Tutorial for Ulead Photo Express 2.0
|Before we start, please read the Disclaimer section of this essay!
Coders from Photo Express, click here!
|The first step to crack a program is usually to
check what type of protection it has. Then we decide how we can crack that program. So,
let's have a look at the dialog box that was displayed as we've started Photo Express:
Since we have to push the "Try
More!"-Button to start the program, we call this a NAG-Screen. The next
thing we've to decide is if it's a Standard-NAG or an Advanced-NAG. Since this tutorial is
written for a Newbie, I don't think you've enough experience to decide what type of a NAG
it is; so I just wanna tell you, that NAGs are mostly no Standard-NAGs (a
dialog box with just a button like "I agree" - and a small icon and NO other
images) - like this one.
So we can crack the NAG by simply removing the
CALL to DialogBoxParamA? - Yes. So clear all Breakpoints by typing BC * and set a BPX to
the DialogBoxParamA-Line and restart Photo Express. Then type "A" in SoftICE to
assemble some instructions:
Now return to Windows (CTRL-D) and take a look at the result of your
Memory-Crack for the NAG-Screen. The NAG-Crack is nearly done, we just have to patch the
file that generated the NAG. SoftICE displayed the 'info' that we're in IPE20.EXE - as I
couldn't find this in IPE20.EXE, I decided to use the knowledge I got from other Ulead
cracks (U32CFG.DLL is *the* DLL).
So far so good. We now have to crack it's *real* protection: the 30-day-Time-Limit. Since this DialogBox looks like the first one, we can set a BPX to DialogBoxParamA. So set a BPX to DialogBoxParamA and restart Photo Express. After you've pressed F11 and then pressed the "OK"-Button, you'll get the following code:
If you compare this code snippet with the last one, you'll recognize that in code snippet 1 there are just the following instructions more:
Code snippet 1:
Then Photo Express won't expire. So set a BPX
to DialogBoxParamA in SoftICE and restart Photo Express. Press F11 and you'll get the code
of code snippet 2. Now set a BPX on the DialogBoxParam-Line and restart
MOV EAX,1 <ENTER>
SoftICE will then display the following code:
Now Photo Express will start as if it hasn't
already expired. We just have to run HIEW and search for
If you're USING Photo Express BEYOND it's FREE TRIAL PERIOD, then please BUY IT.
|Coders from Photo Express: I don't think it's that clever just to set a flag if you're in the trial period or not. I would recommend to set the flag once to fake us crackers and once to check if we're in the trial period. Also I would erase some files, etc. if the trial period is over, so that it *isn't* possible to restore the trial period. BTW, Photo Express was a so called "5-Minutez-Crack" - I hope you'll understand that I'm trying to tell you that you should improve the protection of your mostly great programs.|
Info: Brand and product names are trademarks or registered trademarks of their respective holders.
Copyright © 1998 by TORN@DO and The Immortal Descendants. All Rights Reserved.