

                     L                ZZZZZZ         RRRRR           SSSSS
                     L                    Z          R    R         S
                     L          aaa      Z      aaa  R    R  u   u  S
                     L            a     Z         a  RRRRR   u   u  SSSSS
               XX    L         aaaa    Z       aaaa  R    R  u   u       S
              XXXX   L        a   a   Z       a   a  R    R  u   u       S
             XXXXXX  LLLLLLL  aaaaa  ZZZZZZZ  aaaaa  R    R  uuuuu  SSSSSS
             XXXXXX       
        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
       XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
             XXXXXX
             XXXXXX
              XXXX
               XX


Wow, you really downloaded this although you read at my page that you shouldn't do this. OK,
this small text deals with replacing a picture at the background of a window in a Delphi-Coded
Application. This job was requested by a guy I know from IRC and learn2crack.org and it looks
as if he (better a guy he knows) wants to rip the installer, but that's not my problem. So, as
he told me in the mail, all standard attempts (BRW/Symantec Ressource Workshop...) failed and
he wants me to have a look at it. Alright, then let's start. The only tool I needed was my
beloved HexEditor: HexWorkshop

The first glance at the prog: 868KB - Kewl, it is not packed :]
So I opened it in a hexeditor and looked for all TImage appearances, as I believed the picture
in the background is just a TImage component. It didn't lead me too far, so I searched for 
TBitmap. The first appearance was at offset C1F8B and few bytes below there starts the header
of a bitmap file (BM). I selected all bytes from C1F96 to C2298 and copied them into another
file called a.bmp and as I opened it I saw that it was the icon of an open folder. In fact I
never believed that it is the background image, as it is *much* to big for so few bytes.
So, searched for the next TBitmaps which are found at C2387 and C3425. Both of them have the
size of the first one, so the background image must be saved in a different format. I tried
JPEG first an searched for it. And indeed there are some appearances of JPEG/JPG in the file,
so I tried to find out how a JPEG file is built. For this reason I created a.jpg - Loading the
file into a hexeditor reveals that it starts with FFD8 FFE0 0010 4A46 4946. And searching for
these values in the EXE file bring us to offset B6AD8. Here a JPEG ressource starts. Now we
gotta find the end of it. Another look at the end of a.jpg shows that all (?) JPEG files end
with FFD9. This value can be found at BBA05. So I copied the bytes from B6AD8-BBA05 and saved
them as b.jpg. Open it in your favourite gfx prog and you'll see that it is the background
image. So, we just gotta replace the bytes by the bytes of the new image. But remember: The
new file musn't exceed 20271 bytes. The first file I found was c.jpg - The logo SKORPiEN made
for me. It is only 11KB and fits easily. I copy/pasted the bytes from c.jpg and replaced
the bytes of the old graphic. There is not even a need to change the bytes that come after the
11KB new ressource as the FFD9 of your file indicates the end of the ressource.

So, that was all (The shortest text I've ever written) and I fear that you didn't learn too 
much, but at least the guy that didn't get it learned and if there's another one who has learned
it is enough for me. If nobody else has learned I just take myself as second guy :P

Greetings go to: +Sandman, Acid Burn, alpine, Borna Janes, Carpathia,
CrazyKnight, DEATH, DEZM, dimwitz, DnNuke, duelist, Eternal Bliss, Fravia+,
Iczelion, Jordan, KnowledgeIsPower, Knotty, Lucifer48, MisterE, Neural Noise, night
noos, Prof.X, R!SC, Shadow, SiG, tC, The AntiXryst, The Hobgoblin, TORN@DO,
Volatility, wAj, _y and all the guys I forget and I'll add next time.