Cracking Projects For Newbies

Project VI
Thursday, 04-Feb-99 15:33:56
    194.163.250.33 writes:

    It is clear that the program takes the registration number from the
    name you type in.
    Perhaps the number is created with the help of advapi32.dll, user32.dll
    or kernel32.dll because there are some processes that seems like being
    connected with it.

    program:
    Memory game 95

    type of protection:
    name and code

    start program
    files used:
    windows\system\commdlg.dll
    windows\system\comdlg32.dll
    windows\system\winspool.drv
    windows\system\shell32.dll
    memory\memo95.exe
    uses registry:
    HKCU\Control Panel\*
    HKCR\CLSID (OpenKey)
    HKCU\Software\Microsoft\Windows\CurrentVersion\
    Explorer (CreateKey)
    HKLM\Software\Microsoft\Windows\CurrentVersion\
    Explorer (CreateKey)
    HKCU\Software
    HKCU\Software\Kertes Gábor\Memory game 95\*
    HKCU\Software\Kertes Gábor\Memory game 95\
    Settings\Registration code (QueryValueEx)
    HKLM\Software\Microsoft\Windows\CurrentVersion
    \SubVersionNumber (QueryValueEx)

    opening register screen
    files used:
    memory\memo95.exe
    uses registry:
    -

    try to register (name Pirate Copy and code 11111111 typed):
    files used:
    memory\memo95.exe

    Disambling with W32Dasm

    imported functions:
    kernel32.dll
    user32.dll
    gdi32.dll
    comdlg32.dll
    winspool.drv
    advapi32.dll
    shell32.dll
    comctl32.dll

    Import Module 006: ADVAPI32.dll
    Addr:00036BB6 hint(00D9) Name: RegOpenKeyExA
    Addr:00036BC6 hint(00E1) Name: RegQueryValueExA
    Addr:00036B96 hint(00C2) Name: RegCloseKey
    Addr:00036BA4 hint(00C6) Name: RegCreateKeyExA
    Addr:00036BFE hint(00C9) Name: RegDeleteKeyA
    Addr:00036BDA hint(00EC) Name: RegSetValueExA
    Addr:00036BEC hint(00CB) Name: RegDeleteValueA

    search for "registr"
    there are some lines like this
    * Possible Reference to String Resource ID=612**: "REGISTRATION NAME"
    * Possible Reference to String Resource ID=612**: "REGISTRATION CODE"
    * Possible StringData Ref from Data Obj ->"Registration"
    * Possible Reference to String Resource ID=612**: "Sorry, the registration code does not match! Try again or Ca"

    in the imported functions in connection with "A" there is often spoken of processes that
    perhaps are conected with the register process. (i.e. GetStringTypeA
    CompareStringA
    RegisterClassA)
    perhaps the "A" has a close connection to the registration number.


    information found in order.txt
    Registration name will be used to create the code, and will appear on the
    About dialog after registration (Can be the same as Name))

    information found in the help file
    the registration code is a 16 digit hex code
    Your registration code is good for only that name you specified in your order.



    Fenston


Message thread:

Fenston: Project VI (04-Feb-99 15:33:56)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.