Reverse Code Engineering RCE CD +sandman 2000/ReverseCodeEngineeringRceCdsandman2000.iso/RCE/Library/+HCU/071-080.TXT

Text File | 2000-05-25 | 66.6 KB | 1,731 lines

========================================================
+HCU Maillist          Issue: 71              11/27/1997
--------------------------------------------------------
Send Articles To:......................... *************
Info, Help, Unsubscription, etc:....... ****************
========================================================

CONTENTS:

#1  Subject: iWinDbg debugger

ARTICLES:

-----#1-------------------------------------------------
Subject: iWinDbg debugger

Thanks to Mr. Fravia's references in his latest lesson I've got
iWinDbg and some other SDK utilities. I don't have the SDK kit: it is too
expensive for me. It is the first time I get know about it ("Copyright
Microsoft 1981-1995", for Windows NT). Mr. Fravia names it as "a very
powerful debugger". But why he didn't mention it in his previous lessons?
Nor in "The tools of the trade" of his Website. I hope he will speak
more about that utility and how he proposes to use it. The debugger
has a Help file, rather confused. But before examining that utility,
I would like to gather more references. Has anybody of you used it?
What is your opinion?
Another SDK utility I've got is Apimon.exe (monitor of API calls),
which persistantly claims the presence of Psapi.dll, though I have
put it in the same folder. Very capricious and without any Help file.
My greetings to all readers, AZ111.

=====End of Issue 71====================================





========================================================
+HCU Maillist          Issue: 72              11/28/1997
--------------------------------------------------------
Send Articles To:......................... *************
Info, Help, Unsubscription, etc:....... ****************
========================================================

CONTENTS:

#1  Subject: The suspence is getting to much !!

#2  Subject: possible problem with the corel crack?

#3  Subject: +ORC riddle

#4  Subject: +gthorne ???

ARTICLES:

-----#1-------------------------------------------------
Subject: The suspence is getting to much !!

Hi all
Don't know about you but I can't take this waiting anymore):
To those who know please tell us were the +ORC site is.

I might be able to add some very interesting stuff...
The OLD RED CRACKER might be Grey ... and from (PTA)...

Bye




______________________________________________________
Get Your Private, Free Email at **********************

-----#2-------------------------------------------------
Subject: possible problem with the corel crack?

Hi all!

I've just received an interesting email from someone, informing me
that there may be a problem with the corel crack I made - apparently,
if you patch all the components of the Corel Suite 8 package (eg
Quattro Pro, WordPerfect etc) and then try to run them
*simultaenously* the protection snaps :-( I tried this on Corel Suite
8 but it worked fine for me - so has anybody else had this problem?
If not, can you try to run a few packages together and see if it
works? Thanks...

Cya,
+ReZiDeNt

-----#3-------------------------------------------------
Subject: +ORC riddle

On 16 Nov 97 at 7:22, +HCU ML wrote:

>    Now that we know what should be done with the solution, I'm
> free to inform you that the solution to the riddle HAS been found.
> Very soon, you will find the solution to +ORCs riddle, the
> addresses of his two remaining "gates", and the location of his
> web-site at:
>
>                **************************************
>
>    If you intend to solve the riddle yourself, you should avoid
> the link mentioned above.
>
>                                                       Hackmore

Not to complain, but I did check out the link, and the solution is
still announced for 'a few days from now'..... when is it really
going to be published?

WAFNA

-----#4-------------------------------------------------
Subject: +gthorne ???

Hail AZ111:

Guess most of us were too busy, leaving you the only poster for ML#71.
Most of MS stuff is 'awfully' powerful.  I guess that is one reason
why most of us avoid it and use our poor man's tools such as SoftIce,
WDasm89, and of course the lowly rated IDA Pro 3.7 (which we all want
to keep a secret and can't afford). There are lots of tools you can
have out on the web for free, but who got time to investigate them
all. By reading the essays at fravia+ you get all you need to know on
how to use the above three tools effectively with working examples.

"But why he didn't mention it in his previous lessons?"

Well if you remember seeing his Microsoft Hostile applet at his site,
I wouldn't put it pass him that he is redirecting the losers and
lamers there.  As you have so elegantly stated, "their help files are
of no help at all" which also say a lot for their development tools.
Check out Mammon's essays and web site (and links mentioned in the
previous Mail Lists).  Thanks to them and others, that's the best way
to get started.

Hail All:

I was evaluating IDA and wanted to try out the TASM compilation as
suggested by IDA with TASM /ml/m5.  One of my project was to take a
program that I had written and decompile it with IDA. With the source
codes, it was easier to trace and figure out the IDA environment for
debugging without the manuals.  You can add, edit, delete functions
and features, output the result to an asm listing to recompile.  Not
a bad idea to eliminate the crap out of most programs.  I was going
to download a copy of TASM5 from +gthorne to test this feature on.

So what's with +gthorne's storage link at

*******************************************

My server keeps repeating that it was not responding or that it was
down.  When I try to get at it via Lord Caligo's link to the same
address, I get the same message.  Did he get bombed before leaving for
his holiday or is it my stupid IP?  Last email up post, the IP told me
it didn't send my email, but it did.  I sent it again before receiving
the ML, so it was sent in double.  Makes me look like the fool that I
am for believing it.  TIA.

wlc

=====End of Issue 72====================================





========================================================
+HCU Maillist          Issue: 73              11/29/1997
--------------------------------------------------------
Send Articles To:......................... *************
Info, Help, Unsubscription, etc:....... ****************
========================================================

CONTENTS:

#1  Subject: The Orc Info...

ARTICLES:

-----#1-------------------------------------------------
Subject: The Orc Info...

Friends;

   It seems some of you have missed the new +ORC page, or haven't
visited the site recently. By the time you read this, the new page has
been up for four days. You'll find it at:

               **************************************

   You'll have to be patient though. Nobody bothered to answer my
questions when I asked you how this information should be presented. So
my friend and I figured nobody at HCU was that interested. As a result,
it was decided to release the information slowly, so that "other"
(non-HCU) people would get a chance to "solve" the riddle themselves.

   I can assure you, the riddle HAS been solved, and the web-page HAS
been located. But those of you who expected to find +ORC sitting on the
web-page, waving hello to you, are out of luck. "+ORC" is still a
mystery, but his two remaining "gates" have fallen, and his "camp" has
been discovered.

                                                    Hackmore Readrite


=====End of Issue 73====================================





========================================================
+HCU Maillist          Issue: 74              11/30/1997
--------------------------------------------------------
Send Articles To:......................... *************
Info, Help, Unsubscription, etc:....... ****************
========================================================

CONTENTS:

#1  Subject: Re: +HCU ML Issue 64

#2  Subject: MazeMap Program Source

#3  Subject: comments

ARTICLES:

-----#1-------------------------------------------------
Subject: Re: +HCU ML Issue 64

Hello all of +HCUlist...

