"Yenilsen de yensen de, taraftarin seninle. Iyi gunde, kotu gunde, seninle birlikte."

Registration bolumune “1907” degerini giriyoruz. Program, kodun gecerli olabilmesi icin yeniden basliyor. Peki, bu kodu nasil kontrol ediyor ? Ya Registry’den ya da herhangi bir dosyadan yapabilir. RegMon ile inceledigimizde, herhangi bir ipucuna rastlayamiyoruz. O zaman, programin hangi dosyalari actigina bakacagiz. [bpx createfilea do “d esp->4”] ->
 

Data window’daki degerleri inceledigimizde, “mailwiz.ini” adli dosyayi gorecegiz. Dosyanin ikinci satirinda, girdigimiz sallama serial duruyor. Programin, bu satiri okudugu yeri bulmamiz gerekiyor. Birazcik [F10] ve Memory kontrol esliginde ;

...
0167:004013A3 PUSH DWORD PTR [ESI]
0167:004013A5 PUSH 000000EF
0167:004013AA LEA EDX,[EBP-00F0]
0167:004013B0 PUSH EDX
0167:004013B1 CALL 004115E4                             <- birinci satir

4013B1’deki cagridan sonra -> [d edx] ->

016F:0072FBB4 23 57 61 72 6E 69 6E 67-3A 20 44 6F 20 6E 6F 74 #Warning: Do not
016F:0072FBC4 20 61 6C 74 65 72 20 6F-72 20 64 65 6C 65 74 65 alter or delete
016F:0072FBD4 20 61 6E 79 20 6C 69 6E-65 20 69 6E 20 74 68 69 any line in thi
016F:0072FBE4 73 20 66 69 6C 65 0A 00-EC 26 41 00 74 FC 72 00 s file...&A.t.r.

Gordugunuz gibi ilk satir okundu. Devam edelim ->

0167:004013B6 ADD ESP,0C
0167:004013B9 PUSH DWORD PTR [ESI]
0167:004013BB PUSH 000000EF
0167:004013C0 LEA ECX,[EBP-00F0]
0167:004013C6 PUSH ECX
0167:004013C7 CALL 004115E4                             <- ikinci satir

4013C7’deki cagridan sonra -> [d ecx] ->

016F:0072FBB4 52 45 47 49 53 54 52 41-54 49 4F 4E 5F 4E 4F 3D REGISTRATION_NO=
016F:0072FBC4 31 39 30 37 0A 00 20 6F-72 20 64 65 6C 65 74 65 1907.. or delete

ikinci satir da okunmus bulunuyor. [F10] ile devam ->

...
0167:004013FE MOV EBX,00000001
0167:00401403 JMP 0040140F
0167:00401405 MOV DL,[EBX+EAX]                         <- 1 9 0 7
0167:00401408 MOV [EBX+0044A827],DL                    <- Buraya kopyala
0167:0040140E INC EBX
0167:0040140F MOVSX ECX,BYTE PTR [EBX+EAX]             <- 1 9 0 7
0167:00401413 CMP ECX,20                               <- bitti mi ?
0167:00401416 JGE 00401405

Sallama serial, [ebx+44A827] ile gosterilen bolume kopyalandi. Program, bundan sonra cesitli ayarlar icin, diger satirlari okuyor. Yapmamiz gereken, programin [ebx+44A827] ile gosterilen bolgeden, data okumasi sirasinda devreye girmek.

[bpm [ebx+44A827]]

...
0167:00401B99 CALL 004398A6
0167:00401B9E TEST EAX,EAX
0167:00401BA0 JZ 00401DA1
0167:00401BA6 MOV DL,[EBX]                            <- ilk karakter
0167:00401BA8 PUSH EDX
0167:00401BA9 CALL USER32!IsCharAlphaA                <- Harf mi ?
0167:00401BAE TEST EAX,EAX
0167:00401BB0 JZ 00401DB8                             <- kotu cocuk
0167:00401BB6 MOV CL,[EBX+01]                         <- 2.inci karakter
0167:00401BB9 PUSH ECX
0167:00401BBA CALL USER32!IsCharAlphaA
0167:00401BBF TEST EAX,EAX
0167:00401BC1 JZ 00401DB8
0167:00401BC7 MOV AL,[EBX+02]                         <- 3.uncu karakter
0167:00401BCA PUSH EAX
0167:00401BCB CALL USER32!IsCharAlphaNumericA
0167:00401BD0 TEST EAX,EAX
0167:00401BD2 JZ 00401DB8
0167:00401BD8 MOV DL,[EBX+03]                         <- 4.uncu karakter
0167:00401BDB PUSH EDX
0167:00401BDC CALL USER32!IsCharAlphaNumericA
0167:00401BE1 TEST EAX,EAX
0167:00401BE3 JZ 00401DB8
0167:00401BE9 MOV CL,[EBX+04]                         <- 5.inci karakter
0167:00401BEC PUSH ECX
0167:00401BED CALL USER32!IsCharAlphaNumericA
0167:00401BF2 TEST EAX,EAX
0167:00401BF4 JZ 00401DB8
0167:00401BFA MOV AL,[EBX+05]                         <- 6.inci karakter
0167:00401BFD PUSH EAX
0167:00401BFE CALL USER32!IsCharAlphaNumericA
0167:00401C03 TEST EAX,EAX
0167:00401C05 JZ 00401DB8
0167:00401C0B MOVSX EDX,BYTE PTR [EBX+06]             <- 7.inci karakter
0167:00401C0F CMP EDX,2D                              <- “-“ mi ?
0167:00401C12 JNZ 00401DB8                            <- kotu cocuk
...

Yukaridaki koda gore, serialin ilk bolumu 6 harften olusacak ve sonra “-“ isareti gelecek. Harflerin ne oldugu ile ilgili henuz bir ipucu yok. “ABCDEF-“ [F10] ile takip ederek, serilain kalan bolumlerinin nasil olmasi gerektigini kendiniz bulacaksiniz. En sonunda ise,

...
0167:00401D8C CALL USER32!IsCharAlphaNumericA
0167:00401D91 TEST EAX,EAX
0167:00401D93 JZ 00401DB8
0167:00401D95 MOV DWORD PTR [0043A0C0],00000001       <- ?
0167:00401D9F JMP 00401DB8
0167:00401DA1 XOR EAX,EAX
0167:00401DA3 MOV [0043A0C0],EAX
0167:00401DA8 LEA EDX,[EDI+000001E9]
0167:00401DAE PUSH EDX
0167:00401DAF PUSH EBX
0167:00401DB0 CALL 0040EC24
0167:00401DB5 ADD ESP,08
0167:00401DB8 CMP DWORD PTR [0043A0C0],00
0167:00401DBF JNZ 00401E31                           <- ?
0167:00401DC1 PUSH 00000104

Seriali olmasi gereken sekilde girdikten sonra, acilistaki Unregistered uyarisi ortadan kalkti. Yani, harfler arasinda bir iliski aranmadi. Emin olmak icin, serial bolgesine breakpoint de koysak, program herhangi bir algoritma uygulamadi.
 

Bir programı kullanarak para kazanıyorsanız, programı satın alın.