JosephQuestion 4Wed Dec 9 04:41:57 1998 Greetings everybody,Late is better than never, thus is my contribution to answer question number 4:As instructed, I created the DW key and named it 4D and stuffed it with a number. Starting my W32DASM I searched for "4D" and located it at 004039F9 and 00403E16.Examining the code I Placed a brake at 004039F9 and ran the Rcrawler and when it braked at 00403F9, I started stepping through the code until I reached:00403A62 mov edi, 0040c6F8 ;This is where my number was saved.00403A68 repnz 00403A69 scasb ;This is going to increment edi and decrement ;ecxonce for every bytein the number. My number ; had six Hex numbers which were considered ; as 3 bytes.00403A6A not ecx ;ecx was initialize to FFFFFFFF and ended ;as FFFFFFFB, the not op results in 4.00403A6C dec ecx ;adjust for exact number of bytes.00403A6D cmp ecx, 00000008 ; He is looking for an 8 byte or more number.00403A70 jnb 00403A83 ;My number was only 3 bytes so no jump.The code following the last instruction is run to perform the various tasks needed for the unregistered trial version of the Rcrawler including the check for the number of days remaining.After several infractions which included many calls we finally arrive at:00402E7B call 00403880 ;I suspected this call to be the one where the ;comparison between the number in CRW.98 ;and the current day to be made. 00402E80 add esp, 0000000400402E83 test eax, eax ;Well! Well, eax = 0000000100402E85 je 00402EBA ;Before this instruction was performed, I modified ;eax to 00000000 and clicked on the run button and ;magic, the program did what it was supposed to do.It flashed a new screen at me saying: "This is an UNREGISTERED version of Registry Crawler.It has reached the end of the trial period." When I clicked the OK button everything vanished and the program will run no more.The records at KEY_LOCAL_MACHINE SOFTWARE 4Developer Crawler and KEY_CLASSES_ROOT RCW remained unchanged, but the file RCW.98 has vanished.That is where I am at present and try to restore the file RCW from another installation on a second computer.PS. Last night after I downloaded and installed Rcrawler, I tried to follow the registration procedure and found some interesting things:First I found the cmp edi, 00000008 at 00403A6D mentioned above and following the process after I provided a valid number of bytes I noticed 8267- started to pop up and at:00403AFD mov eax,dword ptr [ebp-10] ;An offset number, starts with 000403B00 mov al, byte ptr[eax+0040C6F8] ;0040C6F8 is where name is stored.00403B06 cmp al, 7F ;Is it the last of the alphanumerical?00403B08 jg 00403BDF00403B0E cmp al, 20 ;Is it still within range?00403B10 jl 00403BF000403B16 cbw ;Convert byte to word.00403B18 mov cl, 0200403B1A idiv cl ;Divides the Ascii value by 200403B1C add al, 22 ;Adds 22 to the result.00403B1E cmp al, 5A ;Is it an upper case character?00403B20 jle 00403B28 ;Jump if so.Finally and after other comparisons an conditional jumps the program arrive at:00403B3B call 004088A8This call takes us deep into a library file which I was too tired to follow, but the processed bytes appears at the end of the mysterious number, 8267-. The process was repeated for the fourth and seventh characters of my 8 character name of 'abcdefgh' and the final result looked like this:8267-RTU.I thought this might be a good S/N for Mr. abcdefgh, but did not work. After I restore Rcrawler I will try again because I have a strong feeling this is the right place.Best regards,Joseph