Welcome to Flu[X] Tutor #8
Author: Flu[X]
Date: 4/22/99

MAterials Required:
SoftICE v3.xx
W32Dasm
Brain
Any program language (i choose pascal)
WinImage v5.00 (www.winimage.com)


Ok, lets begin, this tutor will teach you about keygens..no big deal..
First a few words about this program, It uses a fairly simple way of registering.
It uses multiple reg codes, 5 to be exact.. however you only need to enter any
one  of them to reg the program.  Also this program gets a constant and adds it
to the calculations from your name.  It also converts your name serial to Hexidecimal,
sortof, it actually switches the 'B' and '8' around. Interesting.. enough jibberish..

Lets go!

Note: in the RTF file version the importants stuffs are color coded and commented!!

Fire UP softice.. Set a break poing on 'hmemcpy' enter your fake name and serial
and press enter.

After some tracing we will get to this point



* Referenced by a CALL at Addresses:
|:00434713   , :004347E8   
|
:004346CD 8B442408                mov eax, dword ptr [esp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004346D7(U)
|
:004346D1 803820                  cmp byte ptr [eax], 20
:004346D4 7503                    jne 004346D9
:004346D6 40                      inc eax
:004346D7 EBF8                    jmp 004346D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004346D4(C)
|
:004346D9 50                      push eax
:004346DA FF742408                push [esp+08]

* Reference To: KERNEL32.lstrcpyA, Ord:0302h
                                  |
:004346DE FF1500694400            Call dword ptr [00446900]
:004346E4 FF742404                push [esp+04]

* Reference To: USER32.CharUpperA, Ord:002Fh   <-- Well, what have we here?if you trace though a 
                                                                                           bit you will notice it is goung to Capitalize all letters
                                                                                           in out name (as the function name suggests)
                                  |
:004346E8 FF154C694400            Call dword ptr [0044694C]
:004346EE FF742404                push [esp+04]
:004346F2 E892B2FEFF              call 0041F989
:004346F7 59                      pop ecx
:004346F8 C3                      ret


Simple.. jsut capitalizes name, nothing big here.


* Referenced by a CALL at Addresses:
|:0042EC8D   , :0042EC9F   , :004347F0   
|
:004346F9 55                      push ebp
:004346FA 8BEC                    mov ebp, esp
:004346FC 81EC04010000            sub esp, 00000104
:00434702 FF7508                  push [ebp+08]
:00434705 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:0043470B C745FC4C694700          mov [ebp-04], 0047694C
:00434712 50                      push eax
:00434713 E8B5FFFFFF              call 004346CD
:00434718 59                      pop ecx
:00434719 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:0043471F 59                      pop ecx
:00434720 50                      push eax

* Reference To: KERNEL32.lstrlenA, Ord:0308h  

^^-- Getting length of name?? this is usually a sign of a calculation
 with the name so get ready to watch for interesting stuff..

                                  |
:00434721 FF1594684400            Call dword ptr [00446894]
:00434727 33C9                    xor ecx, ecx
:00434729 894508                  mov dword ptr [ebp+08], eax
:0043472C 85C0                    test eax, eax
:0043472E 7E47                    jle 00434777
:00434730 53                      push ebx
:00434731 56                      push esi
:00434732 8DB5FCFEFFFF            lea esi, dword ptr [ebp+FFFFFEFC]
:00434738 57                      push edi
:00434739 8B7D08                  mov edi, dword ptr [ebp+08]
:0043473C 83EE03                  sub esi, 00000003

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434772(C)
|
:0043473F 8BC1                    mov eax, ecx
:00434741 6A0E                    push 0000000E
:00434743 99                      cdq
:00434744 5B                      pop ebx
:00434745 F7FB                    idiv ebx
:00434747 85D2                    test edx, edx
:00434749 7503                    jne 0043474E
:0043474B 6A27                    push 00000027 <-- initialize EDI to 27 HEX... important in
                                                                            the below function.
:0043474D 5F                      pop edi


Sure enough after some tracing we come to this.... the modifications of the name :)


* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434749(C)
|
:0043474E 0FB6540E03              movzx edx, byte ptr [esi+ecx+03]  <-- get character...
:00434753 8D4103                  lea eax, dword ptr [ecx+03]  <-- eax = position of name+3 meaning... 
                                                                                                     the current position in the string
                                                                                                    (ex. first letter second letter) +3
:00434756 0FAFD7                  imul edx, edi                        <-EDX= ascii of current character multiplied by value of EDI
:00434759 0155FC                  add dword ptr [ebp-04], edx  <- Add EDX to "constant", i will show you how to get the constant in a bit
:0043475C 6A0E                    push 0000000E
:0043475E 99                      cdq
:0043475F 5B                      pop ebx
:00434760 F7FB                    idiv ebx
:00434762 85D2                    test edx, edx           <- do stupid maths.. dont worry bout them..
:00434764 7405                    je 0043476B
:00434766 8D3C7F                  lea edi, dword ptr [edi+2*edi]  <-- EDI = EDI*3
:00434769 EB03                    jmp 0043476E    <-- just follow this

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434764(C)
|
:0043476B 6BFF07                  imul edi, 00000007    <-ignore this

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434769(U)
|
:0043476E 41                      inc ecx  <-increase position
:0043476F 3B4D08                  cmp ecx, dword ptr [ebp+08]  <- test if end of name..
:00434772 7CCB                    jl 0043473F  <- if not.. repeat.. 
:00434774 5F                      pop edi
:00434775 5E                      pop esi
:00434776 5B                      pop ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043472E(C)
|
:00434777 8B45FC                  mov eax, dword ptr [ebp-04]
:0043477A C9                      leave
:0043477B C3                      ret




Now.. simple.. EDI DOES NOT get reset to 27 HEx each loop.. instead, it tripples on
each consecutive loop.... Now how to get the constant? well if we use a 3 or 4
letter name, and write down what it adds each time then we get the total of the new
value and subtract everything that was added to it we get the constant..
pretty simple.. it jsut repeats the above until it gets to the end of your name!

How to do this? simple.. when you get to the below line.. jsut type  " ?edx " and write tis value down
00434759 0155FC                  add dword ptr [ebp-04], edx 

For those of you too lazy.. the constant is:   47694c  Hex

Now, this number generated it your first serial( not the constant, but the
result of all the maths.) with one exception.. It does its crazy switch
with the 'B' and "8" now.




* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004347D9(C)
|
:004347DE FF750C                  push [ebp+0C]
:004347E1 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:004347E7 50                      push eax
:004347E8 E8E0FEFFFF              call 004346CD
:004347ED FF7508                  push [ebp+08]
:004347F0 E804FFFFFF              call 004346F9
:004347F5 8BF8                    mov edi, eax
:004347F7 83C40C                  add esp, 0000000C
:004347FA 81FF26DDDCB8            cmp edi, B8DCDD26
:00434800 0F84FE000000            je 00434904
:00434806 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]   <-string hex value before conversion
:0043480C 50                      push eax
:0043480D 8D8500FEFFFF            lea eax, dword ptr [ebp+FFFFFE00]
:00434813 57                      push edi
:00434814 50                      push eax
:00434815 E862FFFFFF              call 0043477C              <- call 'crazy' converter
:0043481A 59                      pop ecx
:0043481B 59                      pop ecx
:0043481C 50                      push eax

* Reference To: CRTDLL.strcmp, Ord:01CFh  <- compare strings maybe.. like your fake serial and the REAL one
                                  


Ok, simple... all it does is take the value of the result of the additions to the string
and puts them into a HEX value.  Next it uses the 'crazy' call and switches the B and the 8
in hex meaning if your hex string was:

12345B  it would become  123458
and if it was 17A988  it would become 17A9BB

I will explain the crazy function in a bit.

Now i will explain the way to get the other serials.
follow below.. It is importatn to know that EDI starts off as the value of the
result of the maths with our name.

