Pedro
Finished task 3
Fri Dec 18 19:06:26 1998


I ran the program and then typed in 1234567 for the name and 1234567 for the serial. That appears to be a minimum for both of these fields because as soon as I had typed in 7 chars in each the registered button became available.
I set a bpx hmemcpy then pressed f12 7 times then followed the ret's back with f10 until I got to this bit of code.



:0043F9EE 8B45FC mov eax, dword ptr [ebp-04]
:0043F9F1 50 push eax ;our bogus serial
:0043F9F2 8D55F8 lea edx, dword ptr [ebp-08]
:0043F9F5 8B83F8010000 mov eax, dword ptr [ebx+000001F8]
:0043F9FB E8B4D6FDFF call 0041D0B4 ;this call generates the serial
:0043FA00 8B55F8 mov edx, dword ptr [ebp-08]
;edx = the correct serial
:0043FA03 58 pop eax
:0043FA04 E8FB41FCFF call 00403C04 ;this call check to see if regged
:0043FA09 752E jne 0043FA39
;NOP this jne and you can type ;in anything in to be registered

:0043FA0B A1209B4400 mov eax, dword ptr [00449B20]
:0043FA10 8B00 mov eax, dword ptr [eax]
:0043FA12 E8D5AFFEFF call 0042A9EC




Actually I thought this would be a bit harder after the torment I went through in task 2 :)

Pedro