Volatility
My (incorrect?) Solution
Thu Dec 17 22:05:35 1998


Well, I didn't NOP anything, and you can't enter any registration code.. my patch just causes the program to automatically think it's registered, here's how I did it:

1. Disassembled CYT and looked for string references... no error message strings present, so I looked around the string "Registered" for a bit.

2. Found several references to "Registered", but only one looked interesting... found at the following code:

-------------------------------------------------------
*SNIP*

:00444B6C E8971FFCFF call 00406B08
:00444B71 8B55E4 mov edx, dword ptr [ebp-1C]
:00444B74 8B45F8 mov eax, dword ptr [ebp-08]
:00444B77 E888F0FBFF call 00403C04
:00444B7C 741B je 00444B99 :00444B7E A1089D4400 mov eax, dword ptr [00449D08]
:00444B83 8B00 mov eax, dword ptr [eax]
:00444B85 E8625EFEFF call 0042A9EC
:00444B8A 8B55FC mov edx, dword ptr [ebp-04]
:00444B8D 8BC3 mov eax, ebx
:00444B8F E8E4E3FFFF call 00442F78
:00444B94 E9A6000000 jmp 00444C3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444B7C(C)
|
:00444B99 C60511A8440001 mov byte ptr [0044A811], 01
:00444BA0 A1589C4400 mov eax, dword ptr [00449C58]
:00444BA5 8B00 mov eax, dword ptr [eax]
:00444BA7 8B8020020000 mov eax, dword ptr [eax+00000220]

* Possible StringData Ref from Code Obj ->"Registered"
|
:00444BAD BA30504400 mov edx, 00445030
:00444BB2 E82D85FDFF call 0041D0E4

*SNIP*
-------------------------------------------------------

3. Changed the above referenced je to a jne, started the program, and voila! registered!

NOTE: I was asked to re-enter the directory where my Netscape "Users" folder was, but after the first time, it works fine.

I also know this isn't exactly the solution Sandman was looking for, but this works, and when it works, I'm happy.


Volatility
Damn It All Anyhow
Thu Dec 17 22:09:02 1998
My previous message got a little garbled. The following line:
:00444B7C.. 741B.. je.. 00444B99
:00444B7E.. A1089D4400.. mov eax, dword ptr [00449D08]
Should be:
:00444B7C.. 741B.. je.. 00444B99
:00444B7E.. A1089D4400.. mov eax, dword ptr [00449D08]
which is the jump I patched.