> #1  Subject: 2k Party and FTP
> -----#1-------------------------------------------------
> Subject: 2k Party and FTP
>
>
> Fravia and myself would probably go for the idea of a party - we
> both love a good beer :)
>
> +ORC and our original HCU counterpart(s) are always an enigma however.
> I think that even if we did figure out who +ORC is, and even if he
> met Fravia or myself, it would be another ice age before we could
> get him to show up.

Now.... isn't that a little elitist, especially by someone who has
such 'socialist' views? Shouldn't +ORC be normally 'available'.
Furthermore, why the ignoring of people who write to him (or to
+Fravia, to whom I wrote a letter when I had just begun cracking).
IMHO, OK, there are many many lamers around, but isn't it better to
chat with them, to explain how things work, etc. rather than just
ignoring them? I mean, if we had a crackers 2k party, why shouldn't
+ORC showup? OK, he can be an excellent cracker, but that surely
wouldn't make him someone 'above' us.....

All IMHO, of course.....

WAFNA

-----#2-------------------------------------------------
Subject: MazeMap Program Source

Hail +All:

>hi fravia+,
>I read wlc's essay and i think this project is a very interesting one.
>I think this project is important, and it maybe should not be
>developed by a single person but by everybody who'd like to
>participate. i for instance do some programming in pascal, too, so i
>would very much like taking a look at the source code... it would fit
>the spirit of this +pages much more, by the way :-)
>if wlc is interested in some sort of colaboration, please give him my
>address...
>thank you and keep up the great work...
>cya
>FanTC

This above email was sent to fravia+, which he forwarded to me re:
the submission to his student page on the project worked on by myself
and +.MaLaTTia. a short while back, and donated to fravia+ for general
release.  Needless to say, this was only a rushed solution to test the
water and response with source codes slapped together from my other
projects around ideas generated between +.MaLaTTia. and myself.

In the world of programming, some hang on to source codes like sacred
treasures hiding it from the rest of the world.  This is also the same
program which I used to learn and test the potential of IDA Pro v3.7
with, over the last few days.  Using the source codes for comparison,
I saw how my compiler works and how IDA handles the disassembly. So
what is there to hide?  Programing is taking these snippets of codes,
rearranging them into a working order and voila, you solved a problem.

In keeping with the tradition established by fravia+, I would release
the source code freely to anyone in this group upon request if they
want to make use of it to enhance the functions of the program or to
study it for their own use.  Post a request and you've got it.

I'm not a conventional programmer so I don't document my codes.  I
figure that if I don't know what I'm doing, I shouldn't be doing it.
If you have questions on how or why the codes are used, I would be
more than happy to take the time to explain them.

There are many other directions which I could take this project into,
but then it would be no fun to do it alone.  Collaboration brings out
more perspective and detail into focus on a problem and I for one
wouldn't mind exploring this project further.    Who knows what new
aspects and friends we can gain from this?  It need not be solely a
Turbo Pascal or a Dos based project.  +.MaLaTTia. is working on a
version in C.

Gee! If it was possible and enough of us got together to share our
collective knowledge, we would eventually be able to produce the tools
we need for our own use.  Are we lamers, relying on others for our
tools or will the day come when we collectively own and produce the
tools we use?  My humble release is a step in that direction, thanks
to fravia+.

wlc
************************


-----#3-------------------------------------------------
Subject: comments

Hi to all, esp. TIA.
It is regretfull to put emotional comments on participants or
companies. Of course, we are not on the same level, and some
questions and answers may appear too stupid to more advanced.
But we are here to exchange personal technical findings concerning
a particular software (bad or good, from Microsoft or elsewhere)
FOR OUR PERSONAL NEEDS, if somebody had an experience in dealing with
it. I understand feelings of many people face to Microsoft Empire,
but it is not here to discuss that subject. It may be that many
Microsoft products were made deliberately obscure, huge and clumsy
for certain political and commercial purposes (the policy of the
"black box", as it calls Mr. Fravia), and we are here to make them
more transparent, and not to judge them.
    And I do not judge anybody at that gathering, nor Mr.Fravia,
but try to understand, because everybody has its own aims.
For example, as it was mentionned, Mr. Gthorne has left his
storage adress invalid, but it may be that the adress is fully
valid and operational for him and invalid for others, because he is
actually testing new communications and anti-survaillance
techniques, with certain filters.  It is a new interesting subject, I am not
strong in it. Fortunately, Mr. Fravia has begun recently lessons on that
subject.
With my best regards, AZ111.

=====End of Issue 74====================================





========================================================
+HCU Maillist          Issue: 75              12/01/1997
--------------------------------------------------------
Send Articles To:......................... *************
Info, Help, Unsubscription, etc:....... ****************
========================================================

CONTENTS:

#1  Subject: ignoring people, and not answering emails by fravia+

#2  Subject: has the list vanished and more....

#3  Subject: Let's Party!

ARTICLES:

-----#1-------------------------------------------------
Subject: ignoring people, and not answering emails by fravia+

>Shouldn't +ORC be normally 'available'.
>Furthermore, why the ignoring of people who write to him (or to
>+Fravia, to whom I wrote a letter when I had just begun cracking)...
> WAFNA

I don't know about +ORC, but I receive more than 200 (two hundred) emails
per day,
and believe it or not, even with the bloody faq and info.htm page on my
site, there
are at least TWENTY-THIRTY lamers (I say at least!) asking for a crack or
where is
softice or what cmp eax means or similar bloody banal things.

So many people that imply DO NOT MAKE ANY EFFORT, and don't read,
that you get some doubts at time.

Even nice people (like me :-) get a little annoyed by this.
I have some batch files sorting out this mess and throwing away emails
where words like "please could you send" (and other typical
lamer phrases) appear. It happens, of course, that some GOOD emails
get lost. I cannot help it.
WAFNA was not (and is not) on the 'pass everything no matter what they
write'
list. This has nothing to do with elite (or +HCU), has a lot to do with
WHAT one
writes and offers and with the limited time amount disponible for all this
game.
So anyone that wants answers from me better offer something in exchange,
like I do when I write myself to somebody... that's normal Netiquette in a
world where only knowledge counts.

And yes I myself... would probably go for the idea of a party, and would
love to
meet +gthorne (that I have invited at least twenty times to Europe, btw). I
doubt
that +ORC (who is reading this, I'm sure) would appear. He promised me long
ago
a 'meeting' in a 'neutral' location, yet never substantiated this... he is
not socialist, IMO,
btw, he seems to me on the countrary rather elistist ('aristocrat' he
called himself once).
This suits me well, I'm rather elitist myself... see Wafna, the problem
when you teach
is that only a tiny part of the students are worth... and the same is true
the other way
round... when you learn only a tiny part of the 'masters' are worth.

That's the reason we are glad to have found +ORC, with all his (many)
defects,
I would not swap him for another teacher (yet :-)

So let's organise the party, somewhere in Europe, next spring!
May be we'll get the elusive +Alistair as well :-)




later
fravia+

-----#2-------------------------------------------------
Subject: has the list vanished and more....

