Visual Basic cracking still remains to many, a tough nut to crack because you can't just dead list it and expect to see where your going ... Therefore we need to adopt new methods to circumvent this natual barrrier and one possible way is to locate routines within the VB runtime library that we can place traps (breakpoints) on with SoftICE. In order to program Softice to quickly locate the String Compare Routine for us we place the following three lines in our WINICE.DAT file: 
  
AF4="^s 0 l ffffffff 56,57,8B,7C,24,10,8B,74,24,0C,8B,4C,24,14,33,C0,F3,66,A7;" 
  
EXP=C:\WINDOWS\SYSTEM\VB40032.DLL 
EXP=C:\WINDOWS\SYSTEM\MSVBVM50.DLL 
  
This has been tested on both VB4 & VB5 programs and does work, however, if the target program uses Integer/Reals for the serial number then the program will use a different set of routines instead, bypassing our String Compare Routine altogether... In order to combate this I think I've found a Integer/Real routine in VB5 that we can place a BPX on that will show us the *real* numeric serial that the program expects us to use... The VB5 Routine looks like this: 
  
PUSH EBP-20 
CALL MSVBVM50._vbaR8Str        ; Convert string to Integer/Real 
FCOMP QWORD PTR [00401028] ; Our numeric compare! 
  
Once you land on fcomp qword ptr [00401028] Type: DL 00401028 to see the *real* serial #. 
DL is not a typing error, DL means Display Long/real while D on it's own simply uses the current display format... See SoftICE manual for more information on SoftICE Commands. Okay, we now have something new for SoftICE to check on, so lets program this new Search Macro into it ... Open up WINICE.DAT, Make sure you have these lines: 
  
EXP=C:\WINDOWS\SYSTEM\VB40032.DLL 
EXP=C:\WINDOWS\SYSTEM\MSVBVM50.DLL 
  
AF3="^s 0 l ffffffff FF,75,E0,E8,85,EF,FF,FF,DC,1D,28,10,40,00,DF,E0,9E,75,03;" 
AF4="^s 0 l ffffffff 56,57,8B,7C,24,10,8B,74,24,0C,8B,4C,24,14,33,C0,F3,66,A7;" 
  
ALT-F3 Is our Integer/Real Compare search, works only in VB5 
ALT-F4 Is our String Compare search, works in VB4 & VB5 

Features: 
230 solitaire games, full 256-color graphics, sound, undo to the beginning of the game, redo of all moves undone, automatic game saving on exit, selectable card backs, automatic card moving, quick mouse shortcuts for easy play : right click- quick move middle click- undo   double click- move to foundation, over 2 billion starting positions for each game, statistics for multiple players, full history of the scores of all games played, selectable background colors for each game, choose one of the bitmap backgrounds provided, use any tilable bitmap file for a background, snapshot position - return to a previously saved position, The Solitaire Wizard - create your own solitaire games by selecting the rules for the game. Millions of different games can be created. 

... hmm ... seems that thomas wants to play a game with us ... hurrah ... this would be fun ! ... somehow it reminds me to sandra bullock in " The Net "... 

are u thinkin' what i'm thinkin' .. !? .. yeah she has a great ash ... 

Firstly ... i try holding [CTRL]   key 'n  start pushing on cards  in help menu ...  order screen pops up ... try again ... push on register ... #boom# ... huh ... game is over ... it was 2 easy .. here we're asked to enter :  

Name                   : 
Registration Code : 

The registration code is based on what you type in for name.  

1. Deep within your System Registry it uses the following branch to store it's license data.  

    HKEY_CURRENT_USER\Software\Goodsol\PGS98\Registration 

    Code=" " 
    Name=" " 
    RVersion="4.98.2" 
  
2. It's a 30 day, time limited program that will 'expire' after 30 days of being installed.

Name                   : widYa@cL 2011 
Registration Code : 0101010 

DO NOT push [OK]  yet ....  fire up Softice ( CTRL+D) ' n set breakpoint on HMEMCPY function (BPX HMEMCPY) ... X [ENTER] to leave Softice ... then click  [OK] button ... #bOOm# ... .  

