Colin
Task 4
Mon Dec 28 07:35:10 1998


I first unregistered CYT as per Task 2 then ran the prog to enter reg name and serial code as PIRATE COPY and 666111666 to get Sorry, wrong code nag. Then I entered the correct code as per Task 1. Before clicking OK I then Ctl-D to enter Soft Ice and BPX HMEMCPY, X to go back to prog and clicked OK. Soft Ice popped up. I then pressed F-12 about 18 times until I got to following code:

:0043FA00 8B55F8 mov edx, dword ptr [ebp-08] ;Loads location for real serial 07FBDBC
:0043FA03 58 pop eax ;Pops location for input serial 007fBDA4
:0043FA04 E8FB41FCFF call 00403C04

:00403C04 53 push ebx
:00403C05 56 push esi
:00403C06 57 push edi
:00403C07 89C6 mov esi, eax ; moves input location to esi
:00403C09 89D7 mov edi, edx ; moves real location to edi
:00403C0B 39D0 cmp eax, edx ; subtracts 1 location from the other
:00403C0D 0F848F000000 jz 00403CA2 ; not zero continue
:00403C13 85F6 test esi, esi
:00403C15 7468 jz 00403C7F ;not zero continue
:00403C17 85FF test edi, edi
:00403C19 746B jz 00403C86 ;not zero continue
:00403C1B 8B46FC mov eax, dword ptr [esi-04];load 09h
:00403C1E 8B57FC mov edx, dword ptr [edi-04];load 09h
:00403C21 29D0 sub eax, edx ; make sure 1 serial is not longer than other
:00403C23 7702 ja 00403C27 ;not above continue
:00403C25 01C2 add edx, eax

:00403C27 52 push edx
:00403C28 C1EA02 shr edx, 02 ;shift right to make edx = 2
:00403C2B 7426 jz 00403C53 ;not zero continue

:00403C2D 8B0E mov ecx, dword ptr [esi];Load 1st 4 bytes from input serial
:00403C2F 8B1F mov ebx, dword ptr [edi];Load 1st 4 bytes from real serial
:00403C31 39D9 cmp ecx, ebx ;Compare 1st 4 bytes of both serials
:00403C33 7558 jnz 00403C8D ;Jumps on wrong cmp(1st) continues right cmp(2nd)
:00403C35 4A dec edx ;02 to 01
:00403C36 7415 jz 00403C4D
:00403C38 8B4E04 mov ecx, dword ptr [esi+04] ;Load 2nd 4 bytes from input serial
:00403C3B 8B5F04 mov ebx, dword ptr [edi+04] ;Load 2nd 4 bytes from real serial
:00403C3E 39D9 cmp ecx, ebx ;Compare these 2nd 4 bytes of both serials
:00403C40 754B jnz 00403C8D ;zero continue
:00403C42 83C608 add esi, 00000008
:00403C45 83C708 add edi, 00000008
:00403C48 4A dec edx ; 01 to 00
:00403C49 75E2 jnz 00403C2D ;zero continue
:00403C4B EB06 jmp 00403C53 ;Conditional Jump

See next post for more
Cop U Later
Colin