Introduction

Protection

For those who don't know what the program do , will it is a program to change the Startup logo in Win9X and also the waiting logo and the Shutdown screen. although you can do it manully but this prog is much easier !!

o.k this program dose not need any Registration Code or something like that , but the problem is after you use it for i think 30 days it will stop applying the images that you load as a startup logo or a Shutdwon Screen , So this Tutorial will show you how to remove the Time Limit for this program to use it 4Ever , so let's begin !!

The Essay

At first i thought that this program is a freeware , but no !!! i was worng , one day i want to apply an image as a startup logo and *boom* , a meassage appear telling me that this program has expired !!! , so if you saw this message , then you know what to do first , copy the file xrxaddbar.exe to the win32dasm dir and dasm it , after win32 finish look for our error message and double click on it !! and you should see this code :

:0048D016 9E                  sahf
:0048D017 761F                jbe 0048D038 <-- if not expired then jump
:0048D019 6A00                push 00000000

* Possible StringData Ref from Code Obj ->"XrX Add Bar Beta(2)"

:0048D01B 68C8D04800          push 0048D0C8

* Possible StringData Ref from Code Obj ->"This Beta Version has Expired,"

:0048D020 68DCD04800          push 0048D0DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048CFAF(C)

:0048D025 6A00                push 00000000

o.k do you see the jump 0048D017 !! , all wee have to do it to patch !!! and no more expired version , o.k so i did patch it useing hiew !!! and then i runned the program but !!! what !!! the error message is still there !!! hmmm..... o.k go back to win32dasm find the error message and double click on it , then double click again , take a look at the address is changed , so double click again , !!! hmmm !!! the address change again !!! hmmm !!!

there is 3 locations for this error message !!! let's go to the 2nd location

NOTE : These location maybe diffrent at your machine .

so we land at this code !!!

:0048D19E 9E                  sahf
:0048D19F 761F                jbe 0048D1C0 <-- the 2nd jump
:0048D1A1 6A00                push 00000000

* Possible StringData Ref from Code Obj ->"XrX Add Bar Beta(2)"

:0048D1A3 6890D44800          push 0048D490

* Possible StringData Ref from Code Obj ->"This Beta Version has Expired,"

:0048D1A8 68A4D44800          push 0048D4A4
:0048D1AD 6A00                push 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048D139(C)

Now it is up to you to find the thrid check !!!

The Patch

Now we have seen that there is 3 address where the program check if the period has expired or not !! and the address are in random order and accourding to my machine :

0048D7F6 , 0048D017 and 0048D19F

Now all we have to do is to patch the jump at these address !!! and make them look like this

0048D017   761F                jbe 0048D038    change to    0048D017   EB1F                jmps 0048D038
0048D19F   761F                jbe 0048D038    change to    0048D19F   EB1F                jmps 0048D038
0048D7F6   761F                jbe 0048D038    change to    0048D7F6   EB1F                jmps 0048D038

i don't have to explain how to use hiew !!! do i !!! (READ MORE TUTORIALS !!! )

o.k so you have patched the jumps , let's try it now , run XrXAddBar and choose an image to apply it as a logo !!! and yes there you have it !!

                                                                                                                                                                                                                  cya FaT[BiT] \ TNT!