Cracking for Newbies  - by Dahood
                

Target: MatchWare ScreenCoder version  2.1

Tools used: W32dasm
	    Hview

Protection:
1.when u record a message comes up in the middle
2.when u close a nag screen shows 


NOTE: This tutorial is not totally for newbies so i excpect that u know
1.how to use w32dasm
2.how to use hview (change,search,etc...)
3.Assembly



Disassemble the program

1.Search for MatchWare ScreenCorder Demo
which is the message that comes up when u record
and u ll end up with this


* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407B1F(U), :0040872D(C)
|

* Possible StringData Ref from Data Obj ->"MatchWare ScreenCorder Demo"
                                  |
:004087C9 6804E64200              push 0042E604 ==>pushes the message
:004087CE 8D8D04FDFFFF            lea ecx, dword ptr [ebp+FFFFFD04]
:004087D4 E8EF500100              call 0041D8C8 ==>must compare something in this call
:004087D9 C745FC04000000          mov [ebp-04], 00000004
:004087E0 8B8580FBFFFF            mov eax, dword ptr [ebp+FFFFFB80]
:004087E6 8B80B4020000            mov eax, dword ptr [eax+000002B4]
:004087EC 99                      cdq
 
lets check the call 0041D8C8
and ull end up here


* Referenced by a CALL at Addresses:
|:004044BD   , :004087D4   , :0040E418   , :00418C31   , :0041F684   
|:00421FEB   , :00422035   
|
:0041D8C8 A1F4E94200              mov eax, dword ptr [0042E9F4]
:0041D8CD 53                      push ebx
:0041D8CE 8B5C2408                mov ebx, dword ptr [esp+08]
:0041D8D2 56                      push esi
:0041D8D3 8BF1                    mov esi, ecx
:0041D8D5 57                      push edi
:0041D8D6 85DB                    test ebx, ebx
:0041D8D8 8906                    mov dword ptr [esi], eax
:0041D8DA 7436                    je 0041D912 ====>interesting Checks if ur registered

lets change 
:0041D8DA 7436                    je 0041D912
to
:0041D8DA 7536                    jne 0041D912

now try to record....does it work do u see that anoyin message ? NOPE
GOOD

2.NAG screen

u ready ....... k lets do it
open ur favorite hexeditor (hview)
and open the file and make sure ur in hex mode and search for
"This is a"
f7 and make sure u put 00 between ever char
ex
ASCII T h i s   i s   a
HEX   54 00 68 00 69 00 73 00 20 00 69 00 73 00 20 00 61

and u find what ever was displayed in teh nag screen
so at line 
00452F50  FF FF FF FF 82 00 54                ===> é T h i s
00452F50  FF FF FF FF 7E 00 54 CHANGE THAT TO ===> ~ T h i s
which makes the nag screen not pop up

82 = é ======>Makes the screen apears ** u can also use 90
7e = ~ ======>Makes the screen disapear
80 = Ç ======>Makes buttons apears
88 = ê ======>Makes buttons apears
86 = â ======>Makes the button a different color(green) 8b for white
84 = ä ======>Makes 2 arrows buttons

This is my fourth tutorial. i hope i didnt confuse u and if u have any question, comments
my icq# is 69518421 or u can e mail me at webcrawler28@hotmail.com

i would like to say thanks to all the crackers 2 many 2 list , for helpin me also for there 
tutorials
also a big thanks to krobar's site: http://zor.org/krobar
 
				Cracking for Newbies  - by Dahood