The Intro

This document will hopefully serve as some use for people who are familiar with using Soft-Ice, and know what a nag screen is. Basic knowledge of assembly language is of great advantage.
The program I'm going to use as an example is called Info Pro v1.0, a diagnostic program by Eastern Digital LTD. It's available from http://www.sorostm.ro/edc

Some generic nag screen information

First off, we need to decide what type of nag screen it is. Is it a dialog box? Is it a message box? Or is it something else? Well, we can usually work it out by taking a look at the style of the nag screen. If it's CLOSE button in the top right is blanked out, then a point goes in favour of MessageBox. If not, then DialogBox. If no buttons at all, then you're gonna have to do some more investigating. Next trait to look for is the buttons it has for you to select. Common buttons for MessageBoxes are Yes, No, Ok, Cancel, Retry, Abort etc... These are built into Windows so if they're on the nag screen, then notch a few more points up for MessageBox. If the programmer has used names like "Cool!" or "No way!" or similar, then a) s/he's from California and b) Its definately not a MessageBox. Other features to look for is any icons that they use. Again, Windows has standard icons for MessageBoxes, these include :
          and a few other similar icons. You've probably seen them loads of times ;-) If you see these, then even more reason to suspect a MessageBox.

So...to Info Pro then....

Ok, by now you should have run the program and seen the nag screen. Or should I say nag screens. There's one on start up of the program, and one when you're exitining. Using the above information, you should be able to work out that the nag screen is a MessageBox. We know that InfoPro is a 32bit program, therefore we need to place a breakpoint (bpx) on 'MessageBoxA'. So go do that now! Right, you're back :)
Run the program, and it'll break. Press F12 to return the calling function and you'll be presented with the nag screen. Just click YES because we do want to run the program. Boom! You're now back in Soft-Ice. Press F12 again to take us to the function that's responsible for this nag screen. If all's going to plan, then you'll appear just after the CALL statement. This is what we want to get rid of. So for now, disable your breakpoints in Soft-Ice and place a new one on the CALL statement (just move up to it and press F9). Run your program and exit it. Whats this?!?! It's stopped on your breakpoint when its exiting the program to! Right, now we can kill two birds with one stone :-) Just bypass this for now and run the program yet again. OK, so its broken on the CALL statement. Now we know this is where the nags being called, so we want to "fix" the program so that the nag is bypassed. There are numerous ways of doing this, but the one I'm going to use for this example is the blatant use of the NOP. NOP meaning No OPeration for those not up to speed on their assembly ;-)
About now you might be asking, "But how do I use this NOP thing?" Well the answer is relatively easy. Make sure that the CALL statement is the current line of code being executed and type 'A [return]' in the bottom window. This will let you alter the code, and type in the new assembly code. How many NOPs do we need? Well, NOPs take up one byte in memory and the CALL takes more than that, so we need to see when the CALL ends. You'll see it uses six bytes, so we need six NOPs. Go on then, type NOP and [Return] six times! Now press [Return] without entering anything to finish editing the code. Run the program with F5 and you'll see that no nag appears! Exit the program and again, no nag! Congratulations you've removed it! But only temporarily :(

Making the removal permanent

OK, now we want to actually remove the nag from the program, permanently. So we're gonna have to get our hands dirty with hex editors and the like.
Using Soft-Ice get back to the CALL statement we targetted as the guilty party. We want to see what this actually looks like in a file. To do this we can use the data window. So, at the CALL statement, type 'd eip'. This shows the hex representation of the data at EIP (for those without asm backgrounds, EIP points to the current code being executed). In your data window, you should see something similar to :
FF 96 90 00 00 00 C7 45 FC FF FF FF FF 89 45 EC
Write this down and keep it safe, you're going to need it. So what do we need to change this to? Well, change it to NOP's as above and it should now read :
90 90 90 90 90 90 C7 45 FC FF FF FF FF 89 45 EC
So we need to change the first 6 bytes to 90 (hex) or 144 (decimal).
Now just exit the program and disable you're breakpoints. In your favourite hex editor search for the string of hex above in the file IP.EXE. How did I know IP.EXE? Well, Soft-Ice tells you what program you're currently in, at the bottom of the screen ;-) You may think this is obvious for Info Pro, and well, it is. But this is useful to note because other programs may not be as blantant and use DLL files or other sneaky tactics.
Anyway, if you're using the same version of Info Pro as me, v1.0 (IP is 713,728 bytes), then the above hex will have been found at offset 308380. Now just change the first six bytes to 90 or 144 depending on your hex editor. And save it. Hope you made a backup? ;-)

Run your program now, and you'll not see a nag screen! Well done! You removed it! I dunno how you managed to follow my instructions! But you did!

The Finish

Well, you finally did it. You removed a nag screen. This example can be applied to many different programs, though it's not that often you'll be gifted with the program using the same routine for two nags :-)

<copout>
No time to put any thanks, too many people. But you know who you are ;-)
</copout>

Ok, so perhaps one thank is in order. Trancer.. Thank you for testing this document for me.