IXLA Explorer, IXLA Web Easy
   
           Retreiving a valid serial (Unlock code)

		            by
                 
                          L!M!T 

                   [The Exterminators]

		        March 1999
                 
-------------------------------------------------------------
Program info for IXLA Explorer, IXLA Web Easy

Available @ 	 :    http://www.ixla.com
Size 	         :    4.46 Mb (IXLA Explorer v1.2)
		      7.47 Mb (IXLA Web Easy v1.30, International Version)
		      7.48 Mb (IXLA Web Easy v1.30, U.S Only Version)
                      As these prog's are protected the exact same
                      way, it will be enough to get one of them.

Language   	 :    English

Tutorial level	 :    Really easy...
-------------------------------------------------------------
Tools used:

Soft-Ice v3.2x
-------------------------------------------------------------

Prologue
--------

First I want to say that the protection in these programs are
rediculously easy. All of the targets are protected the exact
same way and you can use the same procedure on all three of them.

We'll get the unlock code so easily that it would have been
quite similar to reading it in the local newspaper.

Ok, I assume you have Soft-Ice installed and configured properly.
If you don't, go get it, install it and set it up.

We will not go through the Soft-Ice setup and configuration in this
tutorial, 'coz there are tutorials out there that covers this section.


The First Encounter
-------------------

Install the program you DL:d, either IXLA Explorer or any of the
Web Easy versions.

Run it and the first window created will be a 'Try before you buy'
window telling us how many tries we have left, a 'Try now' button,
a 'Buy now' button and a 'Quit' button. There is also a textbox
where you can enter the unlock code provided by IXLA after you
payed them... 

Enter a bogus unlock code in the textbox and press the 'Buy now'
button. A messagebox pops up, telling us that the code we entered
was invalid and we should contact IXLA Ltd. to sort this problem out.
Or we could try again and instead of calling IXLA, we could ask our 
friend Soft-Ice to help us.


The Procedure - IXLA Explorer
-----------------------------

Click that messagebox away if you haven't done that already.
Now, press CTRL - D to enter Soft-Ice. Type 'bpx GetDlgItemTextA'
(without the quotes) and press Enter. What you just did, was telling
Soft-Ice to break on the execution of the Windows GetDlgItemTextA API
call (bpx=BreakPoint on eXecution). This API retrieves text and other
similar information from dialogitems, such as textboxes.

Ok, now press CTRL - D again to get out of Soft-Ice. Enter your bogus
unlock code again and press the 'Buy now' button.
*B00M* Soft-Ice breaks and you are in the GetDlgItemTextA code.
Press F12 once to leave that code and return to the calling program.

The code screen should look something like this;

015F:005934E6		CALL[USER32!GetDlgItemTextA]   (1)
015F:005934EC		PUSH 005973C0                  (2)
015F:005934F1		LEA EAX,[EBP+FFFFF6D8]         (3)
015F:005934F7		PUSH EAX                       (4)
.............		............................
.............		............................

The addresses may look different on your computer but the code looks the same.
Now type 'D 5973C0' and press enter. In your data window the following word should
be displayed: 'TKL'. If you press F8 twice and type 'D EAX' you should see your
bogus unlock code you entered in the data window. Those are later on compared to 
each other to see if they match. This unlock code is used to unlock the IXLA
Explorer, not the WebEasy packages. If you need the WebEasy packages unlock codes,
just do the same procedure as you did with the IXLA Explorer package.


The Progress
------------

Your fake unlock code is retrieved by GetDlgItemTextA                     (1).
The real unlock code is pushed on to the stack for later use              (2).
Your fake unlock code is placed in EAX.                                   (3).
Your fake unlock code (in EAX) is pushed on to the stack for later use.   (4).

This procedure is applicable to IXLA Explorer, IXLA Web Easy (both Int. Version
and the U.S Only Version) and IXLA Explorer to retrieve the unlock code.


Fast Reference
--------------

1)     Enter your bogus unlock code.
2)     CTRL - D into Soft-Ice
3)     BPX GetDlgItemTextA
4)     CTRL - D out of Soft-Ice
5)     Push 'Buy now' button
6)     ** Soft-Ice breaks **
7)     F12 once to get to the calling program
8)     Type 'D #address#' where #address# is the address that is pushed directly
       after the GetDlgItemTextA. Check the data window. There's the unlock code.
9)     Type 'bc *' to clear all breakpoints so Soft-Ice won't break anymore.
10)    Enter the correct unlock code...

That's it.


'Knowledge is neither given nor taken. It is earned.'

Regards,

L!M!T [TEX]