Web : http://kickme.to/mxbnet
Contact Me : dheeraj_xp@yahoo.com


Main | Index

Magellan Explorer 2.3

Type : Like Windows Explorer
Protection : ADware
Tech : Patching


Crack : It uses MELTICE to detect SICE.So in SICE

BPX CREATEFILEA and then run the program.Program tries to
open files .//SICE and .//NTICE to detect the presence of
SICE.

So When it opens any of these files make EAX = -1 i.e handle
to the file.

About the ADBanner shown.Delete the file ADIMAGE.DLL and start the program.
It will show missing file error box.So in SICE BPX MESSAGEBOXA and once again
start the program.Now look the main CALL above the error dialog CALL.

0x4277C6 CALL [EDX+54]
0x4277C9 TEST EAX,EAX
0x4277CB JNZ 0x4277EF >> GOOD BOY

.....
0x4594FC PUSH 0x443578 >> OEP
0x459501 RET >> DUMP HERE : USE 'JMP EIP' HERE TO
FORM A INFINITE LOOP AND COME OUT
OF SICE.THEN DUMP FULL PROCESS.THEN
OPEN DUMPEDFILE IN HEX EDITOR AND
CHANGE 'JMP EIP' TO 'RET'.

Change the entry point of the dumped program file.


= 0x3F2E0 > 0x13BA0
S/N = 258784 i.e in decimal of 0x3F2E0


BE DIFFERENT
xxxxxxxxx JMP xxxxxxxx =========>> IN YOU COMPUTER AS IT USES
............................... =========>> DYNAMIC LOADING....
================= ******BE CARE FULL
=====SMC STUFF=== ******
=================
0x5627CA MOV AX,0004 | 66 B8 04 00 ===>> WHEN YOU REACH HERE RAISE EXCEPTION i.e

CHANGE 66 B8 ==>> 00 00 - THIS WILL RAISE AN EXCEPTION ...AND PROGRAM WILL NOT
DETECT SICE.

Now finding S/N for this program is realy simple.Enter any fake S/N and in SICE
BPX HMEMCPY ....trace ...

0x490CF8 CALL 4A72DC ==> MAIN CHECK
0x490CFD TEST AL,AL
0x490CFF JZ 490D6C

INSIDE CALL 4A72DC ...

0x4A75AE MOV EDX,[EBP-10] ==>> REAL S/N
0x4A75B1 MOV EAX,[EBP-08] ==>> FAKE S/N
0x4A75B4 CALL 403ECC
0x4A75B9 SETZ BL ===> FLAG SET

Registration Info :

Name = DHEERAJ
S/N = 556858-416753758-PP
LIC = SITE LIC


MPOP.TTY"