The Sandman
Re: Preliminary Information
Sat Nov 7 18:00:20 1998


Greetings Namuras,

First rate job, some good observations and equally good assumptions based on what you have found so far..

When I saw the text string "This registration info is illegal. No need to pirate this software. It is just 10$ to register. Support developing of this software by registering it..." I got the overal impression that the Software Author has used this text message as a last resort meassure to make potential pirates think twice before patching his program.

Perhaps later on in this project we will see what 'triggers' this message to be displayed.. Perhaps it has a number of known *fake* serials or handles to check on before allowing the User to register this program?..

When I first installed this program I played around with my system clock, putting it forward and then putting it backwards a few days just to see how it handled these changes. My 'first' observations were:-

It calculates the 'remaining' days you have left based on the date the actual .exe file was MODIFIED and NOT when it was CREATED. How do I know this?. Easy.. If you copy this .exe file and rename it to a different name then if you check its file properties then you will see that the Creation date has been updated but not it's Modified date. A an old but simple 'trick' from the 'old' ZX-Spectrum days no less. Of course I did some other tests to see if there was another way the program could be using to calculate the days remaining but this one seems the most likly one at this stage of the crack.

Hehehe, I could be wrong about this but unless someone finds the *true* method then how will I know I'm wrong!. Does anyone know how to 'prove' this assumption of mine beyond any reasonable doubt?.

Regards