SERIAL NUMBER IS FISHY - DECLINE YOUR PATCH'ITCH'ING


CleanWin 4.5a 
A Cracking Tutorial 
by ASTAGA [WTF/TTM]


DISCLAIMER 

This reading material is not intended to violate Copyrights 
and/or it is law, but educational purposes only. I hold no 
responsibility ( by all means and in any shape whatsoever ) 
of the mis-used of this material.
Read END NOTES section at the end of this file.



ABOUT THE PROGRAM 


Cover your online tracks and free up wasted disk space at 
the same time!
Evidence is on your computer!  The computer you are on right 
now will remember that you were at this site, and all the 
sites before this.  While on the Internet, the images you 
see, the movies you watch, the sounds you hear and the email 
you read is saved on your computer! Besides wasting disk 
space, this information can be used by anyone to see what you 
do while online with ease!  CleanWin will quickly erase this 
information every time Windows starts.
You can add extra folders and files to CleanWin's script to 
erase other confidential information or junk files.  
Use SuperCleanWin to further clean your system of the garbage 
that it collects.  For more advanced users, Deep Clean can be 
used to remove more junk files than all the other junk file 
removers combined all at one time!
If you want a powerful and versatile deep cleaning tool, then 
CleanWin is the file remover for you.  Protect your privacy 
by covering your tracks automatically.  
Features :
o 



WHERE TO DOWNLOAD


Author   	: KMCS Software
Copyright	: KMCS Software
Homepage 	: http://www.kmcsonline.com
URL		: http://www.kmcsonline.com/DOWNLOAD.HTM
		  http://kmcsonline.com/anonftp/pub/KMCSCW.EXE
Size 		:   KB  as of 
Rel Date	: 




HOW TO GET VALID SERIAL NUMBER by using SoftIce



1.  Run skweegee.EXE, in the registration dialog box type these below 
    informations :

	Code    : 73881050

    Do not click OK button yet
    

2.  Load SoftIce by pressing [ CTRL + D ], set a breakpoint as 
    follow :
    

	BPX multibytetowidechar     [enter]   and
   	F5  to return to the main program


3.  Now, click OK button... you'll return back into SoftIce!
    In within SoftIce press F11, F5, F11, then F12 6 times 
    until you see and break at :

	______________________________________________________________

	015F:0F79B158  E879E0FEFF          CALL      0F7891D6
	015F:0F79B15D  33C0                XOR       EAX,EAX ==> d eax
	015F:0F79B15F  EBF0                JMP       0F79B151
	015F:0F79B161  8B442404            MOV       EAX,[ESP+04]
	015F:0F79B165  A3D8B77B0F          MOV       [0F7BB7D8],EAX
	015F:0F79B16A  3D07080000          CMP       EAX,00000807
	015F:0F79B16F  771A                JA        0F79B18B
	015F:0F79B171  744C                JZ        0F79B1BF


	_________________________ VB40032!.text+0007A157 _______________

	: bd *  [enter] ==> no longer needed
	: bpx 015F:0F79B158  [enter]
	Press F10 once - stop at 015F:0F79B15D - display EAX register

	: d eax  [enter]  	see that fake code at virtual address
				0167:0167:00423DDC ???

    	Create a new breakpoint by typing :
	: bd *  [enter]
	: bpr 0167:00423DDC 0167:00423DDC+8 rw [enter]	
	Press X  to let SoftIce break into this location


5.  If nothing goes wrong you'll break again at these below
    snippet codes : 

	015F:0F79B2AC  33C0                XOR       EAX,EAX 
	015F:0F79B2AE  F366A7              REPZ CMPSW <==
	015F:0F79B2B1  7405                JZ        0F79B2B8
	015F:0F79B2B3  1BC0                SBB       EAX,EAX
	015F:0F79B2B5  83D8FF              SBB       EAX,-01
	015F:0F79B2B8  5F                  POP       EDI
	015F:0F79B2B9  5E                  POP       ESI
	015F:0F79B2BA  C20C00              RET       000C
                 
	___________________ VB40032!.text+0007A2AC ___________________

	Break due to BPR #0167:00423DDC #0167:00423DE4 RW                               

	While stay at 015F:0F79B2AE - dump ESI and EDI registers :

	:d esi	   your fake code at virtual address 0167:0167:00423DDC.

	:d edi    did you see C.W.K.L.M.F.C.D.S.T at virtual address 
		   0167:0167:00424F10 ? Write it down! Remove trailing
		   dot sign (.) between each character.


7.  Disable all breakpoints by typing 

	BD *   [enter]
	Press F5 or X to return to the main program
     

8.  Repeat registration procedure and keyed-in CWKLMFCDST as 
    your S/N. 
    Click OK button .....  there you're registered.


9.	Where the hell is my registration code is stored ??

	The correct registration code is stored in the registry as
	follows : 
	REGEDIT4


10.  How can I practise with my own user name ?

	-  I strongly recommended you not to do this !




					E N D   N O T E S


		Distributing your serial number is illegal and is no 
			different than distributing illegal 
				copies of the registered 
				 software. Violation of
					this rule may 
					  result in 
			temporary or permanent revocation of this
			     license and cancellation of the 
			              serial number; 
				   the original licensee
			   will also be held responsible for 
			    damages, physical and estimated.


   Do not distribute your crack release based on this tutorial, because
   you become a LAMER(s)!!!!!!!!
   ( tHATDUDE (PC97) defined LAMER(s) is the guy who sits in front of
   personal computer, using Hex Editor, ripping off other group(s)
   crack release, repacking (distro) them under his name. 
   Adopted from newsgroup alt.cracks, alt.crackers - February 1997 ) 

    More about LAMER(s):
	lamer /n./ [prob. originated in skateboarder slang]
	Synonym for luser, not used much by hackers but common among warez 
	d00dz, crackers, and phreakers. Oppose elite. Has the same connota
	tions of self-conscious elitism that use of luser does among 
	hackers.
      < SOURCE: http://sagan.earthspace.net/jargon/jargon_27.html >


 		Never attribute to malice that which is adequately 
				explained by stupidity


ASTAGA [WTF/TTM/D4C/C4A] tute-CleanWin45a.zip
[EOF] 1/19/01 6:28:41 AM