New Tutorial
Cracking "Customizer 2000 for w9x/me ver. 6.5.3"

skill: novice
standing: basics built in serial no.
toolz: SoftICE any version and intuition:)
dld: http://www.tweaknow.com

The Program

Config.dat | 20 bytes
Customizer.exe | 773.120 bytes - our target
Logon.exe | 302.248 bytes
Readme.html | 8.820 bytes
Unins000.dat | 1.588 bytes
Unins000.exe | 72.298 bytes
Uninstall.lnk | 398 bytes

1. Short story
--------------
-hmmm a long time past since i've wrote my first tutorial and it's time for
another one eh don't u think? and i've dropped my attention on this simple
program named "Customizer" it's a very good windoze tweaker and personally i
recommend it because i use it allot and it's OK. Let's see, well u wonder
what that "built in thing" stands for, well let me tell u that the good
serial that we have to input in order to reg it it's written in the program
and when the compare function appears the bad serial compares with the good
one.The good one is simply loaded to a special registry (eax, edx...) and
this is what we will use on our next approach. Of course there are many
approaches like destroying the time function to reg it in such way that he
will never expire but this is for another time:)

2. The cracking
---------------
1. we will use the elegant way to discover the good serial number.
2. so let's see what bpx (breakpoint on execution) we will use. Hmmm
GetDlgItemTextA and GetWindowTextA aren't good so i think we will use
Hmemcpy. Start the program and write any serial then Ctrl-D, type in Sice
"bpx hmemcpy" (without quota) and Ctrl-D again and after all of this press
OK.
3. softice must come up after u pressed the button. Press F11 once and then
trace with F10, carefully and be aware that customizer.exe must appear any
second now. Did it appeared, good if not pleaz go back on the stage 1. Ok
here are some loading instructions, loads the length of our serial no it
will look like this:

:E8F133FDFF CALL USER32!CallWindowProcA
:89430C MOV [EBX+0C],EAX
:8B03 MOV EAX,[EBX] <-- returns the length of your
serail no.
:751B CMP EAX,0CA <-- compares your length with 12
...... nothing important here.... just detective work:)..trace for about 32
steps carefully until u will arrive here....
what is following is very important pay attention!

:E89AA8FCFF CALL 0042F8C4 <-- a CALL procedure not important
:8B45FC MOV EAX,[EBP-04] <-- MOVE YOUR SERIAL NUMBER THAT IS
STORED IN ADDRESS [EBP-04] TO EAX SO EAX WILL HAVE THE ADDRESS
VALUE SO U CAN SIMPLY TYPE "D EAX" (without quotas) IN SOFTICE
AND IT WILL APPEAR SOMETHING LIKE THIS (i
used as bad serial 4355 a random one
first that flew my mind):
31 38 31 32 31 39 38 31 - 00 00 00 00 FF FF FF FF 4355..H.x.H <-- so here
it stores my serial no. it's something like a builting in
procedure but in reverse what i spoked earlyer

BA58514600 MOV EDX, 00465158 <-- AND THIS IS THE FINAL IMPORTANT
NOTICE WHERE IN EDX IS LOADED THIS ADDRESS 00465158 THA LOGICAL HAS
OUR GOOD SERIAL NUMBER SIMPLY TYPE D EDX AND 18121981 WILL
APPEAR IN THE DATA WINDOW IN THE UPPER LEFT CORNER
EBF5ECF5FF CALL 00403D2C <-- this will compare our bad serial
number with the real one and don't think that yours will be
right:)

3. Final words
--------------
-so tell me it was hard?? i don't think it was, that dumb programmer should
make the security scheme a little more complicated but despite all of this
we will crack it togheter. Bye and have fun with this one and expect more
tutorials signed by
tracer_v