From here press the 'F12' key 7 times to get into msvbvm50.dll code ... Now we want to quickly find the routine that compares our serial number with the *real* one and we can do this effortlessly by pressing the ALT-F4 keys together ... Softice should now report back one memory location of where the sub-routine were looking for is to be found in memory.  

In my case Softice reported:  
Pattern found at   017F:7B2FD9EA :-----------------: <- This address (SEGMENT:OFFSET) will be different on your system !! 

... ur next step is to set breakpoint on it but first clear HMEMCPY beakpoint 'coz we don't need it anymore ...  

BC* [ENTER] 
BPX 7B2FD9EA [ENTER]      ; once again i remind u .. this address will be different in your system ... 
X [ENTER]                           ; leave Sice  

... #boom# ... 'n Sice should now display this code snippet:-  
 

: 56	push esi	; save esi for later use
: 57	push edi	; save edi for later use
: 8B7C2410	mov edi, [esp + 10]	; press F10 at here .... D EDI   ... you'll see "MICHAEL KREYLING" in wide format
		; Scroll down data window   ... until u see the following data :
		.   .   .    .   \   5  S  .   &   .    .    .   .    .   .     .
		9  .  8   .    1   .   9  .   7   .    7   .   6   .   0   .
		0  .   .    .   Z  .   {   .   {     .   ,    ,   ,    ,     ,   ,
: 8B74240C	mov esi, [esp + 0C]	; F10 .... D ESI  ... you'll see "WIDYA@CL 2011" in wide format

... hmmm .... strange isn't it ?!... This routine is checking for a Name we didn't type in  "Michael Kreyling" ... makes me wondering ... is it use for the generation of valid  serial  or the author has a bad memory with  thiz guy ...?! ...  

... anyway ... thiz number '981977600'   seems to be ur valid reg code  ...  clear the garbage from ur planet ... 

BC* [ENTER] 
X    [ENTER] 

... enter registration again ... 

Name                    : widYa@cL 2011 
Registration Code  : 981977600 

... push [OK] ... #    # ...   huh ... no expression of thanks ...!? . Look in Help - About ... 

Registered to : 
widYa@cL 2011 
981977600 

(NOTES : to Unregister Pgs98  run regedit - goto HKEY_CURRENT_USER\Software\Goodsol\PGS98\Registration - Delete Registration key)  

... i noticed that there's few  'odd'  things in the generation of valid serial after entering registration with different entry several times ... ex : 

1. when i used "CrackZ" as name the data window showed this number "652288" ... i enter reg screen again with the following entry : 

   Name                    : CrackZ 
   Registration Code  : 652288 

.. [OK] ... #boom# ... "Sorry . Invalid Registration Code ..." 

... hmm ... then i look again for every valid reg that i got .... it always begin with "98" ... let's check it out... : 

   Name                    : CrackZ 
   Registration Code  : 98652288 

. [OK] ... #boom# ... registered ... 

2. I used the following entry : 

   Name                    : widYa 
   Registration Code  : 0101010 

... 'damned' ... the valid reg code never showed up ...  so  i change my dummy reg code  .... then ... after a few times entering registration with different key ... finally ... it showed up "98467069" ... hmmm .. though i've found the valid code but still it didn't satisfy me ... since we must to scroll down data window 'n sometimes we need to repeat the routine ....  is there 'something' left behind !?? .... is it a buggie ??! .... aaahhh ..... i'm sleepy now ... i should take a nap for a while .... ...........)^%$!.............!@# ...............*&* ...................... **^%$**^^%$ .............. 

... #DAMNED# .... who said that vb program is newbees nightmare ..... kewl ... !?  

... huh ... now i'm back !! .. with new energy ... let's continue ur examination  ... from what i've learned .. VB   programs is not a really "program" since it used a lot of call to a library (dll). Let's say if it wants to convert  a strings into uppercase then it will call a function in dll (dynamic link library) that dealing with this task. Especially in serial prot schemes we can say there are 3 main routine we need to know (i've discussed this in my 2'nd tutor) : read ur input, calculate them in unique formula, compare ur input with the correct one (part of them). Now .. if we'd like to write a program ... then we will  make it as effectively as possible 'n as efficient as possible right? ...same as writter of msvbvm50.dll ... he  must be wrote a one good function to make any uppercase strings task ... he  must be wrote a one good function to make any compare strings task ... etc.  