:0043481D E87E330000              Call 00437BA0
:00434822 59                      pop ecx
:00434823 85C0                    test eax, eax
:00434825 59                      pop ecx
:00434826 0F84A0000000            je 004348CC
:0043482C 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00434832 50                      push eax
:00434833 8D8748190514            lea eax, dword ptr [edi+14051948]  <- add this constant to the EDI
:00434839 50                      push eax
:0043483A 8D8500FEFFFF            lea eax, dword ptr [ebp+FFFFFE00]
:00434840 50                      push eax
:00434841 E836FFFFFF              call 0043477C   <- call the crazy funtion again..
:00434846 59                      pop ecx
:00434847 59                      pop ecx
:00434848 50                      push eax

* Reference To: CRTDLL.strcmp, Ord:01CFh  <- another string compare??
                                  |

Ok simple.. it jsuts adds a constant to the result of the maths on our name..
It then Converts the B and 8 like above by calling the crazy function again.
This process repeats for all 5 possible serials.. I wont comment the rest because they
are all similar, but i did highlight them for easy access :)



:00434849 E852330000              Call 00437BA0
:0043484E 59                      pop ecx
:0043484F 85C0                    test eax, eax
:00434851 59                      pop ecx
:00434852 7478                    je 004348CC
:00434854 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:0043485A 50                      push eax
:0043485B 8D8754190617            lea eax, dword ptr [edi+17061954]
:00434861 50                      push eax
:00434862 8D8500FEFFFF            lea eax, dword ptr [ebp+FFFFFE00]
:00434868 50                      push eax
:00434869 E80EFFFFFF              call 0043477C
:0043486E 59                      pop ecx
:0043486F 59                      pop ecx
:00434870 50                      push eax

* Reference To: CRTDLL.strcmp, Ord:01CFh
                                  |
:00434871 E82A330000              Call 00437BA0
:00434876 59                      pop ecx
:00434877 85C0                    test eax, eax
:00434879 59                      pop ecx
:0043487A 7450                    je 004348CC
:0043487C 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00434882 50                      push eax
:00434883 8D8781190510            lea eax, dword ptr [edi+10051981]
:00434889 50                      push eax
:0043488A 8D8500FEFFFF            lea eax, dword ptr [ebp+FFFFFE00]
:00434890 50                      push eax
:00434891 E8E6FEFFFF              call 0043477C
:00434896 59                      pop ecx
:00434897 59                      pop ecx
:00434898 50                      push eax

* Reference To: CRTDLL.strcmp, Ord:01CFh
                                  |
:00434899 E802330000              Call 00437BA0
:0043489E 59                      pop ecx
:0043489F 85C0                    test eax, eax
:004348A1 59                      pop ecx
:004348A2 7455                    je 004348F9
:004348A4 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:004348AA 50                      push eax
:004348AB 8D8795190104            lea eax, dword ptr [edi+04011995]
:004348B1 50                      push eax
:004348B2 8D8500FEFFFF            lea eax, dword ptr [ebp+FFFFFE00]
:004348B8 50                      push eax
:004348B9 E8BEFEFFFF              call 0043477C
:004348BE 59                      pop ecx
:004348BF 59                      pop ecx
:004348C0 50                      push eax

* Reference To: CRTDLL.strcmp, Ord:01CFh
                                  |
:004348C1 E8DA320000              Call 00437BA0
:004348C6 59                      pop ecx
:004348C7 85C0                    test eax, eax
:004348C9 59                      pop ecx
:004348CA 7505                    jne 004348D1




Pretty Simple Eh??
Now the below code is my so called 'Crazy funtion'

Basically, this function moves the HEX value into a string and compares the
characters one by one to B or 8, nad if found switches them.



