Hi !

I got a program and i saw with exescope that it has a dialog to enter serial and click Ok to register ! but how can i see this dialog while the prog is running ? is there a way ?

tnx

[Hi UnderCover

Ooh, hidden reg boxes. My favorite

There may be a menu item or hotkey to call up the reg box, if indeed it has the code to do that. If it's a demo, the code to call up the reg box may have been removed, but the resource hasn't, so you still see it with Exescope.

If you're sure it's a fully functional app and the method to call up the reg box is purposely hidden, then you need to do a bit of exploring. Check the menu item resources with Exescope or WDasm and see if there are any listed that you don't see in the program, you may be able to enable the menu item and access the reg box.

Some hidden registration windows are part of the About box resource, there may be 1 or 2 hidden edit controls in the DialogBox. I remember one where you had to click on a bitmap 3 times to enable the hidden controls. Or maybe an accelerator key (Ctrl-R is a common lame one) might call it up.

You can try setting a 'BMSG <hwnd> WM_KEYDOWN or WM_COMMAND' on the About box and press some keys or mouse click on parts of the window and see if it breaks, meaning the Dialog code is monitoring for this kind of input.

If the proggy was really sneaky it might even look for a reg entry or keyfile that the author may have sent on registration, only then enabling access to the dialog box for serial number entry.

Couple of ideas anyway,

Kayaker

as kayaker mentioned, a keypress or click in about box in a weird place, is common place.

i tend to check with exescope under the 'Accelerator' tree option. It will show you all of the various combinations of keys that the author may be using. if there are more than a few, it gets tedious though ;P

NchantA

I don't think it's necessary to bring the hidden window/button to front. It's only a alternative.

If a prog can be registered, it must store the registration info somewhere in your disk, either in a file or in the registry.

If the reg info is stored in a file, just use FileMon to find it, then use "BPX CreateFileA" or "BPX GetPrivateProfileStringA" etc. to trace it.

If the reg info is stored in the registry, use RegMon to find the suspicious registry key, then "BPX RegQueryValueExA" to trace it.