By the help of WDASM i found out the correct combination of the check boxes
(1 means set):

1 0 0 0 0 1
1 0 1 0 0 1

At first, I set a message breakpoint to the "Test it" button in SoftICE,
nothing spectacular. Then tracing a bit, until I reached func. offset
42712B. There, the compare is performed, I recognized it by lots of TEST
AL,AL - exactly 12 times.
I then ran WDASM, disassembled tC's crackme and went to offset 42712B. I set
a breakpoint to the first TEST AL,AL. I checked the boxes in the crackme
window until AL=1. AL=0 means check box is not checked, AL=1 means check box
is checked. I cleared the breakpoint and went to the next TEST AL,AL and so
on....
After the TEST AL,AL is either a JE or JNE (or JNZ, dunno anymore). JE means
that the check box must be checked, JNE/JNZ means it must remain unchecked.

The really mean thing was that tC's enumerated these check boxes in a more
or less chaotic/random way and wrote his crackme in Delphi. Since these are
only 10 and not 100 check boxes, brute force methods work well....



The AntiXryst [CrossOver]