SV
Questions 4 6
Tue Dec 8 05:48:51 1998


Hi everybody
First thanks Sandman for your very great work !!!

Question 4 : Here is the OpenKey for your name and code.

:004039F5 8D442408 lea eax, dword ptr [esp+08]

* Possible StringData Ref from Data Obj ->"4D"
|
:004039F9 8B0DF4C64000 mov ecx, dword ptr [0040C6F4]
:004039FF 8B542404 mov edx, dword ptr [esp+04]
:00403A03 50 push eax
:00403A04 C744240C00020000 mov [esp+0C], 00000200 <- Size of a good key.
:00403A0C 68F8C64000 push 0040C6F8 <- The value of the key is stored
:00403A11 6A00 push 00000000 here after the call.
:00403A13 6A00 push 00000000
:00403A15 51 push ecx
:00403A16 52 push edx

* Reference To: ADVAPI32.RegQueryValueExA, Ord:00E1h
|
:00403A17 FF1580E54000 Call dword ptr [0040E580]
:00403A1D 8BF0 mov esi, eax
:00403A1F 8B4C2404 mov ecx, dword ptr [esp+04]
:00403A23 51 push ecx

* Reference To: ADVAPI32.RegCloseKey, Ord:00C2h
|
:00403A24 FF157CE54000 Call dword ptr [0040E57C]
:00403A2A 85F6 test esi, esi
:00403A2C 7407 je 00403A35

........... continued

:00403A35 E806000000 call 00403A40 <- call to the fonction where
:00403A3A 5E pop esi real code is generated and
compared to the key.
------------------------------------------------

Where it compare :

:00403BAD 8B45EC mov eax, dword ptr [ebp-14]
:00403BB0 68F8C74000 push 0040C7F8 <- Code "read.class" tppabs="http://disc.server.com/read.class" from key
:00403BB5 50 push eax <- Real code "!
* Reference To: MSVCRT40._mbscmp, Ord:02ECh
|
:00403BB6 FF158CE94000 Call dword ptr [0040E98C] <- Compare fonction
:00403BBC C745FCFFFFFFFF mov [ebp-04], FFFFFFFF
:00403BC3 83C408 add esp, 00000008
:00403BC6 83F801 cmp eax, 00000001

Question 6:

The key is 200h long.
First 100h is for the name and folowed by the code.
The first part of the code start with the famous string "8267-".
The next char is generated with the lenght of your name divide by 0Ch.
The rest of the divide is incremented to point at a char in the other famous string
"YMA19X@24$Z%"
Exemple: name of 14 chars, divide by 12 , rest is 2.
The next code char is A (fisrt char is position 0, A is position 2)
The others chars is ??? not yet etudied:-).

Excuse my poor english :-(.

SV