Patch it ... That's it .. now the text is gone ..
So lets goto the next protection in this program, the program expires .. darn ;)
so we have to find the text "The evaluation period of Fund Manager has expired."
Search through the string references until you find it .. found it ? cewl:
:0049510C 83F801 cmp eax, 00000001
:0049510F B800000000 mov eax, 00000000
:00495114 83D0FF adc eax, FFFFFFFF
:00495117 83E02D and eax, 0000002D
:0049511A 8D485A lea ecx, dword ptr [eax+5A]
:0049511D 3BCB cmp ecx, ebx
:0049511F 7F64 jg 00495185
:00495121 BF40E94D00 mov edi, 004DE940
* Reference To: USER32.GetDesktopWindow, Ord:00F0h
|
:00495126 FF15DCA84E00 Call dword ptr [004EA8DC]
* Possible Reference to String Resource ID=00048: "Could not save portfolio"
|
:0049512C 6A30 push 00000030
:0049512E 33F6 xor esi, esi
:00495130 57 push edi
* Possible Reference to String Resource ID=02684: "The evaluation period of Fund Manager has expired."
|
:00495131 687C0A0000 push 00000A7C
okay he does some calculations to see if it's expired, but I don't really
care about this ;) all that I know is, that if it jumps at 49511F it doesn't
write the expire text. So we just patch this line to EB64 aka jmp 00495185.
So lets take a look at what's at 495185:
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049511F(C)
|
:00495185 83C032 add eax, 00000032
:00495188 3BC3 cmp eax, ebx
:0049518A 7F3D jg 004951C9
* Possible Reference to String Resource ID=00048: "Could not save portfolio"
|
:0049518C 6A30 push 00000030
:0049518E BE40E94D00 mov esi, 004DE940
:00495193 56 push esi
* Possible Reference to String Resource ID=02684: "The evaluation period of Fund Manager has expired."
|
:00495194 687C0A0000 push 00000A7C
Well it adds 32h to eax, then compares eax with ebx, if eax is greater than
ebx then it's not expired. So we just patch 49518A 7F3D to EB3D.
Okay .. actually we're finished with this program now, but lets make it
display our name and serial when registering. (even though it isn't ;) heh)
When you press help->about it says "UNREGISTERED EVALUATION COPY" and we don't
want it to say that .. but first we have to make it say "Thank for registering",
so it adds our info to the regbase. Press help->Register... write some info
and press OK. Then it says:
"Invalid Registration. (name and password are case sensitive)"
So lets find that text in string references ..:
:004559D2 7507 jne 004559DB
* Possible Reference to String Resource ID=01662: "Invalid Registration. (name and password are case sensitive)"
|
:004559D4 687E060000 push 0000067E
:004559D9 EB05 jmp 004559E0
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004559D2(C)
|
* Possible Reference to String Resource ID=01633: "Thank you for registering!"
|
:004559DB 6861060000 push 00000661
well it couldn't be easier ;) patch line 4559D2 so it jumps .. that's it ..
The only thing we need now is to make it show our reg info instead of the
"UNREGISTERED EVALUATION COPY", so lets find that text ...
:004117B8 741F je 004117D9
* Possible Reference to Menu: MenuID_00C8
|
:004117BA 68C8000000 push 000000C8
:004117BF 8D85F8FEFFFF lea eax, dword ptr [ebp+FFFFFEF8]
:004117C5 50 push eax
* Possible Reference to String Resource ID=02685: "UNREGISTERED EVALUATION COPY"
|
:004117C6 687D0A0000 push 00000A7D
:004117CB FF35345F4E00 push dword ptr [004E5F34]
* Reference To: USER32.LoadStringA, Ord:0183h
|
:004117D1 FF15FCA84E00 Call dword ptr [004EA8FC]
:004117D7 EB1F jmp 004117F8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004117B8(C)
|
:004117D9 A104514C00 mov eax, dword ptr [004C5104]
:004117DE 8D8DF8FEFFFF lea ecx, dword ptr [ebp+FFFFFEF8]
:004117E4 50 push eax
:004117E5 68D0504C00 push 004C50D0
* Possible StringData Ref from Data Obj ->"Registered To: %s"
|
:004117EA 6830FB4B00 push 004BFB30
wow that looks hard ;) heh not! patch line 4117B8 then it jump directly to line
4117EA.
That's all for now ..
-wOODY^dRN