Could really use some help with this one. It seems to have code related to registering the app & references to the non-demo version of the ini file but I can't see any way to get the prog to call the relevant code, so it may be a genuine demo.
I've never seen (or noticed ) any app that according to filemon managed to not read its ini file if its loaded via symbol loader but it does read it if you break on the ep in sice without using the loader. Even when I'd figured this out, I couldn't seem to get close to the point where the dll attempts to read the ini file.
The app is at ht*p://www.mvsoft.com/pub/eqs/eqs57dem.zip
So, I decided to have a go at reconnecting the print dialog & save code to the appropriate menus instead. (Print dialog is at offset 7071Eh & 7079Ch/Save dialog is at offset 7064Ch and the print menu select is at offset 5301h jumping to the code I changed at offset 4DB5h:
0DB5 push 0000
0DB7 push 0000
0DB9 push 0099
0DBC Call .....
I nop'd the pushes and changed the call to go to what I think is the print dialog code.


I maybe doing somethin basic wrong but if I try to hex edit the main app to redirect the calls, the prog crashes. (this occurs even though the files are same size & the only changes visible in hexwkshop/tools/compare are the redirected call & the nop'd pushes). I tried modifying a couple of jumps here and there and redirected the print to printsetup dialog & the thing worked, so it's not just a file date check that's causing the problem. The crash occurs before the symbol loader kicks in, so I can't trace it that way.
Please can anyone give me some guidance on this.
Scally

Cracked it!
Hi folks,
Kind of answering my own query. Cos the board's been down I decided to play around with this some more. After playing with sice history dumps W32dasm and exescope, I managed to restore the print & save functions in the text/analysis sections. The two jumps in the first segment are 'hard-wired' into the app and I can't see any way of registering it, despite the existence of a suspicious potential register box seen in exescope that doesn't seem to be dialog referenced in W32Dasm. Looks like the dlls aren't concerned with the protection.
Anyhow, the print jump needs to go to Jmp dc7 and it prints! There is a way to get it to give options on printing before it prints but I'm still working on that. Not sure where the 'save' should go to but 'save as' is at F6B, so it serves the purpose. This also needs a cmp & Jne noping around fea but it works. The copy/cut stuff is similar coding, you gotta avoid 1.34c4 and the rest fall into place pretty easy. (The 34c4 call is for errors & the nag is 0099, so only change code above 34c4 calls where 99 is pushed.) This also goes for options that call the print function indirectly, just avoid going to 34c4. From the deadlist, it looks like there might also be a time expiry kicking around .........but this one's gonna go down sooner or later!
Scally