Hello all,

I found that ******************** has an interesting proggie - they
archive old web pages, and when you reach a 404 it gets the page from
the archive (6 terabytes). Could be nice for us to get our censored
pages....

BTW, where's the list????? I haven't received the newsletter in quite
a while....

WAFNA

-----#3-------------------------------------------------
Subject: Let's Party!

Hail +All:

Sorry to open up a can of worms with my year 2000 suggestion. If we
make it happen and 'they will come.'  Fravia+ posted 'AccessMy.HTM'
showing access to his site.  Scanning the list, we seem to be world
wide at quite a few interesting locales.  I for one believe that our
activity brings out the best in us in spirit more so than any other
group or site on the net.  Elitists are outnumbered by the genuine
seekers of knowledge and the seekers will collectively determine the
course of this group.  In helping each other we all move forward and
we can, in time overtake those currently ahead of us.  Where the
group collectively move, the rest must follow or be left out.

+Orc is not an immortal.  He set an example which drove into motion
this group. I can respect that and the work done by fravia+ to help
assemble us here today as a collective force working together.  It
will be through our achievements that they will show up.

"Show me something new, and I'll send you a lesson."

Let's just say, "You wanna to see it?  You better show up at our
party."

We've got the time so let's plan for it and do it.  Let's work hard
and we can all show up as peers and not elitists.

What we write can say so much about us that we have to be careful in
our choice of words because there is no censorship preventing us from
being disclosed as _________.  Make stupid comments and who knows how
many readers will have copies of it to hold over your head and that
is their only impression of you.  Be your best and you may find and
make a lot of new friends instead.  The choice is yours to make.


wlc

=====End of Issue 75====================================





========================================================
+HCU Maillist          Issue: 76              12/02/1997
--------------------------------------------------------
Send Articles To:......................... *************
Info, Help, Unsubscription, etc:....... ****************
========================================================

CONTENTS:

#1  Subject: Anonymous Mail

#2  Subject: ftp site

#3  Subject: re: ignoring people, and not answering emails by fravia+

#4  Subject: free web space - 50 whole megs

#5  Subject: Elitist?

#6  Subject: Regarding M$oft

#7  Subject: Micro$oft

ARTICLES:

-----#1-------------------------------------------------
Subject: Anonymous Mail

Hi all!

I wonder if anybody knows how to use the xref functions
of IDC ( the built in language of IDA). The script below
should list all references from a user selected
function.

#include <idc.idc>

static main() {
  auto ea,x;

  ea = ChooseFunction("Please choose a function");

  Message("\n*** Code references from " + atoa(ea) + "\n");
  for ( x=Rfirst0(ea); x != BADADDR; x=Rnext0(ea,x) )
    Message(atoa(ea) + " refers to " + atoa(x) + "\n");

}

Unfortunately, its not working because the Rfirst and Rnext
functions don't give back the references. Rfirst can not
find the first reference (returns with BADADDR) unless the
reference is at the very first address which is scanned (ea).
But even then Rnext cannot step to the next reference, but
returns with BADADDR. Seems that the scanning part of these
functions are not working for me. If somebody knows how to
use these xref functions (Rfirst, Rfirst0, Rnext, Rnext0)
correctly, please tell me.

Thanks Zer0+

-----#2-------------------------------------------------
Subject: ftp site



I just checked the ftp site i was donated and notice it is not responding.
I assume this may have been most of the last week I was on vacation
though I do not know.
I will check with the guy who donated me the space and find out if
this is going to be a problem.


+gthorne

/*****************************************************\

           Greythorne The Technomancer

  WebSite: *******************************
   (AKA:)  ************************************
   (IP:)   ****************************
  Gateway: *************************************
  Old Mirror: ******************************
  FTP1:    ******************************************
  FTP2:    *******************************************

\*****************************************************/


-----#3-------------------------------------------------
Subject: re: ignoring people, and not answering emails by fravia+


In their defence mien partner fravia, even I get lost in your site and
have trouble spotting things that would be very easy on a less
intensive set of pages. It is definately overwhelming to the newer
person (and a few older ones) on occasion.

Oh yes- back from holiday all - watching porpoises play in the surf
and a bit of relaxation (and a massage or two) seemed to be just what
I needed ;)

+gthorne

/*****************************************************\

           Greythorne The Technomancer

  WebSite: *******************************
   (AKA:)  ************************************
   (IP:)   ****************************
  Gateway: *************************************
  Old Mirror: ******************************
  FTP1:    ******************************************
  FTP2:    *******************************************

\*****************************************************/


-----#4-------------------------------------------------
Subject: free web space - 50 whole megs


I seem talkative today :)

If I were you guys, I wouldn't let anyone other than the HCU ML
subscribers know about this one or we will lose it.

*****************************************

+gthorne

-----#5-------------------------------------------------
Subject: Elitist?

Hail +All:

If you want respect you've got to earn it.  Anyone can brag and say
how good they are, but can you prove it? Or do you have to prove it
to every gunslinger who cross your path?  Yes, there should be some
elite members in any group.  But if the herd of buffalo want to jump
off a cliff, do you want to be a member?

All too often, we've been brainwashed that by society that by making
noise, others should pay attention.  Well, that is not how things
work.  If you want to make noise, you will be ignored.  When my cat
cries 'Feed Me!' everytime I open a can of food, I kick its butt out
of the kitchen.  You've got to 'social engineer'.  Just like you
wanting attention from them, you've got to have something they want
from you.

I'm not writing this in defence of anyone but expressing a different
perspective on this matter.  If fravia+ took the time to write me the
first time I visited his site, I might get the impression, gee how
desperate he must be, everyone must be ignoring him.  Life sure is
lonely for him, he's got nothing better to do than to talk to me.
Great guy to follow cause he's going to have time to give me the
personal attention treatment.

Look at his site and you see a different story.  It takes time and
effort to build it up and he's not wasting it on idle chatter.  You
have to respect him for that.  If you want to help by feeding the
strays cats for him, but all means do so.  How many can you handle
and will they scratch you when you pet them?

When I made a submission to him, it wasn't even a crack, yet he sent
me an email of one line which is more dear to me because it came
from his heart.  He doesn't have to be my friend, but I will be his.
If he sent me that same line the first time I visited his site I
would have no respect for him because I did nothing to deserve it
except to mouth off a few empty words to which he could have replied
the same in return.

Think about it?  If you can do something to gain his respect, would
he refuse to show?

wlc

-----#6-------------------------------------------------
Subject: Regarding M$oft

.....

Microsoft can be regarded as the Evil Galactic Empire, or they can be
viewed as just another consumer product on the shelf. Either way, the
simple fact is that Microsoft has what might be termed a controlling
interest in the PC market (i.e., a dominating market share), and they
employ questionable if not dishonorable business practices.

