7' 5..2E...blablabla in the data box...

here I typed EB over the 75 and I left the 2E alone...

IF equal go ahead and jump to line 0043fa39..., f-10 once to execute this jump; x; to leave ice;
Whoops; badCrackerBox pops, hummmmm

Sorry;
okay re-do everything; who ever said crackers job was easy...
this time when you get to line 0043fa09 ..752E..jnz..0043fa39..you know that you do NOT want to jump to line # 0043fa39...<<-- IF of course this is the correct line AT ALL that will change this program to Reged...

So this time around I tell it to go to the next line down instead of jumping to 0043fa39...to go to the next line down:
type:
r eip=0043fa0b..<<--next line downs #
make sure all breakpoints are disabled;
type: x (enter)

YEP;..:)..Thank you for registering.......

At this point you always want to CLOSE and REOPEN your program; Still reged? Yes? okay...NO?...Then there is another check occurring and you have more work to do...

Okay; I now know that the jump needed to go to the next line down;
Sure at this point you are reged so who cares for more work; right?
Okay...BYE...
But for those who want to learn a little more;<<--who don't know it..

Remove all 4 files once again to UN reg..

Go thru all the above steps once again; get to line # 0043fa39 and stop...

Now how do we tell ice to jump to the NEXT line...
First EB ...is the jump command...so EB would replace 75...
But what about 2E?
Well this is a hex value that equals 46 decimal...

Now take these two lines and look at them closely...

0043fa09..752e..jnz..0043fa39
0043fa0b<<--the next line down

Now subtract 0043fa39 from the next line 0043fa0b...

(0043fa, cancels itself out) so...39 minus 0b..= ..2e

So here the difference between the two lines is a value of 2e; if we don't change anything; then the value 2e is going to cause the jump to move 46 spaces down to the place its going to jump TO...@ 0043fa39

In order not to move those 46 spaces...we change the 2e to..00
This forces the move to the next line down...

So long story short....hehehe

Change the 752E to EB00..<<--EB,jump,00,Zero places
and we are once again reged and no kinda NOP check will ever know...

Hope this has helped those not familiar with these difffernt options to work thru.....

Jeff