Now .. i'd like to find a one good function in msvbvm50.dll which generate our valid code for all VB programs which has serial prot schemes ... is it possible ???  ... hmmm .. where do we start ..?! 

.... think .... think .... think ...... eureka ! ... from what we've seen .. ur name was converted to uppercase (right ?!) ... a good start for me .... what's this function name in msvbvm.dll ... rtcUpperCaseBstr ?! ... let's check it out ....... enter reg again .. with the following  entry : 

   Name                    : CrackZ 
   Registration Code  : 0101010 

... CTRL+D ... 

BPX rtcUpperCaseBstr [ENTER] 
X [ENTER] 

... [OK] ... #bOOm# .. press F12 once ... we land here : 
 

7B3CF8DC	E8ADFFFFFF	CALL MSVBVM50!rtcUpperCaseBstr
7B3CF8E1	66833E08	CMP WORD PTR [ESI], 08	; D EAX .... CRACKZ in wide format ... set BPX at here
7B3CF8E5	8945F8	MOV [EBP-08], EAX

BC* [ENTER] 
BPX 7B3CF8E1 ; This address will be different in your system 
X [ENTER] 
X [ENTER] 

... D EAX ... you'll see UNREGISTERED COPY .. in wide format ... scroll down data window ... we found a fix valid reg code "98652288" ... but still  we need to repeat entering registration sometimes to find it ...  ... i don't know if all this 'odd' things happen in your system too ...  

... r u thinkin' wht i'm thinkin' ?! ... yeah ... where is that "bloody" function !! 

... after learned about vb function for a few minutes .. then i decided to use __VbaStrCat function .... now enter reg again ... fill out the entries ....CTRL+D . 

BC* [ENTER] 
BPX __VbaStrCat [ENTER] 
X [ENTER] 

.. [OK] ... #BOOM# .... F12 once ... we land here : 
 

7B3EEC36	E85434F0FF	CALL MSVBVM50!__vbaStrCat
7B3EEC3B	50	PUSH EAX	; we're gonna set BPX at here

... D EAX ... wht do u see ? : M I   .... interesting ?! .. No ?? ... 

BC* [ENTER] 
BPX 7B3EEC3B ; This address will be different in your system 
X [ENTER] 

... D EAX ... wht do u see ? : M I C .... interesting ?! .. No ?? ... X [ENTER] 
... D EAX ... wht do u see ? : M I C H .... interesting ?! .. hmm !? ...  

... at here .. i decided to trace the CALL ...  snip ... snip ... snip ... heii i think i found the instruction code which generate data we looked  at EAX ...  here is the snippet code : 
 

F3A4	REPZ MOVSB	; copy string
5D	POP EBP	; D EAX here
5F	POP EDI
5E	POP ESI
5B	POP EBX
C20800	RET 0008

... but first ... let's create a function keys to make ur examination easier .... open up winice.dat 'n make the following changes : 

AF5="^s 0 l ffffffff F3,A4,5D,5F,5E,5B,C2,08,00;"  
F5="^x;^dd eax;" 

... Restart windows .... make another cup of coffee .... 

(Unregister Pgs98 : run regedit - goto HKEY_CURRENT_USER\Software\Goodsol\PGS98\Registration - Delete Registration key)  

.... now enter reg again with the following entry : 

   Name                    : CrackZ 
   Registration Code  : 0101010 

... CTRL+D ... 

BPX __VbaStrCat [ENTER] 
X [ENTER] 

.. [OK] ... #BOOM# .... press ALT+F5 ,,, In my case Softice reported :  
Pattern found at   017F:7B2F20F5 :-----------------: <- This address (SEGMENT:OFFSET) will be different on your system !! 

