|
(Example of a Lazy Shareware Programmer) |
Win Code Reversing |
|
|
|
|
|
|
Program Details Program Name: Systemcleaner98.exe Program Type: Hard Disk Utility Program Location: Here Program Size: 518K |
||
W32dasm - Disassembler HexWork Shop32 |
||
|
|
There is a crack, a crack in everything. That's how the light gets in. |
System Cleaner 98 V2
( Reviving
Dead Programs )
Written by The Sandman
|
From the words of the author of System Cleaner 98 here's what this program is all about:-
"System Cleaner 98 fixes and prevents errors in Windows 95 and Windows NT 4.0 by finding and cleaning error producing and space wasting garbage files. System Cleaner 98 operates by regularly scanning your hard drive for various error producing files and then optionally cleaning them from your system for you. System Cleaner 98 targets specific types of error producing files that common disk utilities, uninstall, defrag, disk scanning, and sweep-type programs will miss. The error files that System Cleaner 98 searches for and deletes can produce hazardous results if they are not properly cleaned from your drive on a periodic basis.
System Cleaner 98 is a safe, fast, and thorough way of keeping your system running like new.
¤ Key Features ¤
· Scan for Duplicate
Files (NOTE: Only delete a duplicate file if you are sure it will not be
needed by any application, or if the same file is on the windows system
directory).
· Ability to add
or remove file types to the Temporary Files to be scanned.
· Add/Remove/Edit
The Items you have on your Uninstall Programs list.
· Backup temporary/duplicate
files to a ZIP file.
· Powerful file search.
You can select to scan for files between a certain date, with some or all
file attributes, with a certain size and with the contents of a file matching
a certain text.
· Clean Directories.
Allows you to clean directories that usually have Temporary Files or cache
files (Windows Temp Directory, Documents Folder, MS Internet Explorer Cache
Directory and Netscape Cache Directory).
· FAT-Losses. This
utility allows you to see exactly how much disk space is lost because of
cluster size.
· System Cleaner
98 Scheduler - small applet that sits on the tray area and only loads the
main application when it's time to run a scheduled task. That way System
Cleaner 98 doesn't take memory when it's not needed.
· Remove files to
Recycle Bin, zip them, move them to a folder or completely delete them!
· Schedule scans
every xx minutes, Hourly, Daily, Weekly or Monthtly.
· Scan multiple hard
drives.
· Add your own file
types for scanning.
· You can automatically
make System Cleaner 98 Scheduler run at windows startup.
· Delete some or
all the files found by System Cleaner 98.
· Ability to confirm
deletions.
|
Registration is not possible with this
program, however, because of the way this program is suppose to run, it's
been programmed to 'die' after a short period of time so the author has
not bothered with any nag screens.
This program is not compacted or encrypted
in anyway.
|
In the past I might have just deleted this program and gone onto another but here was a program that screamed out to be resurrected. So practicing what I preach (see essay 8 ) I got out W32Dasm and produced a 'Dead Listing' of this program.
I searched the string sections of this program and found the text:-
"This beta version has expired. Please download a new version from our Web-Site"
Locating where
this string is used within this program revealed the following code:-
:00489CFF DFE0
fstsw ax
:00489D01 9E
sahf
:00489D02 7614
jbe 00489D18 ;If program has expired
;then continue on, else
;jump to location 489d18
* Possible StringData
Ref from Code Obj ->"This beta version has expired. "
->"Please download a new version "
->"from our Web-Site"
:00489D04 B8589E4800
mov eax, 00489E58 ;program expired,
:00489D09 E80A44FBFF
call 0043E118 ;display message then
:00489D0E E87197F7FF
call 00403484 ;close down.
:00489D13 E9FB000000
jmp 00489E13
Can you see where our 'fix' will go and what form it takes?.
That's right, if we change the line:-
:00489D02 7614 jbe 00489D18
to
:00489D02 EB14 jmp 00489D18
then every time the program is run it will
always run as normal regardless of whatever time period it's suppose to
expire.
Job Done.....
|
To revive this program run up HexWorkshop32 or whatever hex editor you have lying around and then:
SEARCH FOR THE BYTES: DFE09E7614B8589E4800E80A44
THEN REPLACE WITH :
DFE09EEB14B8589E4800E80A44
|
It's a shame a good looking program such as this is so easily 'repaired', anyone I'm sure could 'repair' this program if they wanted to and because there are no nag screens to annoy the user there's no extra work involved in disabling them so it's was an easy crack.
My thanks and gratitude goes to:
Fravia+ for providing possibly the greatest
source of Reverse Engineering
knowledge on the Web.
+ORC for showing me the light at the end
of the tunnel.
|
Do I really have to remind you all that by buying and NOT stealing the software you use will ensure that these software houses will continue to produce even *better* software for us to use and more importantly, to continue offering even more challenges to breaking their often weak protection systems.
If your looking for cracks or serial numbers from these pages then your wasting your time, try searching elsewhere on the Web under Warze, Cracks etc.
Next | Return to Essay Index | Previous |