A little food for thought. You will have to work for this one and a little experience will help alot.

 This is a fun little prog to play with, because we get to see how some people make their own .dll's and functions! 

w32dasm 8.x--your choice of flavors

hex editor needed- UltraEdit 7.xx or whatever you want to use

possibly a resource editor, not absolutely needed. I use Restorator 2.5.

www.deneba.com

Just go to this site and then to their download section and get what you need or have them send you a free demo disk..

Here we go guys and girls. Go get the prog and download it, then run the installation setup. Now let's go ahead and 
disassemble it with w32dasm. This should go off without a hitch. Now before you run the installation of your program I 
will tell you a secret, if you set your computer clock way ahead to some unreal date, say ten years in the future, you can 
go ahead and install it and then turn the clock back and it will work perfectly. Now if that is all you're looking for 
then you can quit now and the rest of us will go on with the lesson. I really want you to stay, though, and work through
this with me. Otherwise, you'll never grow in your learning. I must admit though, that I truly like the simplicity of the
date change mechanism and it is nice to know that it works if you need it. I have found another program, a backup program
that has that exact same mechanism and it still works too. Let's move along, though. Our destiny calls us forward into the
new millenium. Go ahead and run through the prog with a good date and see what she looks like. You'll notice that you get 
a splash screen with a lot of junk loading, just like in the Deneba Canvas 7 prog. Once everything initializes, the 
program opens up and you're in free. If you want to play around a bit, go right ahead. There's even a helpful tutorial to
help you get started. If you have a resource editor, you might want to have a look around inside of Deneba CAD and see if
there are any useful references--dialogs, bitmaps, strings. You know all kinds of juicy things could be hidden in there.
Oddly enough the "Sorry, you're out of time messages" are not to be found there. They are in DenebaCad.rsr and can be
viewed with Ultraedit, but they can't be unfolded with w32dasm because they show up as a binary file. Truly a bummer, but
not the end of our rope, as you'll see.
Let's go ahead and set the computer clock ahead since we know we can always return to home base with a simple change. Just
for reference, I always make a backup copy of my .dll or .exe before I screw something up, and believe me I have many
times friends. Now just run the prog without going through w32dasm. Follow the flow again and you'll see the splash screen
with all the initializing going on and then, "Boom!," you'll see a little messagebox that says "Sorry, you lamer. You're 
time is up!" "Ha, I've got that little sucker now. I'll just set a few breakpoints on the messageboxes in User32 and catch
it red-handed." So, what are you waiting for? Go ahead and set them and then run it, baby! Naturally, you won't catch
anything at all, because there aren't any of those fish to catch in this pond. "Boom," you get the same lame message as
before. Now remember, I told you earlier that the expired message is really in the DenebaCad.rsr, so what are you trying 
to do in the executable trying to catch a resource listing? Think about that future cracker. The reality is that it might
entirely be possible to catch that little dude. The reason is because the executable may call the resource directly or may
use another file, such as a .dll to do the call. We don't know at this point, so let's keep going.
Of course, we could search the string listing and it doesn't show up. So what do we do? We think. That's all. Just think.
Think about the environment in the program and what it may be doing. Think like a programmer and what they may have done
to make this prog work in the manner that it is. Think aboupt why the time doesn't matter when we reset it, especially
when we set it way far into the future and then go back. Incidentally, if you just install it in normal time and back track
a few days, the program doesn't keep a count of it, that is, it will not time you out like some other progs do. The 
program doesn't keep a static timer function. Ok, so now that you've had time to think a bit. What can we do? I began by
looking for some kind of calls to time type functions. There is a .dll that is used frequently by this program and it is:
asintppc.dll. There are tons of function calls in this file, but, of course, I was only interested in a couple:
       1. GetDateTime
       2. GetTime
Now we're getting somewhere, maybe. I'll tell you up front that it isn't necessary to disassemble this file although I
thought seriously about the need to do so. What we need to do to test our time idea is to set all the breakpoints we can
that deal with these two functions. They actually show up in several places, but only one is important to us, and not
actually directly, but rather as a pointer close by. Let's load some code and have a peek. Oh yes, you may ask why didn't
I use the GetSystemTime and GetLocalTime functions. It's because they aren't used. These guys made there time function 
calls. 

* Reference To: ASINTPPC.GetDateTime, Ord:028Ch  <---Not used to catch target. Hits before splash screen loads.
,                                   |
:00635B5C E8A9CB0200              Call 0066270A
:00635B61 FF75F8                  push [ebp-08]
:00635B64 E866780700              call 006AD3CF
:00635B69 83C404                  add esp, 00000004
:00635B6C 8D65FC                  lea esp, dword ptr [ebp-04]
:00635B6F 5B                      pop ebx
:00635B70 5D                      pop ebp
:00635B71 C3                      ret

