WHY PATCHING WHILE SERIAL NUMBER IS FISHY PrintScreen v1.3.0 A Cracking Tutorial by ASTAGA [D4C/C4A] ABOUT THE PROGRAM PrintScreen is a utility program that brings back the "Print Screen" key to Windows 95, 98 and NT users. PrintScreen is a great tool to have on hand for easily capturing error messages that pop up with application and system problems. Never again will you need to tediously hand-write the text of those messages to relay them to tech support personnel. BACKGROUND INFORMATION Program Name: PrintScreen.exe Platforms: Windows 95/98/NT Free trial period: 30 days Registration cost: $10 US$. Current version: 1.3.0 Version date: 30-Jan-2000 Web site: www.donth.com Author : Joseph L. Donth HOW TO FISH SERIAL NUMBER by USING SOFTICE 1. Run the program, click REGISTER button and keyed-in fake reg code = 73881050 Do not click OK button yet. 2. Load SoftIce and create a new breakpoint : bpx hmemcpy Press F5 3. Click OK button now, and you'll break in SoftIce again. Press F11 once and press F12 several times until you see this below snippet codes. __________________________________________________________________ 015F:0044CE06 E861E0FDFF CALL 0042AE6C <== break here 015F:0044CE0B 8B55D8 MOV EDX,[EBP-28] 015F:0044CE0E 8B45F8 MOV EAX,[EBP-08] <== D EDX 015F:0044CE11 E88E6BFBFF CALL 004039A4 ........ ........ ________________________PRINTSCREEN!CODE+0004BE06_________________ Break due to BPX KERNEL!HMEMCPY Break due to G : bd * [enter] : BPX 015F:0044CE06 [enter] : Press F10 2 times and display EDX register, your fake reg code appear in the Data Window at virtual address 0167:00BCB6E0 . : BPM 0167:00BCB6E0 [enter] : Press X or F5 You'll break again in SoftIce and see these below snippet codes : _________________________________________________________________ 015F:00403D05 8B0E MOV ECX,[ESI] 015F:00403D07 8B1F MOV EBX,[EDI] <== here 015F:00403D09 39D9 CMP ECX,EBX <== D EDI 015F:00403D0B 7558 JNZ 00403D65 ..... ..... __________________________ PRINTSCREEN!CODE+2D05 ________________ Break due to BPMB #0167:00BCB6E0 RW DR3 Press F10 once : ? ecx [enter] : 38383337 0943207223 "8837" ==> part of your fake code : ? ebx [enter] : 30363130 0808857904 "0610" ==> part of the real code : d esi [enter] ===> your fake code at : d edi [enter] ===> did you see 0160-1920-7875-7537 at 0167:00BC808C . Write down this potential reg code. Scroll up one line above you will see your own product ID ( in my case is 5556-5841-9770-4015 ) . : bd * : F5 to return to registration dialog box 4. Repeat registration procedures, and keyed-in 0160-1920-7875-7537 as your registration code. You're registered. 5. Where the hell is my registration info is stored ?? - The correct registration code is stored in the HKCR and HKLM registry as follows ( before it's registered ) : REGEDIT4 [HKEY_CLASSES_ROOT\CLSID\{F291C121-70E0-11D3-AA01-E00DCCB90001}] [HKEY_CLASSES_ROOT\CLSID\{F291C121-70E0-11D3-AA01-E00DCCB90001}\ProgID] @="008FFD" [HKEY_CLASSES_ROOT\CLSID\{F291C121-70E0-11D3-AA01-E00DCCB90001}\Mask] @="41AC5E55" REGEDIT4 [HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{F291C121-70E0-11D3-AA01-E00DCCB90001}] [HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{F291C121-70E0-11D3-AA01-E00DCCB90001}\ProgID] @="008FFD" [HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{F291C121-70E0-11D3-AA01-E00DCCB90001}\Mask] @="41AC5E55" 6. How can I practise with another registration key ? - I strongly recommended you not to do this ! END NOTES This program is sold as shareware, so you can try before you buy. This is convenient for you, saves expenses by dispensing with all that packaging, and cuts out the middle person. So it is cheap, but it is not free. If you like the program, and you will, be sure to register and pay. To keep shareware prices low, users must do the right thing: Register, pay up, and smile/grin at yourself in the mirror. Do not distribute your crack release based on this tutorial, because you become a LAMER(s)!!!!!!!! ( tHATDUDE (PC97) defined LAMER(s) is the guy who sits in front of personal computer, using Hex Editor, ripping off other group(s) crack release, repacking (distro) them under his name. Adopted from newsgroup alt.cracks, alt.crackers - February 1997 ) More about LAMER(s): lamer /n./ [prob. originated in skateboarder slang] Synonym for luser, not used much by hackers but common among warez d00dz, crackers, and phreakers. Oppose elite. Has the same connota tions of self-conscious elitism that use of luser does among hackers. < SOURCE: http://sagan.earthspace.net/jargon/jargon_27.html > _ Never attribute to malice that which is adequately explained by stupidity _ ASTAGA [D4C/C4A] tute-PrintScreen130.zip [EOF] 10/31/00 6:32:06 PM