VolatilityMy (incorrect?) SolutionThu Dec 17 22:05:35 1998 Well, I didn't NOP anything, and you can't enter any registration code.. my patch just causes the program to automatically think it's registered, here's how I did it:1. Disassembled CYT and looked for string references... no error message strings present, so I looked around the string "Registered" for a bit.2. Found several references to "Registered", but only one looked interesting... found at the following code:-------------------------------------------------------*SNIP*:00444B6C E8971FFCFF call 00406B08:00444B71 8B55E4 mov edx, dword ptr [ebp-1C]:00444B74 8B45F8 mov eax, dword ptr [ebp-08]:00444B77 E888F0FBFF call 00403C04:00444B7C 741B je 00444B99 :00444B7E A1089D4400 mov eax, dword ptr [00449D08]:00444B83 8B00 mov eax, dword ptr [eax]:00444B85 E8625EFEFF call 0042A9EC:00444B8A 8B55FC mov edx, dword ptr [ebp-04]:00444B8D 8BC3 mov eax, ebx:00444B8F E8E4E3FFFF call 00442F78:00444B94 E9A6000000 jmp 00444C3F* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:00444B7C(C)|:00444B99 C60511A8440001 mov byte ptr [0044A811], 01:00444BA0 A1589C4400 mov eax, dword ptr [00449C58]:00444BA5 8B00 mov eax, dword ptr [eax]:00444BA7 8B8020020000 mov eax, dword ptr [eax+00000220]* Possible StringData Ref from Code Obj ->"Registered" |:00444BAD BA30504400 mov edx, 00445030:00444BB2 E82D85FDFF call 0041D0E4*SNIP*-------------------------------------------------------3. Changed the above referenced je to a jne, started the program, and voila! registered!NOTE: I was asked to re-enter the directory where my Netscape "Users" folder was, but after the first time, it works fine.I also know this isn't exactly the solution Sandman was looking for, but this works, and when it works, I'm happy. Volatility Damn It All Anyhow Thu Dec 17 22:09:02 1998 My previous message got a little garbled. The following line: :00444B7C.. 741B.. je.. 00444B99 :00444B7E.. A1089D4400.. mov eax, dword ptr [00449D08] Should be: :00444B7C.. 741B.. je.. 00444B99 :00444B7E.. A1089D4400.. mov eax, dword ptr [00449D08] which is the jump I patched.Hello Violatilty by Jeff , Thu Dec 17 23:42