|
( 'Show name/company in About screen' ) |
Win Code Reversing |
|
|
|
|
|
|
As an addition to Sandman's
essay #38 about RoboHelp Express,
and as I decided to take the challenge of his final notes about "Anyone
who writes an essay on how to make the program display your name/handle
and company name instead of the 30-day trial limit", here is
the way i've done this.
|
*
Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048176F(C)
|
:004817D8
8D4DF0
lea ecx, dword ptr [ebp-10]
--------- snip snip --------
:0048180B 8B3D404B4A00 mov edi, dword ptr [004A4B40]
*
Possible StringData Ref from Data Obj ->"name"
|
:00481811
6844304A00
push 004A3044
:00481816
50
push eax
:00481817
6A02
push 00000002
:00481819
FFD7
call edi
:0048181B
83C410
add esp, 00000010
:0048181E
85C0
test eax, eax
:00481820
740C
je 0048182E
:00481822
8B45F0
mov eax, dword ptr [ebp-10]
:00481825
8D4E60
lea ecx, dword ptr [esi+60]
:00481828
50
push eax
*
Reference To: MFC42.MFC42:NoName0068, Ord:1837h
|
:00481829
E88CA30100
Call 0049BBBA
*
Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481820(C)
|
:0048182E
8D45F0
lea eax, dword ptr [ebp-10]
:00481831
8B4DE8
mov ecx, dword ptr [ebp-18]
:00481834
50
push eax
*
Possible StringData Ref from Data Obj ->"company"
|
:00481835
683C304A00
push 004A303C
:0048183A
51
push ecx
:0048183B
6A02
push 00000002
:0048183D
FFD7
call edi
:0048183F
83C410
add esp, 00000010
:00481842
85C0
test eax, eax
:00481844
740F
je 00481855
:00481846
8B45F0
mov eax, dword ptr [ebp-10]
:00481849
8D8EE0000000
lea ecx, dword ptr [esi+000000E0]
:0048184F
50
push eax
Ok... This is what the program look for in the registry file, so, open Regedit and go to entry :
HKCU\Software\Blue Sky Software\RoboHTML\1.00
To create the new
key we need to click on : Edit/New/String value. Call it company.
To set it with the
value we need to click on : Edit/Modify. put in what ever you like.
now point again
with the mouse on the "1.00".
To create the new
key we need to click on : Edit/New/String value. Call it name.
To set it with the
value we need to click on : Edit/Modify. put in what ever you like.
Ok, run the program
and see what happened now. Go into the help/about...
Nothing changed
!!! we need to take a closer look at the dead list :
*
Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481752(C)
|
:0048176B
837DD4F9 cmp dword ptr [ebp-2C], FFFFFFF9
:0048176F
7467 je 004817D8
; if equal jump to name + company !!
:00481771
8D4DF0 lea ecx, dword ptr [ebp-10]
; else, keep on to
; the 30-day trial
:00481774
E8E7A30100 Call 0049BB60
:00481779
C645FC02 mov [ebp-04], 02
:0048177D
8B45D4 mov eax, dword ptr [ebp-2C]
:00481780
8D4DF0 lea ecx, dword ptr [ebp-10]
:00481783
50 push
eax
*
Possible Reference to String Resource ID=00761: "%d-day
trial license"
|
:00481784
68F9020000 push 000002F9
:00481789
51 push
ecx
We need to check it, we need to 'break' into the program's actual code, with this steps :
1. Select the menu option 'Help'
from within RoboHelp.
2. Press Ctr-D to fire up
Softice.
3. Type bpx getwindowtexta
4. Type x to leave Softice.
5. Select
the 'About' Tab option.
6. Softice
now breaks...
7. Press the
'F11' key 1 TIME followed by the 'F10' key 13
TIMES
8. We should
now be in RoboHelp's code..
9. Type u
48176f
10. Type bc *
11. Type bpx
0048176f
12. Type x to leave Softice.
Softice now brakes on location 0048176f :
:0048176F 7467 je 004817D8 < no jump >
Type r eip=004817d8, and then type
x to leave softice. BINGO.. The name and
company we put in the registry is showing
now in the About screen.
Sandman, i did it !!
|
Load up robohtml.exe into Hex-Editor ( I usu hexWorkshop-32)
SEARCH FOR THE FOLLOWING BYTES
: 837DD4F97467
REPLACE WITH HIGHLIGHTED
BYTES : 837DD4F9EB67
|
My thanks and gratitude goes to:-
The Sandman for all that he is doing for us, newbies.
Rhayader for helping me with Reverse Code
Engineering and
useful tips