Registry Problem

[codeX]

Very interesting...

What is this "embed NULL character in registry key" tecnology and why it cann't be handled by REGEDIT. Can anybody tell me which one is the related article in www.uinc.ru ,as the search gives a number os Rus. results . Or can anybody pls. translate it..

[bgrimm]

Originally Posted by codeX

Very interesting...

What is this "embed NULL character in registry key" tecnology and why it cann't be handled by REGEDIT.

Difference is RegEdit using Win32 API ANSI functions, and Native API using UNICODE. So RegEdit cannot process the extra/embedded Null.

The Registry key was written with UNICODE NTCreateKey. So all operations on it would have to be using Native API functions.


-bg

I posted a util on woodmann's a while back you might be interested in. I have attatched it here for your convience. It includes source that you'll want to modify.

Originally, it was written for eLicense, so the base location of where it starts will need to be modified to reflect this protections base.

More information can be found by going to woodmanns and looking at the thread "E-license 4.0 unpacking" (page 3, 2-28-2004).

Anyway, in main(), replace

pwKeyName_ = L"\\Registry\\Machine\\SOFTWARE\\LicCtrl";

with

pwKeyName_ = L"\\Registry\\Machine\\SOFTWARE\\ZipWORX";

Hope this helps.