Posted by CodeJACKz on 1/14/2000, 4:19 pm
, in reply to "Checkin in!!"
159.134.226.149
Hey all! going through the first steps i have discovered that i dont like regmon and filemon. there is too much fitering of operations to be done even when i have shutdown everything but windows itself!. but as a result of looking at regmon and tracing back i think the key is stored in the registry. Someone confirm please?
then i went to w32dasm and looked for the error message in the string data search that came up when i entered the wrong registration details. this led me to offset ":00446fab" which i assume is the push for the message box.??
a little further on, in the string data search, i found the text that would come up if i had entered the correct registration information. this led me to the offset ":00446f79" which again i assume is the valid registraion message box push.
Somewhere in this area is where the reg code is created but alas this is where my assembly lets me down. Is there anyone that could explain what is going on or what i am looking at, or is my assembly too crap to allow my on this forum?????!!!!!