Posted by evilTeach on 1/17/2000, 6:20 pm
216.67.74.201
Hi everyone! Here's what I've gotten so far on Task #2 -- Please give feedback to help me improve, thanks :) 1) Disable Nagscreen:
I found that this program often uses TEST AL,AL for it's flags. One very special test occurs at 446E5A:
:00446E52 59 pop ecx
:00446E53 57 push edi
:00446E54 E81BFCFFFF call 00446A74
:00446E59 59 pop ecx
:00446E5A 84C0 test al, al <--- Here!!!
:00446E5C 7411 je 00446E6F
:00446E5E 8B8514FDFFFF mov eax, dword ptr [ebp+FFFFFD14]
:00446E64 64A300000000 mov dword ptr fs:[00000000], eax
:00446E6A E98D040000 jmp 004472FC
:00446E6F 57 push edi
:00446E70 E847FDFFFF call 00446BBC
:00446E75 59 pop ecx
:00446E76 84C0 test al, al
:00446E78 0F85A9010000 jne 00447027This is where the program tests to see if it's been registered. The call to 446a74 is the routine that does all the work...here we're just checking the results. If the program isn't registered, it'll jump to 446e64 (More on this address in the next question).
We could simply patch the program by turning the JE into a JNE (turning the byte 74 into a 75), but I dislike a program that works for unregistered users and not for registered users! Instead, I changed the jump location...make it jump to the next statement (turn the bytes 74 11 into 74 00). This makes the program ALWAYS think it's registered. No Reg Nag, no 30 Day Nag.
The only problem is that the Help|About dialog still says Unregistered.A second way to disable the nagscreen is at 447027. There we find a TEST BL,BL followed by a JE 4472F0. If the program jumps at this point, then no Register Nag appears. Again, looking for ways to make the program work for both registered and non-registered users, we need to have the Z Flag set. An easy way to do this? XOR AL,AL. (Thus, at 447027 we could patch by changing 84 DB into 32 C0.
2) Getting rid of Expired Notice:
The test for an expired program occurs just after the test for a registered program...at 446E76 above. The call to 446BBC does all the work, just as before. Here we need to always take the jump to 447027...so I decided to change the TEST AL, AL into TEST DL, DL since it appears that DL will always be non-zero. Thus, again, we'll ALWAYS jump. Now your program will display the Reg/Eval dialog with a message like: "Day 59 of 30"... (unless you've already patched to remove this Nag.)
3) About Box Patch:
Still working...I've found BEST PATCH...but want to find how to get this info in regardless of the reg status flag.
4) Reg Code for Name-Unregistered, Company-Unregistered: AC200-52856
5) BEST PATCH: I found a 2 byte patch that makes the program think it's reg'd AND extracts the Name/Company info from the Registry for the About Box.
:00446BA7 E8AE460400 Call 0048B25A ; lstrcmpa
:00446BAC 85C0 test eax, eax ; test for a serial # match
:00446BAE 0F94C0 setz al ; AL holds if match or not
:00446BB1 83E001 and eax, 00000001
:00446BB4 5F pop edi
:00446BB5 5E pop esi
:00446BB6 5B pop ebx
:00446BB7 8BE5 mov esp, ebp
:00446BB9 5D pop ebp
:00446BBA C3 retThis appears to be the place that is called in several places throughout the program. It is called on startup, and then again when the Help|About menu item is chosen. There are a couple of easy choices for a patch here. My first though went like this: We want this routine to return '1' if the serial numbers match (Which is what we want ALL the time!!!) Easiest should be to turn the AND EAX, 00000001 into OR EAX, 00000001. (There is a little danger here since the AND should also be clearing all but the L.O Bit, but it seems safe in this context.) This SHOULD be a 1 byte patch. Alas, trying to make changes in SoftIce results in an OpCode that uses more than the 3 allowable bytes. I expect that there is a 3 Byte OR opcode, but without an opcode list I am at a loss. Thus, I went about this another way:
Turning the TEST EAX, EAX into TEST AH, AH takes 2 bytes, but does the trick( PATCH: 85 C0 changes to 84 E4). No Nags, no expiration, Full Application...just add Name/Company to registry. Again, as in my previous answers, I have tried to make the application function the same for both Registered and Non-registered users.Looking for comments :) Anyone have the necessary OpCode list to get the 1 Byte patch?
Thanks,
evilTeach