-->Tutorial number 7--<

Name     : Advanced Registry Cleaner

Version  : 2.1

Target   : AdRegCln.exe

Size     :  417 kb (zipped)

Tools    : SoftICE
         : Brain

Cracker  : KlimaX


Get it at, http://www.nit.mk.ua/adregcln.html


...---===This tut is best viewed in full screen===---...


      ==>DISCLAIMER<==
For educational purposes ONLY!
I hold absolutely NO responsibility for the misuse of this material!


_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____
     =====     =====     =====     =====     =====     =====     =====     =====     =====     =====     =====     ===== 

   Hi guys.. I'm back with yet another tut;)

    
   ----====The cracking part====----

1. Start the program, and a messagebox with your licence number and 5 options will pop (please note the licence number,
   as it will appear near the valid s/n in SICE)

2. Select "Enter Registration Code.." and type in any number (I'll use 12345).
   Don't press "OK" yet, cause we need to press ctrl+d and set a breakpoint on HMEMCPY in SoftICE:

   bpx hmemcpy

   Press F5 to exit SICE, and press "OK"

3. SICE will now pop on HMEMCPY, so press F11 to get to the caller, then F12 10 times and now notice the EAX=00000005 in 
   the top-left corner of SICE (5 = the number of digits in our fake serial ;)
   Now we need to press F10 5 times to get past all the RET's, and we should all end up here: 

:0045207F     CALL     0042DB48
:00452084     MOV      EDX, [EBP-2C]         <=-YOU LAND HERE
:00452087     MOV      EAX, [EBP-08]
:0045208A     CALL     00403B84              <=-TRACE HERE (F8)
:0045208F     MOV      BYTE PTR [EBP-09],01
:00452093     XOR      EAX, EAX

   When you land at :00452084, press F10 two times and trace into the CALL (F8) at :0045208A (like above example).
   Now you should be here:

:00403B83     NOP
:00403B84     TEST     EDX, EDX        <=-TYPE D EDX                   
:00403B86     JZ       00403BAC
:00403B88     MOV      ECX, [EDX-08]
:00403B8B     INC      ECX

   When you land at :00403B83, type D EAX and you'll see our fake serial (12345) in the DataWindow.
   Note the Virtual Address for the fake serial (mine is 017F:00C0675C and may diifer from yours)

4. Now set a breakpoint on this address:

   BPM 017F:00C0675C

   Press F5 and SICE will pop. Now you need to concentrate on the DataWindow, where you'll not only see our fake serial,
   but also a lot of other numbers that look quite familiar;)
   (If you wrote down the licence number you were given by the prog, you'll see the similarity).

5. Now press hold the Alt button down, while pressing the down arrow 19 times (or use the scroll down function in SICE),
   and you'll see a different number than your licence number, but it's built up by the same amount of digits and has
   the same structure.
   
   It should look like this:

   52E0-0C08-D00C

   Write this serial down, enter it as your registration code, and whoop your a registered user ;)

   Remember to write the serial exactly as written above (with capital letters), or the registration will fail....
 

_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____=====_____
     =====     =====     =====     =====     =====     =====     =====     =====     =====     =====     =====     ===== 
  
                                                  ________________
                                          ----====Before you leave====----
                                                  

--==>Please bear in mind that shareware programs are a commercial benefit, because it gives YOU the opportunity to "Try
     before you Buy". Therefore, if you like a shareware program, please be sure to pay the authors/makers, so they won't
     stop manking them.


-=>LAST WORDS:

   If you have any comments on this tut, feel free to mail at KlimaX_v2000@mail.com
   _ _ _ _ _ _ _ _

   Special thanks to: 
   
1- The TNT Crack Team, as they have the ultimate cracking site, you simply have to try it!!!!

2- tKC for releasing those great tut's, keep on making 'em!. They are the BEST!!!

3- Astaga (the "Tutorial Machine":), keep on producing those excellent tuts!!

4- All the NewBies in the world;)!