• The 'dead listing' approach (with W32DSM or IDA Pro)
• The serial fishing approach (with SoftICE)

If there is a registering option included, you could try and find the serial code with SoftICE, but as this is quite difficult for newbies, it's almost always possible to use the dead listing approach. Imagine you have a program with a nag screen and a 30 day trial and the possibility to register. Then you have 2 possibilities: 1. crack the program by finding a serial or 2. remove the nag screen and 30 day trial. N° 1 is done with SoftICE and N° 2 with W32DSM and a hex-editor. If you choose n° 2, you have again other possibilities: crack the program by letting it believe it's registered or remove the "draw nagscreen" procedure and time limit.....I would prefer to let the program believe it's registered......more on that can be read in my essay about Planet Zip.
Confused? Here's a little scheme:

Note that this is a really simplified approach scheme. In practice there are much more approaches and different approaches often have to be used together to effectively crack a program.

Before you move to the next chapter make sure you can work with the tools!

Note: I know that Winzip 8.x is the latest version. Don't panic, you can use that version too to follow this lesson. The only difference will be the locations or offsets. The offsets are the ciphers in the left and often start with 40xxxx or 41xxxx.

In this second lesson I'll show you how to do a basic serial fishing. To make it easy, we'll crack Winzip 7.0. Its protection is easy, lame, bad,.....but good to learn from! :) It was my first program I cracked on my own, and it costed me less than 5 minutes to do so!
Serial fishing is always done with a debugger...in this case SoftICE. So launch an unregistered copy of Winzip, click on "Enter registration code". Fill in your name and fill in a serial of your choice (I always use 121212). Now, when you press the "OK" button, Winzip reads your username, your serial, makes the real serial, and compares your serial to the real serial.
In this case we'll search for where the real serial is made. Follow me :)
Popup SoftICE (CTRL-D), type in: "bpx getdlgitemtexta" and enter. Close SoftICE (CTRL-D). Click the OK button......SoftICE pops! :) You are now in the GetDlgItemTextA function. Press F12 to execute it and quit the procedure. Now you're in the real Winzip code. Type "bc *" and enter. (=clear all breakpoints). Trace through the code (F10) 'till you see something like this:

:00408049 803D28D9470000          cmp byte ptr [0047D928], 00
:00408050 59                      pop ecx
:00408051 745F                    je 004080B2
:00408053 803D58D9470000          cmp byte ptr [0047D958], 00
:0040805A 7456                    je 004080B2
:0040805C E8EAFAFFFF              call 00407B4B [-> This makes the real serial]
:00408061 85C0                    test eax, eax [-> Test if good serial]
:00408063 744D                    je 004080B2   [-> Jump if valid]

:00407C0E 8D85C0FEFFFF            lea eax, dword ptr [ebp+FFFFFEC0]
:00407C14 50                      push eax
:00407C15 57                      push edi
:00407C16 E8AB000000              call 00407CC6 [<-Makes real serial in EAX]
:00407C1B 59                      pop ecx
:00407C1C BE58D94700              mov esi, 0047D958
:00407C21 59                      pop ecx
:00407C22 8D85C0FEFFFF            lea eax, dword ptr [ebp+FFFFFEC0]

In this third lesson I'll teach you the basics of a dead listing cracking approach....which I use quite often, mostly in combination with Softice, but in this lesson we 'll crack the program purely with W32DSM and a hex editor. The target program is Regview v1.21a . I wrote a tutorial on this program quite some time ago and I used it in this lesson, BUT....specially adapted for you 100 % newbie! Let's go...

