tHE cRACKiNG aNSWER 2000     

tCA Tutorial on cracking Dreamweaver 3

Author: YoKe 
Target: Macromedia Dreamweaver 3 (c) Macromedia (english version)
Tools needed: Softice 3.2x/4.00
Protection: unlock code to be got online through Release Software Cooperation 

<--Note- before we start this information can only be used for eductational purposes, or if you lost your unlock code or to show how lame some protections are. Do not rip off software. Do not blame me for anything that happens to you or your computer or anything else like that--> 

Yep! this is my second tut for tCA i hope you can understand it and hopefuly learn something from it! Macromedia Dreamweaver 3 (trial) i am working on the english version here but other versions should be able to be cracked the same, just probably different addresses and offsets.

Download 1 of the 4 versions here

LETS GET CRACKiNG..  

Open up the progra.... You now get an ugly dialog that pops up with 2 options [ BUY ]  and [ TRY] so click on buy. (note if you dont get this dilaog and you did before it is because you clicked TRY and have started your trial and the Buy option well come back when the trial is up just put your compuer clock forward a month)
Now we have to fill in all our details, not real details of course, then click next now we are asked what we want to buy, erm click next, now we see payment type just anything here until we can click next, when you do keep going on ultil you come to "Select Communication Method" it is now you should click cancel because been that this program can be registered with  ReleaseNow.com Corporation created a file after you entered in all that crap in your windows folder called rsagent.ini , open it and go down to the line: 

mailStat-xxxxxx=0 x could be any number
change it to, 
mailStat-xxxxxx=1 

Save and exit. This will make dreamweaver think we bought a serial online. If you are still in dreamweaver then exit and reload, now click on [ BUY ]  now a different dialog box! (you may get a message about a personal code been modified this is because we entered no personal code in rsagent.ini but don't worry dreamweaver creates you a new one) In this new dialog box we have FirstName:    LastName:    Personal code:  and finaly UNLOCKING code:  <- this is the only value we don't have and we are going to get it right? We are going to use softice to get it.

So type anything in the unlockcode field , my fav 1324354657, now press CTRL+D now soft-ice is open so we need to put a breakpoint on User32!GetDlgItemTextA , in softice type bpx getdlgitemtexta now press F5 to exit now click on [  OK  ] in the dialog we entered the unlock code and softice splashes up on your screen because we put a bpx on User32!GetDlgItemTextA so press F11 once and you should see something like:

0017:00CD5F01                 Call[User32!GetDlgItemTextA] 
0017:00CD5F07                 MOV EDI, 00CFA06C 
0017:00CD5F0C                OR ECX, -01
0017:00CD5F0F                 XOR EAX, EAX
0017:00CD5F11                 REPNZ SCASP

--more code--

Ok press F10 a few times until you come to the line

0017:00CD5F16               CMP ECX,0A
and below that
0017:00CD5F19               JZ 00CD5F70

HMM IN SOFTICE type ? ecx now you see:
0000000A 0000000010
this looks like the lenght of our fake unlock code!

Whats it compared to in softice type ? 0A you see
0000000A 0000000010

now we can conclude that the unlock has to be ten characters long, and if it is less Dreamweaver will automatically know the ulnock code is wrong. if the unlockcode is long enough then the jump at 00cd5f19 is taken to 00cd5f70. If not long enough then ni jump is taken and it continues down to a User32!MessageBoxA to dispaly "blahblah wrong code" but you did enter in a different code didn't you? if not exit softice (F5)
and enter in a 10 lenght unlock code. (if you entered a 7 length and presses ? ecx at 00CD5F16 the value would be 0000000A 0000000007)

Any way you now have a 10 length unlock code now, so now press F10 onto the line:
0017:00CD5F19              JZ 00CD5F70   press F10 once more hey!! softice jumps because jz means jump if equal and above that the line means compare the length of our serial to the length of a valid serial then jump if they are equal!!

After softice jumps you should see something like..

------------

018F:00CD5F70                   CALL  00CD16D0
018F:00CD5F75                    LEA  EDX, [EBP-00C4] 
018F:00CD5F7B                   MOV  EDI, OOCFA-60
018F:00CD5F80                    OR  ECX, -01

--more code--

oK? press F10 about 22 times until you come across the line:

018F:00CD5FB7                     PUSH EAX

Hmm what could eax be- in softice type    d eax    this dumps the value of eax. In the ascii window you should see your personal code. We must be getting near our unlock code. See that call below that PUSH EAX

018F:00CD5FB8                     CALL  00CDCF90

That call calculates a valid unlock for our code then returns. So lets
see what value it returned with ...
press F10 about 7 times now you should be on the line:

018F:00CD5FDB                     PUSH      ECX

And guess what type in softice d ecx now in the ascii window you should see a ten length upper case code.  ITS OUR DAMM UNLOCK CODE *YEE* (write it down)

Now enter it in an yes it works but another serial is needed f**k but this protection here is so lame ya know then you click [ try ] you see a splah screen "showing off" dreamweaver and there is a number that reads DWW300-69119-97280-19336 yea what are you thinking ? You > emm is it the serial well it is why did macromedia ask for a serial thats already on the spalsh screen i dont know?

*But now you have cracked dreamweaver 3* 
    

OTHER PROGRAMS THAT CAN BE CRACKED IN A SIMILAR WAY..
(not all of these require a final serial like we saw here)
Dreamweaver 1 (c) Macromedia
Dreamweaver 2 (c) Macromedia
Dreamweaver 3 (c) Macromedia (hmm we know :D
Fireworks 1 (c) Macromedia
Fireworks 2 (c) Macromedia
Fireworks 3 (c) Macromedia
Norton AntiVirus 5 (c) Symantec
Xing MPEG Player 3.30 (c) XING
(possibly other macromedia products, if you know of more let me know)

Any questions, comments? then email me: yoke@tca2k.net

Visit Us: www.tca2k.net is-=[tCA tHE cRACKING aNSWER]=-s:

YoKe...............27/04/00

_________________________________________________
|________tHATS aLL f0R n0W uNTiL nEXT tiME....?_______|

Greetz to sEVanD02k, kab00m, Apus, LAP, koBold666, weed2k and r00h_HT and the rest of the tCA crew.