1999 |
( 'what SmartCheck can show' ) |
Win Code Reversing |
|
|
|
|
|
|
Program Name: tweaki2.exe Program Type: System utility Program Location: Here Program Size: 3.4mb |
||
SmartCheck V6.03 - VB6 Debugger a bit of luck :) |
||
|
|
|
The author of Tweaki v2.1.566 says :
Tweaki...for Power Users
gives you all the usual Desktop management ability; like turning off animated
windows, enabling auto logon, removing shortcut arrows, speeding up the
Start Menu, showing BMP files as thumbnails in Explorer, editing the system
owner/company information, placement of cascading menus off the Start Menu
for Control Panel and the Printer's Folder, editing the file descriptions
that Explorer lists for EXE, COM & DLL, turning on/off of AutoPlay,
rebuilding the icon cache file, print directory structure as well as directory
contents from within Explorer (Win9x only), disable smooth scrolling, making
NT always boot with the Num Lock key on, changing the Windows NT logon
logo to something you prefer, changing DOS box colors in NT, X-Mouse support
in NT, Ghost connections in NT, disable autoexec parsing in NT, keep RAS
connections alive, restrict remote registry access in NT, set max number
of simultaneous users to your server, setting security within Win9x and
NT, suppressing printer
server notification
messages, creating custom logon messages, allowing Ctrl + Esc to launch
the Task List vs. the Start Menu, changing the directory where spool files
are created to one that has more space, TAB in a DOS box under NT to complete
path statements, tweak IP performance...the list goes on and on.
|
This protection routine is based
on the user name, but it used the month it registered
in, as a part of the reg key.
The program keeps its settings at the registry :
HKCU\Software\Tweaki\RegName "your name"
but the interesting key is this one :
HKCR\ASControl.Objects\{CC0918E3-EFE5-11CF-A069-00AA00B6015C}\ControlType "10/03/64"
This key is the "heart" of this
protection routine. What we are going to see with
SmarCheck is just the "cherry",
but in my Final Notes, you will have the "cream"
to put above it :)
|
This is my first
tutorial using SmartCheck (from now i will call it SC), so i adupt Eternal_bliss
idea and create a page that includes the most important setting in SC,
to give us as mutch
information we need.
you can view/read
it here. Thanks EB !!
Ok, after we set
up SC to give us the most important details, run SC, in the menu choose
File/Open and choose
Tweaki.exe. Now
to start the program, click on Program/Start, or click on this icon : .
The program now loads,
when it done, go to Options/About and enter any registration name &
number.
Now, click on the
"register" button, got the invalid reg number ? now we will go back to
SC.
in the "program results" window, you'll see this :
Click on the "+" that next to the _click,
and then again on the "+" that next to the second _click, you will see
now all the information that SC provids
when we enterd our name and fake reg key. Scroll to the bottom of
the window and look for this, remember
this is for the name i entered :
Well, i thought to my self, nice
and clear !!!
I entered this number as registration
number, but got the "invalid" message again. At this point i start
wonder what's wrong, and my eyes
"captured" the line "Month" above the string. Now what ??
What this number have to do with
the month (8 / august) ??? i made a few tests :
83420307 + 8 = 83420315
--> invalid
883420307
--> invalid
834203078
--> invalid
AUGUST83420307 -->
invalid
83420307AUGUST -->
invalid
AUG83420307 -->
invalid
83420307AUG -->
invalid
I will not show all the combinations i made, it took more then 2 hours, but finaly i got lucky :
83420307GUA --> BINGO
It takes the first 3 leters of the
current month, and put it in reverse order to the end of the generated
geristration key.
I can't say
it was easy to find, since i could't see how the *fake* and the *real*
codes is compared, but when
i saw the
the month is involved, i had nothing to do, but try and try...
|
Nothing needed...
REMEMBER, i'm
doing my cracks as a hobby and challenge, so please, if you like
this utility and
want to keep using it, support the author and pay for it.
|
Remember the registry key i talked about
in the begining ? I installed this utility on 2 different computers,
with different names and i saw this same
key, ControlType
"10/03/64"
on both of them, and couldn't find where
the real code is
kept.
Delete this key
makes the program "unregistered". Hving this key without the RegName
makes the program
"registered to :".
Final conclusion
: if you create this key in the registry, create the other key with your
name, the program will
be registered...
no need to bother with the real key and the month... TRY IT.
My thanks and gratitude goes to:-
Eternal_Bliss for the "push" he gave me in reversing VB progs.
The Sandman for all what he is doing for us, newbies.
Rhayader for helping me with Reverse Code Engineering and useful tips