Copernic 4.1 reversing  If Unregistered then ads	Anti Advertisement
1/1/2000	by Tsehp
	Courtesy of Fravia's page of reverse engineering	slightly edited by Tsehp
	There is a crack, a crack in everything That's how the light gets in
Rating	(x)Beginner (x)Intermediate ( )Advanced ( )Expert

Lets end all of this...

Copernic 4.1 reversing
 If Unregistered then ads
Written by Tsehp

Introduction

Almost everybody knows this application, it's a meta search engines that uses all the 
most current search engines. It's the most used, so like m$, they use their almost 
monopolistic situation and transform your computer into a mall. Without asking you
if they are authorised to.

Just try this : download the copernic 2000 pro version 4.0 (it will self update to 4.1)
Use a regular, non burned serial (a lot of keygens exists), at first launch, it shows no
ads and everything is working fine. But this tool is auto updating to have the last
links to search engines, and when it does it shows you at the next searches beautiful
banners at the top of your screen. Off course you bought it and you can disable the
ads : tools,options,uncheck display ads while searching. But at the next update (almost
every day) it will self check this option and show you again the ads, so they are sure
you will see at least one. You'll be bored to uncheck this option everytime and will
give up, covered by ads.

Off course there is a crack to destroy all this devious work, you still have the right
to control what's happen inside your pc. I will just show you this easy crack.  

Crack is made on my actual win 2000 build 2195.3

The first step is not to hurry on softices bpx, use zen cracking and think :

There is a feature to remove the ads, so this prog keeps a flag for it, inside a file or
the registry.
Use regmon and check and uncheck the display ads option, bingo it's inside the registry
at HKEY_CURRENT_USER\Software\Copernic Technologies\Copernic4Plus\Preferences\showad

If this key contains ffffffff, copernic will show them, if contains 00000000 it will
not.

You can delete also this key, the ad banners will be gone.

But at the next links update, this f****** key appears again.

Fire softice, bpx regqueryvalueExa do "d esp->8"

Update a search

until showad is visible in data section.

Do several p rets until you land here :

CODE:0056EA46                 call    sub_0_464E68
CODE:0056EA4B                 test    al, al      <-land here
CODE:0056EA4D                 jz      loc_0_56EB06 
CODE:0056EA53                 call    sub_0_46F6E8
CODE:0056EA58                 test    al, al
CODE:0056EA5A                 jnz     loc_0_56EB06
CODE:0056EA60                 cmp     ds:byte_0_599878, 0
CODE:0056EA67                 jnz     loc_0_56EB06
CODE:0056EA6D                 mov     eax, ds:dword_0_5998B0
CODE:0056EA72                 cmp     byte ptr [eax+0Ch], 0
CODE:0056EA76                 jz      short loc_0_56EAA0

The call 464e68 checks for the showad key, created if your serial is not registered into their
server, then al contains 1 if so, the jz to 56eb06 is not taken and it shows the ads.

If you force the jz to jump, the ads will never be showed.

I usually say, this is for learning purposes...blah blah...buy this prog...but not

this time. Those guys takes your money and split on your face with the banner

autoshow feature. So I encourage you to create the patch and spread it with the

keygen, until those guys remove the feature on the next version. 

homepage links search_forms +ORC how to protect academy database
reality cracking how to search javascript wars
tools anonymity academy cocktails antismut CGI-scripts mail_Fravia
Is reverse engineering legal?

SPACE=0 HSPACE=0>mail_Fravia
Is reverse engineering legal?