Web : http://kickme.to/mxbnet
Contact Me : dheeraj_xp@yahoo.com


Main | Index

Snag It 4.3.6

Type : Capture Utility
Protection : Serial
Tech : Serial fishing


Crack : Enter fake S/N and in SICE BPX GETDLGITEMTEXTA

0x41891A CMP EBP,0E >> S/N SHOULD BE 14 CHAR LONG
...................
0x418969 CALL 0x435E6C >> MAIN CHECK AND FLAG SET
......................
0x418976 CALL 0x46028 >> FLAG CHECK
.....................
0x418982 JNZ 0x418A3C >> BAD BOY

Inside CALL 0x435E6C

0x435F0C CALL 0x42BFB1

Inside this CALL ...

0x42106E CMP [ECX+EBP-14],AL >> AL = FAKE S/N AND OTHER POINTS TO
VARYING REAL S/N

So enter S/N = EEEEEEEEEEEEEE

Change one by one from left

Registration Info :

Name = DHEERAJ
S/N = 577243F2EEEEEE


b>Crack :

This program uses some lengthy algorithm to check S/N.Luckly we can use its own algorithm to find valid S/N.First find out the correct CALL and assembl our code in SICE ..so easy.First lets see the program code and CALL.
Enter some S/N and use BPX HMEMCPY and trace

0050FB1 LEA EDX,[EBP-0A] ....>>> OUR FAKE S/N
0050FB4 LEX EAX,[EBP-1A] ....>>> SOME CONSTANT
0050FB7 CALL 501374 .........>>> MAIN ALGO CALL ....HEEE ....
0050FBC TEST AL,AL
0050FBE JNZ 500FC6

Now inside this main call ...

00501387 CALL 5006CC
0050138C CMP WORD PTR[ESP],D9F6 ....AFTER A LONG ALGO RESULT IS COMPARED
00501392 SETZ AL

Now we will do a simple trick and make a counter and rest our PC will do :)
So assemble this in SICE

0050FB1 LEA EDX,[EBP-0A] ....>>> OUR FAKE S/N
0050FB4 LEX EAX,[EBP-1A] ....>>> SOME CONSTANT
0050FB7 CALL 501374 .........>>> MAIN ALGO CALL ....HEEE ....
0050FBC TEST AL,AL
0050FBE JNZ 500FE0 ............. start our trick ...NOTE JUMP ..PUT A BPX ON 500FE0
0050FC0 MOV EAX,DWORD PTR[EBP-0A] ..... READ OUR S/N TO EAX
0050FC3 INC EAX ...............INCREMENT IT ...
0050FC4 MOV DWORD PTR[EBP-0A],EAX .... WRITE BACK ....
0050FC7 JMP 500FB1 .... JUMP UP AND RECALCULATE FOR NEW S/N

Asoon as we break on 500FE0 ..look at [EBP-0A] .... man this is our S/N.

Registration Info : Use any one below

Note : S/N removed due to the request from Company



eturns Integer: 1

Registration Info :

Name = DHEERAJ
Product ID = 3897695580138
Unlock Key = 1283792544077

Note : This is where the program is storing its 50 execution count :Inside the registry ..

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control]
"winsystem"="††"
"windows"="„†zŒ‡}Œ…"

Those invalid charecters are its count if you increase it you will get 50>+ execution ..

 


0x40A6AB CMP EDI,EAX =>3C --"60" ; EDI = NO: DAYS USED
0x40A6AD JLE 40A70A = 7E 5B --> GOOD BOY OFFSET = A6AD
...........................................
NOW BPMB 5F5A78 RW --- CONTINUE
...........................................
0x40A942 PUSH 5F5A78
0x40A947 CALL [005B42A8]
0x40A94D ADD ESP,04
0x40A950 CMP EDI,EAX
0x40A952 JLE 40A973 = 7E 1F --> GOOD BOY OFFSET = A952

So all you want to do is to convert :
JLE ---> JMP i.e 74 ===> EB

 


Suppose we just try to redirect this check to an original and virgin