Nagware Cracking NWE404's Nag
3/12/01	by Vanapaha
	Courtesy of Fravia's page of reverse engineering	slightly edited by +Tsehp
	There is a crack, a crack in everything That's how the light gets in
Rating	( )Beginner (X )Intermediate ( )Advanced ( )Expert

When you can't N0P out the nag then try this method. AFAIK it should work
almost everywhere...i haven't had much chance to test it though. Even if
it doesn't work for the nag you're cracking it's still nice to know.
As you should already know there's code behind a window accepting
user input. Many cracks are based on the obvious..simulating user input.
But what if i don't simulate the input..what if i change the way the
input it handled? For example: User clicks button 'A' i crack the code
that handles input and the code for button 'B' executes though
button 'A' is clicked. You get the idea? Good..then read on.
Imagine a nag with a 'Continue' button..that you have to click.
Imagine that i've cracked the code behind the scenes that takes
care of the user input. And i've cracked it so that when 'Continue'
button is NOT clicked the code thinks that it IS. Lol, just
another user input simulation.

First things first, get rid of the time-trial. You may do it your way but 
this is how i did it.

Set bpx GetSystemTime and start the program. It'll soon trigger...get back
to the program what you're cracking before you continue. Once you're in 
and you're as paranoid as i'm you of course check every possible call.
Let's go then...
Take the first call,the another one(not !wsprintfA) it'll be
a RegOpen. Already in registry? Get out of this call and goto the next one.
Hmm..ReqQueryValueExA..so what's it checking. Look @ eax before the call to
RegQueryValueExA. It says something about time. Could this be the time
check..? Well go on..after it has called the RegQueryValueExA you'll see

test eax,eax
jnz take_this_trip

I had set my system time one year foward before i began cracking this so it
should say expired once i reach the nag. And since eax said something about
time before and this jump wasn't jumping i checked it out. It turns out that
if you take this trip then it'll think that you're on the first day of your
evaluation period. Just patch it so that this jump executes and you've 
cracked the time trial.

Now we still got that stupid nag. Like i said before we're using the window
input handling routine to get rid of it. The nag is obviously a Dialog so
bpx DialogBoxParamA should trigger. And it does. It'll show the nag..press
continue and get inside the program you're cracking. You should land right
after the DialogBoxParamA call. Check the SDK Reference about this call.

int DialogBoxParam(

    HINSTANCE hInstance,	// handle to application instance
    LPCTSTR lpTemplateName,	// identifies dialog box template
    HWND hWndParent,	// handle to owner window
    DLGPROC lpDialogFunc,	// pointer to dialog box procedure  
    LPARAM dwInitParam 	// initialization value
   );

Note that ASM passes variables in the reverse order. So the second push is
the pointer for dialog box procedure. It's soon after the call..
Coz i'm a newbie and don't understand exactly how this stuff works i just
tried to reverse every conditional jump. It was the first JNE jump.
If you reverse that to JE jump then it'll think that the 'Continue' button
was clicked and kill the nag! At least..that's what i think it's doing,lol.

Now when you try it out and want to close the program you'll see another nag.
This is more than a simple MessageBoxA nag. I'll leave some fun for you..
If you don't read the following, lol.

Set bpx MessageBoxA ,what did you expect? Now modify the document and try 
to close the document window..SoftIce will pop up,that's ok..trace it back 
to the source.You'll see that you came out of a call. What takes 
two parameters (two pushes before that). Wonder what would happen if i 
would replace the second push with push 00? Something very 
unexcpected happend. The nag was gone..

I hope you understood what this all was about. It was about reversing 
the stuff behind the scenes..behind the obvious. Til next time..

homepage links search_forms +ORC how to protect academy database
reality cracking how to search javascript wars
tools anonymity academy cocktails antismut CGI-scripts mail_Fravia
Is reverse engineering legal?