WinFax Pro v9.0
Introduction |
Greetings and welcome to the noble art of reverse engineering!
Tools required |
Numega softice v3.24
Target's URL |
http://shop.symantec.com/cgi-bin/trialware/
Essay |
Step1 Run the program and you will get a nag telling you that
this is a trial and etc.
Step2 Press 'b' and you will get the regform.
Note!
If you have a norton product registred you might get the 'Unlocking window'.
Step3 Ok, now press [cancel] and leave winfax.exe.
Goto C:\windows\rsagent.ini
and change 'mailstat=0' to 'mailstat=1' then save and exit!
Step4 Run winfaxpro.exe again and press 'b', type in firstname,
lastname and a dummyserial.
Step5 Start SoftIce and place a bp on BPX GetDlgItemTextA, return
to winfax and press [OK]
and Softice
breaks due to USER32! GetDlgItemTextA
Step7 Press 'F11'
Step8 Now trace down to.........
:10005713 8D8C24D8000000 LEA ECX , [ESP+000000D8] <= load eff. address offset.
If you
dump => Valid serial!
Step9 And at..........
:1000571A 68400F0310
PUSH 10030F40 => Your dummy serial!
:1000571F 51
PUSH ECX => Saves valid serial!
THE END
Final Notes |
BACK |