Web : http://kickme.to/mxbnet
Contact Me : dheeraj_xp@yahoo.com


Main | Index

Customizer 2000 ver 6.5.2

Type : Customize Windows 9x Me 2x
Protection : Serial
Tech : Serial fishing


Crack : Here the program calculates S/N on the fly i.e when we are entering
our fake code ...... how did I know it .... easy ... just put a ... BPX HMEMCPY
in SICE and enter just one char of S/N ....soon we will break in to SICE...trace
back.
Suppose our fake S/N = 12341234

0x4611CE MOV EAX,[EBP-04] >> FAKE S/N --- HERE IT STORES OUR S/N

So put a BPMB XXXXXXXX RW on this address ... this will lead us to comparision point :)

0x403D59 CMP ECX,EBX --> ECX = 4321 -- IN HEX FMT;EBX = 2181 -- IN HEX FMT
...............................
0x403D66 CMP ECX,EBX --> ECX = 4321 -- IN HEX FMT;EBX = 1891 -- IN HEX FMT

So our S/N = 18121981

Registration Info :

S/N = 18121981


00 00
OFFSET = 1B9B5


So our crack will be :
0x759BE8 JMP 00759C37 | EB 4D

Patch :

0x9214F4 MOV BYTE PTR [00759BE8],EB | C6 05 E8 9B 75 00 EB OFFSET = 16E0F4
0x9214FB NOP | 90
0x9214FC NOP | 90
0x9214FD NOP | 90


.........................
0x4245EC CMP ECX,06 --- COMPANY >= 6 CHAR
..............................
0x4245F1 TEST EBX,0000FFFF --- SEE IF LAST SET OF S/N IS 32 BIT
0x4245F7 JZ 424649
0x4245F9 TEST EBX,FFFF0000
0x4245FF JZ 424649
...........................
0x424640 CMP ECX,EBX --- LAST SET COMP
======================================================
0x4240EF XOR BX,[ESP+04] ---- SIMPLE XOR - ADD LOGIC
0x4240F3 ADD EBX,0000FFFF
0x4240F7 LEA EAX,[EBX-0F]
0x4240F9 TEST EBX,FFFF0000
0x4240FC CMP EAX,4BC
................................
0x424116 ADD EBX,0F
0x424119 CMP EBX,4BC
0x42411F JGE 424134

Now this S/N part is over ... but when we restart CDRWin we get a message that we
have used pirated S/N .... so there is another check at start up .... more work ....
To find this point put a BPX at above comparision points and restart ....CDRWin.

0x4034EA CALL 424D80
INSIDE THIS CALL ....
0x424DA5 CMP [004ADD96],AX --- SECOND LAST SET ..... SO RESTART FISHING WITH THIS NEW VALUE :)

Registration Info:

Name : DHEERAJ
Company : MxBNET
Unlock key : 1234-5678-16533450-30E1E554
Check Key : 30E1F760-444C-16536228-26B2D104

CDRWin 4.0A

Name : DHEERAJ
Company : MxBNET
Unlock key : 1234-5678-16533423-30E1E554
Check Key : 30E1F760-444C-1653625B-26B2D177

 


277";
long lResult = 0;
HKEY hKey =0;
int i =0;

char windir[MAX_PATH];
char sysdir[MAX_PATH];
bool error = false;
PROCESS_INFORMATION pi;
STARTUPINFO si;
char* cl;
//===============================================================
char firstkey[] = "{EADF629A-E6FB-4AE5-8D2E-B6F995A7C0A8}";
char seckey[] = "{C2CD9A01-9F53-4411-35FA-3ECCB27B86B3}";
//===============================================================
//Delete Registry Keys
//===============================================================
//First Key
lResult = RegOpenKey(HKEY_CLASSES_ROOT,"CLSID",&hKey);

if(lResult != ERROR_SUCCESS)
{
MessageBox(NULL,"Unable to open Registry..exiting",InfoText,MB_OK);
return 0;
}
lResult = RegDeleteKey(hKey,firstkey);
if(lResult != ERROR_SUCCESS)
{
MessageBox(NULL,"Unable to deleted First Key ...",InfoText,MB_OK);
error = true;
}

RegCloseKey(hKey);
//================================================================
//Second Key
lResult = RegOpenKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Classes\\.ini",&hKey);

if(lResult != ERROR_SUCCESS)
{
MessageBox(NULL,"Unable to open Registry..exiting",InfoText,MB_OK);
return 0;
}

lResult = RegDeleteKey(hKey,seckey);
if(lResult != ERROR_SUCCESS)
{
MessageBox(NULL,"Unable to deleted Second Key ...",InfoText,MB_OK);
error = true;
}

RegCloseKey(hKey);

//===============================================================
//Delete Files ...
GetWindowsDirectory(windir,sizeof(windir));
GetSystemDirectory(sysdir,sizeof(sysdir));
strcat(windir,"\\Vbox\\Licenses\\ _5.51.277_5044.lic");
strcat(sysdir,"\\ws057043.ocx");
//===============================================================
if(!DeleteFile(windir))
{
MessageBox(NULL,"Unable to deleted Lic File ...",InfoText,MB_OK);
error = true;
}
//===============================================================
GetWindowsDirectory(windir,sizeof(windir));
strcat(windir,"\\Vbox\\Licenses\\ _5.51.277_5044.prf");

if(!DeleteFile(windir))
{
MessageBox(NULL,"Unable to deleted Prf File ...",InfoText,MB_OK);
error = true;
}
//================================================================
if(!DeleteFile(sysdir))
{
MessageBox(NULL,"Unable to deleted OCX File ...",InfoText,MB_OK);
error = true;
}
//===============================================================
//Delete os*****.bin
GetWindowsDirectory(windir,sizeof(windir));

for(i=0;i < MAX_PATH;i++)
{
if(windir[i] == '\\')
{
windir[i] = '\0';
}
}
strcat(windir,"\\os291494.bin");

if(!DeleteFile(windir))
{
MessageBox(NULL,"Unable to deleted BIN File ...",InfoText,MB_OK);
error = true;
}
//===============================================================
if(error ==false)
{
MessageBox(NULL,"Removed VBOX Files and Registry Keys ...",InfoText,MB_OK);
}

//===============================================================
//Execute VSetupT.exe
ZeroMemory(&si,sizeof(si));
si.cb = sizeof(si);
cl = GetCommandLine();

if (!CreateProcess("VSetupT.exe",cl, NULL, NULL,FALSE,
NORMAL_PRIORITY_CLASS,NULL, NULL,&si, &pi))
{
MessageBox(NULL,"Unable to load \"VSetupT.exe\" ...",InfoText,MB_OK);
error = true;
}else
{
MessageBox(NULL,"Loaded \"VSetupT.exe\" ...",InfoText,MB_OK);
}
//===============================================================

return 0;

}
//===================================================================================