> Hi there,

>

> You're not going to believe this! I wrote an essay on

> cracking UltraEdit 4.40a and sent it to Fravia just a few *minutes*

> ago - then I went to look at his page and saw you'd done the same -

> hehehehe....we seem to mirror each other - just the other day I made

> a patch/serial code for the same program - then I went to your page

> and saw you had done the same - hehe, it seems you just beat me to it

> each time ;-)

>

> Cya,

> ReZiDeNt



   I read your essay about UltraEdit 4.40a, can you believe I never

noted the presence of a second valid code! Maybe because after I found

the first valid one there were no more interest for me to further

analyze it. On the other hand, i did note the presence of several

hardwired names and codes (there are many, btw) in the disassembled

text. I didn't mention it because it has become a very frequent practice

between programmers (read

my essay about Hex Workshop). I was very amused when you mentioned that

if someone attempts to register it with one of the hardwired names, the

free trial period will be reduced!!!, shame on you programmer!!!, little

devil, he, he, he ...



    What do you think of this consideration about the *.reg file: If you

decide to crack by changing the "je" instruction to "jmp", then your

*.reg file will contain the wrong code (the false one you typed,

encrypted off course), instead, if you point your false code memory

location to the right one by changing ebp-80 to ebp-40, then your *.reg

file will contain the valid calculated code also encrypted, thereby your

*.reg file will be able to unlock the uncracked shareware version of the

program. Moreover, there's another great possibility, taking advantage

from the presence of two valid codes (thanks to your intuition!), it's

possible to exchange the encrypted code memory location (the one that

will be written to the reg file) with the second valid code memory

location (I already found the memory location where the encrypted code

dwells, a simple SICE breakpoint and the instruction that points to it

will be revealed). This double crack will not only defuse the protection

scheme, but also reveal to the user his decrypted second valid code

which will be copied to the uedit32.reg and .ini files in plain ASCII

... Unfortunately, this will disable the reg file from being able to

unlock uncracked versions of the program... Best regards ...



P.D. Take a look at the new SoftICE teaching Section in my Home Page.





				Aesculapius

				aesculpius@cryogen.com

				aesculapius.home.ml.org

Back to project 1