Main | Index

DzSoft PHP Editor 1.0

Type : PHP Editor + Debugger
Protection : ASProtect -- 30 DAY LIMIT
Tech : Loader

Crack : ASProtect is a real mess.Unpacking has become harder.But a loader can be used.
This program has 30 day limit.It seems that it uses code of ASProtect for this.It is interesting to note that after 30 day the address of Nag Box changes.

0x5AA60B CALL [005AF80] --- SHOW NAG

Now content of [005AF380] will decide to run or not to run in 30 Day trial.
IF [005AF80] == 005A9BC4 --- IT WILL RUN IN 30 DAY TRIAL
IF [005AF80] == 005A9DF0 --- EXPIRED ... KICK ASS ....

Now these values are filled by ASProtect.First API call made by this program is GetStartupinfoA.If we put a BPX GETSTARTUPINFOA and look at 005AF80 we can see that it is already filled by sucker ASProtect after checking if 30 DAY is left or not.So if your 30 DAY limit is over then [005AF80] == 005A9DF0.It is interesting to see that at the break of first API if we change [005AF80] ---> 005A9BC4 ..... it RUNS ...

Now a loader can be easily made.With delay = 200ms.

Another interesting point is that we can reset its 30 DAY count if we delete this key :

[HKEY_CURRENT_USER\Software\ASProtect\Data]<