----------------------------------------------------------------------------- + + + AAAAA AAAAA AAAAA AAAAA A AAAAA A A A AAAAA AAAAA AAAAA + + A A A A A A A A A A A A A A A A + + AAAAA AAAAA A AAAAA A AAAAA A A A AAAAA A AAAAA + + A A A A A A A A A A A A A A A A + + A A AAAAA A A A AAAAA A A A A AAAAA A A A + + + ----------------------------------------------------------------------------- + Date : 26. April 2000 + + Title : MediaStudio Pro 6.0 Trial (Ulead) + + Author : Sojourner + + Source : http://www.AstaLaVista.com + ----------------------------------------------------------------------------- MediaStudio Pro 6.0 Trial (Ulead) Hello fellow students- What we will do--use the prog past the 30 day limit Level- intermediate skill Tools-- 1. A resource tool with editing capibility, like Restorator 2.5 2. w32dasm 8.9xxx 3. Ultraedit or hexeditor of your choice History A little history. MediaStudio has aged and improved. Some nice tools if you're into this kind of stuff. This suite of progs will deal with a range of different media. The veditor.exe only deals with "real" DV, not .avi or mpeg. A capture card is necessary for use with the vcapture.exe, et cetera. You'll see. This particular set of progs has a 30 day time limit set through a .dll. Begin Let's find out what's going on in here. Go ahead and choose one of the executibles to start with. It won't matter which one, since they all trigger that same initial .dll. Most of this suite has fairly small packages to disassemble, so it will go rapidly. One thing I found fairly quickly was I could not actually run the program through the debugger, nor could I tap into it after it was running. I always received an error message. Nevertheless, the disassembly was smooth and the program started up with a typical Welcome screen and time limited type of message. It let you know right off the bat that you have 29 days left. You won't find a string reference to this in the .dll or executible. Now which .dll do I keep referring to? It is important to know which believe me, because once you do, you can "fix" it. THE .dll is u32prod.dll. You can disassemble it if you want to , but it won't matter. You will actually use Restorator 2.5 on it to help and change it on the fly! You actually can do some goofy stuff with Restorator 2.5 if you want to, like modify the dialog captions with your own personal name, but that's up to you. Now on to the task at hand. This little snippet of code comes from vpaint.exe. I have shown this to you because it is an important function call that pops up in every single executible in this suite. It is the u32Cfg.ulcCheckLegality---seen just below. My two lines at: :00441A5E 40 inc eax -----have already been :00441A5F 90 nop -----modified :00441A5E 85C0 test eax, eax---original code * Reference To: MSVCRT.malloc, Ord:0291h | :00441A3D FF1568DA4600 Call dword ptr [0046DA68] :00441A43 83C404 add esp, 00000004 :00441A46 3BC3 cmp eax, ebx :00441A48 8985CC010000 mov dword ptr [ebp+000001CC], eax :00441A4E 0F8488020000 je 00441CDC :00441A54 8B4D6C mov ecx, dword ptr [ebp+6C] :00441A57 50 push eax :00441A58 51 push ecx * Reference To: u32Cfg.ulcCheckLegality, Ord:0004h | :00441A59 E8D2480200 Call 00466330 :00441A5E 40 inc eax :00441A5F 90 nop :00441A60 752B jne 00441A8D //////Must jump :00441A62 8B95CC010000 mov edx, dword ptr [ebp+000001CC] :00441A68 52 push edx * Reference To: MSVCRT.free, Ord:025Eh | :00441A69 FF1548DA4600 Call dword ptr [0046DA48] :00441A6F 83C404 add esp, 00000004 :00441A72 899DCC010000 mov dword ptr [ebp+000001CC], ebx If these don't get modified in ALL the executibles, then even though you successfully patch the u32prod.dll, the program will still be dead. You should always be alert for weird or unusual function calls like this one. Part 2 Restoring some functionality to u32prod.dll Initially, when you run any program, you always get the same startup screen mentioned earlier. There are three buttons at the bottom of that screen to start with. One is Try More!, the next is Order Now!, and last is Link to Web Site. After your program times out you will see a new button in place of the Try More!. It will be the OK button. To fix this you need to run Restorator 2.5 and open the u32prod.dll. A quick look into it's resources and you will see the initial startup screen with the aforementioned buttons in place, but not the OK button. That shows up as a completely different resource listing and not a button at all, but merely a string! "The game is afoot, Watson," yells Sherlock Holmes. At dialog 300 you see: 300 DIALOGEX 0, 0, 306, 230, 0 STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_DLGFRAME CAPTION "Ulead MediaStudio Pro 6.0" FONT 8, "MS Sans Serif", 0, TRUE { DEFPUSHBUTTON "&Try More!", 306, 55, 211, 62, 14 PUSHBUTTON "&Order Now!", 307, 119, 211, 59, 14 PUSHBUTTON "Link To Web Site", 308, 187, 211, 113, 14 CONTROL 301, 302, "STATIC", SS_BITMAP | SS_CENTERIMAGE, 6, 6, 294, 56 LTEXT "", 303, 6, 66, 294, 116 CONTROL "", 304, "STATIC", SS_BLACKFRAME | SS_SUNKEN, 6, 183, 294, 1, WS_EX_CLIENTEDGE LTEXT "", 305, 6, 186, 112, 8 } This is the resource for our opening screen. Remember, after we time out the Try More! button will be gone to be replaced by the OK button which is String 645: STRINGTABLE { 10304, "OK" 10305, "ORDER.HLP" } What can we do to help ourselves? See the mods below in the second pushbutton control. I have placed another &Try More! string here since the other is overwritten. 300 DIALOGEX 0, 0, 306, 230, 0 STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUPWINDOW | WS_DLGFRAME CAPTION "Dave's MediaStudio Pro 6.0" FONT 8, "MS Sans Serif", 0, TRUE { DEFPUSHBUTTON "&Try More!", 306, 55, 211, 62, 14 PUSHBUTTON "&Order Now!", 307, 119, 211, 59, 14 PUSHBUTTON "&Try More!", 306, 55, 211, 62, 14 CONTROL 301, 302, "STATIC", SS_BITMAP | SS_CENTERIMAGE, 6, 6, 294, 56 LTEXT "", 303, 6, 66, 294, 116 CONTROL "", 304, "STATIC", SS_BLACKFRAME | SS_SUNKEN, 6, 183, 294, 1, WS_EX_CLIENTEDGE LTEXT "", 305, 6, 186, 112, 8 } Also in string 645: STRINGTABLE { 10304, "OK" } You'll see I got rid of the reference to the help file. Otherwise it will always and forever popup and stay open. Now it doesn't. Finale When you get ready to leave the Restorator 2.5 it will ask you if you want to save your changes and then will save them as the .dll with a slightly different name. You must place the modifed .dll in the same directory as your other Ulead MediaStudio files and then rename the original and then rename the modifed .dll so it gets the name that the original was so that your executibles can now use the modifed u32prod.dll. And that's all there is to that one fellow reversers. Of course, if you really like it , buy it. 'Til later. Sojourner email:jomamameister@hotmail.com