This tutorial is coming from...

ReFleXZ '99 Url: Http://ReFleXZ99.cjb.net Email: ReFleXZ@fcmail.com

About the essay...

Written by: MiZ Date: 10th February 1999 Program name: McAfee VirusScan v4.0.1 Program type: Win32 Program location: Here Program filename: N/A Program size: 8.7 MB Tools required: Softice v3xx HexEditor Difficult level: Easy ( X )  Medium (   )  Hard (    )  Pro (    )

Introduction...

McAfee is one of the best virus scan programs available on the market.You are able to scan your mail,files,files while running,copying...It's simply great program.So if you want to use it,then please BUY it,it's worth paying.And if you want to use this essay just to save yourself from paying more money,then please GET OUT OF HERE!!!

About the protection...

Type of protection: Nags/Timelimit

The Essay...

So first off,move your time few years ahead.Press Ctrl+D to get into Softice,set breakpoint on MessageBoxA,press Ctrl+D again to get out of Softice.Start McAfee VirusScan,press Scan button,a nag appears and we have to options,either we can Purchase the software or Cancel.Press Cancel button,and ice breaks,press F12,press enter and you should be here: :0040F950 FF1500ED4300            Call [User32!MessageBoxA] :0040F956 8B0B                             mov ecx, dword ptr [ebx]                  <---You landed here :0040F958 6A00                              push 00000000 :0040F95A 6A00                              push 00000000 :0040F95C 68D3040000                 push 000004D3 :0040F961 51                                  push ecx Now scroll up a bit until you see: :0040F8EB 85C0                           test eax, eax                                         <---If EAX 0  then :0040F8ED 7410                           je 0040F8FF                                         <---Beggar off cracker :0040F8EF 837C243803               cmp dword ptr [esp+38], 00000003      <---checks again :0040F8F4 7509                            jne 0040F8FF                                       <---Beggar off cracker :0040F8F6 C7400864000000        mov [eax+08], 00000064                     <---no exit :0040F8FD EB69                           jmp 0040F968                                      <---Good guy jump Now we have to NOP th jumps at addresses :0040F8ED  and :0040F8F4,and it won't exit anymore or display message box.Next we have to remove the nag.Now set breakpoint on GetSystemTime in ice.Press again Scan button,ice breaks,now keep pressing F12 until the nag shows up,then press on Purchase button,and keep pressing F12 until you're in SCAN32 code,here: :0040F8E1 50                             push eax :0040F8E2 FFD5                        call ebp                                              <---calls the nag :0040F8E4 8B44242C                mov eax, dword ptr [esp+2C] :0040F8E8 83C418                     add esp, 00000018 :0040F8EB 85C0                         test eax, eax :0040F8ED 7410                         je 0040F8FF                                      <---remember this jump Now scroll up until you see: :0040F8A4 8BE8                             mov ebp, eax :0040F8A6 85ED                            test ebp, ebp :0040F8A8 0F84BA000000            je 0040F968                                   <---remeber this jump,good guy jump Now we need to make jump at :0040F8A8 to jump always. Next there are also nags when windows loads Vshield .So close the Vshield and  in taskbar.Now set breakpoint on MessageBoxA.Then press Vshield button in VirusScan,and then press ok,then message appears sayin' do you wnat to load VShield now,answer with Yes,now ice breaks again,press F12,press F10 until you're here: :00406130 E8FB1C0000             call 00407E30 :00406135 85C0                           test eax, eax                                          <---If EAX=0 then :00406137 740E                           je 00406147                                          <---good guy jump :0040613A E8511D0000              call 00407E90                                        <---calls the nag :0040613F 83C404                       add esp, 00000004                                  <---here you landed :00406142 E97F010000               jmp 004062C6 See that at line :00406137 there's a jump that jumps over the call to the nag,so you have to change it to jump always. We have three more left.After you've patched the SCAN32.EXE and VShwin32.EXE,when you start McAfee VirusScan Central,it detects that we manipulated the .EXE:s.So set once again that