( 'what SmartCheck can show' )
Win Code Reversing
Program Name: tweaki2.exe
Program Type: System utility
Program Location: Here
Program Size: 3.4mb
The author of Tweaki v2.1.566 says :
Tweaki...for Power Users
gives you all the usual Desktop management ability; like turning off animated
windows, enabling auto logon, removing shortcut arrows, speeding up the
Start Menu, showing BMP files as thumbnails in Explorer, editing the system
owner/company information, placement of cascading menus off the Start Menu
for Control Panel and the Printer's Folder, editing the file descriptions
that Explorer lists for EXE, COM & DLL, turning on/off of AutoPlay,
rebuilding the icon cache file, print directory structure as well as directory
contents from within Explorer (Win9x only), disable smooth scrolling, making
NT always boot with the Num Lock key on, changing the Windows NT logon
logo to something you prefer, changing DOS box colors in NT, X-Mouse support
in NT, Ghost connections in NT, disable autoexec parsing in NT, keep RAS
connections alive, restrict remote registry access in NT, set max number
of simultaneous users to your server, setting security within Win9x and
NT, suppressing printer
server notification messages, creating custom logon messages, allowing Ctrl + Esc to launch the Task List vs. the Start Menu, changing the directory where spool files are created to one that has more space, TAB in a DOS box under NT to complete path statements, tweak IP performance...the list goes on and on.
This protection routine is based
on the user name, but it used the month it registered in, as a part of
the reg key.
The program keeps its settings at the registry :
HKCU\Software\Tweaki\RegName "your name"
but the interesting key is this one :
This key is the "heart" of this
protection routine. What we are going to see with SmarCheck is just the
"cherry", but in my Final Notes, you will have the "cream" to put above it :)
This is my first
tutorial using SmartCheck (from now i will call it SC), so i adupt Eternal_bliss
idea and create
a page that includes the most important setting in SC, to give us as mutch information we need.
you can view/read it here . Thanks EB !!
Ok, after we set up SC to give us the most important details, run SC, in the menu choose File/Open and choose
Tweaki.exe. Now to start the program, click on Program/Start, or click on this icon : .
The program now loads,
when it done, go to Options/About and enter any registration name &
Now, click on the "register" button, got the invalid reg number ? now we will go back to SC.
in the "program results" window, you'll see this :
Click on the "+" that next to the _click,
and then again on the "+" that next to the second _click, you will see
now all the information that SC provids when we enterd our name and fake reg key. Scroll to the bottom of
the window and look for this, remember this is for the name i entered :
Well, i thought to my self, nice
and clear !!!
I entered this number as registration number, but got the "invalid" message again. At this point i start
wonder what's wrong, and my eyes "captured" the line "Month" above the string. Now what ??
What this number have to do with the month (8 / august) ??? i made a few tests :
83420307 + 8 = 83420315
883420307 --> invalid
834203078 --> invalid
AUGUST83420307 --> invalid
83420307AUGUST --> invalid
AUG83420307 --> invalid
83420307AUG --> invalid
I will not show all the combinations i made, it took more then 2 hours, but finaly i got lucky :
83420307GUA --> BINGO
It takes the first 3 leters of the
current month, and put it in reverse order to the end of the generated
I can't say
it was easy to find, since i could't see how the *fake* and the *real*
codes is compared, but when
i saw the the month is involved, i had nothing to do, but try and try...
doing my cracks as a hobby and challenge, so please, if you like
this utility and want to keep using it, support the author and pay for it.
Remember the registry key i talked about
in the begining ? I installed this utility on 2 different computers,
with different names and i saw this same key, ControlType "10/03/64" on both of them, and couldn't find where
the real code is kept.
Delete this key makes the program "unregistered". Hving this key without the RegName makes the program
"registered to :".
Final conclusion : if you create this key in the registry, create the other key with your name, the program will
be registered... no need to bother with the real key and the month... TRY IT.
My thanks and gratitude goes to:-
Eternal_Bliss for the "push" he gave me in reversing VB progs.
The Sandman for all what he is doing for us, newbies.
Rhayader for helping me with Reverse Code Engineering and useful tips