Well, obviously RegView is a prog for viewing the Windows registery file. I always use it when cracking, and therefore it is an indispensable tool. It's "protected" with a 30-uses limit. When the 30 uses are exceeded, RegView displays the following message: "Maximum number of trials has been reached! To continue use...." etc. Before loading regview.exe into W32DSM, we'll first make a copy of it and disassemble the copy of it and NOT the .exe itself. Why? Because if the original .EXE is disassembled and you should try to hex-edit the file (to patch the program) it 'd give a "Readonly error". So make a copy of regview.exe. I always use the extension .DSM, so our copy would be regview.dsm
Now fire up W32DSM and disassemble the .DSM file (remember: do not disassemble the .EXE !!) You disassemble a file by clicking on "Disassembler" then on "Open File to disassemble" then select regview.dsm and click on open. Now THAT's easy huh?
Give the program some time to disassemble....on bigger files that can take quite some time! When the program is disassembled, click on "Disassembler" then on "Save disassembly textfile" then just save it. Next time you can open the "dead listing" by clicking on "Project" then on "Open project file". Btw, I won't explain how to do things anymore in W32DSM because it's just too simple...you can also use the buttons...and if you don't know what each button represents, just stand a few seconds still on them....a little yellow box 'll explain what it'll do!

Okay...you remember the string "Maximum number of trials has been reached! To continue use...." ? You can search for it in the dead listing. Do that NOW......you should see the following asm code:

---------------------------Start-of-partial-code----------------------------

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048D830(C) <- That's the location where u can find a jump to this "beggar off"
|
:0048D856 6A00                    push 00000000
:0048D858 668B0DBCDB4800          mov cx, word ptr [0048DBBC]
:0048D85F B202                    mov dl, 02 

* Possible StringData Ref from Code Obj ->"Maximum number of trials has been "
                                        ->"reached! To continue use of this "
                                        ->"program, you need to register "
                                        ->"now!"
----------------------------End-of-partial-code-----------------------------

---------------------------Start-of-partial-code----------------------------
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048D806(C) <- There's a jump at 48D806 that jumps to this "beggar off" 
|
:0048D816 8D55F0                  lea edx, dword ptr [ebp-10]
:0048D819 B801000000              mov eax, 00000001
:0048D81E E8BD51F7FF              call 004029E0
:0048D823 8B45F0                  mov eax, dword ptr [ebp-10]

* Possible StringData Ref from Code Obj ->"try"
                                  |
:0048D826 BAB8DB4800              mov edx, 0048DBB8
:0048D82B E83066F7FF              call 00403E60
:0048D830 7524                    jne 0048D856 <- Here is the jump
:0048D832 B90CFFFFFF              mov ecx, FFFFFF0C

----------------------------End-of-partial-code-----------------------------

---------------------------Start-of-partial-code----------------------------
* Possible StringData Ref from Code Obj ->"CLSID"
                                  |
:0048D7C4 BAA8DB4800              mov edx, 0048DBA8
:0048D7C9 8B45F8                  mov eax, dword ptr [ebp-08]
:0048D7CC E85B9CFCFF              call 0045742C
:0048D7D1 8B1550D34900            mov edx, dword ptr [0049D350]
:0048D7D7 8902                    mov dword ptr [edx], eax
:0048D7D9 A150D34900              mov eax, dword ptr [0049D350]
:0048D7DE 81280BFFFFFF            sub dword ptr [eax], FFFFFF0B
:0048D7E4 A150D34900              mov eax, dword ptr [0049D350]
:0048D7E9 81387CF8FFFF            cmp dword ptr [eax], FFFFF87C

:0048D7EF 750D                    jne 0048D7FE <- if registration code in
                                             	   registery is false then check trial uses
				  
:0048D7F1 A104D34900              mov eax, dword ptr [0049D304]
:0048D7F6 C60001                  mov byte ptr [eax], 01 <- set registered
				                                             flag!!		
:0048D7F9 E987020000              jmp 0048DA85

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048D7EF(C) 
|
:0048D7FE A150D34900              mov eax, dword ptr [0049D350]
:0048D803 83381E                  cmp dword ptr [eax], 0000001E <- compares
		                                                            the amount of uses to the maximum amount of
		                                                            uses. (1E is the hex value for 30!!)
					
