*****Tut Begins***** Program: ImageWolf v1.04 Build 003 Homepage: www.trellian.com Size: 978KB Prog Synopsis: A prog that searches the net for pictures and movie files. Registration fee is approx. $25. Tools needed: SoftIce (of course!) Method: OK fire up the proggie and click on Help-Register and put in your name and serial number. Registration Name: jkon7 Serial Number: 12121212 As you can guess it didn't work. Grrr! *#%! OK lets do it again but don't press OK yet. Ctrl-D in Sice and bpx hmemcpy. Press OK and Sice fires up. We need to get into the proggie itself so F11 to get us just below the hmemcpy call and then F12 (8 times) to get us into the prog at 404A00 lea edx, [ESP+0C] I like to put a bpx a little further up from where we land so I put a bpx on 4049D8 (just double-click it in Sice and don't forget to disable your bpx on hmemcpy). Press F5 and OK and then press OK again and Sice will break at 4049D8. Now looking down the code you will see a few calls but just F10 down until you land on 404A36 call 00411580 ------------ follow this code by pressing F8 You arrive at 411580 move eax, [ESP+08] 411584 sub esp, 30 411587 test eax, eax 411589 push ebx 41158A push edi 41158B jz 004116F9 411591 mov edi, [ESP+3C] 411595 test edi, edi 411597 jz 004116F9 41159D cmp byte ptr [EAX], 49 ----------------------look at this! 49h is ASCII for "I" 4115A0 jnz 004116F9 ----------------------beggar off, cracker! 4115A6 cmp byte ptr [EAX+01], 57 -------------------look at this! 57h is ASCII for "W" 4115AA jnz 004116F9 ----------------------beggar off, cracker! 4115B0 push 14 4115B2 push eax 4115B3 lea eax, [ESP+18] 4115B7 push eax 4115B8 call 0040AB40 4115BD lea ecx, [ESP+1C] 4115C1 push 2D -----------------------------look at this! 2Dh is the ASCII for "-" So we have to start our serial number with "IW" and also there probably is a hyphen in there. OK lets restart the proggie. I noticed whilst I was looking at the data window once that I saw a "2-" so I thought I would put this ie IW2-12121212 OK this seems to get past the above code but there follows a lot of checking loops so to avoid keep pressing F10 (more than 100 times - I need a new F10 keyboard key :-) I found where they finished and put a bpx on 411692. We arrive at: 411692 push ecx 411693 push 0041CC0C 411698 lea ecx, [ESP+30C] 41169C push 14 ---------------------anyone know what the hell that does? 41169E push eax 41169F call 00411C78 4116A4 add esp, 10 ---------------------------F10 down to here When you land on 4116A4 type d ecx in Sice and a number appears in the data window - in my case 930576. Perfecto!! Write this number down, F5 out of Sice, press OK. Enter: Registration Name: jkon7 Serial Number: IW2-930576 and job done. Yee haw!! Hope this helps. jkon7 ******Tut Ends****** Best wishes jkon7