It just shows the wrong nag screen, so what we do is to nop the second
instruction, and make the third jump. Then change the text at 403056 to
the real serial .. but what is it ?? ;) heh you can try changed it to 'woody
rules',00 ... aren't you curious is that's the real serial ?? try it out :)
Lets check what's going on at 401022
:00401022 A352304000 mov dword ptr [00403052], eax
:00401027 B912000000 mov ecx, 00000012
:0040102C 8B1D52304000 mov ebx, dword ptr [00403052]
:00401032 BA7C304000 mov edx, 0040307C
First it moves the value of eax into [403052], So now the value at [403052] is
403056 because 403056 was moved into eax in the first instruction. As you know
ecx is mostly used as a counter for stuff, so now it moves 12h into ecx. 12h
in decimal is 18.
Then it moves the value at 403052 into ebx, so ebx is now 403056. and edx
is now 40307c.
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401044(C)
|
:00401037 8A03 mov al, byte ptr [ebx]
:00401039 8A22 mov ah, byte ptr [edx]
:0040103B 32C4 xor al, ah
:0040103D 8802 mov byte ptr [edx], al
:0040103F 43 inc ebx
:00401040 42 inc edx
:00401041 49 dec ecx
:00401042 85C9 test ecx, ecx
:00401044 75F1 jne 00401037
:00401046 E931200000 jmp 0040307C
Here it moves the value at [ebx] which was where our serial was, and if you
typed 'woody rules' al should now hold the hex value of 'w'. Then it moves
the value at [edx] (40307c) into ah. Then it xor al with ah ... xor the first
char of our serial with the char at 40307c. then it replaces the value at
[edx] with al. increases ebx and edx, and decreases ecx. Checks if ecx is zero
if so - jump to 40307c, but if not jump to 401037. Ecx was 12h so it will do
this 18 times. As you probably (hopefully) can see, is that it xors the new
code at 40307c to 40307c+12h, when it's done it jumps to execute the new
code .. which should be and register engine or so ...
Now try it out ... can you do it .. you know how to make a messagebox
if you read some of the older Vaczine mags :) come on :) mail me when you
found the right serial. it's easy ... but only because it's a messagebox!
that's all :)
-wOODY^dRN