Regardless, they are a large software development group with a huge (and
well-funded) R&D department--which, it seems, has been largely ignored
by the underground community. MSResearch, the R&D department for this
colossal company, has a page full of technical papers (but few tools,
alas) at
*************************************

It is well worth checking out, for 1) these guys will be defining the
future of PC computing, 2) you get to see where the M$oft people are
coming from and where they are going to, and 3) some of this stuff is
just damn interesting. It is worth keeping in mind that Microsoft's
(publicly stated) long-term goals are admirable; it is their products
and their methods (and some of their short-term goals) that are not.

_m

______________________________________________________
Get Your Private, Free Email at **********************

-----#7-------------------------------------------------
Subject: Micro$oft

Hello AZ111,

> It is regretfull to put emotional comments on participants or
> companies. Of course, we are not on the same level, and some
> questions and answers may appear too stupid to more advanced.
> But we are here to exchange personal technical findings concerning a
> particular software (bad or good, from Microsoft or elsewhere) FOR
> OUR PERSONAL NEEDS, if somebody had an experience in dealing with
> it. I understand feelings of many people face to Microsoft Empire,
> but it is not here to discuss that subject. It may be that many
> Microsoft products were made deliberately obscure, huge and clumsy
> for certain political and commercial purposes (the policy of the
> "black box", as it calls Mr. Fravia), and we are here to make them
> more transparent, and not to judge them.

 I don't think there is any need to play devil's advocate for
Micro$haft - the reason so many of us are against Micro$haft more than
other companies is because of the detrimental effect they have on the
computer industry and competition in general. For example, in the UK,
Bill Gates has 'generously donated' a sizeable sum of money to
Cambridge University. Many uninformed (and even most informed)
observers praised this 'philanthropical' move - but they failed to see
the hidden agenda behind it - by making this donation, Micro$haft have
secured access to some of the world's finest computer engineers and
researchers. This means that instead of pushing forward with new
technology for the benifit of all, these brilliant workers will
instead be working soley for Micro$hafts benefit, on Micro$hafts
useless projects. Talk about pearls before swine!

I agree that the primary purpose of cracking is technical, but I don't
think there is anything wrong with attacking those who attack us.

Cya,
+ReZiDeNt

=====End of Issue 76====================================





========================================================
+HCU Maillist          Issue: 77              12/03/1997
--------------------------------------------------------
Send Articles To:......................... *************
Info, Help, Unsubscription, etc:....... ****************
========================================================

CONTENTS:

#1  Subject: elitism again

#2  Subject: Wafna: spectralab again! :)

#3  Subject: Putting it all together in between the lines.

#4  Subject: Microsoft

#5  Subject: WindowsCE decompiling...

ARTICLES:

-----#1-------------------------------------------------
Subject: elitism again

Hello all,

I think I must have stirred up some trouble if the subject is still
on after such a long time. Now, a little explanation: due to a little
mix up by our beloved (ahem) listadmin, I haven't been receiving the
+HCU/ML for quite a long time, therefore I don't know what has been
going on... He sent the all the missing issues in one zip file, and I
will be checking it ASAP.

WAFNA of FCA

OK, just checked (and, BTW, zero, you forgot issue 74 in the zip
file)

Now, regarding elitism, I read +Fravia's comments, which seemed
farily reasonable (see, I'm often in irc and Usenet, so I'm used to
really bad flame wars....)

I just wanted to say that, we, once were all complete lamers
(horror!) and we had no idea on how to use a computer. Some of us
(like me) started with the Sinclair back in.... whatever... and have
eventually evolved into the PC. I understand that getting 200 e-mails
a day is really a bother (you have 2 weeks off and you find 1400
e-mails, how can you read them all?). A suggestion, perhaps, would be
to make your e-mail address a little 'cloaked', so that only people
with a little brains would contact you.

For instance, if I recall correctly, you are in Venice (oh, BTW, I'm
Italian too, but I live in South America now.... curious that this
list seems to be mainly European, eh?), you are a man, and, taking a
very wild shot, perhaps called Francesco or Franco.

So - and it's only a suggestion -, you could perhaps eliminate the
reference to your compuserve account on your main pages, and create a
stupid web page that, somewhere, contains the words 'Venezia' and
'cracking', or 'reverse engineering'. Call your page perhaps
'cracking in Venice'. In this way, anyone who has a little brains
and who has searched for you will find you, and the most obvious
lamers will have been cut out.

Since we're on the subject, I noticed that +orc has had quite an
influence in you - for instance, you like to use the verb 'to delve'
like he does (which is quite an uncommon word).

OK, now for all of you, since I have lived 8 years in Brazil (yes, I
had a friend who lived near Ronald Biggs, the train robber; no I
never met him) - now I'm not in Brazil - here's the recipe for
'caipirinha' (pron caipirigna, read as an Italian word), a Brazilian
cocktail which is quite insidious and which therefore might enable
you to spot exactly that JNE you have been looking for the whole
day....


1) get one or two lemons (note: Brazilian lemons are green and tiny,
not like the European ones, so use, say, half of one of our
'yellow' lemons), cut them in four and place them in a glass:

|        |
|        |
----------

understood the kind of glass? The fairly 'square' one. Anyway....

2) add 1 tbsp sugar (or more to taste), replace sugar with 'diet'
powder to have a diet caipirinha (ridiculous, but one never knows).

3) add lots of ice

4) add cacha=E7a (pron casciassa, again, read as an Italian word), or
if you don't have it, vodka.

5) get merry and press ctrl-D at will. Don't drink too much,
otherwise you might end up trying to crack the ROM and wondering why
it doesn't accept any changes.

WAFNA of FCA
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

------ ATTENTION! ATTENTION! ATTENTION!

------ CHANGE OF E-MAIL ADDRESS

------ PLEASE NOTE THAT MY ADDRESS IS NO LONGER **************

------ MY NEW ADDRESS IS ***********************

------ PLEASE UPDATE YOUR RECORDS
------ any mail sent to **************
------ or ******************* will still
------ be received for a limited time,
------ but please change your records

-----#2-------------------------------------------------
Subject: Wafna: spectralab again! :)

Hi WAFNA, hi All! :)

I've got a question for you: have you tried to install Spectralab on different
systems, such as NT and 95, or 3.1 and 95? A friend of mine told me that the
patch in cryp95.dll doesn't work if you install the program under NT or if you
have 32bit fat, because that dll isn't even installed... I've got only 95
installed and didn't realize my patch was wong :-/
Did you make the crack in the .dll or in the .exe? Maybe if you just modify
the .exe file it works fine... :)

byez,

    .+MaLaTTiA.

-----#3-------------------------------------------------
Subject: Putting it all together in between the lines.

Hail +All:

Given that the idea of a get together is desirable,  we may be faced
with an Olympic decision as to where to host this thing.  Seems that
+gthorne doesn't like to travel to Europe. Have to nominate HackMore
to lead a committee to resolve this. Maybe WAFNA can help provide us
with passports and diplomatic passes from  his friends in the greedy
government agencies for those who want to travel anonymously. Got to
have beer for fravia+gthorne, any brand in particular? AZ111 & WAFNA
should have some great ideas on how to raise up some casino money to
cover all our expenses.  If not, we may have to ask ReZiDent to sell
a better protection scheme to Corel for the air fare that we need.

