This tutorial is coming from...

ReFleXZ '99 Url: Http://ReFleXZ99.cjb.net Email: ReFleXZ@fcmail.com

About the essay...

Written by: MiZ Date: 16th February 1999 Program name: AreaEditor v1.15 Program type: Win32 Program location: Here Program filename: N/A Program size: 480 KB Tools required: Softice v3xx HexEditor Difficult level: Easy ( X )  Medium (   )  Hard (    )  Pro (    )

Introduction...

Using a nag,to get registered.

About the protection...

Type of protection: Nag/Timelimit/Name/Serial

The Essay...

Press Ctrl+D to get in softice,set breakpoint on MessageBoxA, like this bpx MessageBoxA,press Ctrl+D to get out of ice.Start AreaEditor, softice breaks,press F12,press enter,press F10 exatcly 14 times then you should be here: :004521CD E88E8AFDFF              call 0042AC60                             <---Check if we're registered or not :004521D2 83C408                          add esp, 00000008 :004521D5 85C0                               test eax, eax                                  <---Test if EAX=0 :004521D7 740E                               je 004521E7                                <---Good guy jump :004521D9 6A00                               push 00000000 :004521DB 6A40                               push 00000040 :004521E2 E8FB530200                 call 004775E2                                <---Display Message :004521E7 8D4C2404                      lea ecx, [esp+04]                            <---Here we landed Now set breakpoint on that call at :004521CD , like this: bpx 4521CD,and restart AreaEditor. Ice breaks again,press t to trace the call,you should be here: :0042AC60 6AFF                           push FFFFFFFF :0042AC62 68D9314900              push 004931D9 Scroll down until you see: :0042AD53 83C408                  add esp, 00000008 :0042AD56 85C0                       test eax, eax                                            <---Check if EAX=0 :0042AD58 7575                       jne 0042ADCF                                        <----Jump if not,bad guy jump First of all,nop that jump at :0042AD58 , like this: a 0042AD58,hit enter,type nop,enter,nop,enter,enter. Then after you nop this one,just below there&acute;s another: :0042AD5A 8B540410                 mov edx, dword ptr [esp+eax+10] :0042AD5E 8B4C046C                mov ecx, dword ptr [esp+eax+6C] :0042AD62 3BD1                          cmp edx, ecx                                            <---EDX=ECX ? :0042AD64 7569                            jne 0042ADCF                                        <---Jump if not,bad guy jump Nop this one as well,just like you did with a the above one. Note:If you want to make this permanent,you must search for bytes in hexeditor and patch it. Now goto Help,Register AreaEditor,enter your name,and any code,and it will be registered. Job done.

Final notes...

Greetz and thanx: McCodEMaN,Bjanes,The Sandman,CrackZ,+ORC,Jeff,Eternal Bliss.....and all otherz....

Disclaimer...

This tutorial is written for EDUCATIONAL purposes only. So if you want to use the program after its trial period ends please BUY IT! Support shareware(and its authors), this is our learning tool!   ReFleXZ is not responsibile for any damage caused with this essay or any of its parts. So everything what you're doing and 'experimenting' is on your own responsibile!   Also, in this tutorial you'll not find any serial numbers, so try to search elsewhere under Cracks and Warez.