Posted by Josep on 1/17/2000, 6:36 pm
209.179.251.91
II.1 Try to get rid of the nagscreen Find a patch that removes the nagscreen (the one that appears at startup
There are at least two places where this task could be accomplished:
First
Change 00447029 0F84C1020000 Je 004472F0
To 00447029 0F84C1020000 Jne 004472F0
This one byte will make the program jump over the nagscreen routine.
Second
Change 00446E5C 7411 Je 00446EF6
To 00446E5C 7511 Jne 00446EF6
This one byte change will make the program think that it is registered while it is not and will the remaining time check and will not produce a nagscreen.II.2 Change your date and bypass the "Evaluation period expired" nag Find a patch that makes the program never expire.
The date may be change by advancing the system clock or by changing the value in 'Cross' to a value = Cross - 18AC. This is equivalent to setting the time of first execution 30 days before it was actually executed for the first tine. It is the reverse of advancing the system clock, and will make the program expire.
For example: If I change value of 'Cross' in the registry file from 0x01bf6007 to 0x01bf485b Acoustica will expire.
To defeat the expiration date, it is possible fool the program and making think that it has lots of time left every time it runs and regardless for how long. To do this you need to change one byte.
Change 00446E78 0F85A9010000 Jne 00447027
To 00446E78 0F84A9010000 Je 00447027
This change will ignore the remaining time question.II.3 Make your name and company appear in the "About screen". In registered versions, the name and company replace the "Unregistered" in the screen - Find a patch for it.
Run the program and click the 'Register' button and fill the name and company with your choice of name. And enter any dummy number in the key window, then klick register. This will give the message 'The key does not match the license owner' and the program will not be registered, however some useful information is created. The program creates three new strings in the HKEY_CURRENT_USER\Software\Acon AS\Acoustica\2.0\RegiterInfo folder, one for the Name with the name you entered in it , a second one for the Company with the name of the company in it, and the third one for Key with the dummy number you enter in it. This information will be available to the program any time the About window is checked. To make these names appear in your about window without registering the program you made to change one byte:
Change 0044677C 0F85E6000000 Jne 00446868
To 0044677C 0F84E6000000 Je 0044868
This one byte change will trick the program into thinking that it is registered and display the Name an Company in the About window.II.4 Get a valid serial for Name: Unregistered - Company: Unregistered Now, the serial-stuff begins. Get a valid serial for the specified name and company.
The number AC200-52856 registered the program to Unregistered, Unregistered and displayed the message "Your license is registered. Thank you for your purchase of Acoustica 2.0II.5 Find the "best" patch for nagscreen, time limit, register box (accept all serials) and About box. Patch the file in a way that you remove all limits by changing less than 7 bytes - 3 bytes are my solution, so go for the 2 ;)
What about changing only one byte? OK. Let me tell you how I did it.
Every time the program runs it checks for registration, and when the about screen is clicked the program also checks for registration. If the program is registered, or fooled to think so it ignores the check for the remaining time. If the program not registered it sets a flag but if registered that flag is reset. This flag is stored in 'al' and checked before a jump is made. One way to deal with this situation is to fined those jumps and reverse them. To do it this way we need to make two changes: One at 00446E5C and the other at 0044677C and reversing the jumps in these locations will do the job. Since the time check is ignored if the program thinks it is registered, there is no need for a third possible change after the program checks for the remaining time. This change will be redundant. So do the following changes:
Change 00446E5C 7411 Je 00446EF6
To 00446E5C 7511 Jne 00446EF6Change 0044677C 0F85E6000000 Jne 00446868
To 0044677C 0F84E6000000 Je 0044868
This is the two byte change solution, what about the one byte? This solution does not involve reversing jump instructions, instead it reverses the flag which I mentioned earlier. The flag is set or reset at location 006BAE, so if we change one byte at this location we will achieve a full solution, and here what needs to be done:
Change 00446BAE 0F94C0 Sete al
To 00446BAE 0F95C0 Setne al
That is all that is needed and nothing else.Joseph