Author: matias921 Target: ToggleMOUSE v4.3.4 Where: http://www.toggle.com Protection: Name/Code Tools: w32dasm and any hex editor ======================================================================= Run the program (ToggleMOUSE.exe) and it is in system try. Right-click --> Settings... --> Order --> enter code button. Write anything for name and code and hit , a MessageBox shows: "the registration information is not valid..blabla" Open w32dasm and disassemble ToggleMOUSE.exe. Search for: the registration information * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0040E82A(C) | :0040E8DF 6AFF push FFFFFFFF :0040E8E1 6A10 push 00000010 * Possible Reference to String Resource ID=00165: "The registration information you have entered is not valid. " | :0040E8E3 68A5000000 push 000000A5 :0040E8E8 E840F70100 call 0042E02D :0040E8ED EB2F jmp 0040E91E As you can see, the nag is referenced by a jump in 0040E82A Scroll up a bit until you are in 0040E82A: :0040E822 E869570000 call 00413F90 :0040E827 3BC6 cmp eax, esi :0040E829 59 pop ecx :0040E82A 0F85AF000000 jne 0040E8DF --> HERE :0040E830 E84B3B0200 call 00432380 :0040E835 8B4004 mov eax, dword ptr [eax+04] :0040E838 56 push esi Now, we will nop the jump to the nag. With your favorite hex editor load the program and in hex mode search 0F85AF000000 and change to 909090909090 Next enter anything for name/code and the program is regged! Contact: matias921@come.to mov eax,000460048