Got to get this thing moving, fravia+ set on a spring meeting doesn't
leave us too much time as always.  Those unnamed are not forgotten.
Of course you are invited.  Just post up some feedback as to who you
are and where you'll be coming from so that Hackmore and  mammon_ can
source out a good site.  Keep in mind that Kubak and +.MaLaTTiA. got
school schedules and exams to meet.   Zero+ will keep you up to date
on all the latest developments.   If you should fear that you'll get
lost, +.MaLaTTia. and I will draw you a map.  For those newly coming
onto this Mail List, like FanTC, check in with +.MaLaTTiA. for old
issues in HTML format at:

**********************************************************

or make a search at

***********************************************************


RSVP
wlc


-----#4-------------------------------------------------
Subject: Microsoft

Hi _m!

>Microsoft can be regarded as the Evil Galactic Empire, or they can be=20
>viewed as just another consumer product on the shelf.=20

Unfortunately they want to be the ONLY product in the shell and they
don't just want it, as you say:

>employ questionable if not dishonorable business practices.=20

More:

>(publicly stated) long-term goals are admirable;=20

They want to convert Internet in a huge T.V. show. This don't seem so
admirable to me :(

>it is their products=20
>and their methods (and some of their short-term goals) that are not.

I do have very good goals. But I don't expect that people judge them,
but my actual work ;-)

----------------

and Hello AZ111!

> It is regretfull to put emotional comments on participants or
> companies.=20

Of course. I don't think lions are "bad". But I don't think that it is
a good idea to have one as my pet =3D:-O

> but it is not here to discuss that subject. It may be that many
> Microsoft products were made deliberately obscure, huge and clumsy
> for certain political and commercial purposes (the policy of the

There is a real danger against privacy and *everybody* should become
aware of it. Null security on IE and all MS comms systems are
specially dangerous because of the huge power of Microsoft and its
known tendecy to unfair play...

If people who are diving deepest into software and internetworking
seem indiferent, who do you think that will care?=20

> "black box", as it calls Mr. Fravia), and we are here to make them
> more transparent, and not to judge them.

The only way to make it more transparent is to find out how it works.
This is impossible unless you reverse engineer it.=20
Are you curious about how Microsoft judges reverse engineers?=20
Check the story of Mr. Fravia's site.

I don't think W95 is too bad. It's easy to use and comfortable and
there's a ton of good programs made for it :)''

Anyway I prefer to use something like Linux, a free, more powerful and
more secure system, supported by its own users. The main warranty is
that you have the complete *source* code.
It's too raw right now for home users but it's vastly used by Internet
sites and many business. Give it a chance.=20

greetings

    +trurl

-----#5-------------------------------------------------
Subject: WindowsCE decompiling...

Recently there has been an influx of Hand-Held PC hype. so much so i got
intreasted and investigated some H/PC's and WindowsCE (the OS which
seems too be coming out on top in the market, what a suprise), and there
(just as on any other OS) are alot of shareware programs being released
for WinCE. As far as i can make out WinCe isnt very compatable with
Win95 because most of the H/PC's run RISC processors, so much so it cant
run normal Win32 programs.
I was wondering if any of you out there have had any expirence with
WinCE? and if the tradional cracking techniques/tools work with the
WinCE programs, because if M$ have their way WinCE will be in every item
with a chip, so one day you might end up cracking your toaster ;P

Regards,
faeton

=====End of Issue 77====================================





========================================================
+HCU Maillist          Issue: 78              12/04/1997
--------------------------------------------------------
Send Articles To:......................... *************
Info, Help, Unsubscription, etc:....... ****************
========================================================

CONTENTS:

#1  Subject: WebSkr, Mgfx, and meeting...

#2  Subject: Windows CE

#3  Subject: Undercover Investigators on IRC

#4  Subject: bpx problems

#5  Subject: Venice?

#6  Subject: are we really going to have a meeting? :-)

#7  Subject: a pretty long attack on the forces of oppression :-)

ARTICLES:

-----#1-------------------------------------------------
Subject: WebSkr, Mgfx, and meeting...

Hi all !!!
Some free time at last !! (but not for long;(

1. For the first thing, I'm very happy that the list "got alive" after
several numbers of silence. There is finally something to read at last.

2. I do not know if You have missed my posting on WebSeeker, or have
just ignored me because of lameness of the topic. I still think it is an
interesting scheme, and I'm stuck half the way (maybe 75%). So if anyone
has tried, or cracked WebSeeker, please contact me. It is not a crack
demmand, it is only question for showing me the right way (as this list
was (is ??!!) intended to be.
3. I know that this is an easy one, so can enyone give me a tip, where
Micrographics Picture Publisher time trial demo marks, the instalation ?
I have checked the registry, and the filesystem (it doesn't seem to lay
eggs. (althou i have noticed that it does something wint win.com)
4. As for the meeting. I think that it is a good idea, but:
    a) I don't think that +ORC would show up, simply because he doesn't
wont to be recocnized, nor on the web nor IRL
    b) don't You think it could be a bit dangerous ? I'm not a lweyer, but
it wouldn't be nice to get arrested, the first thing after we say Hello
?
    c) the exam sessions aren't as big problem as money is. As You all know
i'm a student, and Poland is'n a country where a student can afford
cross European trips (overseas ? SIC!). But i'm sure that if it all
fires up I'll find a way to be THERE!! (reverse engeneering of railway
companies ;)))
    d) I want to say that such meeting would be a wonderfull thing to
happen to us, but i'm very sceptical about it. My main worry is showing
up of the grat ones : +ORC, +Fravia, +gthorne.

So Fravia, gthorne, what do You think about it ????

BTW: Thanx wlc for remembering me ;) The letter i prommised is comming
You way (slowly, but it's comming ;)

Allrighty then, thanks to evryone who answers this posting and keep
coool (or warm ?? ;)

    Kubak

-----#2-------------------------------------------------
Subject: Windows CE


Recently the company where I work was considering Windows CE palmtops
(the execs were too lazy to carry their laptops on short trips) and I
had to do an evaluation with a few of the available models. Naturally,
the first idea I had was to put SysInfo or FileMon on these things, but
I found 2 problems:
1) Space Available--Most of these palmtops have about 2-4MB of storage
space available; not a lot for your cracking tools
2) API Functionality--Only about 150 API calls are supported in Windows
CE, so some of your more tricky apps will not run

However, when scouting the CE issue at micro$oft.com (a site more
cumbersome than Fravia's ;), I found a copy of the Windows CE SDK
available for download.
This allows you to debug applications on the palmtop from your desktop
PC--files included are Process Viewer, RemoteSpy, RemoteMemView,
RemoteRegEdit, RemoteZoomin, Dialog/Font Editor, Windiff, Spy, Remote
Connection Server, help files for the SDK and DDK, and an Emulation
Shell/Build environment (the compiling tools are command-line). Needless
to say, this should allow you to decompile any CE application from your
desktop...and with the CE API being a subset of the 95 API, there should
be very few unfamiliar commands.

