Posted by ManKind on 1/15/2000, 6:00 am
202.188.50.189
Thanks to LaZaRuS for his wonderful idea and effort on (re)setting up The Newbie Project Forum. Thanks to Acid Cool 178 for informing me about this new project forum. Where should I begin? I think I should just make it as simple as possible, enough to just answer LaZaRuS's questions.
I. Easy tasks
I.1 What do you find when you look at target at first. Look what you find, when you look at the program, at the helpfile or somewhere else. Be sure not to use *any* tools yet, only look directly at the program.My answer:When I start it, I am presented with a nag with three buttons. There is a nice quite nice gfx on that nag. 'Evaluate' button lets us go into the main program to try it. 'Purchase' button will display the program's help file. 'Register' button will cause the nag to disappear but another small registration window will appear. There are three input fields for registration, Name, Company and Key code. If a wrong registration info is entered, "The key does not match license owner" will be presented and the first nag will reappear. Even if you click cancel on the registration window, the nag will reappear too. In the nag screen, users are asked to register the program after 30 days for EUR 49. There are some useful info regarding audio recording and how to use the program in the help file. In the about screen, there is one "Unregistered" text. Looking at it in a glance, it is a cool program.
I.2 Do you find anything interested in the W32Dasm disassembly? Now you can use a deadlisting from your favourite disassembler and look for suspicious stuff.My answer:Hmm, LaZaRuS asks about interesting and suspicious stuffs. Below are some String Data References of that kind to me:
"Your license is registered. Thank"
"Day %d of your 30 days trail period." ;;wrong spelling for 'trial', hehe
"Unregistered"
"The evaluation period has expired"
"The key does not match license " ;;should be the one I see earlier
"TempDirectory"
"\Software\Acon AS\Acoustica\2.0\" ;;registry
"RegisterInfo"
"Registered to "
"BWCC32.DLL"
"Algorithm"
I.3 What kind of window is the "Wrong-serial"-"messagebox" really? As you will see later the window that says "Wrong serial" is no Messagebox, but another kind of window.My answer:If LaZaRuS didn't inform me that the "Wrong-serial"-"window" is not messagebox, I would have said that it is a messagebox. After checking, it is a dialogbox which uses "MessageBoxExA" API function. For more information, get TORN@DO's wonderful "cRACKER's n0TES".
I.4 Where does the program store its Registration information? In the registry, in a file, in the EXE itself - where?My answer:In the registry. I am not sure if it stores the registration info in anywhere else but I am quite sure that registry is one place where it store the info in the following folders:
My Computer\HKCU\Software\Acon AS\Acoustica\2.0\RegisterInfo\
My Computer\HKU\.DEFAULT\Software\Acon AS\Acoustica\2.0\RegisterInfo\
Most probably, it didn't store the info in a file because those common file accesses breakpoints I set in SoftIce won't break.
I.5 Where does the program store how many days are left? Same as aboveMy answer:In the registry and probably in a file in C:\your_windows_dir\temp. There is very slight possiblity that it store the info in the EXE itself. The registry folders and values as below:
My Computer\HKCU\Software\Acon AS\Acoustica\2.0\General\
My Computer\HKCU\Software\Acon AS\Acoustica\2.0\Reverb\
My Computer\HKU\.DEFAULT\Software\Acon AS\Acoustica\2.0\General\
My Computer\HKU\.DEFAULT\Software\Acon AS\Acoustica\2.0\Reverb\
I am not really sure where or which is the value that is important but the important code of determining whether we are expired or not lies in the below address:
:00446C70
Its a call.That's all for my solution, thanks.
Service for Mankind
ManKind
mankind001@bigfoot.com