Subject: Cracking
Target: Regview 1.21a
Author: BlackB
Date: 1999-04-05
Tools used: W32DSM89, Hex Workshop
Difficulty (scale 1-5): 1
Requirements: Basic crackin' knowledge

Hehe, this is my sixth essay or something. Felt bored today and crackin' 
didn't work out very well....So I thought: "Why not writing an essay about
a proggy I already cracked!". And here it is :-)

A few days ago I received a mail with some comment about my essays, and one
of the remarks was "to add the URL where to download the prog". And actually
he was right.....so I certainly will in my newer essays! Nopes, not in this
essay because I really don't know where the f*** (sorry for my language :p)
I downloaded the prog :-/
*sigh* Let's crack :)

30 trial uses

Well, obviously RegView is a prog for viewing the Winblows registery file 
(read: mess). I always use it when cracking, and therefore it is an 
indispensable tool.
It's "protected" with a 30-uses limit. 

When the 30 uses are exceeded, RegView displays the following message: 
"Maximum number of trials has been reached! To continue use...." etc :)
Load RegView in W32DSM and search for the string above. You should see
this above the string:

---------------------------Start-of-partial-code----------------------------

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048D830(C) <- That's where u can find a jump to this "beggar off"
|
:0048D856 6A00                    push 00000000
:0048D858 668B0DBCDB4800          mov cx, word ptr [0048DBBC]
:0048D85F B202                    mov dl, 02

* Possible StringData Ref from Code Obj ->"Maximum number of trials has been "
                                        ->"reached! To continue use of this "
                                        ->"program, you need to register "
                                        ->"now!"
----------------------------End-of-partial-code-----------------------------
 
 Okay, so the "beggar off" jump is located at :0048D830! Let's take a look:
 

---------------------------Start-of-partial-code----------------------------
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048D806(C) <- There's a jump at 48D806 that jumps to this "beggar off" 
|
:0048D816 8D55F0                  lea edx, dword ptr [ebp-10]
:0048D819 B801000000              mov eax, 00000001
:0048D81E E8BD51F7FF              call 004029E0
:0048D823 8B45F0                  mov eax, dword ptr [ebp-10]

* Possible StringData Ref from Code Obj ->"try"
                                  |
:0048D826 BAB8DB4800              mov edx, 0048DBB8
:0048D82B E83066F7FF              call 00403E60
:0048D830 7524                    jne 0048D856 <- Beggar off jump
:0048D832 B90CFFFFFF              mov ecx, FFFFFF0C

----------------------------End-of-partial-code-----------------------------

Hmmm, we're getting closer! :-) Let's take a look where this routine is 
called from...so go to 0048D806. To understand how the "protection" works
trace through the code from below to above, it'll be easier if ur a real 
newbie :p 

---------------------------Start-of-partial-code----------------------------
* Possible StringData Ref from Code Obj ->"CLSID"
                                  |
:0048D7C4 BAA8DB4800              mov edx, 0048DBA8
:0048D7C9 8B45F8                  mov eax, dword ptr [ebp-08]
:0048D7CC E85B9CFCFF              call 0045742C
:0048D7D1 8B1550D34900            mov edx, dword ptr [0049D350]
:0048D7D7 8902                    mov dword ptr [edx], eax
:0048D7D9 A150D34900              mov eax, dword ptr [0049D350]
:0048D7DE 81280BFFFFFF            sub dword ptr [eax], FFFFFF0B
:0048D7E4 A150D34900              mov eax, dword ptr [0049D350]
:0048D7E9 81387CF8FFFF            cmp dword ptr [eax], FFFFF87C

:0048D7EF 750D                    jne 0048D7FE <- if registration code in
				  registery is false then check trial uses
				  
:0048D7F1 A104D34900              mov eax, dword ptr [0049D304]
:0048D7F6 C60001                  mov byte ptr [eax], 01 <- set registered
							    flag!!		
:0048D7F9 E987020000              jmp 0048DA85

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048D7EF(C) 
|
:0048D7FE A150D34900              mov eax, dword ptr [0049D350]
:0048D803 83381E                  cmp dword ptr [eax], 0000001E <- compares
				the amount of uses to the maximum amount of
				uses.
					
:0048D806 7F0E                    jg 0048D816 <- if exceeded the 30 trial 
						uses then "beggar off"	
----------------------------End-of-partial-code-----------------------------

So, the only thing there's left is to change the "jne 0048D7FE" at 0048D7EF
in two NOP (=do nothing) instructions, so it 'll never jump to the beggar 
off routine!

If u have any questions, comments, etc... mail me on cracking@softhome.net
or BlackBir@mail.dma.be (but preferred is the first!)

U can also visit my homepage at http://myplace.to.be/blackb. It's an anti-
virus site....no cracking stuff.

Thanks goto: +ORC, tKC, Qapla and all other fantastic tutorial writers who taught me cracking! :-)

*********************************************************
*RegView rulez....The author deserves the money he asks!*
*********************************************************

BlackB