* Referenced by a CALL at Addresses:
|:00434815   , :00434841   , :00434869   , :00434891   , :004348B9   
|:004348E6   
|
:0043477C 55                      push ebp
:0043477D 8BEC                    mov ebp, esp
:0043477F 83EC10                  sub esp, 00000010
:00434782 56                      push esi
:00434783 8B7508                  mov esi, dword ptr [ebp+08]
:00434786 FF750C                  push [ebp+0C]
:00434789 8D45F0                  lea eax, dword ptr [ebp-10]

* Possible StringData Ref from Data Obj ->"%lX"
                                  |
:0043478C 68E0274400              push 004427E0
:00434791 50                      push eax

* Reference To: USER32.wsprintfA, Ord:02ACh
                                  |
:00434792 FF15FC6A4400            Call dword ptr [00446AFC]
:00434798 8A45F0                  mov al, byte ptr [ebp-10]  <-load first character into AL
:0043479B 83C40C                  add esp, 0000000C
:0043479E 84C0                    test al, al
:004347A0 741E                    je 004347C0
:004347A2 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004347A5 2BCE                    sub ecx, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004347BE(C)
|
:004347A7 3C38                    cmp al, 38  <- compare AL to '8'
:004347A9 7504                    jne 004347AF  <- if not 8 continue
:004347AB 040A                    add al, 0A  <- if it is 8 Convert it to B and follow next jump
:004347AD EB06                    jmp 004347B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004347A9(C)
|
:004347AF 3C42                    cmp al, 42   <-compare to B
:004347B1 7502                    jne 004347B5 <-if it isnt B continue
:004347B3 04F6                    add al, F6  <- if it is B convert to 8 by adding F6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004347AD(U), :004347B1(C)
|
:004347B5 8806                    mov byte ptr [esi], al  <- move modified character over old character in string
:004347B7 8A443101                mov al, byte ptr [ecx+esi+01]  <- Get next character
:004347BB 46                      inc esi   <-increase position marker
:004347BC 84C0                    test al, al    <- test for end of string..
:004347BE 75E7                    jne 004347A7  <- if more characters, loop back

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004347A0(C)
|
:004347C0 802600                  and byte ptr [esi], 00
:004347C3 8B4508                  mov eax, dword ptr [ebp+08]
:004347C6 5E                      pop esi
:004347C7 C9                      leave
:004347C8 C3                      ret





Ok, i hope you can put this all together.. I will also include my source code for my keygen below.
Yeah im a terribel programmer.. but it works! BTW, I only did 3 of the five serials.. can you do the other two?


===Begin Source Code===



var
 name:string;
 secondc,py,pos:integer;
 total,z,eax,edx,ebx,ecx,edi,nextedi:longint;



begin


 writeln('WinImage V5.00.5000 Keygen');
 writeln('Flu[X]/IDIV');
 writeln('4/22/99');
 writeln(' ');
 write('Enter Name :');
 readln(name);


 pos:=1;
 total:=$47694c;
 eax:=0;
 edx:=0;
 ecx:=0;
 edi:=$27;


  while pos <= length(name) do {all caps}
  begin

  z:= ord(name[pos]);
  secondc:=ord(name[pos]);
   if ord(name[pos]) > 96 then
    begin
     if ord(name[pos]) <= 122 then
      begin
       name[pos] := chr(ord(name[pos]) - 32);

      end;
    end;
    pos:=pos+1;
   end;
  pos:=1;




 while pos <= length(name) do
 begin
   edx:=ord(name[pos]);
   eax:=3+pos;
   edx:=edx*edi;
   total:=total+edx;
   edi:=edi*3;
   pos:=pos+1;
 end;
 Write('Registration Key 1: ');

 eax:=total;
 py:=0;
 while eax>=268435456 do
   begin
    eax:=eax-268435456;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=16777216 do
   begin
    eax:=eax-16777216;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;


   while eax>=1048576 do
   begin
    eax:=eax-1048576;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=65536 do
   begin
    eax:=eax-65536;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=4096 do
   begin
    eax:=eax-4096;
    ecx:=ecx+1;
   end;
   if ecx =0 then write('0');
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=256 do
   begin
    eax:=eax-256;
    ecx:=ecx+1;
   end;
   if ecx =0 then write('0');
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=16 do
   begin
    eax:=eax-16;
    ecx:=ecx+1;
   end;
   if ecx =0 then write('0');
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   if eax =0 then write('0');
   if eax =1 then write('1');
   if eax =2 then write('2');
   if eax =3 then write('3');
   if eax =4 then write('4');
   if eax =5 then write('5');
   if eax =6 then write('6');
   if eax =7 then write('7');
   if eax =8 then write('B');
   if eax =9 then write('9');
   if eax =10 then write('A');
   if eax =11 then write('8');
   if eax =12 then write('C');
   if eax =13 then write('D');
   if eax =14 then write('E');
   if eax =15 then write('F');
   writeln('');