BC* [ENTER] 
BPX 017F:7B2F20F5 
X [ENTER] 

... #bOOm# ... we're here : 
 

7B2F20F5	F3A4	REPZ MOVSB
7B2F20F7	5D	POP EBP	;  we're gonna set BPX at here

BC* [ENTER] 
BPX 7B2F20F7 

.... heiii ... u can relax now ... 'coz i'll show u the greatest magic you've ever seen ....  

... Keep pressing F5 until you see the valid reg code in data window ( ... just like a slide show or a movie isn't it ?! ... everytime we push F5 .. data window updated char by char copy from "Michael Kreyling" strings .... after no more char to copy from "Michael Kreyling" ... then we have 'a commercial break'  ... keep pressing F5 ... #bOOm# ... finally ... data window shows 97652288 in wide char format ... NO NEED TO SCROLL DOWN DATA WINDOW.... ) 

....  u can try with different entry ... soon you'll see that my new method will always shows the valid reg code .... aahh .... i'm  satisfied now ...  

r u thinkin' somethin' ... ?! .. Yeah ... the valid reg code has 2 version ... Pgs97 version 'n Pgs98 version ... so the valid reg code for name : CrackZ is  98652288 or 97652288 ... both are works fine .... 

... hmm ... now i have one more question in my mind .... r u thinkin' wht i'm thinkin' .. !? ... kewl .. AGAINNN !!!?? 

... what if we enter "Michael Kreyling" as name ... though we saw 974309568 in data window ... still we can't make it registered .... seems that Thomas Warfield has blacklist this guyz ...?!? ... (anyone knows who is Michael Kreyling ?!) ...  

... heiii ... r u sayin' somethin' ... ?! .... ThankGod my parents didn't gave me name "Michael Kreyling" ...??? 

name      : 
e-mail    : 
number  : 

The registration code is based on what you type in for name 'n e-mail.  

1. Deep within your System Registry it uses the following branch to store it's license data.  

     HKEY_CURRENT_USER\Software\OhBugger\Pam 

2. It's a 42 day, time limited program that will 'expire' after 42 days of being installed. 
3. No nags, no limitations !

Name    : widYa@cL 2011 
e-mail   : widya-cl@usa.net 
number : 0101010 

... DO NOT push [register PAM]  yet ....CTRL+D ... 

BPX __VbaStrCat [ENTER] 
X [ENTER] 

. [register PAM] ... #bOOm# .... press ALT+F5 ,,, In my case Softice reported :  
Pattern found at   017F:7B2F20F5 :-----------------: <- This address (SEGMENT:OFFSET) will be different on your system !! 

BC* [ENTER] 
 

BPX 017F:7B2F20F5 
X [ENTER] 

... #bOOm# ... we're here : 
 

7B2F20F5	F3A4	REPZ MOVSB
7B2F20F7	5D	POP EBP	;  we're gonna set BPX at here

BC* [ENTER] 
BPX 7B2F20F7 

... now let's enjoy the movie presented by Visual basic ..... Keep pressing F5 until you see the good serial form in wide format ... after pushing F5 for about 62 times .. data window displays : 
 

5	.	E	.	o	.	1	.	8	.	2	.	a	.	S	.
6	.	1	.	2	.	7	.	7	.	n	.	j	.	9	.
p	.	7	.	3	.	2	.	0	.	7	.	5	.	3	.
8	.	2	.	7	.	A	.	g	.	x	.	.	.	c	.
)	.		.	c	.	o	.	p	.	y	.	r	.	i	.
g	.	h	.	t	.		.	1	.	9	.	9	.	8	.
	.	b	.	y	.		.	m	.		.	d	.	o	.
e	.	r	.	i	.	n	.	g	.		.		.		.

... hmm .. is it the valid reg code ?! ... let's find out .... enter reg again : 

Name    : widYa@cL 2011 
e-mail   : widya-cl@usa.net 
number : 5Eo182aS61277nj9p7320753827Agx 

... #bOOm# ... Registered to widYa@cL 2011 - Thank You! ... You're Welcome! ....  

... Wow .. the longest serial i've ever seen ...