|
Let's see what kind of
protection it has.So,fire up the program,and we see evaluation
notice:
a
nag screen.You have an option to purchase the software,so click on
Purchase button,and enter some codel like 323323213
and press Unlock software button.A message
appears sayin' that you entered an invalid code.
OK.Disassembly the Xara3d with
W32Dasm.When disassembled goto String Data References and look for a
messge "You entered and invalid...",double click on it,now you should be
here:
* Referenced
by a (U)nconditional or (C)onditional Jump at
Addresses:
|:0040F434(C), :0040F448(C), :0040F464(C),
:0040F480(C), :0040F49C(C)
|:0040F4B8(C),
:0040F4D4(C), :0040F4F0(C), :0040F55C(C)
|
* Possible
Reference to Dialog: DialogID_0133, CONTROL_ID:00FF,
""
|
:0040F615
6AFF
push FFFFFFFF
:0040F617
6A10
push 00000010
* Possible
Reference to String Resource ID=03005: "You entered an invalid unlock
code.
The program has not
been"
|
:0040F619
68BD0B0000
push 00000BBD
:0040F61E
E809D30700
call 0048C92C
* Referenced
by a (U)nconditional or (C)onditional Jump at
Address:
|:0040F424(C)
|
:0040F623
8A442413
mov al, byte ptr [esp+13]
Look above at
all those jumps,so scroll up to the first one(:0040F434) and you should be
here:
:0040F42A
8B842440010000 mov
eax, dword ptr [esp+00000140]
:0040F431
3958F8
cmp dword ptr [eax-08], ebx
:0040F434
0F85DB010000
jne
0040F615 <--- Bad
jump
:0040F43A
0FBE10
movsx edx, byte ptr [eax]
:0040F43D
52
push edx
:0040F43E
E8DD700500
call 00466520
:0040F443
83C404
add esp, 00000004
:0040F446
85C0
test eax, eax
:0040F448
0F84C7010000
je
0040F615 <--- Bad
jump
:0040F44E
8B842440010000 mov
eax, dword ptr [esp+00000140]
:0040F455
0FBE4801
movsx ecx, byte ptr [eax+01]
:0040F459
51
push ecx
:0040F45A
E8C1700500
call 00466520
:0040F45F
83C404
add esp, 00000004
:0040F462
85C0
test eax, eax
:0040F464
0F84AB010000
je
0040F615 <--- Bad
jump
:0040F46A
8B942440010000 mov
edx, dword ptr [esp+00000140]
:0040F471
0FBE4202
movsx eax, byte ptr [edx+02]
:0040F475
50
push eax
:0040F476
E8A5700500
call 00466520
:0040F47B
83C404
add esp, 00000004
:0040F47E
85C0
test eax, eax
:0040F480
0F848F010000
je
0040F615 <--- Bad
jump
:0040F486
8B8C2440010000 mov
ecx, dword ptr [esp+00000140]
:0040F48D
0FBE5103
movsx edx, byte ptr [ecx+03]
:0040F491
52
push edx
:0040F492
E889700500
call 00466520
:0040F497
83C404
add esp, 00000004
:0040F49A
85C0
test eax, eax
:0040F49C
0F8473010000
je
0040F615 <--- Bad
jump
:0040F4A2
8B842440010000 mov
eax, dword ptr [esp+00000140]
:0040F4A9
0FBE4804
movsx ecx, byte ptr [eax+04]
:0040F4AD
51
push ecx
:0040F4AE
E86D700500
call 00466520
:0040F4B3
83C404
add esp, 00000004
:0040F4B6
85C0
test eax, eax
:0040F4B8
0F8457010000
je
0040F615 <--- Bad
jump
:0040F4BE
8B942440010000 mov
edx, dword ptr [esp+00000140]
:0040F4C5
0FBE4205
movsx eax, byte ptr [edx+05]
:0040F4C9
50
push eax
:0040F4CA
E851700500
call 00466520
:0040F4CF
83C404
add esp, 00000004
:0040F4D2
85C0
test eax, eax
:0040F4D4
0F843B010000
je
0040F615 <--- Bad
jump
:0040F4DA
8B8C2440010000 mov ecx, dword
ptr [esp+00000140]
:0040F4E1
0FBE5106
movsx edx, byte ptr [ecx+06]
:0040F4E5
52
push edx
:0040F4E6
E835700500
call 00466520
:0040F4EB
83C404
add esp, 00000004
:0040F4EE
85C0
test eax, eax
:0040F4F0
0F841F010000
je
0040F615 <--- Bad
jump
:0040F4F6
8B842440010000 mov eax,
dword ptr [esp+00000140]
:0040F4FD
0FBE4804
movsx ecx, byte ptr [eax+04]
...
:0040F554
69D251ED8764
imul edx, 6487ED51
:0040F55A
3BCA
cmp ecx, edx
:0040F55C
0F85B3000000
jne
0040F615 <--- Bad
jump
:0040F562
8B0D70EB4D00
mov ecx, dword ptr [004DEB70]
You see that we must NOP
every single jump that jumps to 0040F615,in order to
register.
So
make sure the line is at :0040F434 and look what offset it is(it should be E834),now open your favourite hexeditor
and goto offset E834 and
enter OF84.You must do
this for every other jump that jumps to 0040F615.
Example if the jump is jne 0040F615 then you must change it to
je 0040F615 (in hex it
would be 0F85 to
0F84) and if it is
je 0040F615 then change it
to jne 0040F615 (in hex:
0F84 to 0F85).
When done all this,then save and
start Xara3D and enter any code press to register.And it accepts the
code.
After you register it
creates a key in registry:
HKEY_CURRENT_USER/SOFTWARE/XARA/X3D3/INSTALL/KEY
0x1da8403d (497565757)
The key could be different on your
computer.
Job
done.
|
