Macromedia® Firework MX 2002 (Part B—Time Limit)

By +Jonathan

7-1-2002

 

Time Limit is easy to defeat, since comparing to the Nag screen, it is much easier! Have your Coke ready and listen to only Aikawa Nanase’s music J Before we start, let think about the expired process:

 

(1)            Display expired MessageBox

 

 


(2)            Exit Firework MX

 

As you can see, the weakest link is at (1) to (2); thus let’s break point on (1) and do a “Auto Step Into”,

 you will pop up at (2). Let’s see the snip:

 

:00B07E80 6A30                     push 00000030                        * Push the MB_Style, you should have already

:00B07E82 681C81EA00      push 00EA811C                          change it into “37” already

:00B07E87 51                          push ecx

:00B07E88 FFD7                   call edi

:00B07E8A 50                         push eax

:00B07E8B FFD6                   call esi                                        * Call the message out*

:00B07E8D 33C0                    xor eax, eax

:00B07E8F 5F                         pop edi

:00B07E90 84DB                    test bl, bl

:00B07E92 5E                          pop esi

:00B07E93 5B                          pop ebx

:00B07E94 0F95C0                setne al

:00B07E97 81C44C080000   add esp, 0000084C

:00B07E9D C3                         ret                                               *return to the main execution*

 

Let’s break point on 00B07E8D. In this way, you will see a Message Box after your execution!! As soon as you press down, it will pop up!! Then as I said before, you may want to use “Auto Step Into”, and you will pop up at:

 

:00B2418D E8CE3BFEFF        call 00B07D60                       * Call Check Time Routine*

:00B24192 84C0                           test al, al                                 * Check the flag*

:00B24194 741E                           je 00B241B4                          * Jump if you are a good guy*

:00B24196 53                                push ebx

:00B24197 8D4DA0                     lea ecx, dword ptr [ebp-60]

:00B2419A C7459C23140480   mov [ebp-64], 80041423

:00B241A1 E8EA128EFF          call 00405490

:00B241A6 8D459C                     lea eax, dword ptr [ebp-64]

:00B241A9 684053E500             push 00E55340

:00B241AE 50                               push eax

:00B241AF E8F1890C00           call 00BECBA5                    * bad cracker Beggar off!!!

:00B241B4 E8F719C0FF           call 00725BB0                      * Call real routine!!!

 

If you get into the call 00BECBA5 you will see “* KERNEL32.RaiseException” which means terminate!!

So let’s quickly crack this one:

 

                                       Search:  84 c0 74 1E 53 8D 4D A0

                                       Modify:  ====EB============

 

                                       Search:  7D 04 B3 01 EB 04 84 DB 74 2D

                                       Modify:  EB=================EB==

 

                                       Search:  04 00 00 6a 30  68 1C 81 EA 00     

                                       Modify:  =========37============

 

Oh! Once again, an essay has finished!! If you have any question, please E-Mail me at:

Aikawa-nanase7511@juno.com