This next section is where all the relevant checks take place! The jumps at:
004096BD and
004096D4
are very important! If you follow the call through into asintppc.dll, you'll see what is actually going on. In a 
convoluted way, there is a time check going on that checks current time. I say convoluted because there is a simple
mathematical manipulation that takes place. You can single step through it in the asintppc.dll as it's happening
and look at the changes to the times as they occur. You'll later realize that's it's mostly academic, that is, the
studying of that .dll, but who knows, we may have needed it's vital info. We need to always keep our eyes open when
we work. As I mentioned above, the really important ares are the two jumps. In order to check this out, you must 
keep good notes as I am want to do. I went through all this routine with good time left on the prog and found out
that at 004096BD, the jl never jumped. It just fell through. Now at 004096D4, on the other hand, it jumped with
time left and did not jump when the time was expired! So if you weren't paying attention to these little details,
then how would you have trapped that beast? Answer--you wouldn't have. You know what to do now don't you? Get the
offset from w32dasm and go into your hexeditor and make the minor little change:
:004096D4 7C41   change to EB41 and you're home free. Another way around this would possibly have gone into the
asintppc.dll and force it to load a fictitious date of your own choosing, so it would always be happy. But this 
way it doesn't matter. The choice is up to you. 

* Reference To: ASINTPPC.GetTime, Ord:0416h
                                  |
:00409633 E8E6882500              Call 00661F1E
:00409638 66C785DEFDFFFFCC07      mov word ptr [ebp+FFFFFDDE], 07CC
:00409641 66C785E0FDFFFF0100      mov word ptr [ebp+FFFFFDE0], 0001
:0040964A 66C785E2FDFFFF0100      mov word ptr [ebp+FFFFFDE2], 0001
:00409653 BA00000000              mov edx, 00000000
:00409658 668995E4FDFFFF          mov word ptr [ebp+FFFFFDE4], dx
:0040965F BA00000000              mov edx, 00000000
:00409664 668995E6FDFFFF          mov word ptr [ebp+FFFFFDE6], dx
:0040966B BA00000000              mov edx, 00000000
:00409670 668995E8FDFFFF          mov word ptr [ebp+FFFFFDE8], dx
:00409677 BA00000000              mov edx, 00000000
:0040967C 668995EAFDFFFF          mov word ptr [ebp+FFFFFDEA], dx
:00409683 EB00                    jmp 00409685

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409683(U)
|
:00409685 8D85F0FDFFFF            lea eax, dword ptr [ebp+FFFFFDF0]
:0040968B 50                      push eax
:0040968C 8D85DEFDFFFF            lea eax, dword ptr [ebp+FFFFFDDE]
:00409692 50                      push eax
:00409693 E8BDF7FFFF              call 00408E55
:00409698 83C408                  add esp, 00000008
:0040969B 8D85ECFDFFFF            lea eax, dword ptr [ebp+FFFFFDEC]
:004096A1 50                      push eax
:004096A2 8D85D0FDFFFF            lea eax, dword ptr [ebp+FFFFFDD0]
:004096A8 50                      push eax
:004096A9 E8A7F7FFFF              call 00408E55
:004096AE 83C408                  add esp, 00000008
:004096B1 8B95ECFDFFFF            mov edx, dword ptr [ebp+FFFFFDEC]
:004096B7 3B95F0FDFFFF            cmp edx, dword ptr [ebp+FFFFFDF0]
:004096BD 7C17                    jl 004096D6 <-- HERE    Return
:004096BF 8B95ECFDFFFF            mov edx, dword ptr [ebp+FFFFFDEC]
:004096C5 2B95F0FDFFFF            sub edx, dword ptr [ebp+FFFFFDF0]
:004096CB 83C201                  add edx, 00000001
:004096CE 3B95CCFCFFFF            cmp edx, dword ptr [ebp+FFFFFCCC]
:004096D4 7C41                    jl 00409717 <-- and HERE  Return

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004096BD(C)
|
:004096D6 6830057200              push 00720530
:004096DB 8D85F4FDFFFF            lea eax, dword ptr [ebp+FFFFFDF4]
:004096E1 89C1                    mov ecx, eax
:004096E3 E899322200              call 0062C981
:004096E8 83C404                  add esp, 00000004
:004096EB 8D85F4FDFFFF            lea eax, dword ptr [ebp+FFFFFDF4]
:004096F1 6A4E                    push 0000004E
:004096F3 68A2000000              push 000000A2
:004096F8 50                      push eax

* Reference To: ASINTPPC.GetIndString, Ord:012Eh
                                  |
:004096F9 E8061E2400              Call 0064B504
:004096FE 8D85F4FDFFFF            lea eax, dword ptr [ebp+FFFFFDF4]
:00409704 50                      push eax
:00409705 E8B5E2FFFF              call 004079BF
:0040970A 83C404                  add esp, 00000004
:0040970D C785C8FCFFFF4E000000    mov dword ptr [ebp+FFFFFCC8], 0000004E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409586(C), :004096D4(C)
|
:00409717 8B85C8FCFFFF            mov eax, dword ptr [ebp+FFFFFCC8]
:0040971D 8D65F4                  lea esp, dword ptr [ebp-0C]
:00409720 5F                      pop edi
:00409721 5E                      pop esi
:00409722 5B                      pop ebx
:00409723 5D                      pop ebp
:00409724 C3                      ret        

 I hope you enjoyed this lesson. It was fun! I actually have a patch available for those of you who may not be able or
willing to reverse. Ask for it. I'll email it to you only after you have read the tutorial. Until later.

If you have any questions please feel free to contact me at jomamameister@yahoo.com