Web
: http://mxb.cjb.net
Contact Me : [email protected] or [email protected]
WinRAR 2.71
Type : Data Compression
Protection : Key File
Tech : Patching
Crack : Best compressor i have ever seen ...
If we use API spy we can see it is trying to open a
file named "rarreg.key" ... registration file .....
So create a fake file
Name : rarreg.key
-------------------------
xxxxxxxxxxxxx
DHEERAJ
-------------------------
So in SICE BPX CREATEFILEA .... trace back
It is interesting to see that program is checking registration
twice ....
0x426353 CALL 43C0E8
0x426358 MOV [00466CCC],AL >> SAVE FLAG : IF AL = 01 >> PROGRAM
IS REGISTERED
...........................
0x41AF44 CALL 43C0E8 >> USE BPX 43C0E8 TO REACH HERE :)
0x41AF49 MOV [00466CCC],AL >> SAVE FLAG : IF AL = 01 >> PROGRAM
IS REGISTERED
INSIDE CALL 43C0E8
0x43C375 CMP EBX,[EDI+00000600]
0x43C37B JZ 43C39B >> GOOD BOY
...................
0x43C39B CMP BYTE PTR [EBP+08],00
0x43C39F JZ 43C46D >> GOOD BOY | 0F 84 C8 00 00 00
...................
0x43C46D MOV AL,01 >> REGISTERED MODE
Patch :
0x43C37B JMP 43C39B | EB 1E OFFSET = 3B97B
0x43C39F JMP 43C46D | E9 C9 00 00 00 90 >> 90 FOR COMPENSATION >>
OFFSET = 3B99F