Introduction

Protection

Have you ever wished something and came true !!! , will try !!! but careful what you wish !!! , this one is the easiest crack in history !!! it take about -1min or less to register it !!! , yes again it needs a Name and a Registration Code to make it yours !!! that's it !! let's go !!

The Essay

O.k !! run window blinds it will show a screen with 3 options , one of them is Enter a Serial number , click it , and there you have a name and a code !!! , kool !!! , so enter your name with any serial you want , click on o.k , and boom there you have it our error message , o.k .....

did you notice the type of the error message , yes it is a message box , so we can set a break point on it can't we , so now you are still at the registration screen right !!! , o.k , press [Ctrl]+[d] and set a break point like this one :

bpx MessageBoxA

Now press F5 to leave SoftIce , click on the o.k button !! , SoftIce will break !! press F11 , the error message will be displayed , click o.k on the error message , SoftIce make another break and you will be at this code :

:00427E37   call [user32!MessageBoxA]
:00427E3E   pop esi   <-- We Land HERE !!!
:00427E3F   ret 000C

Now scroll up in softice until you see this code :

:00457E10   mov eax,[esp+08]   <-- we set a bpx here !!
:00427E14   push esi <-- y the prog store esi in the stack !!! hmmm !!
:00427E15   test eax,eax
:00427E17   mov esi,ecx
:00427E19   jnz 00427E23
:00427E1B   call 0042F679
:00427E20   mov eax,[eax+10]
:00427E23   test esi,esi
:00427E25   jnz 00427E2B
:00427E27   xor ecx,ecx
:00427E29   jmp 00427E2E
:00427E2B   mov ecx,[esi+1C]
:00427E2E   push DWORD ptr [esp+10]
:00427E32   push eax
:00427E33   push DWORD ptr [esp+10]
:00427E37   push ecx
:00427E37   call [user32!MessageBoxA]
:00427E3E   pop esi
:00427E3F   ret 000C

Now do a (bc *) to clear all the bpx in softice and set a new break point at 00427E10 , you can do that by writing 'bpx 00427E10' , and press F5 to quit SoftIce , now you are at the registration screen , all you have to do is to press o.k , and SoftICe will break at 00457E10 , now look at the line next to it , you will see that ths prog is storeing the content of the esi register , but why ? , so let's see what's inside the esi register by writing the command 'd esi' and take alook at the data window *boom* it is our real serial !! , write down in my case it was :

NAME : FaT[BiT] \ TNT!
CODE : WB-13ff1dek

So... let's try our code here , enter th info and ......

The Patch

                                                                                                                                                                                                                  cya FaT[BiT] \ TNT!