Posted by Nop90 on January 15, 2000, 4:09 pm
209.179.193.27
Im in too...thanks for putting this togther guys! Here is my solution to task 1 I.1 What do you find when you look at target at first.
Look what you find, when you look at the program, at the helpfile
or somewhere else. Be sure not to use *any* tools yet, only look
directly at the program.
-------------------------------------------------------------------------
* 3 keys on the opening window.. Evaluate, Purchase & Reg
* I see a name, company, keycode for the reg window(named Acoustica Registration).
* No info in the reg details of value I can see.
* The purchase window produces nothing usefull.
* The prog has a 30 day time trial.
* When entering dummy stuff in the reg window...It pops a new window (Acoustica) and says..."The key does not match the license owner".
========================================================================
I.2 Do you find anything interested in the W32Dasm disassembly?
Now you can use a deadlisting from your favourite disassembler
and look for suspicious stuff.
-------------------------------------------------------------------------
* Wdasm indicates not a Delphi or VB prog and not packed.
* String refs yield possiblities..."key","Name","Register to","RegisterInfo", "The evaluation period has expired","The Key dont match License","Unregistered","Your license is registered. Thank"
========================================================================
I.3 What kind of window is the "Wrong-serial"-"messagebox" really?
As you will see later the window that says "Wrong serial" is
no Messagebox, but another kind of window.
-------------------------------------------------------------------------
I see the "bad key" messages in 2 places...I see no references to what the api that puts the message up is. I do find references to messageboxa in the imports. I see no way to refernce what THE api is from the deadlisting. I could use some help here.
========================================================================
I.4 Where does the program store its Registration information?
In the registry, in a file, in the EXE itself - where?
-------------------------------------------------------------------------
* Reg info stored in the registry under HKEY_CURRENT_USER\Software\Acon AS\Acoustica\2.0\RegisterInfo
========================================================================
I.5 Where does the program store how many days are left?
-------------------------------------------------------------------------
* The time trial period MAY be in HKEY_CURRENT_USER\Software\Acon AS\Acoustica\2.0\General ? The 15Ah looks suspicious. I see no clues in filemon.