1999 |
( 'what SmartCheck can show' ) |
Win Code Reversing |
|
|
|
|
|
|
Program Name: tweaki2.exe Program Type: System utility Program Location: Here Program Size: 3.4mb |
||
Tools Used: |
||
|
|
|
The author of Tweaki v2.1.566 says :
Tweaki...for Power Users gives
you all the usual Desktop management ability; like turning off animated windows,
enabling auto logon, removing shortcut arrows, speeding up the Start Menu,
showing BMP files as thumbnails in Explorer, editing the system owner/company
information, placement of cascading menus off the Start Menu for Control Panel
and the Printer's Folder, editing the file descriptions that Explorer lists for
EXE, COM & DLL, turning on/off of AutoPlay, rebuilding the icon cache file,
print directory structure as well as directory contents from within Explorer
(Win9x only), disable smooth scrolling, making NT always boot with the Num Lock
key on, changing the Windows NT logon logo to something you prefer, changing DOS
box colors in NT, X-Mouse support in NT, Ghost connections in NT, disable
autoexec parsing in NT, keep RAS connections alive, restrict remote registry
access in NT, set max number of simultaneous users to your server, setting
security within Win9x and NT, suppressing printer
server notification messages, creating
custom logon messages, allowing Ctrl + Esc to launch the Task List vs. the Start
Menu, changing the directory where spool files are created to one that has more
space, TAB in a DOS box under NT to complete path statements, tweak IP
performance...the list goes on and on.
|
This protection routine is based on the user
name, but it used the month it registered in, as a part of
the reg key.
The program keeps its settings at the registry :
HKCU\Software\Tweaki\RegName "your name"
but the interesting key is this one :
HKCR\ASControl.Objects\{CC0918E3-EFE5-11CF-A069-00AA00B6015C}\ControlType "10/03/64"
This key is the "heart" of this protection
routine. What we are going to see with SmarCheck is just the
"cherry", but in my Final Notes, you will have
the "cream" to put above it :)
|
This is my first tutorial
using SmartCheck (from now i will call it SC), so i adupt Eternal_bliss idea and
create
a page
that includes the most important setting in SC, to give us as mutch information
we need.
you
can view/read it here.
Thanks EB !!
Ok, after we set up SC to give us the most important details, run
SC, in the menu choose File/Open and choose
Tweaki.exe. Now to start the program,
click on Program/Start, or click on this icon : .
The program now loads, when it
done, go to Options/About and enter any registration name &
number.
Now,
click on the "register" button, got the invalid reg number ? now we will go back
to SC.
in the "program results" window, you'll see this :
Click on the "+" that next to the _click, and then
again on the "+" that next to the second _click, you will see
now all the information that SC provids when we enterd our
name and fake reg key. Scroll to the bottom of
the window and look for this, remember this is for the name
i entered :
Well, i thought to my self, nice and clear
!!!
I entered this number as
registration number, but got the "invalid" message again. At this point i
start
wonder what's wrong, and my
eyes "captured" the line "Month" above the string. Now what ??
What this number have to do with the month (8 /
august) ??? i made a few tests :
83420307 + 8 =
83420315 --> invalid
883420307 --> invalid
834203078 --> invalid
AUGUST83420307 -->
invalid
83420307AUGUST
--> invalid
AUG83420307 --> invalid
83420307AUG -->
invalid
I will not show all the combinations i made, it took more then 2 hours, but finaly i got lucky :
83420307GUA --> BINGO
It takes the first 3 leters of the current
month, and put it in reverse order to the end of the generated
geristration key.
I can't say it was easy
to find, since i could't see how the *fake* and the *real* codes is compared,
but when
i saw the the month is involved, i had nothing to do, but
try and try...
|
Nothing needed...
REMEMBER, i'm doing my
cracks as a hobby and challenge, so please, if you like
this utility and want to keep using it,
support the author and pay for it.
|
Remember the registry key i talked about in the
begining ? I installed this utility on 2 different computers,
with different names and i saw this same key, ControlType "10/03/64" on both of
them, and couldn't find where
the real code is kept.
Delete this key makes the program
"unregistered". Hving this key without the RegName makes the
program
"registered to :".
Final conclusion : if you create this
key in the registry, create the other key with your name, the program
will
be
registered... no need to bother with the real key and the month...
TRY IT.
My thanks and gratitude goes to:-
Eternal_Bliss for the "push" he gave me in reversing VB progs.
The Sandman for all what he is doing for us, newbies.
Rhayader for helping me with Reverse Code Engineering and useful tips