   write('Registration Key 2: ');
   pos:=1;
   edi:=$27;
   eax:=total;
   eax:=eax+$14051948;
 py:=0;
 while eax>=268435456 do
   begin
    eax:=eax-268435456;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=16777216 do
   begin
    eax:=eax-16777216;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;


   while eax>=1048576 do
   begin
    eax:=eax-1048576;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=65536 do
   begin
    eax:=eax-65536;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=4096 do
   begin
    eax:=eax-4096;
    ecx:=ecx+1;
   end;
   if ecx =0 then write('0');
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=256 do
   begin
    eax:=eax-256;
    ecx:=ecx+1;
   end;
   if ecx =0 then write('0');
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=16 do
   begin
    eax:=eax-16;
    ecx:=ecx+1;
   end;
   if ecx =0 then write('0');
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   if eax =0 then writeln('0');
   if eax =1 then writeln('1');
   if eax =2 then writeln('2');
   if eax =3 then writeln('3');
   if eax =4 then writeln('4');
   if eax =5 then writeln('5');
   if eax =6 then writeln('6');
   if eax =7 then writeln('7');
   if eax =8 then writeln('B');
   if eax =9 then writeln('9');
   if eax =10 then writeln('A');
   if eax =11 then writeln('8');
   if eax =12 then writeln('C');
   if eax =13 then writeln('D');
   if eax =14 then writeln('E');
   if eax =15 then writeln('F');



   write('Registration Key 3: ');
   pos:=1;
   edi:=$27;
   eax:=total;
   eax:=eax+$17061954;
 py:=0;
 while eax>=268435456 do
   begin
    eax:=eax-268435456;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=16777216 do
   begin
    eax:=eax-16777216;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;


   while eax>=1048576 do
   begin
    eax:=eax-1048576;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=65536 do
   begin
    eax:=eax-65536;
    ecx:=ecx+1;
    py:=1;
   end;
   if py>1 then
   begin
   if ecx =0 then write('0');
   end;
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=4096 do
   begin
    eax:=eax-4096;
    ecx:=ecx+1;
   end;
   if ecx =0 then write('0');
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=256 do
   begin
    eax:=eax-256;
    ecx:=ecx+1;
   end;
   if ecx =0 then write('0');
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   while eax>=16 do
   begin
    eax:=eax-16;
    ecx:=ecx+1;
   end;
   if ecx =0 then write('0');
   if ecx =1 then write('1');
   if ecx =2 then write('2');
   if ecx =3 then write('3');
   if ecx =4 then write('4');
   if ecx =5 then write('5');
   if ecx =6 then write('6');
   if ecx =7 then write('7');
   if ecx =8 then write('B');
   if ecx =9 then write('9');
   if ecx =10 then write('A');
   if ecx =11 then write('8');
   if ecx =12 then write('C');
   if ecx =13 then write('D');
   if ecx =14 then write('E');
   if ecx =15 then write('F');
   ecx:=0;

   if eax =0 then writeln('0');
   if eax =1 then writeln('1');
   if eax =2 then writeln('2');
   if eax =3 then writeln('3');
   if eax =4 then writeln('4');
   if eax =5 then writeln('5');
   if eax =6 then writeln('6');
   if eax =7 then writeln('7');
   if eax =8 then writeln('B');
   if eax =9 then writeln('9');
   if eax =10 then writeln('A');
   if eax =11 then writeln('8');
   if eax =12 then writeln('C');
   if eax =13 then writeln('D');
   if eax =14 then writeln('E');
   if eax =15 then writeln('F');


end.



===End Source Code===



I hope to see you again in Flu[X] tutor #9
As always if you like a program buy it!  This essay is for
educational purposes ONLY! Software authors deserve your support!

Flu[X]/TNO99
http://tuts99.cjb.net
htp://tuts98m1.cjb.net
XXX@xxx.xxx
