May 1998
"SYSTEM CLEANER 98 V2"
(Example of a Lazy Shareware Programmer)
Win '95 PROGRAM
Win Code Reversing
 
 
by The Sandman 
 
 
Code Reversing For Beginners 
 
 
 
Program Details
Program Name: Systemcleaner98.exe
Program Type: Hard Disk Utility
Program Location:  Here
Program Size: 518K 
 
   
Tools Used:
W32dasm - Disassembler
HexWork Shop32 
 
Rating
Easy ( X )  Medium (    )  Hard (    )  Pro (    ) 
There is a crack, a crack in everything. That's how the light gets in.
 
  
 
System Cleaner 98 V2
( Reviving Dead Programs  )
Written by The Sandman
 
 
 
Introduction
 
From the words of the author of System Cleaner 98 here's what this program is all about:-

"System Cleaner 98 fixes and prevents errors in Windows 95 and Windows NT 4.0 by finding and cleaning error producing and space wasting garbage files. System Cleaner 98 operates by regularly scanning your hard drive for various error producing files and then optionally cleaning them from your system for you. System Cleaner 98 targets specific types of error producing files that common disk utilities, uninstall, defrag, disk scanning, and sweep-type programs will miss. The error files that System Cleaner 98 searches for and deletes can produce hazardous results if they are not properly cleaned from your drive on a periodic basis.

System Cleaner 98 is a safe, fast, and thorough way of keeping your system running like new.

¤ Key Features ¤
 
· Scan for Duplicate Files (NOTE: Only delete a duplicate file if you are sure it will not be needed by any application, or if the same file is on the windows system directory).
· Ability to add or remove file types to the Temporary Files to be scanned.
· Add/Remove/Edit The Items you have on your Uninstall Programs list.
· Backup temporary/duplicate files to a ZIP file.
· Powerful file search. You can select to scan for files between a certain date, with some or all file attributes, with a certain size and with the contents of a file matching a certain text.

· Clean Directories. Allows you to clean directories that usually have Temporary Files or cache files (Windows Temp Directory, Documents Folder, MS Internet Explorer Cache Directory and Netscape Cache Directory).
· FAT-Losses. This utility allows you to see exactly how much disk space is lost because of cluster size.
· System Cleaner 98 Scheduler - small applet that sits on the tray area and only loads the main application when it's time to run a scheduled task. That way System Cleaner 98 doesn't take memory when it's not needed.

· Remove files to Recycle Bin, zip them, move them to a folder or completely delete them!
· Schedule scans every xx minutes, Hourly, Daily, Weekly or Monthtly.
· Scan multiple hard drives.
· Add your own file types for scanning.
· You can automatically make System Cleaner 98 Scheduler run at windows startup.
· Delete some or all the files found by System Cleaner 98.
· Ability to confirm deletions.
 
 
About this protection system
 
Registration is not possible with this program, however, because of the way this program is suppose to run, it's been programmed to 'die' after a short period of time so the author has not bothered with any nag screens.
 

This program is not compacted or encrypted in anyway.
 
 
The Essay 
    
The version I obtained from the web came from Tucows and was already 'expired' even before I had downloaded it.  So when I tried to run it after installing it all I got was a message box saying that it had expired and that I had to download a fresh copy from the authors web page!. I think not...

In the past I might have just deleted this program and gone onto another but here was a program that screamed out to be resurrected.  So practicing what I preach (see essay 8 ) I got out W32Dasm and produced a 'Dead Listing' of this program.

I searched the string sections of this program and found the text:-
 
"This beta version has expired.  Please download a new version from our Web-Site"
 
 Locating where this string is used within this program revealed the following code:-
 

:00489CFF DFE0                    fstsw ax
:00489D01 9E                      sahf
:00489D02 7614                    jbe 00489D18 ;If program has expired
                                               ;then continue on, else
                                               ;jump to location 489d18

* Possible StringData Ref from Code Obj ->"This beta version has expired. "
                                        ->"Please download a new version "
                                        ->"from our Web-Site"
 
:00489D04 B8589E4800              mov eax, 00489E58 ;program expired,
:00489D09 E80A44FBFF              call 0043E118     ;display message then
:00489D0E E87197F7FF              call 00403484     ;close down.
:00489D13 E9FB000000              jmp 00489E13
 

Can you see where our 'fix' will go and what form it takes?.
 
That's right, if we change the line:-
 
:00489D02 7614                    jbe 00489D18
 
to

:00489D02 EB14                    jmp 00489D18
 
then every time the program is run it will always run as normal regardless of whatever time period it's suppose to expire.
 

Job Done.....
 
The 'Crack' 
 
To revive this program run up HexWorkshop32 or whatever hex editor you have lying around and then:
 
SEARCH FOR THE BYTES: DFE09E7614B8589E4800E80A44
THEN REPLACE WITH   : DFE09EEB14B8589E4800E80A44

    
Final Notes 
 
It's a shame a good looking program such as this is so easily 'repaired', anyone I'm sure could 'repair' this program if they wanted to and because there are no nag screens to annoy the user there's no extra work involved in disabling them so it's was an easy crack.
 
My thanks and gratitude goes to:

Fravia+ for providing possibly the greatest source of Reverse Engineering
knowledge on the Web.
 
+ORC for showing me the light at the end of the tunnel.

 
Ob Duh 
 
Do I really have to remind you all that by buying and NOT stealing the software you use will ensure that these software houses will continue to  produce even *better* software for us to use and more importantly, to continue offering even more challenges to breaking their often weak protection systems.
 
If your looking for cracks or serial numbers from these pages then your wasting your time, try searching elsewhere on the Web under Warze, Cracks etc.
 


 
 
 Next   Return to Essay Index   Previous 
 


Essay by:          The Sandman
Page Created: 16th May 1998