Cronos
Damn, Heres part 2.
Fri Dec 18 12:58:15 1998


s_Button1Click:
1000:0043f954 0c427574746f6e3143.. ds "Button1Click"
1000:0043f961 12 db 12
1000:0043f962 00 db 00
1000:0043f963 88fa4300 dd offset 43fa88h
s_Edit1Change:
1000:0043f967 0b4564697431436861.. ds "Edit1Change"
1000:0043f973 12 db 12
1000:0043f974 00 db 00
1000:0043f975 e4044400 dd offset 4404e4h
s_Edit2Change:
1000:0043f979 0b4564697432436861.. ds "Edit2Change"
s_TForm7:
1000:0043f985 0654466f726d37 ds "TForm7"
;XREFS
1000:0043f98c 04 db 04
1000:0043f98d 00 db 00
1000:0043f98e d4ff4200 dd offset 42ffd4h
1000:0043f992 68604300 dd offset 436068h
1000:0043f996 80e84200 dd offset 42e880h
1000:0043f99a fcee4200 dd offset 42eefch
1000:0043f99e 8b db 8b
1000:0043f99f c0 db c0
1000:0043f9a0 a4f94300 dd offset 43f9a4h
;XREFS
1000:0043f9a4 07 db 07
s_TForm7:
1000:0043f9a5 0654466f726d37 ds "TForm7"
1000:0043f9ac 4cf84300 dd offset 43f84ch
1000:0043f9b0 185c4200 dd offset 425c18h
1000:0043f9b4 3b db 3b ;';'
1000:0043f9b5 00 db 00
s_Unit7:
1000:0043f9b6 05556e697437 ds "Unit7"
1000:0043f9bc 00 db 00
1000:0043f9bd 00 db 00
1000:0043f9be 8b db 8b
1000:0043f9bf c0 db c0
;XREFS
1000:0043f9c0 e8cbadfeff call 42a790h
1000:0043f9c5 c3 ret
1000:0043f9c6 8b db 8b
1000:0043f9c7 c0 db c0
RegisterButton:
;XREFS
1000:0043f9c8 55 push ebp
1000:0043f9c9 8bec mov ebp, esp
1000:0043f9cb 6a00 push 00h
1000:0043f9cd 6a00 push 00h
1000:0043f9cf 53 push ebx
1000:0043f9d0 8bd8 mov ebx, eax
1000:0043f9d2 33c0 xor eax, eax
1000:0043f9d4 55 push ebp
1000:0043f9d5 687afa4300 push offset 43fa7ah
1000:0043f9da 64ff30 push dword ptr fs:[eax]
1000:0043f9dd 648920 mov fs:[eax], esp
1000:0043f9e0 8d55fc lea edx, [ebp-04h]
1000:0043f9e3 8b83f4010000 mov eax, [ebx+1f4h]
1000:0043f9e9 e8c6d6fdff call 41d0b4h
1000:0043f9ee 8b45fc mov eax, [ebp-04h]
1000:0043f9f1 50 push eax
1000:0043f9f2 8d55f8 lea edx, [ebp-08h]
1000:0043f9f5 8b83f8010000 mov eax, [ebx+1f8h]
1000:0043f9fb e8b4d6fdff call 41d0b4h
1000:0043fa00 8b55f8 mov edx, [ebp-08h]
1000:0043fa03 58 pop eax
1000:0043fa04 e8fb41fcff call 403c04h
The Crack Is Here:
1000:0043fa09 752e jnz 43fa39h
1000:0043fa0b a1209b4400 mov eax, [449b20h]
1000:0043fa10 8b00 mov eax, [eax]
1000:0043fa12 e8d5affeff call 42a9ech
1000:0043fa17 a1109d4400 mov eax, [449d10h]
1000:0043fa1c 803800 cmp byte ptr [eax], 00h
1000:0043fa1f 750c jnz 43fa2dh
1000:0043fa21 a1089d4400 mov eax, [449d08h]
1000:0043fa26 8b00 mov eax, [eax]
1000:0043fa28 e863adfeff call 42a790h
;XREFS
1000:0043fa2d a1cca74400 mov eax, [44a7cch]
1000:0043fa32 e859adfeff call 42a790h
1000:0043fa37 eb26 jmp 43fa5fh
;XREFS

How nice! TForm7 is laid out before us. The addresses of the routines for Button1 click and Button2 click are there for us to see. It is a simple matter to look down the code for the Button 2 click and find a conditional jump not very far in. The routine before it contains quite a few 'arithmetic' type instructions, which I'm not even going to bother to look at closely. We can NOP this jump out and see the effect - Task 3 solved.

Cronos.

Anyone using WDAsm ? heh.

Incidentally, try this:
go into DOS and type
cd c:windows empor~1
dir/a:s
Anyone else got any hidden directories there ? Any files in them ? Does clearing cache/history always remove them all ?