This tutorial is coming from...

ReFleXZ '99 Url: Http://ReFleXZ99.cjb.net Email: ReFleXZ@fcmail.com

About the essay...

Written by: MiZ Date: 20th January 1999 Program name: Buzof v1.44 Program type: Win32 Program location: Here Program filename: N/A Program size: 310KB Tools required: Softice 3.2 - Debugger W32Dasm V8.9 - Disassembler Difficult level: Easy ( X )  Medium (   )  Hard (    )  Pro (    )

Introduction...

N/A

About the protection...

Type of protection: Nag/Timelimit At startup you'll get a NAG.

The Essay...

Let's see what kind of protection it has.So,fire up the program,and we see evaluation notice: a nag screen.  If you press Yes you'll get registration box to enter the reg code,but we press no and there's the main screen.Exit the program and disassenbly it.After disassembled , goto String Data References and look what fe found: String Resource ID=25211: "THIS SOFTWARE IS NOT REGISTERED" String Resource ID=25212: "%sThis is a %s product%s" String Resource ID=25213: "freeware shareware" String Resource ID=25220: "The application cannot start because the system clock is not" String Resource ID=25221: "The evaluation period for this application has expired." <--- Double click on this line String Resource ID=25222: "Expiration date: %x." String Resource ID=25224: "The password you have entered is incorrect." String Resource ID=25225: "The evaluation period for this product has expired.Please " After you double clicked on it you should be here: :004067F0 E82B010000              call 00406920 :004067F5 83C404                      add esp, 00000004 :004067F8 85C0                          test eax, eax :004067FA 750F                          jne 0040680B                          <---Good guy jump * Possible Reference to String Resource ID=25221: "The evaluation period for this application has expired."                                   | :004067FC 6885620000              push 00006285 :00406801 8D4DE4                     lea ecx, dword ptr [ebp-1C] :00406804 E86C930100              call 0041FB75 :00406809 EB29                          jmp 00406834 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:004067FA(C) | :0040680B 8D45E0                      lea eax, dword ptr [ebp-20] * Possible Reference to String Resource ID=25222: "Expiration date: %x."                                   | :0040680E 6886620000                  push 00006286 See jump at :004067FA we need to change it to jmp 0040680B so it will always jump to good guy. Make sure in W32Dasm that the line is on :004067FA and look below what offset it is (it's 5BFA),now goto your favourite hexeditor goto offset 5BFA and enter EB.Save it.Run tha Buzof again.There's no nags. But we aren't done yet. Remeber the line in String Data References:String Resource ID=25225: "The evaluation period for this product has expired.Please " , we need to check it too.So goto Data References again and double click on it. We should be here: :00409CF3 50                               push eax :00409CF4 E897F0FFFF              call 00408D90 :00409CF9 8BF0                           mov esi, eax :00409CFB 85F6                          test esi, esi :00409CFD 740E                          je 00409D0D                        <--- Good guy jump :00409CFF 6AFF                         push FFFFFFFF :00409D01 6A10                          push 00000010 * Possible Reference to String Resource ID=25225: "The evaluation period for this product has expired.Please "                                   | :00409D03 6889620000                push 00006289 :00409D08 E8D79A0100              call 004237E4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00409CFD(C) | :00409D0D 8D8C24C8000000          lea ecx, dword ptr [esp+000000C8] See we need to change the jump at line :00409CFD to jmp 00409D0D so it will never expire.Now we're done with timelimit. Make sure in W32Dasm that the line is on :00409CFD and look below what offset it is (it's 90FD),now goto your favourite hexeditor goto offset 90FD and enter EB.Save it.Run tha Buzof again.There's no nags. We stll have that nagscreen.No problems.Goto HexWorkshop(or your favourite hexeditor) and search for word Welcome(That's a caption of our nag screen).Nothing found.Ok now we know Buzof is a 32bit program so try to search for W e l c o m e in hexcode.Just search for bytes 57 00 65 00 6C 00 63 00 6F 00 6D 00 65 00 .In HexWorkshop you don't need to do this,just type in find box "welcome" and make sure that Unicode checkbox is checked and Case Sensitive unchecked.You will see something like this: 0000000000000000C000C88000000000 060000000000DE006400000000005700 65006C0063006F006D00650020007400 6F00200025007300000008004D005300 2000530061006E007300200053006500 72006900660000000000025000000000 07000700D00030008969FFFF82002500 73002000690073002000610020007300 Now we are looking for 2 FF and 82 because they only work.Found it and we need to change it to:FFFF7E Now save the file.Try to start it...hey wtf it ain't startin. Don't worry set your time few years backwards,and try to fire Buzof again...Message appears The application cannot start because the system clock.... When you press OK it exits..IT`S TIME TO BRING SOFTICE IN USE... YEAH.... OK.So press Ctrl+D to bring Softice,set breakpoint on MessageBoxA by typing bpx MessageBoxA,press Ctrl+D again to leave Softice.Now fire up Buzof and Softice breaks.Press F12,press OK,and then press F10 exactly 47 times until you're here: :00407447 8D4C2408                   lea ecx, dword ptr [esp+08] :0040744B E8F0250000               call 00409A40 :00407450 85C0                           test eax, eax                                    <--- EAX=1 then :00407452 7525                            jne 00407479                                    <---Jump to start the application :00407454 8D4C240C                  lea ecx, dword ptr [esp+0C] We need to change the jump at :00407452 to jmp 00407479 so it will always start,no matter what... Make sure in W32Dasm that the line is on :00407452 and look below what offset it is (it's 6852),now goto your favourite hexeditor goto offset 6852 and enter EB.Save it.Run the Buzof again.Press OK and application starts,but we still have the message.What now?Well disassembly Buzof again and goto String Data References ,now remember that "String Resource ID=25220: "The application cannot start because the system clock is not",double click on it,and you should be here: :00408FA0 E8290B0100              call 00419ACE :00408FA5 8BCF                         mov ecx, edi :00408FA7 E8740A0000              call 00409A20 :00408FAC 85C0                          test eax, eax :00408FAE 741E                           je 00408FCE              <---This is good guy jump,it jumps over the message :00408FB0 6AFF                           push FFFFFFFF :00408FB2 6A10                           push 00000010 * Possible Reference to String Resource ID=25220: "The application cannot start because the system clock is not"                                   | :00408FB4 6884620000               push 00006284 :00408FB9 E826A80100               call 004237E4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00408F89(C) | :00408FBE C74620FFFFFFFF          mov [esi+20], FFFFFFFF All we need to do is to change the jump at :00408FAE to jmp 00408FCE and it wont show the message anymore. Make sure in W32Dasm that the line is on :00408FAE and look below what offset it is (it's 83AE),now goto your favourite hexeditor goto offset 83AE and enter EB.Save it.Run tha Buzof again.There's no nags. Job done. By the way,most of Basta Computing Software programs can be cracked this way.

Final notes...

Greetz and thanx: McCodEMaN,Bjanes,The Sandman,CrackZ,+ORC,Jeff,Eternal Bliss.....and all otherz....

Disclaimer...

This tutorial is written for EDUCATIONAL purposes only. So if you want to use the program after its trial period ends please BUY IT! Support shareware(and its authors), this is our learning tool!   ReFleXZ is not responsibile for any damage caused with this essay or any of its parts. So everything what you're doing and 'experimenting' is on your own responsibile!   Also, in this tutorial you'll not find any serial numbers, so try to search elsewhere under Cracks and Warez.