JeffObservationsPreservationsAnswervationsSun Dec 6 17:59:41 1998 Hi all!Ahhhh; a new project; COOL!Once again I will try to be short and sweet and not long winded as I can sometimes tend to be...Did I ever tell you about...Whoops...another time...RegCrawler version 1.2 ...12698XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX------------------------------ Here's the information you need to begin... Program Name: Registry Crawler V1.2 Program URL: http://www.proweb.co.uk/~greenway/Files/regc.zip Program Size: 229K XXXXXXXXXXXXXXXXXXXXXXXXXXXX++++++++++++++++++++++++++++++++Searching in RegMon:lines not found in regmon:30 Rcrawler QueryValueEx HKLMSoftware4Developer rawler4D NOTFOUND 53 Rcrawler QueryValueEx HKLMSoftware4Developer rawler4D NOTFOUND lines of questionable meaning:33 Rcrawler QueryValueEx HKCRRCWValue SUCCESS 30 22 B 0 80 Rcrawler QueryValueEx HKLMSoftware4Developer rawlerSettingsKeys SUCCESS 1 0 0 0 83 Rcrawler QueryValueEx HKLMSoftware4Developer rawlerSettingsValues SUCCESS 1 0 0 0 86 Rcrawler QueryValueEx HKLMSoftware4Developer rawlerSettingsData SUCCESS 1 0 0 0 92 Rcrawler QueryValueEx HKLMSoftware4Developer rawlerSettingsHKCR SUCCESS 0 0 0 0 104 Rcrawler QueryValueEx HKLMSoftware4Developer rawlerSettingsMatchString SUCCESS 0 0 0 0 151 Rcrawler SetValueEx HKLMSoftware4Developer rawlerSettingsSearchIsActivePage SUCCESS 0x1 NOTE: UPON FURTHER INSPECTION OF THE REGISTRY ITSELF THE ABOVE LINES OF QUESTIONABLE MEANING (to me at least) ARE THE KEYS AND VALUES ASSIGNED IN THE SETTINGS FOLDER IN REGISTRY...============================================================Searching in FileMon:Filemon:104 10:08:18 AM Rcrawler FindOpen C:WINDOW W.D98 SUCCESS RCW.D98 105 10:08:18 AM Rcrawler FindClose C:WINDOW W.D98 SUCCESS 106 10:08:18 AM Rcrawler Open C:WINDOW W.D98 SUCCESS OPENEXISTING OPENALWAYS 107 10:08:18 AM Rcrawler Seek C:WINDOW W.D98 SUCCESS End Offset: 0 108 10:08:18 AM Rcrawler Seek C:WINDOW W.D98 SUCCESS End Offset: -1 109 10:08:18 AM Rcrawler Read C:WINDOW W.D98 SUCCESS Offset: 5 Length: 1 110 10:08:18 AM Rcrawler Seek C:WINDOW W.D98 SUCCESS Beginning Offset: 0 XXXXXXXXXXxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxXXXXXXXXTO find RCW.D98startfindfiles&folders type in: RCW.D98 open in notepad: inside states: 729648------------------------------------------------------------NOTE:Having seen Eternal Bliss post stating that upon changing his clock forward he lost all capability to open the program when he changed the clock; and uninstalling and re-installing did not revert program to operating status......I did what perhaps I will make a firm habit of doing in the future projects....I made a back-up copy of HKEY_LOCAL_MACHINE..Software..4Developers..folder which copied all of its contents to a .reg file...I also made a copy of the RCW.D98 file: mine contains the # 729648...I noted that Eternal Biss's # was 729635...and that Colin's # was 729648...I thought at this time that it was either an 'install date' or a number change that produced the error box...unregistered bla bla....and dis-allowed the program to continue...I then reset the clock forward one year; error message appears telling you that you have 30 seconds to exit before hard drive formatting begins....(okay I have your attention *grin*)(just a bad joke; this does NOT happen don't worry)For now I opened the registry and the filedirectoryHKEY_LOCAL_MACHINE..Software..4Developers..folder...NO LONGER exisited...GONE!!!So I double clicked my back-up .reg and it reinstalled the missing folder re-ran RegCrawlerand it once again worked fine.....