Web
: http://mxb.cjb.net
Contact Me : [email protected] or [email protected]
WinRAR 2.80
Type : Data Compression
Protection : Keyfile
Tech : Patching
Crack : Best compressor i have ever seen ...
If we use API spy we can see it is trying to open a
file named "rarreg.key" ... registration file .....
So create a fake file
Name : rarreg.key
-------------------------
xxxxxxxxxxxxx
DHEERAJ
-------------------------
So in SICE BPX CREATEFILEA .... trace back
It is interesting to see that program is checking registration
twice ....
0x42B7BE CALL 41582C
0x42B7C3 MOV [00473B2C],AL >> SAVE FLAG : IF AL = 01 >> PROGRAM
IS REGISTERED
...........................
0x4348B3 CALL 41582C >> USE BPX 41582C TO REACH HERE :)
0x4348B8 MOV [00473B2C],AL >> SAVE FLAG : IF AL = 01 >> PROGRAM
IS REGISTERED
INSIDE CALL 41582C
0x415B26 CALL 419664
....................
0x415B33 JZ 415B59 | 74 24 >> GOOD BOY
...................
0x415C22 CALL 40615C
0x415C27 TEST EAX,EAX
0x415C29 JNZ 415C4F | 75 24 >> GOOD BOY
...................
0x415C96 CALL 40615C
0x415C9B TEST EAX,EAX
0x415C9D JNZ 415CC0 | 75 21 >> GOOD BOY
....................
0x415CC0 MOV AL,01 >> REGISTERED MODE
Patch :
0x415B33 JMP 415B59 | EB 24 OFFSET = 15133
...................
0x415C29 JMP 415C4F | EB 24 OFFSET = 15229
...................
0x415C9D JMP 415CC0 | EB 21 OFFSET = 1529D