![]() |
|
|
|
#1
|
|||
|
|||
|
Hi britedream,
I first thought that JackD's way would indeed give a full registered app... but that's not the case Quote:
If the above mentioned address points to an ASCII string, the "Register..." part is no longer there and the About box shows said string as the name of the registered user. But in fact the app is still unregistered since some of it's functions produce a "Function only available for registered users" message. But since I only wanted to unpack and not crack it, that's no problem with me About the part on how to find the first address: I think I've found a straighter way to get there... Assuming the data at 00620480 and afterwards is the same as "data AFTER ASPR dips" (which was true for my dump), simply start the app in Olly and try to open the "About" box. Olly pops up with an access violation. Looking at the stack you'll see the ret address of the call to the function that produces the violation. Go to this address and you're two or three lines below 578685. Regards Wurstgote |
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| one newbie question | SubzEro | General Discussion | 7 | 03-12-2015 06:05 |
| ASPR, ARMA question | sgdt | General Discussion | 3 | 04-09-2006 03:38 |
| ASPR 1.2 question | gabri3l | General Discussion | 42 | 05-01-2004 15:09 |
| a newbie question about CRC32 | abccc | General Discussion | 13 | 04-23-2004 03:13 |
| "newbie" question for crackers ;) | newbie007 | General Discussion | 4 | 10-07-2003 04:46 |