Cracking for Newbies  - by Dahood
                

Target: MP3 To Wave Converter Plus 2.08

Tools used: W32dasm
	    Hview
	    ProcDump32 

Protection:Serial (takes anything u put)


NOTE: This tutorial is not totally for newbies so i excpect that u know
1.how to use w32dasm
2.how to use hview (change,search,etc...)
3.Assembly



Disassemble the program


U cant find any good strings Right.. Yeah well look again look for anything with the word
Register.... u probably found 

* Possible StringData Ref from Data Obj ->"IDS_YOU_REGISTERED"
                                  |
:0040E60D 6858214200              push 00422158
:0040E612 E899110000              call 0040F7B0
:0040E617 8B44241C                mov eax, dword ptr [esp+1C]
:0040E61B 83C408                  add esp, 00000008
:0040E61E 5F                      pop edi
:0040E61F 5E                      pop esi
:0040E620 5D                      pop ebp
:0040E621 5B                      pop ebx
:0040E622 C20800                  ret 0008

OK good scroll up a bit and look at the code...NICE

* Referenced by a CALL at Addresses:
|:0040E74A   , :0040ED27   ------>"IDS_YOU_REGISTERED"
|
:0040E5A0 53                      push ebx
:0040E5A1 55                      push ebp
:0040E5A2 8B6C240C                mov ebp, dword ptr [esp+0C]
:0040E5A6 56                      push esi
:0040E5A7 81FD40420F00            cmp ebp, 000F4240
:0040E5AD 8BD9                    mov ebx, ecx
:0040E5AF BE01000000              mov esi, 00000001
:0040E5B4 766F                    jbe 0040E625
:0040E5B6 8BC5                    mov eax, ebp
:0040E5B8 33D2                    xor edx, edx
:0040E5BA B97FDF0000              mov ecx, 0000DF7F
:0040E5BF F7F1                    div ecx
:0040E5C1 85D2                    test edx, edx
:0040E5C3 7560                    jne 0040E625
:0040E5C5 8B03                    mov eax, dword ptr [ebx]
:0040E5C7 89742410                mov dword ptr [esp+10], esi
:0040E5CB 3BE8                    cmp ebp, eax
:0040E5CD 0F84AB000000            je 0040E67E
:0040E5D3 57                      push edi
:0040E5D4 8B7C2418                mov edi, dword ptr [esp+18]

we know that this is the last call b4 she determines if we are bad guy(Resigtered) or
unregistered (Crackers = good guys) :)

now i know u probably made a back up of the mp3towave.exe so always remmember u have nuthin
to lose if u try if think positive and if things went bad paste the original in the same 
directory and replace the file.. 

Yep .. u figured it out 
:0040E5C3 7560                    jne 0040E625
should be 
:0040E5C3 7460                    je 0040E625

i hope i didnt confuse u and if u have any question, comments
my icq# is 69518421 or u can e mail me at webcrawler28@hotmail.com

i would like to say thanks to all the crackers 2 many 2 list , for helpin me also for there 
tutorials
also a big thanks to krobar's site: http://zor.org/krobar
 
				Cracking for Newbies  - by Dahood