D0gBytesQuestion 1 Uninstall ManagerSun Nov 8 00:40:31 1998 Hello Gang.I see that I am late starting again and most every thing from question 1 has been answered. Well, too bad. I wrote it so I'm gonna post it. *Grin*Running the program produces a Splash shareware screen which tells us that we may use it for 30 days. The splash screen gives us two options. An OK button and a Register button. The Register button takes us to a screen where we are prompted to enter a "Registration Name" and a "Registration Key." Entering incorrect information produces a "Sorry Not a Correct Reg Key" screen with an OK button. Clicking OK on the first splash screen produces a 2d splash screen that tells us "This Product is Licenced to: UNREGISTERED VERSION" and "You Are On Day 1 Of Your 30 Day Evaluation Period." Again we have A "Register" button and an "OK" button.Clicking Register takes us again the the screen to enter a Name and key. Clicking OK takes us into the program in the Shareware mode. These screens give us some indication that entering a correct value in the "Registration Key" window would place the program into the registered mode. The screens also give us some things to look for in the "String Data" in W32dasm.Running the program with Filemon in the background gives us some interesting things to look at. C:UMUNINSMAN.ENU.DLL NOTFOUNDC:UMUNINSMAN.EN.DLL NOTFOUNDC:UMUNINSMAN.INI NOTFOUNDCreating these files did not register the program but it did write some default settings into the UNINSMAN.INI fileRunning the program with Regmon in the background gives us more interesting things to look at. HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced NOTFOUND < I don't think this is anything of value but I am not sure of it. 57 Uninsman QueryValueEx 0xC11EC3E8C:UMUNINSMAN.INI NOTFOUND < This changed when I created the file. It then did several reads and writes to this ini file. Uninsman QueryValueEx HKCUsoftwaremicrosoftwindowscurrentversionexplorerSetKey NOTFOUND < Not sure about this one either. Uninsman QueryValueEx HKCUsoftwareNoktaSoftwareUninstallManagerReg NOTFOUND < This one is Very interesting. Creating this key with RegEdit produces changes in the way the program deals with the shareware issues. I did not find a value that would register the program but this may be one way and it deserves more attention. I will look at this closely.W32Dasm Give us alot of string data to look through. Many of the normal things a cracker might look for and some interesting new ones. Something that probably needs looking into is the following strings."This Registration info is illegal" And something about "No Need to pirate the sofware" Could this be an indication of a checksum or some other anti-cracker activity by the author? Perhaps it screens for "Known Cracker handles" or screens for Known published keygens already on the internet. There is a String "Silicone Surfer" Is this a known cracker? We shall see. I am off to take a closer look.RegardsBytesDOgbytes...En; Enu; .Dlls by Jeff , Sun Nov 8 18:07 Re: dll. Thanks Jeff, I seem to remember that now by D0Bytes , Sun Nov 8 20:11