January 2000

Netscape annoyances

Windows Reversing 

 

by Amante4 

 

 

Code Reversing For Beginners 

   

Published by Tsehp

  Program Details Program Name: Netscape Navigator Program Type: Browser Program Location: [ here ] Program Size: Too big

 
 

   Tools Required:

Hexeditor- I use Ultraedit

 

Rating

Easy ( X )  Medium (   )  Hard (   )  Pro (   ) 

There is a crack, a crack in everything. That's how the light gets in.

   


  Destroying Netscape annoyances Written by Amante4  
 
 

Introduction

With all the comercial advertising going on lately there's one thing about all current Netscape browsers that really annoys me. Whenever I open the messenger (mail tool) portion of Netscape it automatically downloads some annonying page from netscape in the bottom most window. This really sucks and not to mention hogs bandwidth for no good reason. The purpose of this essay is to show how I put a stop to it. Included is some C code I wrote to "fix" this problem on any version of Netscape.

The Essay 

Try it. Just open any version of Netscape (probably needs to be 4.? or greater) and go to Communicator->Messenger. Notice the page it downloads in the window. Now before clicking on anything goto View->Page Source. You'll see that this page comes from http://messenger.netscape.com/bookmark/4_5/messengerstart.html . Grep for this in the netscape directory and you'll find it in a file called resdll.dll. Here's a snippet of the text from the file:

pref("mailnews.start_page.url", "http://messenger.netscape.com/bookmark/4_5/messengerstart.html"); <------ The page in question
pref("mailnews.start_page.enabled", true); <------ A flag to enable or disable this page from loading

Try using your hexeditor to change the true to a false (yes you can do it because there is a space between the , and the t in true). So now your line should look like this:

pref("mailnews.start_page.enabled",false); <------ Notice no space between , and f in false

Restart Netscape and Cool!!!! the page no longer loads. Free at last :)

Although this is simple, new versions of Netscape are produced pretty fast and I'd get tired of manually editing this each time I got a new version. So I wrote a little C program to do the fixing for you. Here's the C code netscape_patch.c:

#include <stdio.h>
#include <fcntl.h>
#include <io.h>
#include <windows.h>

void main() {
    // local variables
    unsigned char* install_directory; // the key value
    unsigned long value_length; // the length of the key
    char *target_file;
    long ret_value=0;
    HKEY hKey, hSubKey;
    int find_and_patch_file(char *);



        // update the status window
        printf("Attempting to locate netscape install directory...\n");
        SleepEx(1000,FALSE);


        // try to open the registry key
        ret_value = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
            "Software",
                            0,
                            KEY_QUERY_VALUE,
                            &hKey
                            );
        ret_value = RegOpenKeyEx(hKey,
            "Microsoft",
                            0,
                            KEY_QUERY_VALUE,
                            &hSubKey
                            );
        hKey = hSubKey;

        ret_value = RegOpenKeyEx(hKey,
            "Windows",
                            0,
                            KEY_QUERY_VALUE,
                            &hSubKey
                            );
        hKey = hSubKey;

        ret_value = RegOpenKeyEx(hKey,
            "CurrentVersion",
                            0,
                            KEY_QUERY_VALUE,
                            &hSubKey
                            );
        hKey = hSubKey;

        ret_value = RegOpenKeyEx(hKey,
            "App Paths",
                            0,
                            KEY_QUERY_VALUE,
                            &hSubKey
                            );
        hKey = hSubKey;

        ret_value = RegOpenKeyEx(hKey,
            "Netscape.exe",
                            0,
                            KEY_QUERY_VALUE,
                            &hSubKey
                            );
        hKey = hSubKey;



        if (ret_value != ERROR_SUCCESS) { // if there's an error
            printf("Unable to find a valid Netscape installation.\n");
        }

        else {


            // first query value to get size of value
            ret_value = RegQueryValueEx(hKey,
            "Path",
                                    NULL,
                                    NULL,
                                    NULL,
                                    &value_length
                                    );

            install_directory = (unsigned char*)malloc(value_length);
            target_file = (char*)malloc(value_length+15); // add some for our filename

            ret_value = RegQueryValueEx(hKey,
                "Path",
                                        NULL,
                                        NULL,
                                        install_directory,
                                        &value_length
                                        );
            if (ret_value != ERROR_SUCCESS) {
                    printf("Unable to get installation path.\n");
            }
            else {
                printf("Found Netscape installation.\n");
                SleepEx(1000,FALSE);

                target_file = install_directory; // convert to CString

                strcat(target_file,"\\resdll.dll");

                printf("Opening file %s\n",target_file);
                SleepEx(1000,FALSE);

                find_and_patch_file(target_file); // call the function to find the code and patch it


            }
        }
}

int find_and_patch_file(char *file)
{
    int file_handle;
    char* filename;

    // the code signature to look for in file
    unsigned char code_sig[35] = { 0x70, 0x72, 0x65, 0x66, 0x28, 0x22, 0x6d, 0x61, 0x69,
                0x6c, 0x6e, 0x65, 0x77, 0x73, 0x2e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f,
                0x70, 0x61, 0x67, 0x65, 0x2e, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
                0x22, 0x2c }; // pref("mailnews.start_page.enabled",
    unsigned char patch_bytes[5] = { 0x66, 0x61, 0x6c, 0x73, 0x65 }; // "false"
    int index = 0; // the index into the code_sig array
    unsigned char read_byte; // a 1 byte buffer

    // open the file

    if ((file_handle = open(file, O_RDWR | O_BINARY)) == -1) {
        printf("Error: Can't open file. Please make sure Netscape is closed.\n");
        return (0); // failure
    }


    printf("Finding Code Signature\n");
    SleepEx(1000,FALSE);

    while (file_handle != (int)NULL) {


        // we've read the entire string from file
        if (index == 35) {
            printf("Found Code Signature\n");
            SleepEx(1000,FALSE);

            printf("Patching file\n");
            SleepEx(1000,FALSE);

            write(file_handle, &patch_bytes, 5); // patch the file

            printf("Done.\n");
            SleepEx(1000,FALSE);


            return (1); // success
        }



        read(file_handle, &read_byte, 1); // read a byte from the file

        if (read_byte == code_sig[index]) {
            ++index;
        }
        else {
            index = 0; // reset index if ever a mismatch
        }

    }
    printf("Error: Code Signature Not Found.\n");
    return (0); // fail
}

 


 

Final Notes 

This file resdll.dll seems to contain default settings for many things in Netscape. The crack was simple but the program will allieviate any manual editing on future versions of Netscape. Hope this is helpful.


Job Done.

Amante4

Ob Duh 

 
Do I really have to remind you all that by buying and NOT stealing the software you use will ensure that these software houses will continue to produce even *better* software for us to use and more importantly, to continue offering even more challenges to breaking their often weak protection systems.

If your looking for cracks or serial numbers from these pages then your wasting your time, try searching elsewhere on the Web under Warze, Cracks etc.