Has anyone tried cracking Registry Drill V1.2.03. It can be had at:

http://www.easydesksoftware.com

Unfortunately, it is about 3.5MB. It is a 10 day trial. I loaded it onto my hard about a month ago, but have not been able to look at it till now. It is a VB5 program that is p-coded, so there is not much useful information from SmartCheck (that I could find anyway). The interesting registry key that I found with Regmon is:

\HKEY_USERS\.Default\Software\VB and VBA Program Settings\Registry Drill\Content\Registration

The key value is blank when the program is installed. If you load a string value into it, it responds right after reading that key (and followed with a BAD_KEY) with:

"It appears that you are a registered user. With this update the unlock code has change. Please contact IDRequest for another unlock code....."

I put a bp on RegQueryValueEx if *((esp->8)== 'Regi' do "d esp->14", let it pop three times and followed the code. I put some bpr on the fake unlock code, but could not find where it was being compared or what manipulation was being used. It just changed it to Wide Char and then back (unless I missed something in between) and was not looked at again. Just seems to be a lot of p-code woods.

Any suggestions?

I'm not 100% positive about the app (I think it's this target), but if it's the same one I'm thinking of registry drill HAS to be patched. Its been quite some time, but as I remember it goes something like this:

1) read registry value
2) store value in variable
3) overwrite variable

There seems to be a missing call to the algo (if the algo is even there). THEN a certain value is stored in a hidden object on one of the forms. That value is checked throughout the program. If the program had a registration function, then it'd do everything for you! As it is, you'll have to rewrite a few little sections of code and it should be fully reg'd.

Good luck

joe

The program did have a registration function, but when the time trial expired it took the registration function with it. I believe you are right that if you do not register with that function it does not do any good to insert a correct SN in the registry key (which I have done). The irony here is that I was able to get the registration screen to come up early on (after the trial expired), but I was trying to create/find a good SN so did not really pay attention to what I had done to get it. Thanks for your info josephCo.

halifax