M$oft should have this available still. If not, contact me and I'll see
if I still have a copy stashed somewhere for upload (14 MB).

mammon_

______________________________________________________
Get Your Private, Free Email at **********************

-----#3-------------------------------------------------
Subject: Undercover Investigators on IRC

Hello fellow crackers,

While I was searching the net I stumbled upon an interesting article
from wired.com.

In this article you can read
- how crackers, warez-traders are trapped, and catched.
- what profile do those investigators have, and how they operate.
- and much more.

Location :  ****************************************************

I like to add something to this article :

These undercover IRC investigators seem to know all the Ins and outs of
the underground computer world. The first thing they look for is your
IP-adres.

Can anybody tell me how get on IRC anonymous ? With a fake IP or
something ?

Keep in touch,

Code-X





-----#4-------------------------------------------------
Subject: bpx problems

Hi all,

I've just recieved a message form someone asking why SoftICE for
Windows 95 won't break on the old 16-bit file I/O functions (e.g.
_lseek,  _lopen etc) - I'm not sure why this is, although I have an
idea....can anyone tell me how to get around this problem?

Cya,
+ReZiDeNt

-----#5-------------------------------------------------
Subject: Venice?

Wafna, you will probably not believe it, yet I'm not living in Venice,
 (even if I have been often there) that's only part of the smoke (wich
I learned from +ORC, btw).
My "actual" smoking is more German oriented, and I have intensified it
in recent times..., you'll notice a (bogus) 'forgotten' signature as Franz
Von Iannecke on one of my new pages :-)
I think I will slowly drift "Austrian", und warum auch nicht? Ich liebe
Sachertorten! Yet I love belgian beer (Ename and Gran Cru!), and
you will probably be able to meet me in Essen every year at the
Spielmesse (strategische Spielen, that is).

Even +gthorne (who is really good in these stalking matters) lost sight
of me on my 'second' defence line. The only one that caught me
really unaware until now is +Alistair (and that seems to be his 'job' :-(

This said I could not care less about you knowing my real identity and
will therefore gladly come to any (reasonable european located) party
in spring. Could we now close all this useless and a little boring
personal
things and go over to cracking matters with our maillist?

later
fravia+

-----#6-------------------------------------------------
Subject: are we really going to have a meeting? :-)

Hi wlc,

 Regarding this idea of a meet someplace....

> Got to get this thing moving, fravia+ set on a spring meeting
> doesn't leave us too much time as always.  Those unnamed are not
> forgotten. Of course you are invited.  Just post up some feedback as
> to who you are and where you'll be coming from so that Hackmore and
> mammon_ can source out a good site.  Keep in mind that Kubak and
> +.MaLaTTiA. got school schedules and exams to meet.   Zero+ will
> keep you up to date on all the latest developments.   If you should
> fear that you'll get lost, +.MaLaTTia. and I will draw you a map.

 You seem to be moving quickly! I'd better get my name on the
guest list :-)

 But seriously, there are a few things I thought it might be good to
say.

 Firstly, I agree with fravia+ on a location in (western?) Europe -
this would make it possible for me to come along :-) I'm as poor as a
church mouse, and couldn't afford to go to the States. However, what
if there were to be one meet in the States (for those in the US, South
America, Far East and Australia etc) and one in Europe - these could
be linked via the Internet and video-conferencing...big business do it
all the time, so could we :-)

 Secondly, what about security? I wouldn't be surprised if we found a
few real 'rezidents' turned up, so perhaps someplace with lax laws on
computers would be an idea? Also, people might not want to disclose
their real identities, so if a place were arranged in plenty of time
and adequately advertised, that would give everyone the opportunity of
turning up without having to much sensitive information having to swop
hands....or am I being paranoid? :-)

 Oh yes, after May/early June is the best time for me, as well as
probably many people (summer holidays, school holidays).

Cya,
+ReZiDeNt

-----#7-------------------------------------------------
Subject: a pretty long attack on the forces of oppression :-)

Hello _m,

> It is well worth checking out, for 1) these guys will be defining
> the future of PC computing, 2) you get to see where the M$oft people
> are coming from and where they are going to, and 3) some of this
> stuff is just damn interesting. It is worth keeping in mind that
> Microsoft's (publicly stated) long-term goals are admirable; it is
> their products and their methods (and some of their short-term
> goals) that are not.

I'm afraid I have to take issue with that last statement :-) The
primary (indeed, the only) real purpose of business is to make money.
Now, maybe you are a small business and only want to survive, like
most people, and you don't trample on others and become an oppressive
international force. On the other hand, if you are infected with the
seeds of meglomania (cue Bill Gates and an inestimable number of his
counterparts, particularly in politics and *big* business) you do not
desire to 'make the world a better place' or even simply to make
money, whatever your PR department or autobiography might say. Once
you've made your millions (or billions) you quickly realise that money
is no longer relevent (you have more than you could realistically ever
spend anyway) - and you become interested solely in the *power* of the
money.

Remember, 'the love of money is the root of all evil' - this point I'm
making about money and power becoming blurred is what O'Brien told
Winston Smith in the Ministry of Love during the interrogation (if you
don't understand that last statement, I strongly suggest you go to a
library or bookshop and get ahold of a copy of '1984', by George
Orwell and *study* it, from cover to cover. Read it twice, make notes,
underline the important parts and see and *understand* how so much of
that book is, perhaps unwittingly, chillingly accurate when compared
to the world today).

I'm not a communist/socialist; I have nothing against people making
money to live (so long as they do it honestly, and without greed), but
Bill Gates is no philanthropist. You can call me a cynic, but I don't
believe that *anyone* gets into positions of power, excessive wealth
and influence without selling their souls to the devil. These
billionaires may wake up one morning and give a million to so-called
charity, but its just another cunnigly disguised press conference, a
carefully calculated gesture.

The people who run the world (I mean *really* run the world, not the
puppets-on-a-string who the media tell us run the world) have no other
interest than *absolute* power and control of *everyone* - just look
how they attempt to bend the benefits of modern technology to suit
themselves - by creating databases to track us all, push electronic
'smart ID cards' down our throats like you would tag cattle, and
brain-wash the population with TV and other mass media channels (even
the Internet, if they can!). These people are trying to herd us over
the edge, into total subservience to their will  - the sad thing is
that, with a few exceptions (such as, I hope, at least some of us
+crackers) the population are completely oblivious to this, to the
extent that they rush towards their own doom, building their own
scaffolds and digging their own graves, pathetically stupid lemmings
who are charging to their sad fate (but are nevertheless thrilled to
death about it).

Now, all my ramblings abve may be overdoing it a bit in the case of
Bill Gates; he is not, of course, the Antichrist, but he does hob-nob
with those who are addicted to power, who use (abuse!) it as a drug.
He is just 'small fry' compared to the full pond, a flea on the hide
of those who really run the show - nevertheless he is a part of it,
and they doubtless will use and are using him to exert force on those
they cannot control as they would wish (e.g. ourselves, those who are
aware of the world around them!).

