Posted by Joseph on 1/24/2000, 10:49 pm
, in reply to "Task-3 "
209.179.250.106
Greetings, +Sandman asked some questions regarding the importance of the key AC200-0 found out by HaQue, and Eternal Bliss talked about the difficult he had manipulating the Registry entries in order to reinitialize Acoustica. Both of these prompted me to do some more probing in an attempt to answer the +Sandman's questions and find the reason for Eternal Bliss's difficulties, and this is what I find:
1. Every time the program resumes, regardless whether registered or not, makes a check for a valid registration by going through the key generating routine and comparing the results with what is stored in HKEY_CURRENT_USER\Software\Acon AS\2.0\General\RegisterInfo\Key, then one of two things happen:
A. If the calculated key matches the stored key, then continue.
1: Has the program been run before? Cmp ecx, 00024BCB
a: Not equal, then the program has been run, go check remaining time.
b: Equal, then check Cross:
1: If Cross equal 0 then initialize the program and start with 0 days used
2: Else go check for remaining number of days (or days used)
a: If number of days used is mor than 30, "Evaluation period expired
b: Else display nag screen with number of days used.
Here is a snippet of code where this starts:
:00446C0B 81F9CB4B0200 cmp ecx, 00024BCB
:00446C11 754E jne 00446C61
:00446C13 8B45F0 mov eax, dword ptr [ebp-10]
:00446C16 85C0 test eax, eax
:00446C18 7547 jne 00446C61
:00446C1A E851EB0300 call 00485770
Knowing how the program behaves in above section makes it very easy to play games with the program. Here how you can make it go to initial state any time you wish as long as it is not registered.
Restore the value in 'C' to its initial value 0x00024bcb and delete 'Cross' or make its value equal 0 and run the program, and you will by at "Day 0 of your 30 days trial period". You can't do this if 'C' has been deleted.
What happened when Eternal Bliss after he deleted all Registry items is this: 'C' became null = 0, and 'Cross' became null = 0, so every time the program was run it first checked for valid registration and did not find one, thus it went to check if the time was run before by comparing 'C' = 0 with 24bcb and they were not equal and that made the program it was run before so it went to check for the remaining time and subtracted 0 from the number for date it fetched and the deference was so big and concluded that the evaluation period has expired. To get of this messy situation, Eternal Bliss had to reinstall the program and that is what ever body would have done, but is there an alternative? Yes, there is. Before deleting the whole registry for the program, E. B. could have restored the value in 'C' to 24bcb and deleted 'Cross' or zeroed its value and then run the program and every thing would have gone to its initial stage. But what if 'C' has been deleted already? Simple. Registry entries can be created manually and name to any thing one wants. Suppose the subdirectory ..\2.0\General has not been deleted: Click on it with the right mouse select New- DOWOD value. This will create a new item in 'General' named New Value #1 and it will be highlighted. Type the letter 'C' as the new name and hit enter and 'C' will be the name of the new item. You can rename the item you created later if you wish by clicking on it with the right button and selecting rename. If the 'General' has been deleted, you can create it by following a similar procedure, but this time click with the right button 2,0 and select New - Key and then name it 'General'. This might sound confusing, but it is very simple and little experimentation will not hurt.Now to the questions raised by +Sandman:
First +Sandman suggested that the key 'AC200-0' discovered by HaQue might be a back door or some thing of the sort.
.I found it to be no different from any other key and perfectly natural taking int consideration how Acoustica.exe generates keys.
As long as the program has not been registered and 'Name' and 'Company' has not been created or are still blanc, the program calculation ends up to be 0 and prefixing this value with AC200- it becomes AC200-0. This key will be compared with 'Key' if exists or with a 0 and resets the not registered flag. But if 'Key' in the Registry file has the string AC200-0 it will set the registration flag and run as registered.Second +Sandman asks about the checking the program makes when it runs. Regarding this, this is what I found:
1. Every time the program runs, regardless whether it was registered or not, it checks for a valid registration by calculating the key from the values of 'Name' and 'Company', and if nor registered it checks for remaining time. The call to the key calculating routine is made from 00446E54 call 00446A74
2. Every time the About screen is opened the program performs a registration check by calling 446A74. This call is made from 00446774.
3. When one tries to register before the trial period is finished. The call to the calculating function is made from 00447294 call 00446A74.
4. When one tries to register after the trial period has been finished. This time the call to the calculation function is made from 00446F63 call 00446A.
I was not able to find any other registration the program might make, and I have no idea where to look for such possibilities.
Best regards,
Joseph