Talking E-mail v1.3

Talking E-mail v1.3 Visual Basic 5 Written by McCodEMaN

Introduction

Greetings and welcome to the noble art of reverse engineering!

This is a nice VB program that can read your mail, well..it can read everything you ask it to!
A Visual Basic program are a list of calls to various funktions included in a dll-file. VB5 programs uses a file called: msvbvm50.dll
so if you use softice, make sure that....

EXP=C:\windows\system\msvbvm50.dll

is active in your softice.dat file.
If you don`t have this string you should add it!
To crack VB5 using SoftIce can be fun and there many tricks to use..
but then again there is SmartCheck!!

Tools required

Numega SmartCheck v6.x

Target's URL

http://www.4developers.com/

Essay

Step1 Run Smartcheck and configure the settings, like this:

Under Program/settings menu:

*ERROR DETECTION: Check all boxes except 'Report errors immediately'

*ADVANCED SETTINGS: Check the first four boxes. The others should be emty!

*REPORTING: All boxes should be checked except the one for:
'Report Mouse Move events from ocx controls'

Step2 OK, now you are ready to fight!

Step3 Load e-talk.exe by click 'File' and 'Open', => open e-talk.exe!

Step4 Run e-talk.exe in SmartCheck by pressing F5 or by pressing the runbuttom in the
toolfield.

Step5 Ok, now you are going to type in name and a fake serial, i use:
          McCodEMaN & 1234567890,
          the program validates the serial and tell you that it was wrong.
          Now terminate e-talk.exe by clicking on the stop buttom.

Step7 Ok, now look through the strings, do you see 'frmTray_Load' ?
Good, open it by clicking the ' + ' sign.

Step8 Now go into: 'frmMain_Load' ,then down and into: 'frmNotice.Show'
          Ok, we are inside frm Notice.Show...were should we go now?
          Yes, into: 'cmdUnlock_Click' .
          Now, go down to: 'txtRegCode.Text'
          Make sure the blue bar is on it!
          Go to "View" and choose: "Show All Events" now you will see almost everything
           that happens inside the program.

Step9 Ok, you are standing on 'txtRegCode.Text' under this string you will see one called
__vbaStrMove returns DWORD:4BD140 and if you look in the little window to
your right, you will see the contents.

"1234567890" (our fake serial)!

Step10 If you go down to: __vbaStrCmp returns DWORD:FFFFFFFF

String1= "UNREGISTERED USER"

String2= "McCodEMaN" (Your username)!

Please Note: I will type a fake serial that represents the valid, because if i type ' X '
instead of the real character it could be hard for you to understand!
So dont bother to try the serial in this essay, i made it up!!!!

Step11 Go down to: __vbaStrCopy returns DWORD:56046C <= "1632-"

Step12 The: __vbaStrMove returns DWORD:48D2C4 <= "M"

            So we now know that the single: __vbaStrMove between ' Mid$ ' and 'Asc returns Integer:'
            contains our username. So if this one contains "M" the next should in my case contain
            "c" and the next after that "C" and then "o" then "d" and so on........

Step13 Go to: Len returns LONG:21 do you see the contens?
Do you know what this is?.....well, i think you will soon!!!

Step14 Now go down to:

__vbaStrMove returns DWORD:48D2C4 <= "V"

__vbaStrCat returns DWORD:46739C <= Add "V" to "1632-"

__vbaStrMove returns DWORD:46739C <= "1632-V" "1632-"

Step15 Go down to next: Move, Cat, Move.......

__vbaStrMove returns DWORD:56046C <= "+"

__vbaStrCat returns DWORD:4626F4 <= Add "+" to "1632-V"

__vabStrMove returns DWORD:4626F4 <= "1632-V+" "1632-V"

Step16 And next....

__vbaStrMove returns DWORD:56046C <= "G"

__vbaStrCat returns DWORD:46739C <= Add "G" to "1632-V+"

__vbaStrMove returns DWORD:46739C <= "1632-V+G" "1632-V+"

Step17 __vbaStrMove returns DWORD:56046C <= "#"

__vbaStrCat returns DWORD:4626F4 <= Add "#" to "1632-V+G"

__vbaStrMove returns DWORD:4626F4 <= "1632-V+G#" "1632-V+G"

Step18 __vbaStrMove returns DWORD:56046C <= "%"

__vbaStrCat returns DWORD:46739C <= Add "%" to "1632-V+G#"

__vbaStrMove returns DWORD:46739C <= "1632-V+G#%" "1632-V+G#"

Step19 __vbaStrMove returns DWORD:56046C <= "&"

__vbaStrCat returns DWORD:4626F4 <= Add "&" to "1632-V+G#%"

__vbaStrMove returns DWORD:4626F4 <= "1632-V+G#%&" "1632-V+G#%"

Step20 __vbaStrMove returns DWORD:56046C <= "8"

__vbaStrCat returns DWORD:46739C <= Add "8" to "1632-V+G#%&"

__vbaStrMove returns DWORD:46739C <= "1632-V+G#%&8"

"1632-V+G#%&"

Step21 __vbaStrMove return DWORD:56046C <= "2"

__vbaStrCat returns DWORD:4626F4 <= Add "2" to "1632-V+G#%&8"

__vbaStrMove returns DWORD:4626F4 <= "1632-V+G#%&82"

"1632-V+G#%&8"

Step22 __vbaStrMove returns DWORD:56046C <= "Q"

__vbaStrCat returns DWORD:4BCBA0 <= Add "Q" to "1632-V+G#%&82"

__vbaStrMove returns DWORD:4BCBA0 <= "1632-V+G#%&82Q"

"1632-V+G#%&82"

__vbaStrCmp returns DWORD:1

String1 = 1234567890

String2 = 1632-V+G#%&82Q

__vbaFreeStr returns DWORD:0 <= 1632-V+G#%&82Q

Final Notes

I would like to thank:

Razzia, for making me interested in VB in the first place!
Jeff, for making me come back to the VB environment after a long vacation!
Eternal Bliss, for providing us with a great VB source!

When ever there is a door,
there is an entrance.
And behind an entrance can no secret hide,
when a cracker takes his knowledge for a ride

ObDuh

The information in this essay is for educational purpose only!
You are only allow to crack, reverse engineer, modify code and debugg programs that you legaly bought and then for personal use only!!
To ignore this warning is a criminell act and can result in lawful actions!

So please note!
I take no responebility for how you use the information in this essay, i take NO responebility for what might happen to you or your computer! You use this information on your own risk!!

What i mean is: Please buy the software!

Return

When ever there is a door, there is an entrance. And behind an entrance can no secret hide, when a cracker takes his knowledge for a ride

When ever there is a door,
there is an entrance.
And behind an entrance can no secret hide,
when a cracker takes his knowledge for a ride