---------------------------------------------- How to find a serial for Fireworks screensaver ---------------------------------------------- Cracker: stealthFIGHTER Target: Fireworks screensaver v2.5 Tools: W32Dasm++ Where: http://www.nexusmedia.net Protection: Serial number, VB -------------------------------------------------- Sorry for my English, it's not my mother language. -------------------------------------------------- ---------------- ---[ Step 1 ]--- ---------------- ======================================================================= After installation in C:\NexusMedia there are files needed for the screensaver. Main file (*.scr) is in C:\%SYSTEM%\SYSTEM directory - Fireworks.scr. Ok. ======================================================================= Run W32Dasm++ and load your Fireworks.scr. Once file is disassembled click SDR button and look for string: " Thank you for your purchase! ". Double click on it. ======================================================================= :0044A3CD mov dword ptr [ebp+FFFFFF5C], 04D77303 ;duh? :0044A3D7 mov dword ptr [ebp+FFFFFF54], 00008003 * Reference To: MSVBVM50.__vbaVarTstEq, Ord:0000h :0044A3E1 Call dword ptr [004532D8] ;Test If Equal? :0044A3E7 test ax, ax :0044A3EA je 0044A50E ;Jump to bad boy :0044A3F0 mov eax, 80020004 :0044A3F5 lea edx, dword ptr [ebp-5C] :0044A3F8 mov dword ptr [ebp-54], eax :0044A3FB mov dword ptr [ebp-44], eax :0044A3FE mov dword ptr [ebp-34], eax :0044A401 lea eax, dword ptr [ebp-4C] :0044A404 push edx :0044A405 lea ecx, dword ptr [ebp-3C] :0044A408 push eax :0044A409 push ecx :0044A40A push 00000000 :0044A40C lea edx, dword ptr [ebp+FFFFFF54] :0044A412 push esi :0044A413 lea eax, dword ptr [ebp-2C] :0044A416 push edx :0044A417 push eax :0044A418 mov dword ptr [ebp-5C], ebx :0044A41B mov dword ptr [ebp-4C], ebx :0044A41E mov dword ptr [ebp-3C], ebx * Possible StringData Ref from Code Obj ->" Thank you for your purchase! " ======================================================================= You probably see the fantastic value at address 0044A3CD, that is moved somewhere. Its a hex value of the right serial number, so if we convert it to dec and enter it we are registered :-). ======================================================================= Any comments or mistakes are welcome at: crackercz@yahoo.co.uk or you can visit me at: http://nitrous.hop.to or http://stealthfighter.cjb.net =======================================================================7px;width:14px;height:51px'>