Web
: http://kickme.to/mxbnet
Contact Me : dheeraj_xp@yahoo.com
Ultra Edit 8.0 a
Type : Multi Editor
Protection : Key File
Tech : Serial Fishing
Crack : This program is using key file protection.So when we
enter any registration details it is stored in file "Uedit32.reg".
When the program is restarted it will open this fill and check
registration details.This is an encrypted file.
So enter some fake values and restart the program.
In SICE BPX CREATEFILEA ... when we pop in to SICE type "d *(ESP+4)"
in SICE as command to see which file is opened ...
When registration file is opened ... trace...we can see the registration
string being read and decrypted .... now comes the trick.If we go on
tracing from here we will not reach any where :(
We must use BPR xxxxxxxx xxxxxxxx on the decrypted string,
which is copied in to another memory location.
We will break in to main check :
0x4112AE AND BYTE PTR [EBP-79],00
0x4112B2 MOV BYTE PTR [EBP-89],30
0x4112B9 MOV BYTE PTR [EBP-84],30
0x4112C0 MOV BYTE PTR [EBP-7A],30
0x4112C4 MOV BYTE PTR [EBP-C4],30
0x4112CB MOV BYTE PTR [EBP-BA],30
0x4112D2 CALL 48B3C0 >> FIRST CHECK
....................
0x4112DA TEST EAX,EAX >> IF EAX = 0 : PROGRAM IS REGISTERED
0x4112DC JNZ 411301 >> BAD BOY
....................
.................... >> SIMILAR ONE OR TWO CHECK
....................
0x411317 LEA EAX,[EBP-00D0] >> REAL S/N
0x41131D PUSH EAX
0x41131E LEA EAX,[EBP-0090] >> FAKE S/N
0x411325 CALL 48B3C0 >> ANOTHER CHECK
....................
0x41132B TEST EAX,EAX
0x41132E JZ 411340 >> GOOD BOY
May be program is using many set of S/N ... that is why registration details
is checked
many times.
Our S/N seems to be working ... but after some days the program is self deleting
registration file "Uedit32.reg" ... why ??? is it a protection or
bug ...
Registration Info :
Name = DHEERAJ
S/N = U5T4T-M0P4V-07Z2I-C1P00