|
|
|
|
|
|
|
|
|
|
We have to remember that it's not registered,
so in the registry file we don't have the proper
entry, and this is our job here. I'm
sure that at this point you have a dead list of the prog, if not, do it.
Let search for some words for our case,
do you see the name
and company yet
?
Click twice on the name
string and we see this snippet code :
*
Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048176F(C)
|
:004817D8
8D4DF0
lea ecx, dword ptr [ebp-10]
--------- snip snip --------
:0048180B 8B3D404B4A00 mov edi, dword ptr [004A4B40]
*
Possible StringData Ref from Data Obj ->"name"
|
:00481811
6844304A00
push 004A3044
:00481816
50
push eax
:00481817
6A02
push 00000002
:00481819
FFD7
call edi
:0048181B
83C410
add esp, 00000010
:0048181E
85C0
test eax, eax
:00481820
740C
je 0048182E
:00481822
8B45F0
mov eax, dword ptr [ebp-10]
:00481825
8D4E60
lea ecx, dword ptr [esi+60]
:00481828
50
push eax
*
Reference To: MFC42.MFC42:NoName0068, Ord:1837h
|
:00481829
E88CA30100
Call 0049BBBA
*
Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481820(C)
|
:0048182E
8D45F0
lea eax, dword ptr [ebp-10]
:00481831
8B4DE8
mov ecx, dword ptr [ebp-18]
:00481834
50
push eax
*
Possible StringData Ref from Data Obj ->"company"
|
:00481835
683C304A00
push 004A303C
:0048183A
51
push ecx
:0048183B
6A02
push 00000002
:0048183D
FFD7
call edi
:0048183F
83C410
add esp, 00000010
:00481842
85C0
test eax, eax
:00481844
740F
je 00481855
:00481846
8B45F0
mov eax, dword ptr [ebp-10]
:00481849
8D8EE0000000
lea ecx, dword ptr [esi+000000E0]
:0048184F
50
push eax
Ok... This is what the program look for in the registry file, so, open Regedit and go to entry :
HKCU\Software\Blue Sky Software\RoboHTML\1.00
To create the new
key we need to click on : Edit/New/String value. Call it company.
To set it with the
value we need to click on : Edit/Modify. put in what ever you like.
now point again
with the mouse on the "1.00".
To create the new
key we need to click on : Edit/New/String value. Call it name.
To set it with the
value we need to click on : Edit/Modify. put in what ever you like.
Ok, run the program
and see what happened now. Go into the help/about...
Nothing changed
!!! we need to take a closer look at the dead list :
*
Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481752(C)
|
:0048176B
837DD4F9 cmp dword ptr [ebp-2C], FFFFFFF9
:0048176F
7467 je 004817D8
; if equal jump to name + company !!
:00481771
8D4DF0 lea ecx, dword ptr [ebp-10]
; else, keep on to
; the 30-day trial
:00481774
E8E7A30100 Call 0049BB60
:00481779
C645FC02 mov [ebp-04], 02
:0048177D
8B45D4 mov eax, dword ptr [ebp-2C]
:00481780
8D4DF0 lea ecx, dword ptr [ebp-10]
:00481783
50 push
eax
*
Possible Reference to String Resource ID=00761: "%d-day
trial license"
|
:00481784
68F9020000 push 000002F9
:00481789
51 push
ecx
We need to check it, we need to 'break' into the program's actual code, with this steps :
1. Select the menu option 'Help'
from within RoboHelp.
2. Press Ctr-D to fire up
Softice.
3. Type bpx getwindowtexta
4. Type x to leave Softice.
5. Select
the 'About' Tab option.
6. Softice
now breaks...
7. Press the
'F11' key 1 TIME followed by the 'F10' key 13
TIMES
8. We should
now be in RoboHelp's code..
9. Type u
48176f
10. Type bc *
11. Type bpx
0048176f
12. Type x to leave Softice.
Softice now brakes on location 0048176f :
:0048176F 7467 je 004817D8 < no jump >
Type r eip=004817d8, and then type
x to leave softice. BINGO.. The name and
company we put in the registry is showing
now in the About screen.
Sandman, i did it !!
|
|
Back to Students Essay's |