Nag Removal And Hex Editing
Please Read The Disclaimer
This essay will give you some insight on removing annoying nag screens. Since the program is so easy to reverse, I threw in a little hex editing just for fun.
Prepare To Crack:
Upon running the program, and testing all options, I found that there are no disabled functions in the unregistered version. There is also no screen to enter a registration. The only limitation is the annoying nag message box that follows:
Making The Crack:
To remove this nag, disassemble WinDAC32.exe with Wdasm ("Disassembler", "Open File To Disassemble") then choose WinDAC32.exe.
For a nag type such as
this, there is a very simple way with which you can find exactly where
the routine is in Wdasm. Choose "Debug" then "Load Process" once
the program is disassembled. When the program is finished loading,
press the "Run" button on the code screen. As soon as the nag
box pops up in WinDAC, press the "Step Into" button on the code screen.
You are now directly in the routine where the nag box is called, so
press "Terminate" to get back to Wdasm, and you should be here:
Now scroll up a bit.
Let's look for the spot where the program checks to see if it's registered,
and then jumps. You'll find this code here:
We'll need to patch the jump so that we jump to registered status (nag screen won't show). To do this, first you need to find the location where we will be set to registered status. You'll find this at line ":00432AF2 6A01 push 00000001". highlight the line "je 00432ACC" and get the offset from below (should be 00031EC7h (31EC7)). Now do as follows:
1. If you haven't already,
create a copy of the program in a different directory.
Now run WinDAC, and the
nag is gone! Since this crack is so simple, let's have some fun.
Click on the question mark to show the "About" screen. Down at
the bottom, you'll see the following:
Just for the fun of it, let's change this so it says "Cracked" and then your name. (Note: the link won't work after this, but your name will still be able to be highlighted if you choose). Mine looks like this:
For simple text editing, I use a simple hex editor, HEDIT, but any editor will work. After searching for the location we need to edit, you'll find it at address 000661C0. Now you just need to change the original text to your new text. Below are what my original and edited looked like:
Hex editing text can be rather difficult, as you usually cannot go over, or under the amount of original characters. It just takes some trial and error, as well as a little luck (like mine!).
Copyright © 1998 Volatility And The Immortal Descendants. All Rights Reserved.