Cracking for Newbies  - by Dahood
                

Target: UniView v1.62

Tools used: W32dasm
	    Hview
	    ProcDump32 
            Softice

Protection:
1.Serial (keygen)


NOTE: This tutorial is not totally for newbies so i excpect that u know
1.how to use w32dasm
2.how to use hview (change,search,etc...)
3.Assembly



Disassemble the program

Right its packed and im not going to go into details i hate packed programs
when u tried to disassemble it crashed....hmmm
open it with hview or ur fav hex editor and on the top u see upx 
so now we know what is it packed with
for most of the packed programs i use ProcDump
open procdump and click on unpack , pick a file , pick upx ....
unpack it and save the unpacked to a different name like View.exe

check the properties of both files and see is they differe
try to disassemble the unpacked file k good...

Now the unpacked file works 
disassemble it look at the strings.. not good

are we going to give up.. after going through unpackin nope what do we do now
Yep u guessed it Softice. Open the program and click register put anyname and any number
ctrl d ----to go in to softice
bpx hmemcpy
ctrl d ---->to leave softice

now click ok it breaks and u end up in softice...u there

d cx ------> u see the name u used 
f5
d cx-------> u see the number u used
if u f5 again ull get the error message
now f11,f10 till u see the name of the file (32bit)
now u should go through about 7 or 8 ret
and now u should end up here

00524b8A              mov edx, dword ptr [ebp-08] 
trace line by line  f 10 till u get here
00524BA9              jz  00524BE6 ----->jmp if zero
f 10 and ull land here
00524BE8              mov ecx,00524C90 -->d ecx and u see the error message

so now we know that jz  00524BE6 should be changed to jnz 00524BE6 
a 524BA9 <enter>
now type jnz 00524BE6 <enter> twice
f5 to leave softice
and ur registered

now u can disassemble the unpacked file and go to address 00524BA9
and check the offset add which is 12418A
open u r fav hex editor and change the je to jne 


i hope i didnt confuse u and if u have any question, comments
my icq# is 69518421 or u can e mail me at webcrawler28@hotmail.com

i would like to say thanks to all the crackers 2 many 2 list , for helpin me also for there 
tutorials
also a big thanks to krobar's site: http://zor.org/krobar/
 
				Cracking for Newbies  - by Dahood