Talking E-mail v1.3
Visual Basic 5
Written by McCodEMaN
 
 
 
Introduction
Greetings and welcome to the noble art of reverse engineering!

This is a nice VB program that can read your mail, well..it can read everything you ask it to!
A Visual Basic program are a list of calls to various funktions included in a dll-file. VB5 programs uses a file called: msvbvm50.dll
so if you use softice, make sure that....

   EXP=C:\windows\system\msvbvm50.dll

is active in your softice.dat file.
If you don`t have this string you should add it!
To crack VB5 using SoftIce can be fun and there many tricks to use..
but then again there is SmartCheck!!
 
Tools required 
 
Numega SmartCheck v6.x
 
Target's URL 
 
http://www.4developers.com/
 
Essay 
 
Step1 Run Smartcheck and configure the settings, like this:

      Under Program/settings menu:

     *ERROR DETECTION: Check all boxes except 'Report errors immediately'

     *ADVANCED SETTINGS: Check the first four boxes. The others should be emty!

     *REPORTING: All boxes should be checked except the one for:
                                'Report Mouse Move events from ocx controls'
 
 
 

Step2  OK, now you are ready to fight!
 
 

Step3  Load e-talk.exe by click 'File' and 'Open', => open e-talk.exe!
 
 

Step4  Run e-talk.exe in SmartCheck by pressing F5 or by pressing the runbuttom in the
           toolfield.
 
 

Step5  Ok, now you are going to type in name and a fake serial, i use:
          McCodEMaN & 1234567890,
          the program validates the serial and tell you that it was wrong.
          Now terminate e-talk.exe by clicking on the stop buttom.
 
 

Step7  Ok, now look through the strings, do you see 'frmTray_Load' ?
           Good, open it by clicking the ' + ' sign.
 
 

Step8  Now go into: 'frmMain_Load' ,then down and into: 'frmNotice.Show'
          Ok, we are inside frm Notice.Show...were should we go now?
          Yes, into: 'cmdUnlock_Click' .
          Now, go down to: 'txtRegCode.Text'
          Make sure the blue bar is on it!
          Go to "View" and choose: "Show All Events" now you will see almost everything
           that happens inside the program.
 
 

Step9  Ok, you are standing on 'txtRegCode.Text' under this string you will see one called
           __vbaStrMove  returns   DWORD:4BD140 and if you look in the little window to
           your right, you will see the contents.

                           "1234567890"  (our fake serial)!
 

Step10 If you go down to: __vbaStrCmp  returns  DWORD:FFFFFFFF

                         String1= "UNREGISTERED USER"

                         String2= "McCodEMaN" (Your username)!
 
 

Please Note: I will type a fake serial that represents the valid, because if i type ' X '
                      instead of the real character it could be hard for you to understand!
                      So dont bother to try the serial in this essay, i made it up!!!!
 
 
 

Step11 Go down to: __vbaStrCopy  returns  DWORD:56046C  <= "1632-"
 

Step12 The: __vbaStrMove  returns  DWORD:48D2C4 <= "M"

            So we now know that the single: __vbaStrMove between ' Mid$ ' and 'Asc returns Integer:'
            contains our username. So if this one contains "M" the next should in my case contain
            "c"  and the next after that "C" and then "o" then "d" and so on........
 
 

Step13 Go to: Len returns LONG:21 do you see the contens?
           Do you know what this is?.....well, i think you will soon!!!
 
 

Step14 Now go down to:

              __vbaStrMove  returns  DWORD:48D2C4 <= "V"

             __vbaStrCat  returns  DWORD:46739C <= Add "V" to "1632-"

             __vbaStrMove  returns  DWORD:46739C <= "1632-V"    "1632-"

 

Step15 Go down to next: Move, Cat, Move.......

               __vbaStrMove  returns DWORD:56046C <= "+"

               __vbaStrCat  returns  DWORD:4626F4 <= Add "+" to "1632-V"

               __vabStrMove  returns  DWORD:4626F4 <= "1632-V+"    "1632-V"
 
 

Step16 And next....

                 __vbaStrMove  returns  DWORD:56046C <= "G"

                 __vbaStrCat  returns  DWORD:46739C <= Add "G" to "1632-V+"

                 __vbaStrMove  returns  DWORD:46739C <= "1632-V+G"   "1632-V+"
 
 

Step17      __vbaStrMove  returns  DWORD:56046C <= "#"

                __vbaStrCat  returns  DWORD:4626F4 <= Add "#" to "1632-V+G"

                __vbaStrMove  returns  DWORD:4626F4 <= "1632-V+G#"     "1632-V+G"
 
 

Step18      __vbaStrMove  returns  DWORD:56046C <= "%"

                __vbaStrCat  returns  DWORD:46739C <= Add "%" to "1632-V+G#"

                __vbaStrMove  returns  DWORD:46739C <= "1632-V+G#%"     "1632-V+G#"
 
 

Step19      __vbaStrMove  returns  DWORD:56046C <= "&"

                __vbaStrCat  returns  DWORD:4626F4 <= Add "&" to "1632-V+G#%"

                __vbaStrMove  returns  DWORD:4626F4 <= "1632-V+G#%&"    "1632-V+G#%"
 
 

Step20      __vbaStrMove  returns  DWORD:56046C <= "8"

                __vbaStrCat  returns  DWORD:46739C <= Add "8" to "1632-V+G#%&"

                __vbaStrMove  returns  DWORD:46739C <= "1632-V+G#%&8"

                                                                                                                   "1632-V+G#%&"
 
 

Step21      __vbaStrMove  return  DWORD:56046C <= "2"

                __vbaStrCat  returns  DWORD:4626F4 <= Add "2" to "1632-V+G#%&8"

                __vbaStrMove  returns  DWORD:4626F4 <= "1632-V+G#%&82"

                                                                                                                   "1632-V+G#%&8"
 
 

Step22      __vbaStrMove  returns  DWORD:56046C <= "Q"

                __vbaStrCat  returns  DWORD:4BCBA0 <= Add "Q" to "1632-V+G#%&82"

                __vbaStrMove  returns  DWORD:4BCBA0 <= "1632-V+G#%&82Q"
 
                                                                                                                    "1632-V+G#%&82"

                __vbaStrCmp  returns  DWORD:1

                         String1 = 1234567890

                         String2 = 1632-V+G#%&82Q
 

                __vbaFreeStr  returns  DWORD:0 <= 1632-V+G#%&82Q
 
 
Final Notes 
 

I would like to thank:

Razzia, for making me interested in VB in the first place!
Jeff, for making me come back to the VB environment after a long vacation!
Eternal Bliss, for providing us with a great VB source!
 
 

When ever there is a door,
there is an entrance.
And behind an entrance can no secret hide,
when a cracker takes his knowledge for a ride

 
ObDuh 
The information in this essay is for educational purpose only!
You are only allow to crack, reverse engineer, modify code and debugg programs that you legaly bought and then for personal use only!!
To ignore this warning is a criminell act and can result in lawful actions!

So please note!
I take no responebility for how you use the information in this essay, i take NO responebility for what might happen to you or your computer! You use this information on your own risk!!

What i mean is: Please buy the software!
 


 
 
 Return 
 

Essay written by McCodEMaN ©TRES2000. All Rights Reserved.