assume cs:code,ds:code
code	segment
	org 100h
start:
mov ah,09h              ; Write some text to screen
lea dx,text1
int 21h

mov ah,09h              ; Yep, lets write some more
lea dx,text2
int 21h

mov ah,03dh             ; Open the file
mov al,02
lea dx,file
int 21h

jnc filefound           ; Did we find the file?
mov ah,09h              ; Guess not, so we'll write some text to screen
lea dx,text3
int 21h
jmp ready               ; and exit the program

filefound:              ; Yeah - found the file
mov handle,ax           ; So lets save the filehandle

mov ah,42h              ; Now we need to move the filepointer
xor al,al
xor cx,cx
mov bx,handle
mov dx,02F9Ch           ; See the still confused session at the end of the page to understand how I got this value
int 21h

mov ah,40h              ; Yeah - lets patch the sucker
mov bx,handle
mov cx,1                ; We only want to write one byte
lea dx,value            ; And this is the value we want to write
int 21h

mov ah,42h              ; Ok, move the filepointer again
mov al,0
mov bx,handle
xor cx,cx
mov dx,030EDh
int 21h

mov ah,40h              ; And patch this value
mov bx,handle
mov cx,1
lea dx,value
int 21h

mov ah,42h              ; Recognize this???
mov al,0
mov bx,handle
xor cx,cx
mov dx,03482h
int 21h

mov ah,40h              ; And this???
mov bx,handle
mov cx,1
lea dx,value
int 21h

mov ah,3eh              ; And we're done! Lets close the file'
mov bx,handle
int 21h

mov ah,09h              ; Write some more to the screen
lea dx,text4
int 21h

ready:
mov ax,4c00h            ; Let's jump right back to dos
int 21h                 ; And we're ready!

handle dw 0
text1 db 'Crack for CGI-star pro 3.1',13,10,'$'
text2 db 'Made by Cruehead / MIB',13,10,'$'
text3 db 'You must have CSPRO.EXE in the same directory as CRACK.COM',13,10,'$'
text4 db 'Done! Enjoy it!',13,10,'$'
value db 235          	   ; hex for 235 is EB and EB is the op code for JMP
file db 'CSPRO.EXE',0 	   ; ASCII Zero string for the filename

code ends
end start

mov ah,42h              ; Now we need to move the filepointer
xor al,al
xor cx,cx
mov bx,handle
mov dx,02F9Ch           ; This value...
int 21h

When debugging in softice I pretty soon saw where to patch it in order to get the program cracked, so I simply changed these values in a hex editor. Then I used the good old dos command FC (File Compare) to compare the original file and the cracked one. And that is how I got the values.

So, knowing this, the rest of the source should be easy to follow...

Copyright © MiB 1998. All rights reversed.