August
 1999
"Tweaki v2.1.566"
( 'what SmartCheck can show'  )
Win '95 PROGRAM
Win Code Reversing
 
by The Snake
 
 
Code Reversing For Beginners
 
Program Details
Program Name: tweaki2.exe
Program Type: System utility 
Program Location: Here
Program Size: 3.4mb
 
 
 

Tools Used:
 SmartCheck V6.03 - VB6 Debugger
a bit of luck :)

 
Rating
Easy (X)  Medium (  )  Hard (    )  Pro (    )
 


Tweaki v2.1.566
( 'what SmartCheck can show'  )
Written by The Snake
Introduction

The author of  Tweaki v2.1.566 says :

Tweaki...for Power Users gives you all the usual Desktop management ability; like turning off animated windows, enabling auto logon, removing shortcut arrows, speeding up the Start Menu, showing BMP files as thumbnails in Explorer, editing the system owner/company information, placement of cascading menus off the Start Menu for Control Panel and the Printer's Folder, editing the file descriptions that Explorer lists for EXE, COM & DLL, turning on/off of AutoPlay, rebuilding the icon cache file, print directory structure as well as directory contents from within Explorer (Win9x only), disable smooth scrolling, making NT always boot with the Num Lock key on, changing the Windows NT logon logo to something you prefer, changing DOS box colors in NT, X-Mouse support in NT, Ghost connections in NT, disable autoexec parsing in NT, keep RAS connections alive, restrict remote registry access in NT, set max number of simultaneous users to your server, setting security within Win9x and NT, suppressing printer
server notification messages, creating custom logon messages, allowing Ctrl + Esc to launch the Task List vs. the Start Menu, changing the directory where spool files are created to one that has more space, TAB in a DOS box under NT to complete path statements, tweak IP performance...the list goes on and on.
 
About this protection system

 This protection routine is based on the user name, but it used the month it registered in, as a part of
 the reg key.

 The program keeps its settings at the registry :

   HKCU\Software\Tweaki\RegName "your name"

  but the interesting key is this one :

   HKCR\ASControl.Objects\{CC0918E3-EFE5-11CF-A069-00AA00B6015C}\ControlType "10/03/64"

  This key is the "heart" of this protection routine. What we are going to see with SmarCheck is just the
  "cherry",  but in my Final Notes, you will have the "cream" to put above it :)
 
The Essay

This is my first tutorial using SmartCheck (from now i will call it SC), so i adupt Eternal_bliss idea and create
a page that includes the most important setting in SC, to give us as mutch information we need.
you can view/read it here .   Thanks EB !!
Ok, after we set up SC to give us the most important details, run SC, in the menu choose File/Open and choose
Tweaki.exe. Now to start the program, click on Program/Start, or click on this icon : .

The program now loads, when it done, go to Options/About and enter any registration name & number.
Now, click on the "register" button, got the invalid reg number ? now we will go back to SC.

in the "program results" window, you'll see this :

Click on the "+" that next to the _click, and then again on the "+" that next to the second _click, you will see
now all the information that SC provids when we enterd our name and fake reg key. Scroll to the bottom of
the window and look for this, remember this is for the name i entered :

 Well, i thought to my self, nice and clear !!!
 I entered this number as registration number, but got the "invalid" message again. At this point i start
 wonder what's wrong, and my eyes "captured" the line "Month" above the string. Now what ??
 What this number have to do with the month (8 / august) ???     i made a few tests :

    83420307 + 8 = 83420315   -->  invalid
    883420307   -->  invalid
    834203078   -->  invalid
    AUGUST83420307 -->  invalid
    83420307AUGUST -->  invalid
    AUG83420307  -->  invalid
    83420307AUG  -->  invalid

 I will not show all the combinations i made, it took more then 2 hours, but finaly i got lucky :

   83420307GUA  -->  BINGO

 It takes the first 3 leters of the current month, and put it in reverse order to the end of the generated
 geristration key.

 I can't say it was easy to find, since i could't see how the *fake* and the *real* codes is compared, but when
 i saw the the month is involved, i had nothing to do, but try and try...
 
The Patches

 Nothing needed...

REMEMBER, i'm doing my cracks as a hobby and challenge, so please, if you like
this utility and want to keep using it, support the author and pay for it.
 
Final Notes

Remember the registry key i talked about in the begining ? I installed this utility on 2 different computers,
with different names and i saw this same key, ControlType "10/03/64"  on both of them, and couldn't find where
the real code is kept.
Delete this key makes the program "unregistered". Hving this key without the RegName makes the program
"registered to :".
Final conclusion : if you create this key in the registry, create the other key with your name, the program will
be registered...  no need to bother with the real key and the month...  TRY IT.

My thanks and gratitude goes to:-

Eternal_Bliss for the "push" he gave me in reversing VB progs.

The Sandman for all what he is doing for us, newbies.

Rhayader for helping me with Reverse Code Engineering and useful tips



Essay by:         The snake
Page Created: 22th August 1999