Ok Tornado, i got little carried away and wrote a solution for the app of the week in the c4n
project. ;) It is easier and better way's to crack this ? i duno ...probably

tools needed:
     SoftIce v4.0
     Hackers View v6.03 (HIEW)

     protools.cjb.net got them all i think.


1. lets start of by running the program, now we se a nag screen. i thoght at once that i wanted
   to break on CreateWindowExA. Do that and you land here :

   :004061F2 50                      push eax
   :004061F3 6A00                    push 00000000

   * Reference To: user32.CreateWindowExA, Ord:0000h
                                     |
   :004061F5 E82EFBFFFF              Call 00405D28 <<<--- your here ..
   :004061FA 5B                      pop ebx
   :004061FB 5D                      pop ebp
   :004061FC C22000                  ret 0020   <<<--- retrive from call

 -

   :0042F0F0 8BD0                    mov edx, eax
   :0042F0F2 B90000CA84              mov ecx, 84CA0000

   * Possible StringData Ref from Code Obj ->"TApplication"
                                     |
   :0042F0F7 A110284600              mov eax, dword ptr [00462810]
   :0042F0FC E8CB70FDFF              call 004061CC   <<<<---- thats where we came from ..
   :0042F101 894324                  mov dword ptr [ebx+24], eax

   Press F12. and ret .

 -

   :0042EEFC 7507                    jne 0042EF05
   :0042EEFE 8BC3                    mov eax, ebx
   :0042EF00 E817010000              call 0042F01C <<<--- that's where we came from ...

   Now just trace down some way until you come to this code location ...

   :00461F15 83C034                  add eax, 00000034

   * Possible StringData Ref from Code Obj ->"Ftpnav.hlp"
                                     |
   :00461F18 BAA81F4600              mov edx, 00461FA8
   :00461F1D E8FA1AFAFF              call 00403A1C
   :00461F22 E8C57EFFFF              call 00459DEC
   :00461F27 E82C7DFFFF              call 00459C58   <---<-<-<--- that's the call where it creates the window(s).
   :00461F2C 8B0D582E4600            mov ecx, dword ptr [00462E58]
   :00461F32 8B03                    mov eax, dword ptr [ebx]



   So basicly you just NOP out that call, and you have goten rid of the nag screen.

   Now that we are rid of the nag we could consider on the (Unbregistered) string, goto hiew, open the file,
   press F5, chose hex, press F7, enter in the string (Unregistered), press return, ah there it found it ;)
   press F3 (to edit) enter 20 * 71, witch means 20 on all 71 bytes forward end press F9 ....end of essay.
   it would have been pretty easy to make a keygen patch for this one ;)) *hint hint*

   Greetings to: TORN@DO, cTT, sortof, llama, JosepCo, WarezPup, [Drone], EinZtein, Neural, Mem Lost, Kwai, DEZM,
                 yoshi, Prophecy, Xorolc, ytc, Wart, Sporaw, Acid Burn, N0-Body, yates, etc... etc....


                 SIGNED 08201999 BY : zoltan . ;)