This is why we must resist him, just as we must resist all the forces
of oppression.

(wow, I feel tired after all that :-))

Cya,
+ReZiDeNt

=====End of Issue 78====================================





========================================================
+HCU Maillist          Issue: 79              12/05/1997
--------------------------------------------------------
Send Articles To:......................... *************
Info, Help, Unsubscription, etc:....... ****************
========================================================

CONTENTS:

#1  Subject: Clarification...

#2  Subject: Reply to legal issues

#3  Subject: +HCU ML Repository!

#4  Subject: A Net Conference?

#5  Subject: Cracking Photoshop, and problems with IDA pro

ARTICLES:

-----#1-------------------------------------------------
Subject: Clarification...

Not to perpetuate a debate regarding a company whose interests I truly
do not care about, but I gather that one of my comments was a little
misunderstood (more than once, apparently ;). When I referred to
That-Which-Shall-Not-Be-Named (any Lovecraft fans out there?)'s public
goals, I was referring to their self-professed desire to make computers
easy to use, sort of a "computers for the masses" plan. From a customer
support standpoint (where I stand in most of my jobs), it is easier to
train/setup/support customers on a Windows 95 machine than on any other
(except MacIntosh)--this is not to say that 95 is better than, oh,
Linux, but rather that most people are not willing to put any time into
learning computers, and people like that need simple Mac-like PCs if
people like me are going to be able to get any work done (by not being
burdened with dumb questions like "what's a directory?").

The real goals of this company, as with any capitalist venture are of
course to make money--there is not even a pretense otherwise (hence the
comment about their business practices. The point I had been trying to
make at the time was "Microsoft is just another company. They only
happen to be very rich and huge. They are not a force of evil, they are
a market force." I'll let the bulk of Rezident's email slide on to those
who need to hear it; 1984/THX1138/ Brave New World/Brazil/et al. are old
news here ;).

Rezident:
RE SoftIce and 16-bit functions...are you sure they have loaded the
exports for kernel.exe in addition to kernel32.dll? I haven't had any
problem with 16-bit code in soft-ice; I managed to plumb through some
interesting kernel routines (exception handling, swap file, mem
allocation) in an old 3.1 dll with no problem...

mammon_

______________________________________________________
Get Your Private, Free Email at **********************

-----#2-------------------------------------------------
Subject: Reply to legal issues

>    b) don't You think it could be a bit dangerous ? I'm not a >
lawyer, but
>it wouldn't be nice to get arrested, the first thing after we say
>hello

After HIP in the Netherlands passed without any attempts of arrest, I
guess that a +HCU convention wouldn't do too much harm to anyone.

In most european countries the issue of reverse engineering is largely
unclear. I don't know of any "Hacker/Cracker"-related cases which were
actually taken to court in the style they did it in the states in 90/91.
The only case I can remember was that german guy who went to jail for
getting free phonecalls to his own sex-line, therefore amassing money.
If you're well know in the warez scene, you'd better
keep your handle secret to the authorities, since there are some
free-lance lawyers seeking to make a buck.

In fact, I don't think that there is ANY danger of being harassed by
cops. I don't know about most of the other guys here, but
I'd say that none of you is searched with a warrant, therefore no
arrests.

HalVar from Flake

______________________________________________________
Get Your Private, Free Email at **********************

-----#3-------------------------------------------------
Subject: +HCU ML Repository!

Hi All! :)

I wanted it to be a surprise... well, I think it is, even if I'm late... :)
I've put online the ml repository, if you've seen it yet forget it, I'm
uploading the new pages right now... :)
First of all, I've grouped the issues in groups of 10: 1-10, 11-20 and so on,
'cause it's easier for me to maintain the ml in this way (just two new files
every 10 days), and it's easier to upload 1/10 of the files with that damned
fortunecity's file manager... :)
Then I added a little FAQ, just to keep away most of the lamers, tell me if you
think I should change it in any point...
Finally, I added the .zip files to make the download easier and faster...
uhmm... do you think I should put less bigger zips, or maybe just one with all
the issues?
That's all for now, tell me if you liked my job and if you see any non-stripped
address, tell me what you think I should change in every page, 'cause the ML is
yours and so is its page :)
Now, you have to remember just ONE address:

**********************************************************

byez,

    .+MaLaTTiA.

-----#4-------------------------------------------------
Subject: A Net Conference?

Hail +All:

I for one enjoy reading this Mail List, regardless of the topic.  So
what's the reason for being here?  Technical contributions can be hard
to come by, unless we are doing it full time.  I can't afford to give
up my job and family just yet.  People (friends included) still expect
us crackers to perform our services free of charge. Kinda like, you go
rob the bank and give me the money.

If you haven't seen any cracks from me, it is because they were too
trivial to mention and covered by essays on the topic.  I'm still
following up on material and techniques covered by others and far from
being an expert to give the right answers.  If I don't ask questions,
it is because of my tenacious nature to go at it on my own and try and
find the answer before troubling anyone by asking.

It goes without saying that if anyone takes the time to write anything
to this Mail List, it is being read and responded to, even if it is off
topic.  There is enough space to accommodate more participation.  We
should not drive ourselves underground with our paranoia?  If so, we
should stop meeting here and go back into the closet to hide.

It takes a guy like WAFNA to crack the stone fortress of fravia+
personality and draw out some personal insights into the great man.
Great job WAFNA.

Hey ReZiDeNt, where do you get your views from?  After reading your
work on Corel, I didn't think you had much time left for other things.
Good thing I'll be on your side of the fence when it comes to throwing
rocks. You can be on my list any time.  Your idea of an Internet video
conferencing link would be a practical solution to follow up on due to
the nature of our interests.  Can anyone recommend a Xmas wish list of
the programs and equipment needed for this project before Santa comes
and goes?

wlc

-----#5-------------------------------------------------
Subject: Cracking Photoshop, and problems with IDA pro

Firstly a disclaimer.
I've only been reading this list a couple of days, so if I say something
stupid, dont yell at me!

Anyway, I have recently spent my time trying to crack a save disabled
version of Photoshop(I can get a full vesrion easy, I am just cracking this
for fun)

Its been a lot harder than all the other save disabled targets I have read
about, because it disables the menu items.
Therefore you can't use bpx MessageBox
It also does not use use Resources to store the menus.
Eventually I found out how createmenu, appendmenu, enablemenuitem etc work,
and was able to write a quick half crack, by ensuring that it only called
enablemenuitem when enabling items(This enables menus all the time[although
save is enabled even when you haven't opened anything, so I'll have to fix
it up a bit for a final crack])

Unfortunately this is only half the crack, I now have to find where it gets
processed when the WM_COMMAND comes in.
I made a program that showed me the WM_COMMAND numbers of each menu item,
and after a bit of lucky, was able to work out where it goes to(sometimes).