breakpoint on MessageBoxA. Start Central again,ice breaks press F12 ,press enter and you sohould be in VSCAN40 code here: :0040725E FF1510884200            Call [User32!MessageBoxA] :00407264 56                                 push esi                                      <---here we landed :00407265 FFD5                            call ebp :00407267 50                                  push eax Now scroll up until you see: :00407229 8BF0                    mov esi, eax :0040722B 85F6                    test esi, esi :0040722D 7449                    je 00407278                                        <----notice this jump jumps over the message We need to chnage this jump at :0040722D to jmp 00407278.But even after you change it,it will still exit.So it's after this jump again some check.So when you jump from jump at :0040722D,you'll jump here: :00407278 33F6                              xor esi, esi :0040727A 8B4704                         mov eax, dword ptr [edi+04] :0040727D 83C704                        add edi, 00000004 :00407280 85C0                             test eax, eax                                  <---If EAX 0 then :00407282 0F8536FFFFFF            jne 004071BE                                  <----exit :00407288 8BC6                            mov eax, esi                                   <---else continue loading program :0040728A 5F                                pop edi :0040728B 5E                                pop esi :0040728C 5D                               pop ebp :0040728D 5B                               pop ebx :0040728E 81C404010000            add esp, 00000104 :00407294 C3                                ret Now you'll have to nop this jump above as well as the test eax,eax. When you press Scan button,message appears sayin that validation code of bla bla...please reinstall. Ok,now set breakpoint on DialogBoxParamA.Click on Scan button,ice breaks,press F12,press enter,press F10 5 times and you're in SCAN32 code here: :0042A941 894C241C                    mov dword ptr [esp+1C], ecx :0042A945 897C2424                    mov dword ptr [esp+24], edi :0042A949 E8C277FEFF              call 00412110                          <---call message :0042A94E 33ED                          xor ebp, ebp Now scroll up until you see: :0042A8DB BEF88F4300              mov esi, 00438FF8 :0042A8E0 83FD01                        cmp ebp, 00000001 :0042A8E3 7575                             jne 0042A95A                        <---good guy jump Now you need to change jne to jmp and you're done. Now when you click on Schedule button it,displays a message saying that the file bla bla...please reinstall. Set again breakpoint on MessageBoxA,click on Schedule,ice breaks,press F12,press enter,and you are in Avconsol code here: :00401F3E FF15B0074200            Call [User32!MessageBoxA] :00401F44 56                                 push esi                                          <---here we landed :00401F45 FFD5                            call ebp :00401F47 50                                 push eax Now scroll up until you see: :00401E80 57                                   push edi :00401E81 BE01000000                  mov esi, 00000001 :00401E86 0F84DC000000             je 00401F68                                <---good guy jump You need to change jump at :00401E86 to jmp 00401F68 , and it will always start. The Crack: Open file SCAN32.EXE in your favourite hexeditor and search for bytes: 242C83C41885C07410 replace with 242C83C41840484048 837C2438037509 replace with 837C2438039090 85ED0F84BA000000 replace with 85EDE9BB00000090 8F430083FD017575 replace with 8F430083FD01EB75 In Vshwin32.exe: B1C000085C0740E replace with B1C000085C0EB0E In VSCAN40.EXE 8BF085F674498D44 replace with 8BF085F6EB498D44 85C00F8536FFFFFF replace with 4048404840484048 In AVCONSOL.EXE: 00000F84DC0000 replace with 0000E9DD00000090 Job done.

Final notes...

Greetz and thanx: McCodEMaN,Bjanes,The Sandman,CrackZ,+ORC,Jeff,Eternal Bliss.....and all otherz....

Disclaimer...

This tutorial is written for EDUCATIONAL purposes only. So if you want to use the program after its trial period ends please BUY IT! Support shareware(and its authors), this is our learning tool!   ReFleXZ is not responsibile for any damage caused with this essay or any of its parts. So everything what you're doing and 'experimenting' is on your own responsibile!   Also, in this tutorial you'll not find any serial numbers, so try to search elsewhere under Cracks and Warez.