------------------------------------------------
How to find a serial in Cline 2k
------------------------------------------------

Cracker: stealthFIGHTER 

Target: Cline 2k 1.0.1 (VB)

Tools: SoftIce
	Brain

Where: http://home.twcny.rr.com/jssoftware/

Sorry for my english, its not my mother language.


-----------
Step 1:
-----------

===
Run Cline, press REG. button and enter your name and
fake s/n. Press enter ... Registration Code Invalid ... .
As I say this is a Visual Basic 6 program so we use
VB comparing breakpoint:  bpx MSVBVM60!__vbaStrComp
So go to Soft-Ice and set the breakpoint, go back (F5) and
press REB. button again ... break ... we are in SI. 
Now press two times "F5" key and "F11" to get to the 
caller.
You should be here:
===


015F:66024164	E803000000	CALL MSVBVM60!__vbaStrComp
015F:66024169	C20800		RET 0008		<--- we land here


===
Here press "F10" key to pass the RETurn.
You should be here:
===


015F:0046DABE	FF151C114000	CALL [MSVBVM60!__vbaStrComp]
015F:0046DAC4	F7D8		NEG EAX
015F:0046DAC6	1BC0		SBB EAX, EAX
015F:0046DAC8	8D4DE4		LEA ECX, [EBP-1C]		<--- STOP here!
015F:0046DACB	40		INC EAX
015F:0046DACC	F7D8		NEG EAX
015F:0046DACE	0BD8		OR EBX, EAX
015F:0046DAD0	0D45E0		LEA, EAX [EBP-20]
015F:0046DAD3	50		PUSH EAX
015F:0046DAD4	51		PUSH ECX
015F:0046DAD5	6A02		PUSH 02


===
 Go through (F10) and stop at LEA ECX, [EBP-1C].
At this line you will see at right-top corner something
like this: SS:006AD700=00490A08. 
Now we display the memory. Type d 00490A08 and in 
the data window you should see some like this:
===

9.8.7.6.5.4.3.2.1....		<--- my fake s/n
....H.A.....$.............		
...8.5.2.0.0.2.0.A.2		<--- real s/n
2.F.3.3..................		<--- real s/n
.............................			
.N.A.M.E..........		<--- my name
.............................


===
Now only write the real s/n down (it is in 
wide char [without the points]).
=== 

---------------------------------------------------------
If i make a mistake, please e-mail me 
to: stealthfighter@another.com
---------------------------------------------------------