Anyway, the problem is that the code is large and convulated(54 megs, takes
2 hours to decompile with IDA!). Some parts of the code seem to use function
pointers, and recursively call themselves many times. Having read some of
the latest essays on call tables, I am pretty sure it is has been written
using Object oriented code, with a complicated object hierarchy, and virtual
functions etc.

Has anyone come across code like this before? Got any suggestions as to how
I might proceed(I absolutely refuse to give up, there is no way some
compiler is going to beat me!)

My second problem is with IDA Pro. I have been using a quine cracked version
for a while now, but I can't seem to run it at the same time as Softice 3.2,
as soon as I set a breakpoint, system crashes :(
I haven't been able to download the full version off Greythornes ftp yet, so
I am not sure if it is my demo version, or my system setup.
Anyway come across this problem before?

One last thing, what is the status with the PDF cracking? I was netless for
a while, and by the time I got back on it seems to have already been
finished. Is there anything left to do?

+Alt-F4


=====End of Issue 79====================================





========================================================
+HCU Maillist          Issue: 80              12/06/1997
--------------------------------------------------------
Send Articles To:......................... *************
Info, Help, Unsubscription, etc:....... ****************
========================================================

CONTENTS:

#1  Subject: OOP assembly

#2  Subject: IDA Pro

#3  Subject: IDA and SoftIce 3.2

#4  Subject: Win 16 imports

#5  Subject: Cracking PhotoShop?

#6  Subject: Security...

#7  Subject: Time.... :-)

ARTICLES:

-----#1-------------------------------------------------
Subject: OOP assembly

Alt-F4:

First off, for large targets like that you may want to stick with
W32DASM for the time factor alone. I recently tackled a 3 MB exe with
IDA and the resulting 54 MB ASM file took over an hour....

Secondly, if you are seeing calls like "call [ebp+24]", then yes, this
is OOP code. The first time I came across it I had thought the
programmers were just really clever; then I read some of Barry Kauler's
OOP asm code and found the same style...so yes, you are dealing with
classes.

I have found only two ways of dealing with this kind of code, and
neither is very elegant:

1) Run the prog with soft-ice and BPX on the area of code in question,
then dump [ebp+24] or whatever and get the address of the function,
which you then note down and crack later, or

2) Back-track through the source code to see what gets put in [ebp+24]
etc; usually it is the result of a GetProcAddress function that has
passed hands a few times...this is a bit of work though (but IDA is
perfect for it)

As a final thought, you may look at the dll exports that come with
Photoshop and see where the "Save As" function lies, then put a
GetProcAddress of your own into the code and force the menu item to that
dll function. I was considering this with w32dasm, as it comes with the
full Borland OWL library (replete with Save functions), but never got
around to it...

Oh, one more thing...I have for my use and experimentation both the
"Quine" and the "Hackmore" IDA versions and have not had your problem,
but I do get a GPF when I try to decompile a second .exe in IDA. Maybe
system resources are a problem?

mammon_

______________________________________________________
Get Your Private, Free Email at **********************

-----#2-------------------------------------------------
Subject: IDA Pro

Attn Everyone:

IDA Pro has the potential to be a fantastic "modular" disassembler,
basically to be used as the "engine" behind a decompiling environment or
a code analysis/abstraction tool. I am probing these areas right now
with back ends, etc, trying to see what would be the best
approach--i.e., a simple file parser/abstraction engine (with a huge
database that classifies the code and searches for patterns), a neural
net back-end with an API "knowledge store" trained on simple .exes, or
just a conglomeration of IDC scripts for specific purposes (DOS int
calls, kernel calls, file access, resources, etc).

This may take me awhile, and I could use any time-savers available. If
any of you have written IDC scripts (or even C/C++ front- or back-ends)
for IDA, I would appreciate it if you would send them (in original or
psuedocode, whatever) to me at *******************

Thanks,
mammon_

______________________________________________________
Get Your Private, Free Email at **********************

-----#3-------------------------------------------------
Subject: IDA and SoftIce 3.2

Hi All!

In reply to Alt-F4's problem: I have experienced the same problem with
my SoftIce and IDA. To work around it, I just use the dos version of ida
pro (idax). It does not seem to conflict.

Later,

Great Dalmuti

______________________________________________________
Get Your Private, Free Email at **********************

-----#4-------------------------------------------------
Subject: Win 16 imports


Hi there mammon,

> Rezident:
> RE SoftIce and 16-bit functions...are you sure they have loaded the
> exports for kernel.exe in addition to kernel32.dll? I haven't had
> any problem with 16-bit code in soft-ice; I managed to plumb through
> some interesting kernel routines (exception handling, swap file, mem
> allocation) in an old 3.1 dll with no problem...

 hmm....you mean load the krnl386/286.exe from Win 16?

Cya,
+ReZiDeNt

-----#5-------------------------------------------------
Subject: Cracking PhotoShop?

Hi there Alt-F4!

> enablemenuitem etc work, and was able to write a quick half crack,
> by ensuring that it only called enablemenuitem when enabling
> items(This enables menus all the time[although save is enabled even
> when you haven't opened anything, so I'll have to fix it up a bit
> for a final crack])

 Does this mean that the save code is actually in the program? (e.g.
have you been able to get up the save dialog boxes and save a file?).
If so, I'd be very interested in this....I took a (very quick) look at
one demo version of Photoshop, it seemed to be deadware....

Cya,
+ReZiDeNt

-----#6-------------------------------------------------
Subject: Security...


Hi there HalVar,

> In fact, I don't think that there is ANY danger of being harassed by
> cops. I don't know about most of the other guys here, but I'd say
> that none of you is searched with a warrant, therefore no arrests.

 I admire your courage :-) However, I would not like to put this to
the test in the UK. Unfortunately in this country we have seen several
instances of the police overstepping their authority when it comes to
computer issues....although of course in theory they should leave us
in peace, since we are not criminals :-)

Cya,
+ReZiDeNt

-----#7-------------------------------------------------
Subject: Time.... :-)


Hello wlc,

> Hey ReZiDeNt, where do you get your views from?  After reading your
> work on Corel, I didn't think you had much time left for other
> things. Good thing I'll be on your side of the fence when it comes
> to throwing rocks. You can be on my list any time.  Your idea of an
> Internet video conferencing link would be a practical solution to
> follow up on due to the nature of our interests.  Can anyone
> recommend a Xmas wish list of the programs and equipment needed for
> this project before Santa comes and goes?

 I don't 'get' my views from anywhere :-) I don't subscribe to any
particular political/social movements, I'm just trying to get people
to wake up and look around before its too late....

 Yes, I am very busy, but I still manage to find time for different
(important) things, such as cracking, experimenting with Linux (which
I sadly don't know enough about), delving (I hope nobody minds me
using this word :-)) deep into the false information we are fed and
making sense of it, finding the truth behind the facade....

Cya,
+ReZiDeNt

=====End of Issue 80====================================