Strange Found Friday, 05-Feb-99 22:41:52
Hi, This is my first time that I found the reg number by Softice. When I traced at 0040CCCC, I changed the Zero Flag. Then I found the program have been comparing my regcode with something one by one. It is very strange that when I found the correct regcode and use it to register, the program did not go into the loop 0040CCD6-0040CCF0, and the wrong regcode did the same thing. regards, Henry * Referenced by a CALL at Addresses: |:00401D3D , :00401E74 , :00402194 , :00405C3D , :0040B73A |:0041C424 , :0041C43D | :0040CCC0 83EC04 sub esp, 00000004 :0040CCC3 833D24F1420000 cmp dword ptr [0042F124], 00000000 :0040CCCA 53 push ebx :0040CCCB 56 push esi :0040CCCC 7537 jne 0040CD05 :0040CCCE 8B4C2410 mov ecx, dword ptr [esp+10] :0040CCD2 8B542414 mov edx, dword ptr [esp+14] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0040CCF0(C) | :0040CCD6 8A01 mov al, byte ptr [ecx] :0040CCD8 3A02 cmp al, byte ptr [edx] :0040CCDA 751E jne 0040CCFA :0040CCDC 0AC0 or al, al :0040CCDE 7412 je 0040CCF2 :0040CCE0 8A4101 mov al, byte ptr [ecx+01] :0040CCE3 3A4201 cmp al, byte ptr [edx+01] :0040CCE6 7512 jne 0040CCFA :0040CCE8 83C102 add ecx, 00000002 :0040CCEB 83C202 add edx, 00000002 :0040CCEE 0AC0 or al, al :0040CCF0 75E4 jne 0040CCD6 Henry |
Henry: Strange Found (05-Feb-99 22:41:52) |
|
Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.