*****Tut Begins*****

Program:		SuperCleaner

Home Page:	http://www.FirasE.com

Size:		936KB

Prog Synopsis:	SuperCleaner is a program designed to clean out the garbage 
from your computer and protect your privacy, both 		on and off the Internet.

Tools needed:	SoftIce


Method:

This program has the usual nag screen and if you press the top left hand 
icon it tells you it is an unregisted version.

Okay, lets rock 'n' roll - go to the register screen (either the one that 
fires up first or press the top left hand icon and the register label)

	Reg-Name	jkon7

	Reg-Code	12121212

Of course, I got the wrong code message.  Grrr! *#$!

Press the OK to get rid of the message and open Sice and set a bpx hmemcpy.

F5 out of Sice, press the OK to register button and Sice fires up.

Press F11 - F5 - F11 - F12(8 times) to get back into the proggie and arrive 
at

0167:00408289	lea eax, [esp+00000108]
0167:00408290	lea ecx [esp+08]	<----------	d eax here shows your false s/n.
0167:00408294	push eax		<----------	d ecx here shows your name.
0167:00408295	push ecx
0167:00408296	call 00408500	<----------	FOLLOW THIS CALL BY PRESSING F8

You arrive at:

0167:00408540	mov ecx, [esp+04]	<----------	you arrive here - F10 down to 
0167:00408566
0167:00408544	sub esp, 00000100
0167:0040854A	lea ecx, [esp+00]
0167:0040854E	push esi
0167:0040854F	push eax
0167:00408550	push ecx
0167:00408551	xor esi, esi
0167:00408553	call 00408610
0167:00408558	mov eax, [esp+00000114]
0167:0040855F	add esp, 08
0167:00408562	lea edx, [esp+04]
0167:00408566	push edx		<---------	d edx gives the correct s/n (in my case 
679-25428-549-6846)

The s/n is placed in HKEY_USERS\.DEFAULT\Software\SuperCleaner\Registration.

Job done - Yee haw!!

Hope this helps

jkon7

******Tut Ends******