Domnick
Question 4 .... 4D Key
Tue Dec 8 01:35:59 1998


Fist of all let me start by saying that I know a lot of what I found has some significance, but I can't make heads or tails of it so maybe I can pass on a train of though to someone that can do something with it. Here it goes:

First of all, Like Jeff, I already had a DWord key called 4D under the branch HKEY_LOCAL_MACHINESOFTWARE4Developer rawler, but I think that I know why... I'll explain why later.

When I looked inside my 4D key, its contents were very large, in fact I couldn't see it all until I did a Modify and saw that at line number 0000 were the contents 'Domnick' and further down at line 0100 was '123456'. These were the values that I had been testing with, prior to reading question 4-6. How did they get there? ... Well I put a BPX on 'GetWindowTextA' and pressed the 'Unlock' button on the register screen and SoftICE popped up. After F-11 out and quite a few f-10's (27 I think) I came to the line:

014F:00403D81 MOV EAX,[EAX]

When I viewed EAX after this line it 'Domnick' from the register window.

Also of note (although probably irrelevant) after stepping through the line

00403D83 PUSH 0040C918

I pressed 'd 0040C918' I saw UNREGISTERED USER.

Anyhow, later on down the way I came to:

00403DCE TEST EAX,EAX
00403DD0 JZ

When I toggled the zero flag (R FL Z) and then cleared my break points and exited out of SoftICE, I was presented with a window that said, "Welcome to the REGISTERED version of registry crawler. Please restart registry crawler so that all limitations are removed." When I pressed OK, the window for the registry crawler program still said unregistered version, and when I restarted the program, I was presented with the friendly old nag screen and limit of 10 bookmarks.

Upon further investigation, I found that at line

00403E1B MOV 0040C6F4

moved the value '4D' into EAX. This has to do w/ Registry crawler creating a key in the Windows Registry, but other than what I mentioned here, I am lost. I hope this information helps someone.

I am off to find out what I can using W32DASM.