Cracking Tutorial for 3DMark 99
|Coders from 3DMark, click here!|
|Well, the first thing I
recognized after executing 3DMark 99 was it's window title: "3DMark 99
Lite". So it seems to be function disabled, if you haven't registerd it (you may also
read this info in the help files). So click on Register, Register 3DMark. Now a dialog box
with a input field for your User Name and a input field for your Registration Code get's
displayed. So enter "cRACKING tUTORIAL" as User Name and "12345-67890"
as Registration Code. Now enter SoftICE by pressing CTRL-D and set a BPX to HMEMCPY. Then
leave SoftICE and press the "OK"-Button. SoftICE will now pop up. Since there
were two input fields, we can leave SoftICE, because it will pop up again. So do this now.
As SoftICE poped up again, press F12 (about 8 times), until you get the following code
snippet, which is BTW located in MFC42.DLL:
As you see at 5F415185, we could also have set a BPX to GetWindowTextA. But why shouldn't we prepare ourself for the day, when there are (hopefully) no lame programmers, who will use GetWindowTextA left? Better to 'practice' using HMEMCPY now, isn't it? Ok. Now press F10 until you've executed the "RET 000C" instruction. Now you'll be looking at the following code snippet:
Since there's nothing interesting here, press F12. Now you'll be looking at the following code snippet:
This code is located in MFC42.DLL again, so it's absolutely useless for us. So we need to press F12 again. After you did this, you'll be confrontated with the following code snippet:
At 405C8C, ECX, will be
assigned our User Name. Then at 405C8F, EAX will be assigned the length of our User Name.
After that it's checked if we have enterd something as our User Name. If this isn't the
case, we'll jump to 405D2D ("Incorrect registration information"). At 405C9A,
EAX will be assigned our Registration Code. Then at 405C9D, EAX will be assigned the
length of our Registration Code. After that it's checked if we have enterd something as
our Registration Code. If this isn't the case, we'll jump to 405D2D ("Incorrect
registration information"). There's another check of EAX. It is checked, if EAX is
11h, which means 17 dec - so our Registration Code must be 17 chars long.
At 405CD2, DL will be
assigned the first character which is contained in EAX; at 405CD4, BL will be assigned the
first character contained in ESI. Then at 405CD8 DL and BL are compared. So what's
contained in EAX and ESI?
|Coders from 3DMark: You should recalculate and check the InstallD every time 3DMark is executed.|
Copyright © 1998 by TORN@DO and The Immortal Descendants. All Rights Reserved.
> :0041595E 89742414