_____  ___  /_______
                              __  / / /  __/  ___/
                              _  /_/ // /_ / /__
                              _\__, / \__/ \___/

Target Info

Name       : Talking Email v1.0
URL        : http://www.4developers.com
Protection : Keyfile, Visual Basic 5, native code


This program from has a nag screen during startup. Some of it's functions
are disabled. Plus, it has a 14-day evaluation period. This program is 
written in Visual Basic 5 and compiled in native code, therefore, the 
need of using SmartCheck.

Here, I'll be using the SmartCheck + IDA approach. You will be suprised
to see how well these two tools coincides with each other, as if they 
were meant to be together. It's just so perfect that words really can't 
describe it. I'm sure all the other crackers out there will agree with 

Tools Needed

SmartCheck v6.0
Interactive Disassembler v3.76
Softice v3.24
UltraEdit v5.21

The Essay

Let's begin by making a backup copy of your target, TalkMail.exe. Next,
use IDA and disassemble the target. You *MUST* read Mammon_'s intro to 
this great tool first to know about what settings to choose when you 
load the program. You should refer to Mammon's IDA primer to learn how 
to configure IDA to get the best results to your own liking. While IDA
is running, let's have a look at SmartCheck.

Fire up SmartCheck and load the exe file. Play around with the settings 
to see what is it for until you find one which suits yourself. Here's 
how mine looks like. Under Error Detection tab, I checked everything. 
In Advanced... settings, check Suppress system API and OLE calls and 
Report errors only once. Under Reporting tab, everything is checked 
except for Report MouseMove events from OCX controls. All other tabs 
are left alone. The others are up to you to choose. Then Start the 
program and you will see that the window on your right hand side with 
have lots of things going on. After the program has loaded, quit it 
and we'll have a look at the things discovered by SmartCheck. Before 
doing that, go to View 
and choose Show All Events. Also check on Arguments and Seqence Numbers. 
You will see most of the things happening inside that program, with the 
number events.

Now, look through the listing. With the names given, you should be able 
to easily identify what are the functions for. For example, take a look 
at event number 9, frmMain (Form) created, on the left pane. Make sure 
the blue bar is on it. Then look at the right pane. On top of it, you 
should be able to see MSVBVM50.DLL!00028FAD. This means that the frmMain 
function, which creates the main form, is created in the MSVBVM50.DLL 
at address 00028FAD. Let's take a look at another example, this time, 
a function which happens in our target.

At line 50 in SmartCheck (maybe you will get a different number), the 
function is frmMain_Load. Looking on the right pane, you will see that 
this function starts at line 00014A10 in TalkMail.exe. Lets see if it 
is correct (it is correct, I assure you). Go back to IDA. It might still 
be in THINKING mode, but don't worry, you still can explore your dead 
listing of the target. Press G and key in 414A10. Hey, what's this?? 
Didn't the address showed 14A10 in SmartCheck? Why the extra digit?! 
Solution is simple. In IDA, the starting address of this code starts at 
40000, hence, the extra digit, 4. Here's what you should see. Mine 
should be a little bit different from yours because of the different 
settings in ida.cfg.

00414A10                loc_414A10:             ; CODE XREF: 0040642E|j
00414A10 55             push    ebp
00414A11 8B EC          mov     ebp, esp
00414A11 83 EC 0C       sub     esp, 0Ch

There, simple deduction will tell you that *this* is the routine which 
calls the creation of frmMain. If you want, you can rename is routine, 
from loc_414A10, to any name you like. I'd prefer the name used in 
SmartCheck to make referring easier for me. How to do this? Place your 
cursor on line 00414A10 and press N.Now we'll have a look at the next 
few events in SmartCheck, which is quite interesting.

Dir(VARIANT:ByRef String:"C:\Progr...",FLAGS:00000000)

By looking at the right pane, you can easily guess what all this crap 
is. LCase changes your string to lowercase and UCase changes the string 
to uppercase. The third line combines them, together with the directory. 
And again, simple deduction wins again. This program looks for a key 
file, etaLK.KEY, to determine whether you are registered or not. Have 
a closer look at this routine in IDA. Rename the calls, locations and 
routines recklessly to make sure you can understand the code easily at 
first look. If  you guessed that this whole routine is the protection 
scheme, you can congratulate yourself. Scrolling down, you will see a 
few Visual Basic functions such as _vbaFileOpen, _vbaFileClose and so 
on. By comparing and studying the events which happened in SmartCheck 
with your dead listing, you can easily deduce that jumping at every 
jnz loc_4201C3 brings you to the nag screen. If you want, you can change 
jnz loc_4201C3 to any other names. I changed mine to jnz sucker. Looking 
at the whole routine, you can see that there are many jnz suckers. Which 
means, it does a whole lot of comparing and testing.

Well, I hope this information is already enough for you to decide where 
to patch, or better, to create your own keyfile. I changed mine to 
jnz next_line, which brings them to the next line so that even if they 
have the valid keyfile, they will also be considered registered. With 
simple common sense, you should know that if you change it to jz sucker, 
the user will go to unregistered status if they have a valid key file. 
Please take note that by changing the first jnz sucker to jnz next_line, 
you will get an error because it will go to _vbaFileOpen function, but 
there's no file to open! So you need to change the jump to go over the 
_vbaFileOpen and _vbaFileClose function, but before the second jnz sucker.

Final Notes

Notice that I didn't use a debugger here. A combination of SmartCheck and 
IDA is already enough to kill protection schemes in Visual Basic 5 programs. 
By the way, if you want to use this program, pay for it. It is very very 
important for users to do so because the developers needs the money to 
further develop their programs to serve their customers. Without supporting 
them, users will be stuck to their old versions, and worse still, we 
crackers will lose our source of challenges.

Good luck!