MP
March 15th, 2001, 10:41
I am a newbie trying to crack a programme
( 606kb zip) whose author and webside is untraceble. further the programme is useless without registration file or serial by which the programme is operational for 2 weeks. Hence I disassembled it with win32dasm. The first error message is "no registration file". Hence i got the details of the string. unable to understand details in win32dasm i need help from experienced and expert people to start with. I have put down string details at below as starting point. Kindly guide me to proceed further so that i can use the programme. preferably how to write the registration file or diable the checking of registration file. help will be highly appreciated.
* Possible StringData Ref from Data Obj ->"No registration file"
|
:00409079 BAC5B14600 mov edx, 0046B1C5
:0040907E A1A8AC4800 mov eax, dword ptr [0048ACA8]
:00409083 E804F70400 call 0045878C
:00409088 E9F6020000 jmp 00409383
* Referenced by a CALL at Addresses:
|:00404AE8 , :00408F4A , :00409083 , :00413582 , :00413681
|
:0045878C E97FFDFDFF jmp 00438510
:00458791 90 nop
:00458792 90 nop
:00458793 90 nop
:00458794 E94FCFFDFF jmp 004356E8
:00458799 90 nop
:0045879A 90 nop
:0045879B 90 nop
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045878C(U)
|
:00438510 55 push ebp
:00438511 8BEC mov ebp, esp
:00438513 83C4F4 add esp, FFFFFFF4
:00438516 53 push ebx
:00438517 56 push esi
:00438518 57 push edi
:00438519 8BF9 mov edi, ecx
:0043851B 8BF2 mov esi, edx
:0043851D 8BD8 mov ebx, eax
for jmp call
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408F4F(U), :00409088(U), :004090A2(C), :004090C7(C)
|
:00409383 8B4DCC mov ecx, dword ptr [ebp-34]
:00409386 64890D00000000 mov dword ptr fs:[00000000], ecx
:0040938D 8B45FC mov eax, dword ptr [ebp-04]
:00409390 807DCB00 cmp byte ptr [ebp-35], 00
:00409394 7405 je 0040939B
:00409396 E8AE2C0100 call 0041C049
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409394(C)
|
:0040939B 5F pop edi
:0040939C 5E pop esi
:0040939D 5B pop ebx
:0040939E 8BE5 mov esp, ebp
:004093A0 5D pop ebp
:004093A1 C3 ret
:0041C049 50 push eax
:0041C04A 8B10 mov edx, dword ptr [eax]
:0041C04C FF52E4 call [edx-1C]
:0041C04F 58 pop eax
:0041C050 C3 ret
( 606kb zip) whose author and webside is untraceble. further the programme is useless without registration file or serial by which the programme is operational for 2 weeks. Hence I disassembled it with win32dasm. The first error message is "no registration file". Hence i got the details of the string. unable to understand details in win32dasm i need help from experienced and expert people to start with. I have put down string details at below as starting point. Kindly guide me to proceed further so that i can use the programme. preferably how to write the registration file or diable the checking of registration file. help will be highly appreciated.
* Possible StringData Ref from Data Obj ->"No registration file"
|
:00409079 BAC5B14600 mov edx, 0046B1C5
:0040907E A1A8AC4800 mov eax, dword ptr [0048ACA8]
:00409083 E804F70400 call 0045878C
:00409088 E9F6020000 jmp 00409383
* Referenced by a CALL at Addresses:
|:00404AE8 , :00408F4A , :00409083 , :00413582 , :00413681
|
:0045878C E97FFDFDFF jmp 00438510
:00458791 90 nop
:00458792 90 nop
:00458793 90 nop
:00458794 E94FCFFDFF jmp 004356E8
:00458799 90 nop
:0045879A 90 nop
:0045879B 90 nop
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045878C(U)
|
:00438510 55 push ebp
:00438511 8BEC mov ebp, esp
:00438513 83C4F4 add esp, FFFFFFF4
:00438516 53 push ebx
:00438517 56 push esi
:00438518 57 push edi
:00438519 8BF9 mov edi, ecx
:0043851B 8BF2 mov esi, edx
:0043851D 8BD8 mov ebx, eax
for jmp call
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408F4F(U), :00409088(U), :004090A2(C), :004090C7(C)
|
:00409383 8B4DCC mov ecx, dword ptr [ebp-34]
:00409386 64890D00000000 mov dword ptr fs:[00000000], ecx
:0040938D 8B45FC mov eax, dword ptr [ebp-04]
:00409390 807DCB00 cmp byte ptr [ebp-35], 00
:00409394 7405 je 0040939B
:00409396 E8AE2C0100 call 0041C049
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409394(C)
|
:0040939B 5F pop edi
:0040939C 5E pop esi
:0040939D 5B pop ebx
:0040939E 8BE5 mov esp, ebp
:004093A0 5D pop ebp
:004093A1 C3 ret
:0041C049 50 push eax
:0041C04A 8B10 mov edx, dword ptr [eax]
:0041C04C FF52E4 call [edx-1C]
:0041C04F 58 pop eax
:0041C050 C3 ret