----------------------------------------------
How to find a serial for Fireworks screensaver
----------------------------------------------

Cracker: stealthFIGHTER

Target: Fireworks screensaver v2.5

Tools: W32Dasm++

Where: http://www.nexusmedia.net

Protection: Serial number, VB

--------------------------------------------------
Sorry for my English, it's not my mother language.
--------------------------------------------------

----------------
---[ Step 1 ]---
----------------

=======================================================================
After installation in C:\NexusMedia there are files needed for the
screensaver. Main file (*.scr) is in C:\%SYSTEM%\SYSTEM directory -
Fireworks.scr. Ok.
=======================================================================
Run W32Dasm++ and load your Fireworks.scr. Once file is disassembled
click SDR button and look for string: " Thank you for your purchase! ".
Double click on it.
=======================================================================

:0044A3CD  mov dword ptr [ebp+FFFFFF5C], 04D77303   ;duh?
:0044A3D7  mov dword ptr [ebp+FFFFFF54], 00008003

* Reference To: MSVBVM50.__vbaVarTstEq, Ord:0000h

:0044A3E1  Call dword ptr [004532D8]		    ;Test If Equal?
:0044A3E7  test ax, ax
:0044A3EA  je 0044A50E				    ;Jump to bad boy
:0044A3F0  mov eax, 80020004
:0044A3F5  lea edx, dword ptr [ebp-5C]
:0044A3F8  mov dword ptr [ebp-54], eax
:0044A3FB  mov dword ptr [ebp-44], eax
:0044A3FE  mov dword ptr [ebp-34], eax
:0044A401  lea eax, dword ptr [ebp-4C]
:0044A404  push edx
:0044A405  lea ecx, dword ptr [ebp-3C]
:0044A408  push eax
:0044A409  push ecx
:0044A40A  push 00000000
:0044A40C  lea edx, dword ptr [ebp+FFFFFF54]
:0044A412  push esi
:0044A413  lea eax, dword ptr [ebp-2C]
:0044A416  push edx
:0044A417  push eax
:0044A418  mov dword ptr [ebp-5C], ebx
:0044A41B  mov dword ptr [ebp-4C], ebx
:0044A41E  mov dword ptr [ebp-3C], ebx

* Possible StringData Ref from Code Obj ->"  Thank you for your purchase! "

=======================================================================
You probably see the fantastic value at address 0044A3CD, that is
moved somewhere. Its a hex value of the right serial number, so
if we convert it to dec and enter it we are registered :-).
=======================================================================
Any comments or mistakes are welcome at: crackercz@yahoo.co.uk or you
can visit me at: http://nitrous.hop.to or http://stealthfighter.cjb.net
=======================================================================7px;width:14px;height:51px'><img