------------------------------------------------------------I then checked my RCW.D98 file thinking that it may have been changed to 729635 as Eternal Bliss seems to indictate...but it did not...it remained 729648...hummmm...Note: (( MAKE sure you have made a copy of this before you change it))...I then changed the value 729648...to 999999...This change also popped the error: Unregistered and dis-allowed the program to open...I did a search for the RCW.D98 file...and it was no longer to be found in C:windowsI then Made a copy of my saved copy and re-inserted it into C:windows and it once again was allowed to open with 30 day Nag.... ============================================================Lesson here: Always make copys of any files you may advertently, or inadvertently, make a change too.XXXXXXXXXXXXxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxXXXXXXX Question 1. Where in the System Registry does this program store it's default program settings?.It stores the settings in [HKEY_LOCAL_MACHINE..Software..4Developers..RCrawler..Settings]Note: there would seem to be a key file not installed called @: HKLMSoftware4Developer rawler4D <<--4DXXXXXXXXXXXXxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Question 2. Where does this program store it's 'days left..' counter?.I believe the RCW.D98 file to be the file that somehow contains the date check.Manipulations may yet prove to be successful depending upon the checksum routine employeed in loading and checking this file for checking for tampering.....(heheheh listen to me am I getting to sound 'dah, enabled' or what... :)XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Question 3. What are the Main protection systems employed by this program? Example, is it protected with:- Nag screens,Serial protected,hidden Registration Screen, crippled/restricted functions,Time Limited,Indirect Code Addressing,Self-Modifying Code,Dongle etc etc.#1 Splash screen (saying 30 day trial version) with options: unlock, reg online, reg later, reg by mail etc. #2 After 30 days, you will have to register to run the program else it will exit and NO LONGER open nor run the program.#3 Changing the clock Forward will cause the program to display a Unregistered nag; and the program will no longer be displayed nor run.#4 You have to enter a User Name and a Registration Code. Then press Unlock. ============================================================ Question 4. What (if any) 'interesting' files are used by this program?. Ignore the normal windows system files such as .DLL's, .SYS etc.-----------------Could be some of these-----------------#130 Rcrawler QueryValueEx HKLMSoftware4Developer rawler4D NOTFOUND 104 10:08:18 AM Rcrawler FindOpen C:WINDOW W.D98 SUCCESS RCW.D98 In Dasm:#2"YMA19X@24$Z%" <<<--- I will want to take a strong look at this one...are there more of these hiding around......?#3Here I find a good comparison to follow:"Welcome to the REGISTERED version " ->"of Registry Crawler." * Referenced by a (U)nconditional or (C)onditional Jump at Address:|:00403E5B(C)|:00403E63 6A00 push 00000000* Possible StringData Ref from Data Obj ->"REGISTERED User" |:00403E65 68D0CB4000 push 0040CBD0* Possible StringData Ref from Data Obj ->"Welcome to the REGISTERED version " ->"of Registry Crawler." |:00403E6A 6850CB4000 push 0040CB50:00403E6F 50 push eaxAND here is my favorite.....if it takes me somewhere useful....#4"The registration information you " ->"have entered could not be validated." * Referenced by a (U)nconditional or (C)onditional Jump at Address:|:00403E8C(C)|:00403E94 6A30 push 00000030* Possible StringData Ref from Data Obj ->"UNREGISTERED User" |:00403E96 683CCB4000 push 0040CB3C* Possible StringData Ref from Data Obj ->"The registration information you " ->"have entered could not be validated." |:00403E9B 68FCC94000 push 0040C9FC:00403EA0 50 push eax+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Well; i think that about does it for this part of the questions;I will now start playing with these settings and values to see if any neat things blow -up... :)Cya all at the 'projects'Great Crackin' to ya all!Re: ObservationsPreservationsAnswervations by The Sandman , Sun Dec 6 18:59 Hmmm.. by Devil-C , Sun Dec 6 18:15 Some starting ideas by Domnick , Sun Dec 6 20:55 Re: Hmmm.. by The Sandman , Sun Dec 6 19:57