Hi,

I am starting on trying to enable menu function as the next step :>.. read af ew tutorials and tried Cool Edit Pro as my target... I have found a few things interesting...

The website stated that the full version has to be ordered from CD but looking at the source code, I have found numerous string "Registered to :", "You have the full license etc.."

Also, I tried to patch the nag, there were a CRC nag... i tested various patch in memory with SoftIce and guess what, Suddenly Cool Edit (not Pro) pops up ask me to select which function i wish to enable for my trial :>... however, i couldnt find where i patched it to make it become a normal version again :<.. results of messy patching...

I looked closer into the source code and suspect that all 3 version, Cool Edit, Pro Demo and Pro Reg are in there.. i found this function
Export : _regForm with lots of NOPs
RegisterMsgProc : which has full source code seems to display the registration form and get the registration key etc.. but there is no reference for it...

This looks like a nice target for trying i guess, but could some1 drops me a hint on how to continue as I am kinda stuck there... the menu function that i enabled somehow is not there anymore which makes me uncertain... has any1 tried reversing it yet?

Thanx

ARGHHHH...

I am still unable to find the stupid CRC check... bpm on the changed byte doesnt break... tracing brings me to DialogBoxParam and the Dialog close automatically if the file is patched :<... tracing the handle proc of that dialog gave the same route with both patched and unpatched proggies..

Is there any other way of finding the crc? I read Predator's essay he used "bpx _lopen" but din explain how it works... I tried with no luck... could some1 throw me some light?

Thanx,

P.S : Clandestiny, i understand that u did this prog some times ago, have u bypassed the crc check yet? If yes, could u drop a hint ?

The program opens it's executable file via _lopen. It then generates its checksum via _lread's of the file within a checksum loop, followed by _lclose when it's done.

The relevant _lopen in CoolEdit is after a call to GetModuleFileNameA.

Yeah.. found it alredi.. but thanx anyway :>