Hello. I'm pretty new to RCE, so I hope I don't annoy you too much with my problem.

The program I'm working on functions similar to a media player or a computer in that it allows you to start running something, pause it, stop it, and restart it. The limit is that you can only do so for three minutes before seeing a nag screen and having to restart. The program displays how much time it has been running for with a timer of the form m:ss.hh, where m = minutes, ss = seconds, hh = hundredths of a second. Some possibly useful information is that you can press the "continue" button after the time limit is up, but the nag appears every hundredth of a second thereafter.

I was able to find the code that calls the nag and NOP it. I ran the program to see what would happen, and it still stopped at 3 minutes (it was exactly 3:00.00 on the timer). I couldn't get the program running in Ollydbg because of some exception that it wouldn't accept even if I pressed Shift-F7/F8/F9, so I was pretty discouraged. To make a long story shorter, I loaded it in Wdasm and set a breakpoint on the code that I had NOPed. I found out that the nag actually shows when the timer is 2:59.49.

When I set breakpoints on GetSystemTime, I found that one of the two occurrences of this call always occurs at times of the form m:ss.49, in addition to other times. I also set breakpoints on GetLocalTime and GetTickCount, and I think the information I got could be useful. Namely, those functions aren't called every time the timer increases. For example some hundredths of a second are skipped in certain places: The timer goes directly from 0:00.07 (or maybe 0:00.08) to 0:00.11 without any call to GetTickCount. The calls to GetSystemTime and GetLocalTime are even farther apart with regard to the timer. Even setting breakpoints on every instance of those functions at the same time leads to some skips.

I was able to find the location that caused the current value of the timer to be displayed, and I NOPed that without any difference in the running of the program (other than the timer not showing). Today, I decided to work backwards from the nag code to determine the jump that leads to it. I found it after a while and changed it so that it always takes the good jump. The code is below:

I tested the program, and it ran past the three minutes. However, the timer stopped at 3:11.11. I wasn't sure if it was just the timer stopping, or if the whole program had stopped. To stick to my media player analogy, I loaded a "media file" and found that it just stopped at 3:11.11. There was no error message or anything, it just stopped. To make matters worse, stopping and then restarting the file didn't make it work, like before my edit of the code. I would have to completely exit the program and open it again in order to play a "media file."

This is my current state. I would appreciate any help in what I should do next. I have several questions:

1. How does A0EEBB00 (= 2,700,000,000 decimal) = 3 minutes, or even 2:59.49? I found some possible conversions, but using them to find the equivalent of 3:11.11 and searching for that in the deadlisting didn't produce any results.

2. I know that the stop at 3:11.11 could be caused either by a second time check or by the number of the internally stored time being too large for some operation, but which is more likely? If it's the latter, wouldn't that cause some error other than just freezing the "media file"? If it's the former, then I need to figure out the conversion before I can do anything else.

Thanks for any help.

It's running off the end. As this "demo" version is only designed to run for 3 minutes, shouldn't it be obvious to you that they only read in a little more than 3 minutes worth of its input file? Set a breakpoint on ReadFile and ReadFileEx, and observe its behavior with regards to these two functions.

Forgive me for my ignorance, but what does running off the end mean?

Yes, that does make sense. However, I think the analogy I made was not the best one. The program doesn't need an input file. It's more like a computer than a media player in this respect. You can press the "start" button without having loaded a file, as if you just start your computer and let it sit there. Even this "sitting there" is timed, however, and the program behaves the same with respect to the time limit regardless of whether you load a file or not.

I did set a breakpoint on ReadFile (it doesn't call ReadFileEx). Of the three occurrences in the deadlisting, only one of them was ever called. It was called as the program started up. If I loaded a file and pressed "start," it was also called almost every hundredth of a second while the file was playing. There were some skips, though, as with the calls to the time functions. I'll look into it more, unless the information above suggests another approach.

Once again, thank you very much for your help.

EDIT:
I'm thinking about going through the deadlisting line by line to figure out how it works, and to learn more ASM. Just in case this should affect my approach, Stud_PE detects a Microsoft Visual C++ 6.0 signature for the file.