Dark Heaven - Tutorial: Registration of Applet Menu Wizard v1.0

Program: 	Applet Menu Wizard v1.0
Description: 	Creating of HTML-Menus
Author: 	(C) 1998 Source Tec Software Co. Ltd
Size: 		414.208 Bytes (APPLETMENUWIZARD.EXE)


Used Tool(s): - W32DASM v8.93


1. First, we must find out which kind of protection use this program.
   To this we start "Applet Menu Wizard" and searching for a point to register it. 
   
   Well, "Applet Menu Wizard" use a Serial-Number as protection !

   To get a clue about our Serial now, write down any data on the Registrations Menu now.
   e.g. Name: Dark Heaven Serial: 1122334455
  
   Noticing the appearing error message absolutely !!!

2. Leave the program and Load W32DASM89

3. Now, you should disassemble the APPLETMENUWIZARD.EXE (to be on the safe side, save 
   the code) and run the program via the Debugger [Debug/Load Process].

4. Look for the error message "Sorry, that is not a valid register code"
   via [Refs/String Data References]. The corresponding lines are shown on the 
   listing by double clicks. 
   We find the reference(s) at the address(es) : 0040C7AB.

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C726(C)
|
:0040C7A7 6A00                    push 00000000       			; <- searching JUMP to this point
:0040C7A9 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"Sorry, that is not a valid register "
                                        ->"code."
                                  |
:0040C7AB 68D0FC4300              push 0043FCD0          		; <- the ERROR message
:0040C7B0 E82DD20100              call 004299E2
:0040C7B5 8D4C240C                lea ecx, dword ptr [esp+0C]
:0040C7B9 C7442418FFFFFFFF        mov [esp+18], FFFFFFFF
:0040C7C1 E8688E0100              call 0042562E
:0040C7C6 8B4C2410                mov ecx, dword ptr [esp+10]
:0040C7CA 5F                      pop edi
:0040C7CB 5E                      pop esi
:0040C7CC 33C0                    xor eax, eax
:0040C7CE 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040C7D5 5D                      pop ebp
:0040C7D6 83C410                  add esp, 00000010
:0040C7D9 C20800                  ret 0008

SNIP

5. Now we must find the Jump to the Error message.Therefore we choose the menu [Goto] 
   and the menu option [Goto Code Location] and enter the address 0040C726.

* Referenced by a CALL at Address:
|:0040C8F0   
|
:0040C6B0 6AFF                    push FFFFFFFF
:0040C6B2 68A02B4300              push 00432BA0
:0040C6B7 64A100000000            mov eax, dword ptr fs:[00000000]
:0040C6BD 50                      push eax
:0040C6BE 64892500000000          mov dword ptr fs:[00000000], esp
:0040C6C5 51                      push ecx
:0040C6C6 55                      push ebp
:0040C6C7 56                      push esi
:0040C6C8 8BF1                    mov esi, ecx
:0040C6CA 57                      push edi
:0040C6CB 8D4C240C                lea ecx, dword ptr [esp+0C]
:0040C6CF E80F8E0100              call 004254E3
:0040C6D4 8B7C2420                mov edi, dword ptr [esp+20]
:0040C6D8 83C614                  add esi, 00000014
:0040C6DB 56                      push esi
:0040C6DC 8D442424                lea eax, dword ptr [esp+24]
:0040C6E0 57                      push edi
:0040C6E1 50                      push eax
:0040C6E2 C744242400000000        mov [esp+24], 00000000
:0040C6EA E801A0FFFF              call 004066F0
:0040C6EF 83C40C                  add esp, 0000000C
:0040C6F2 50                      push eax
:0040C6F3 8D4C2410                lea ecx, dword ptr [esp+10]
:0040C6F7 C644241C01              mov [esp+1C], 01
:0040C6FC E826900100              call 00425727
:0040C701 8D4C2420                lea ecx, dword ptr [esp+20]
:0040C705 C644241800              mov [esp+18], 00
:0040C70A E81F8F0100              call 0042562E
:0040C70F 8B6C2424                mov ebp, dword ptr [esp+24]
:0040C713 8B4C240C                mov ecx, dword ptr [esp+0C]
:0040C717 51                      push ecx
:0040C718 8B5500                  mov edx, dword ptr [ebp+00]
:0040C71B 52                      push edx
:0040C71C E8CF4E0000              call 004115F0           		; <- here we set a Breakpoint
:0040C721 83C408                  add esp, 00000008
:0040C724 85C0                    test eax, eax
:0040C726 757F                    jne 0040C7A7     			; <- Jump to ERROR message
:0040C728 E8BF320200              call 0042F9EC
:0040C72D 8B7004                  mov esi, dword ptr [eax+04]

6. At address 0040C71C we must set our first breakpoint via [F2].
   Then we change to "Applet Menu Wizard" and enter our name and a dummy code :

   e.g. Email Adress : Dark Heaven
        Register Code: 1122334455

7. After entering our datas WDASM will break at our Breakpoint.Now we can 
   take a look at the contents of the register addresses [edx] and [ecx].

   EDX = 007C0F7C: EDX-00000020 = Dark Heaven
                   EDX+00000000 = 1122334455
   ECX = 007C152C: ECX+00000000 = 44DD9FF9816152E0 ( the searched key )

8. Now we can register "Applet Menu Wizard" with the serial we have found.
   As result we will get the message "Thank you! Please restart".

   e.g. Email Adress : Dark Heaven
        Register Code: 44DD9FF9816152E0



I hope you have fun with cracking!
Dark Heaven
01.02.1999