Acid_Cool_178
presents he's

#2  Tutorial

 

Athour Information
E-mail acid_cool_178@hotmail.com
Age 17
Web Page http://acidcool.cjb.net/
Member in Hellforge Flying Horse Cracking Force
Groups Web Page Hellforge Login FHCF Login

 

Program Infromation
Name Ultra Edit 7.00A
Uedit32.exe
Where to Downlaod HTTP://WWW.ULTRAEDIT.COM
Size 1.70MB Installed on my HDD
What kind of a program Crackme Shareware
     
Skill Easy Not so easy Hard X-pert
         
Tools Used W32Dasm
Hiew		 Download it here
Before We Start

I must say that my english sux bigtime and this are my seccond text for hellforge.

Information about the protection

When you start the program a NSG til pop up and you have to choose "enter reg" code and write in you name and code. When you click on OK button a MsgBox wil pop and say that you have to exit the program before it will compare your code. Well, just click on OK there and start the programam again. Now you shoud see the same NAG with that eneter code" button if your code are worng and the NAG will be in wonderland if the code are correct..

The Process

I did fire up W32Dasm and take a search at "String Data Reference" until i coud see this "Reg" and doubble clickked on it three times. And now i will land here,

* Possible StringData Ref from Data Obj ->"REG"
|
:0043D62B 68CCDF4D00 push 004DDFCC

This are not the intressed part for me but if you will scroll up so you can se this code

* Reference To: USER32.CreateWindowExA, Ord:0059h
|
:0043D5AF FF1528B74B00 Call dword ptr [004BB728]
:0043D5B5 A3E8834E00 mov dword ptr [004E83E8], eax
:0043D5BA 8D8796020000 lea eax, dword ptr [edi+00000296]
:0043D5C0 885810 mov byte ptr [eax+10], bl
:0043D5C3 FF3520694E00 push dword ptr [004E6920]
:0043D5C9 6A01 push 00000001
:0043D5CB 50 push eax
:0043D5CC FF75F0 push [ebp-10]
:0043D5CF E8B111FDFF call 0040E785        <-- Offset 3D5CF Need to ne NOP'ed :)
:0043D5D4 83C410 add esp, 00000010
:0043D5D7 85C0 test eax, eax                <-- Testing Code ?
:0043D5D9 0F8489010000 je 0043D768        <-- Jump if good code
:0043D5DF 391D3C844E00 cmp dword ptr [004E843C], ebx
:0043D5E5 0F857D010000 jne 0043D768        <-- Jump is hell is here (Bad Code)

I guess that you now what to do ?

If you don't then fire up Hiew.exe and open Uedit32.exe in ASM code, GoTo 3D5CF and nop it 5 times, update the file and exit. run Ultra Edit and the NAG ere in Wonderland :)

Ending

I guess that this text don't have the feeling in code explanation. well, thats bacause i can't say so much on the code to you, i don't understand it myselfh.

Greetings

LaZaRuS, Wajid, Borna Janes, ManKind, Eddie Van Camper, ACiD BuRN, KoRnFLeX, Eternal_Bliss