Posted by Eternal Bliss on 1/14/2000, 7:34 pm
, in reply to "I'm in too. 8)"
194.69.104.29
I.1 What do you find when you look at target at first. Look what you find, when you look at the program, at the helpfile or somewhere else. Be sure not to use *any* tools yet, only look directly at the program.
--------------------------------------------
When starting the program, I get a nag screen saying it's shareware and a count of the number of days it's used. 3 buttons are available: Evaluate, Purchase and Register. On clicking "Evaluate", you get to use the program. Clicking "Purchase" will open up the helpfile. Clicking "Register" will show you a window that you have to enter "Name", "Company" and "Key code".
There is an empty directory called "Settings" under the main folder where you installed this program. Not sure if that has got any use yet.Helpfile says "After Acon AS has recieved the payment, you will get a key code sent to you by mail or email."
When you try registering with the wrong serial, you will get "The key does not match license owner". Something that we can look for in the String Data Reference in W32dasm. 8)
Clicking on the "OK" button here will bring you back to the previous nagscreen.Days can be reversed simply by changing back the system clock. When you set the time back more than the day you installed, you get an expired message. On clicking "ok", you are given the register window. If you click cancel on that window, the program will exit and the helpfile will be shown. Setting the system clock back once again will do the trick. 8)
============================================
I.2 Do you find anything interested in the W32Dasm disassembly? Now you can use a deadlisting from your favourite disassembler and look for suspicious stuff.
--------------------------------------------
For newbies:
click on the little toolbar button called "Strn Ref" which is for the strings seen in the program. Search for suspicious or interesting stuff. Once you find it, double click on that line in the SDR (String Data Reference) and you will be brought to the place in the codes where the string is used. Double click on the same line again to make sure that there is only one such location, else you will be brought to another location.SDR has got the following:
1) Company (004468CD, 00446ADD, 0042CB67)
2) Name (00446AB1, 0042CB37, 004468A0)
3) Key (0042CB96, 00446B04)
4) Registered to (004468E8)
5) RegisterInfo (00446AE2, 00446B09, 0042CB3C, 0042CB6C, 0042CB9B, 004468AB, 004468D2, 00446AB6)
6) The evaluation period has expired. (00446E8A)
7) The key does not match license owner. (00446FAB, 004472CF)
(seen when you register wrongly)
8) Unregistered (0042CD0C, 0044678B)
9) Your license is registered. Thank... (00446F79, 004472AA)
10) Day %d of your 30 days trail period. (0042C90D)In the Dialog Reference:
DialogID_03E8, CONTROL_ID:00C7, "Unregistered"============================================
I.3 What kind of window is the "Wrong-serial"-"messagebox" really? As you will see later the window that says "Wrong serial" is no Messagebox, but another kind of window.
--------------------------------------------
hmmm.... I have seen two types of windows... It's either a messagebox or a dialog box... If it is not a messagebox, it might be a dialog box then....============================================
I.4 Where does the program store its Registration information? In the registry, in a file, in the EXE itself - where?
--------------------------------------------
Using Filemon, there isn't anything of significance.
Using Regmon,
HKCU\\Software\\Acon AS\\Acoustica\\2.0\\RegisterInfo
is accessed. The "Name", "Company" and "Key" are all under it.============================================
I.5 Where does the program store how many days are left? Same as above
--------------------------------------------
Using Regmon and making a backup of the registry keys involved, I deleted an entry at a time looking for interesting results.
The key HKEY_CURRENT_USER\\Software\\Acon AS\\Acoustica\\2.0\\Reverb\\Cross
has interesting result when I deleted it. I got the expired message!!!
My value for it is 1bf5e7c. I haven't figured out how it is formed. I installed it on 14th Jan.
But adding 80 decimal to it, I manage to get it to become Day 0 again after I set my system clock a day forward...