:0048D806 7F0E                    jg 0048D816 <- if exceeded the 30 trial 
		                                          uses then "beggar off"	
----------------------------End-of-partial-code-----------------------------

  Before cracking:
  ---------------
  
  :0048D7EF 750D          jne 0048D7FE
  
  After cracking:
  ---------------
  
  :0048D7EF 90            NOP
  :0048D7F0 90            NOP

• Goto code location 0048D7EF
• Note the offset address in the bottom right corner of W32DSM
• Open up HIEW and open REGVIEW.EXE
• Press F4 then F3
• Press F5 (goto location) and type in the offset adress you noted
• Press F3 (change code)
• Type "90" twice, of course withouth the quotes
• Press F9 (=save changes)
• Press Escape if you made a mistake

  The program is cracked!! To make a leet crack for it...download RTD-patcher here. Please read the docs on how to do it!! The syntax for getting the assembler file is "RTD_PT20.EXE [original file] [patched file] /A". Then you can change it your way and compile it afterwards. You have to do this! If you won't, your crack will try to patch the dead listing copy you made for W32DSM!!

I told you earlier that I would come back on all sort of breakpoints that are usefull when cracking. I'll keep it as easy as possible, however it's possible you won't understand everything. But don't worry, just try and practice, you'll get it in no time!

• BPX

  This is the most common breakpoint: breakpoint on execution. It's used to break on API calls like GetWindowTextA or GetDlgItemTextA (those two read text in editboxes....mostly used to search for serials or to follow how a serial is created in a program). Of course there are many many other breakpoints. On my mainpage you can view a list on breakpoints that are used most when cracking.
  Syntax: bpx [API call]

• BPM

  Breakpoint on memory access. It 's used for breaking on a specific memory location. When serials are created, the program first has to read the serial you typed in. By setting a breakpoint on the memory location where you serial is stored, SoftICE will pop-up when the program reads your serial. This is usefull as then you can see what it does with you serial or with a part of your serial
  Syntax: bpm #xxxx:xxxxxxxx

• BPR

  Breakpoint on memory range. It's almost the same as BPM, but it's more usefull (actually, I always use bpr and NOT bpm) : it sets a breakpoint on a certain memory range. Now imagine that you serial (8 chars long) is stored at memory location #0030:80000000. Setting a "bpm #0030:80000000" will only cause a break when the first character of your serial is read. If you set however a "bpr #0030:80000000 #0030:80000000+8" (note that you can use math signs like "+", "-", etc...) SoftICE will pop-up on every character that 's read. Setting a bpr on a serial is used to find out what instructions of the program you want to crack read and process your serial.
  Syntax: bpr #xxxx:xxxxxxxx #yyyy:yyyyyyyy

• BMSG

  This breakpoint is somewhat more complicated, but it's very useful and I use it all the time when cracking programs. It breaks on the handle of certain things like: buttons, mouseclicks, windows, etc... . It's common used to find out the offset adress of where a nagscreen is drawn, or to find out how a serial is read in memory if it doesn't use the normal GetWindowTextA or GetDlgItemTextA.
  But now: how do you use it? Well, let's make a fictious program and call it "Crackme". Let's say it has a nagscreen with an OK-button on it. So what do we do: we fire up Crackme, press CTRL-D to popup SoftICE. We want the handle of OK button, so first type in Sice: "hwnd crackme". Now you will see a list of every object drawn on the screen of the program crackme. Somewhere you should see the handle of the nagscreen. Note the handle of it (let's imagine it is 035C).....then type: "bmsg 035C wm_lbuttonup". This command 'll break if you pressed the OK button. That way you can find out the call that draws the nagscreen or find out where the comparison is made whether the OK-button is pressed or not.
  I guess this is somewhat difficult to understand, and I had some difficulties with it when first reading how to use BMSG, but I'll try and put a tutorial for it online :

Voila. These were your first basic lessons. You're still a newbie and you have still tons to learn. So...next thing to do for you is reading tutorials (and after that try to crack the program yourself) and by trying to crack a program all by yourself without the help of a tutorial. However, I strongly suggest to start following some tutorials. They 'll arm you with some experience you'll need when cracking a program on your own. The other content of my site will surely come in handy ;-)