We register Date X Pro v1.0.
It is the program - prognosis. With its help it is possible to find out date of death and presumable reason. If you it has interested, load the program from here: http://store.in.ru/~nop/PROGRAMS/date_x.exe
TOOLS - old, kind S-Ice, I used version 3.24, it is a little patience and very few gains on the part of a head brain.
Well have gone. We start for object of a research and there is such non-standard window with two fields:
1) The serial number of the given copy of the program: at me it was equalled 464698505, at once I want to make small retreat the given parameter on different machines will be changed, the 2-nd line, therefore probability is accordingly changed also that it(he) at someone will be identical, is very small;
2)Please enter an appropriate code, well with it all is clear, pay money and die!:-)
Also there are 2 buttons; one for registration, other for a prolongation without registration (but is stipulated, that without registration the program works with restrictions, namely you do not find out date of death, or other examinee of the person, that me has not arranged at all, and you probably too). And one more important note, the program is packed Shrinker. All attempts on unpacking were abortive, can at you will be received.
So, we enter in S-Ice and we put a point of interruption on function Hmemcpy (naturally after filling 2 fields), we press a button "to be registered" and we appear in S-Ice, in the module Kernel32, we leave on F12 in the module of the program, necessary to us, and is visible, that a code in which we have appeared "enclosed", but it is not necessary to leave it begin trace (F10) will not leave yet all investments. If have made all correctly, appear here 004A736C mov EAX, [EBP-04] ; entry in eax of the code, entered by us, 004A736F push EAX ; Code on the stack 004A7370 lea EDX ,[EBP-08] 004A7373 mov EAX , [004B3480] 004A7378 mov EAX, , [EAX] and further there will be CALL, us there (F8), and in it one more to the address: 00407401, we go and such place reaches: 00408155 mov EDX , 00001001 0040815A call 00407D48 ; It can be passed 0040815F mov EBX , EAX ; Here it is possible to see length of a correct registration code (9), d ebx, and further trase up to such place: 00408184 lea EDX , [EBP+FFFFEFFE] ; Here we shall see interesting figures is a CORRECT CODE 0040818E call 00403988 ; We pass 00403922 mov EAX , ESI ; Correct code from esi in eax 00403924 call 0040275C ; We go 0040275C push ESI ; Correct code on the stack 0040275D push EDI 0040275E mov ESI , EAX ; Here, I think all clearly 00402760 mov EDI , EDX 00402763 mov EAX , ECX ; In eax length of a valid code further we reach up to ret, before an exit the valid code in edi and esi, and from different addresses is collected from the stack 00403929 mov EAX , EBX ; We here 0040392B call 00403824 Further we leave from 4th functions and we appear here in such code: 004A737F mov EDX , [EBP-08] ; In edx a valid code 004A7382 pop EAX ; We collect from the stack the code, entered by us, in eax 004A7383 call 00403BB0 ; Procedure of check? We go there 00403BB0 push EBX 00403BB1 push ESI 00403BB2 push EDI 00403BB3 mov ESI , EAX ; Our code in esi 00403BB5 mov EDI, EDX ; The valid code in edi (at me it was 136767175) 00403BB7 cmp EAX, EDX ; We compare our code with correct 00403BB9 jz 00403C4E ; On idea this jump should be critical for us, actually it not so. If to enter a registration code equal on an amount of figures, serial number, critical there will be following places: 1)00403BDF JNZ 00403C39 2)00403BEC JNZ 00403C39 3)00403C0B JNZ 00403C4E I have interchanged significance of a flag of zero on opposite and has received registration, by opening a key in the register [HKEY_LOCAL_MACHINE\Software\NOP\DateXPro] "Version"="VŚrsiÓn 1.0" "Code"="136767175" I with surprise have seen the not entered code, and correct.
Now it would be advisable to make crack, but at once I shall tell that with it at me there is nothing has not left, I tried Risc and some other modifiers for patch in memory, but anything except for error has not received. If at you will leave can write to me. Yes, such joke was remarked, the truth on my machine I such did not observe, but me one friend has told, so here the ambassador 3 attempts of introduction of an incorrect code, the program issued such message: you have made 3 attempts, all of them have appeared unsuccessful, and then formatting the disk C With begins, there is a window with the indicator of progress "format", but actually, certainly of any formatting did not happen, the author simply joked.
This material is written for the educational purposes, instead of for use with the purposes of cracked of the program, do not overlook that it is a commercial product which costs of money, if you want to use this program pay to the author, as he too lives in Russia.
Before speed meetings GoKs!!!