Posted by HaQue on 1/23/2000, 11:11 pm
, in reply to "Re: TASK II"
203.108.0.58
=========================================================
II.3 Make your name and company appear in the
"About screen".
In registered versions, the name and company
replace the "Unregistered" in the nagscreen.
Find a patch for it.---------------------------------------------------------
Okay, I wasn't sure if we are supposed to register the
program properly to get the name and company in. I decided
to do ONLY what the task states.
When you are asked to register, this patch will put your
name and company in the ABOUT box regardless of the serial.
:00446774 E8FB020000 call 00446A74 <--- is prog registered?
:00446779 59 pop ecx
:0044677A 84C0 test al, al
:0044677C 0F85E6000000 jne 00446868 <--patch to "Je"
:00446782 66C785FCFDFFFF0800 mov word ptr [ebp+FFFFFDFC], 0008* Possible StringData Ref from Data Obj ->"Unregistered" <--- the about box won't show this now!
|
:0044678B 681E9F4900 push 00499F1E
:00446790 83C4FC add esp, FFFFFFFC
Actually, I just tested this, and it works BUT i also found a
REAL SERIAL in softice and tested that. As I thought it
shows UNREGISTERED. So I guess it is not a solution.Ideally, a "jmp" at the patch location would work, but I
tried it in HIEW, and it seems to stuff up the code
after it. I think this has to do with the amount of bytes
the opcodes are.I changed 0044677C to a "jmp", using HIEW's feature of F3 - edit,
then F2 for ASM, and it does put your name and company in the About
box, regardless of the success of the registration process.without a alid serial it still will not register but will
put your name and company in, and with a valid serial now
will also put it there.=========================================================
II.4 Get a valid serial for Name:Unregistered
- Company: Unregistered.
Now, the serial-stuff begins. Get a valid serial
for the specified name and company.
---------------------------------------------------------
i made sure I had a clean install of the program as we
don't want to be misled by any previous patching we have done.
I ran the prog and chose "register"
I entered in "Unregistered" for the name and company, and then
set a breakpoint in Softice at LstrCmpA by typing:BPX LSTRCMPA
Then I clicked "register" and softice pops. I always look at
the registers before I do anything, and ESP was the one that
shows the serial. view it by right clicking on any ESP, or typeD ESP
The serial for Unregistered, Unregistered
was ACP200-52856Don't think it will always be so easy!!!!!
=========================================================
II.5 Find the "best" patch for nagscreen, time limit,
register box (accept all serials) and About box.
Patch the file in a way that you remove all limits
by changing less than 7 bytes.
- 3 bytes are my solution, so go for the 2 ;)
---------------------------------------------------------I found 2 ways of doing this, both 1 byte patches :-)
The first way I tried was to change the "set" opcode so that
whichever serial (good or bad) was used, the flags that were
set would set al to 1. I chose "setle al" because the opcode
reference states:
"sets the byte in the operand to 1 if the zero flag is
set ( a good serial does this), or the sign flag is not equal
to the overflow flag (a bad serial does this)."so it always sets the al to 1.
It is slightly possible that the flags may not always be set
like this so it might not be the best way.
:00446BAC 85C0 test eax, eax
:00446BAE 0F94C0 sete al <-----change to "setle"
:00446BB1 83E001 and eax, 00000001
:00446BB4 5F pop edithis next way registers the program regardless of what is in the registry:
You can even delete all references to the prog in the registry and it
will work fully registered.
:00446B99 8D9510FFFFFF lea edx, dword ptr [ebp+FFFFFF10]
:00446B9F 52 push edx
:00446BA0 8D8DA0FEFFFF lea ecx, dword ptr [ebp+FFFFFEA0]
:00446BA6 51 push ecx <----patch to "push edx"* Reference To: KERNEL32.lstrcmpA, Ord:0000h
|
:00446BA7 E8AE460400 Call 0048B25A
:00446BAC 85C0 test eax, eaxpush the same values to LstrcmpA so it always matches.
Jeez, this was fun to do! What a perfect target you found Laz!
I hope I get time to work on Task III.HaQue