Main | Index

Black Magic v2.1 Rel 2.6T

Type : Excelent Image processor ... convert Black&White photos to Color photos ..
Protection : Serial
Tech : Patching

Note : Ready made crack and program is available with me if you want please mail me :)

dw link : http://www.timebrush.com/dl/he/2.1/2.3.3/bm21he_trial.zip

Company Info : http://www.timebrush.com

Crack : This program is made using Delphi ... so it makes it hard to crack.No more API Calls and no more direct flag jumps. Here we have to deal with forms.Thanks goes to DaFixer for his Delphi Decompiler "DeDe".I was unable to crack BlackMgk completely ... but got a working edition.Following have been cracked ...

1. 30 Day expire
2. Timer which remind to register
3. Most important part ...is the logo which this program put when we save the file...this protection have been brutaly trashed :)

Use Limit and Nag was very easy to crack.But ... the last part was very hard.I could not find a valid GDI call which puts their Logo when we save image..An idea came in to my mind after 3 days of countinous try... why not to find their logo in resource section of exe file and delete it ? ....
So i used Borland Resource Editor and removed some suspicious resource Timage in .. Form 1....but program failed to work....man this is becoming hard..Another idea came to my mind why don't corrupt Timage section instead of removing it ..... it worked and a crack is born.

Use Limit chk
*************

0049233C MOV BYTE PTR[0049B03C],01 = C6 05 3C B0 49 00 01-OFF = 91742
00492343 RET = C3
00492344 MOV BYTE PTR[0049B03C],01 = C6 05 3C B0 49 00 01-OFF = 9174A
0049234B RET = C3

Make "01" --> "00"

Reg Nag Box
***********

BPMB 49B03C RW ...

00494A7 CMP BYTE PTR[EAX+44],00
00494AB JNZ 004904B9 = 75 0C OFF = 8F8AB -- GOOD BOY

Make JNZ 75 -- JMP EB

TForm1
******
Timer1
------
00491B53 80784400 cmp byte ptr [eax+$44], $00
00491B57 751E jnz 00491B77
00491B59 803D3AB0490000 cmp byte ptr [$49B03A], $00
00491B60 7515 jnz 00491B77 = off:90F60-->EB

Timer2
------
00491C76 80784400 cmp byte ptr [eax+$44], $00
00491C7A 0F8565010000 jnz 00491DE5 = off:9107A-->90E9

TImage
------
object Image4: TImage
Left = 328
Top = 256
Width = 348
Height = 84
AutoSize = True
Picture.Data = {TBitmap.....} ---> Fill with zero's :)
off:B1688 - B755F

Update: One Month [JUNE] use limit crack :
After one month i noticed that program refused to run.It was designed to run for june 2002.I could not find a place where the date was checked.Delphi programs are a mess ....to crack.Never mind there is always a way.API Spy shows that this program never calls win api's ...bad boy ...it is not true.API SPY fails to hook it.What we are going to do is that find out which api call is called to get system time and we are going to insert our date there.

BPX in GetLocalTime api in SICE and we reach here ...

00408A9F LEA EAX,[ESP+08]
00408AA3 PUSH EAX
00408AA4 CALL GetLocalTime
00408AA9 MOV CX,[ESP+0E] ........ DAY
00408AAE MOV DX,[ESP+0A] ........ MONTH ... MAKE = 06 JUNE
00408AB3 MOV AX,[ESP+08] ........ YEAR ... 07D2 = 2002

Patch ...

00408A9F MOV ECX,04 = B9 04 00 00 00 OFFSET = 7E9F
00408AA4 MOV EDX,06 = BA 06 00 00 00
00408AA9 MOV EAX,07D2 = B8 D2 07 00 00
00408AAE NOP = 90
............
. FILL WITH NOP = 90
.
00408AB7 NOP = 90