============================================================================
TITLE.:
32bit Convert It c9.64.01
============================================================================
BEST VIEWED.:
Notepad with word wrap enabled, and in restored window mode
============================================================================
TOOLS USED.:
OllyDbg v1.10(step 2)
============================================================================
TARGET.:
32BC.EXE 671744 bytes.
Written in Microsoft Visual C++ 6.0
============================================================================
LOCATION OF TOOLS AND PROGRAM.:
http://www.grinders.withernsea.com/tools/odbg110b1.rar
http://www.grinders.withernsea.com/tools/32bcsx.rar
http://www.grinders.withernsea.com/tools/Krugerstoolbox.rar
http://www.grinders.withernsea.com/patches/32bit_Convert_It_vc9.64.01_Inside_KeyGen.rar
============================================================================
WEBSITE.:
http://cracking.accessroot.com/
============================================================================
CONTACT INFORMATION.:
kruger48@hotmail.com
============================================================================
TUTORIAL VERSION.:
v1.0 Written 12th of May 2004
============================================================================
AUTHOR AND OTHER ALIASES.:
Kruger
AKA.:(Swat'98) (Swat'99) (Swat)
============================================================================
First, to make this crack easy to follow I have used few references
so you won't loose the grip of the crack.
A lot of tutors bombs you with jumps and calls ;-)
I try to keep it Plain, Simple, Stupid!

I remember in the mid 90's that I got a crack creating a inside "KeyGen"
It was for a program called WinPatch.
I was very impressed and used a lot of time to try to do the same. (With no luck!)
Now, with Olly it's quite easy to do this. 
Let's follow this tutor and you will create a inside KeyGen!
============================================================================
Install app, and load in Olly.
F9, and insert.:
Register Name (Kruger)
Register Email Address (kruger@soft.com)
Registration Code (1234567890)
Click apply...nag...(Timer)...click Order later...OK... 
You are now back in main program window.
Push F12, then Push Ctrl+N.
Browse and find "lstrlenA"
Right click put brakes on all references...
Now push F9... Breaks on address
0040A882  |.  8B2D CC414300 MOV EBP,[DWORD DS:<&KERNEL32.lstrlenA>]  ;  KERNEL32.lstrlenA
Insert 1234567890
push F8
Loops some times...Have a look on
0040A892 . BF E0FB4400 MOV EDI,32BC.0044FBE0 ; ASCII "30353A383D3E"
ASCII "30353A383D3E" Cool!
Finally we got the same ASCII string repeated some times and ends up at address.:
0040BD88 . BF E0054500 MOV EDI,32BC.004505E0 ; ASCII "30353A383D3E"
Now, we got a valid serial.
============================================================================
***Turning app into Inside KeyGen***
Before starting to explain "how to" it's important with some basic knowledge.
The problem.:
1. You need to know the address that refers to the serial is the same all the time.
To verify this try to register with long and short name/address/serial 
and check that the address is unchanged.
If it changes this crack will fail, or just work with the same lenght in Name/Serial!
2. We need to show the serial somewhere in the app, a MsgBox is the easiest way.
============================================================================
So, with this knowledge let's try to KeyGen!
Reload app, go to top in CPU window - right click - choose search for all referenced text strings.
Search for "Don't push this button"
Found it at address .:
0040C1AF 68 EC8B4400 PUSH 32BC.00448BEC ; ASCII "Don't press this button"
F2+enter - into cpu window
Change jump to.:
Old.:
0040C1AF 68 EC8B4400 PUSH 32BC.00448BEC
New.:
0040C1AF 68 E0054500 PUSH 32BC.004505E0
Try app...shit I can only see the serial fore some secs..
Ok, let's dig this out.
After the first txtstring, it's replaced with a new one (using a timer)
"Press one of these buttons, order now"
Hmmm...Go to References search for  ASCII "Press one of these buttons, order now"
Found it at address.:
0040C343
F2+enter
Put brake on JNZ two lines up at.:
0040C33C 75 26 JNZ SHORT 32BC.0040C364
Breaks at address...0040C33C
push F7... and look carefully...loops and finally shows the text that covers the serial 4 us.
0040C353 68 FB030000 PUSH 3FB
Hmm... "PUSH 3FB"
Use Kruger's ToolBox, try to convert 3FB to Decimal.
3FB (Hex) =  1000 (Decimal)
This is the counter for the timer, counting from 0 to 1000!
So, lets kill the timer.
We are going to count from 0 to 0!
Old.:
0040C364 68 E8030000 PUSH 3E8 (1000)
New.:
0040C364 6A 00000000  PUSH 0   (0)
Let's kill the loop.
Old.:
JNZ SHORT 32BC.0040C364
New.:
JMP SHORT 32BC.0040C364
Save changes run app.
The serial is now shown all time, and counter is disabled.
Congrat's! We have just made a inside KeyGen!
============================================================================
SHOUTZ AND GREETZ:
To all Members of AR Team, TSRh Club, the creator of Olly! 
And to all of you reading my Tuts!
============================================================================