PhilSolutionFri Dec 18 15:06:24 1998 Task 3Okay...I found two ways to register this program. One using S-ice and the other Wdasm.First with S-ice: I tried all the common breakpoints, getwindowtexta, getdlgitemtexta...but none worked so I resorted to 'hmemcpy'. I started up CYT and entered 'Pirate Copy' and '1234567' note: your name and serial number has to be atleast 7 characters long, pressed register and s-ice opened. I pressed 'F12' seven times until I landed in the program, CYT!CODE... and then F10 a couple of times until I came to CS:0043F9EE.*Snipcs:0043F933 mov eax,[ebp-04] -your name ...cs:0043F9FB call 0041d0b4 -get real serial mov edx,[ebp-08] -real serial ... call 00403c04 -compare real to fakecs:0043FA09 jnz 0043fa39 -jump if... ...so you just have to nop out the 'jnz' at cs:0043FA09 to have the program register with any name/serial. Second with WDasm: I started up WDasm and loaded up CYT. I then opened up the 'String Data Reference' and looked for anything that might be of interest. The only thing worth checking out was the word 'Registered'. So I clicked on that and landed at cs:0043F4F9 but found nothing interesting there, so I clicked on 'Registered' again hoping there might be another area. And there was, cs:00444BAD.*Snip ...:00444B77 call 00403c04 -compare real to fake:00444B7C je 00444b99 -jump to goodguy if equal ...*Referenced by a (U)nconditional...|:00444B7C (C)|:00444B99 mov byte ptr [004a811], 01 -register the program ...*Possible StringData..."Registered" -YOU LAND HERE:00444BAD mov edx,00445030:00444BB2 call 0041d0e4 ...I then loaded up 'Psedit' and change 'jz' at cs:00444B7C to 'jnz' and the program registered itself without the need of a name or serial.That's about it... Re: Solution by Joseph , Sat Dec 19 06:35 Re: Solution by Joseph , Sat Dec 19 17:56