---------------------------------------------------------
How to find a serial in QuickDial v1.1
---------------------------------------------------------

Cracker: stealthFIGHTER

Target: QuickDial v1.1

Tools: SoftIce
       Brain

Where: http://www.ics.uci.edu/~dmyers/software/

Sorry for my english, its not my mother language.

-------
Step 1:
-------


Run QuickDial, enter name and fake s/n. Ctrl+D to SI and
set breakpoint on getwindowtexta and go back.
Press "F5" (two inputo boxess), "F11" to a caller and you´ll be here:

	
* Reference To: USER32.GetWindowTextA, Ord:013Fh
                                  |
:00402A02 FF1508C34000            Call dword ptr [0040C308]
:00402A08 8D85F0F7FFFF            lea eax, dword ptr [ebp+FFFFF7F0]
:00402A0E 50                      push eax			<------ d eax our s/n and name
:00402A0F E88C010000              call 00402BA0			and some horrible #
:00402A14 83C404                  add esp, 00000004
:00402A17 83F803                  cmp eax, 00000003
:00402A1A 7723                    ja 00402A3F


Nothinth interesting, yet. Go through the code by pressing "F10" (many times):
You´ll be here:

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402AC3(C)
|
:00402AEC 8D95F0F7FFFF            lea edx, dword ptr [ebp+FFFFF7F0]
:00402AF2 52                                 push edx		
:00402AF3 8D8518F8FFFF            lea eax, dword ptr [ebp+FFFFF818]
:00402AF9 50                                 push eax		<----- real s/n:
:00402AFA E8D1010000               call 00402CD0
:00402AFF 83C408                        add esp, 00000008
:00402B02 898534F8FFFF            mov dword ptr [ebp+FFFFF834], eax
:00402B08 83BD34F8FFFF00       cmp dword ptr [ebp+FFFFF834], 00000000
:00402B0F 753F                            jne 00402B50        	  <---- bad boy


Type bc * to clear bpx.
Enter new s/n - wov, we are a registered user.

---------------------------------------
If i make a mistake, please e-mail 
me to: stealthfighter@another.com
---------------------------------------04047F9 B94BC64700              mov ecx, 0047C64B