TimeSlice(v1.1.0) - Tutorial

Download the program at the authors ftp server
 http://www.scruznet.com/users/~maui/public/win/TimeS-16.zip

Welcome to this reversers tutorial, As this is my first tutorial and I'am not english at all, you'll see that this essay will be poorly written.

You should have softice already installed on your computer, Window$ 3.11 or worse.

Start Timeslice and you will see a nag screen which asks you to register.
So if the author of this program wants us to register why not.


Let's start to reverse this baby,.Fire timeslice up.
Choose in the nag screen Register Now.
We choose to register timeslice for the first time
 
Fill in your name i used lownoise.
and registration code :12341234.
 
Now goto softice, We can set a breakpoint on bpx Getwindowtext

 But We will using hwnd timeslic, with hwnd timeslic we'll see the handle of the edit boxes

 So lets set a breakpoint on the first edit box bmsg (handle) wm_gettext

 Softice wil break four times

 After the fourth time push F11 three times and you will here.

 2C48 call USER.GETWINDOWTEXTLENGTH
2C4D mov si, ax
2C4F push word ptr [bp-02]
2C52 push ax
2C53 push word ptr [bp+08]
2C56 push word ptr [bp+06]
2C59 call 0001.1B98
2C5E push dx
2C5F push ax
2C60 lea ax, [si+01]
2C63 push ax
2C64 call USER.GETWINDOWTEXT
2C69 jmp 2C7B ;you're here

Disable the breakpoint bd*
step to the code with F10 till you come to the next section of code

688B push es
688C push cx
688D push ss
688E push word ptr [bp-0C]
6891 call 0001.1712 ;important call
6896 call 0004.6694 ;important call
689B add sp, 000E ;Stack correction
689E mov es, [bp+08]
68A1 push word ptr es:[si+2A] ;Offset Your Code (OFC)
68A5 push word ptr es:[si+28] ;Adress Your Code (AFC)
68A9 push word ptr [bp-1A] ;Offset Correct Code (OCO)
68AC push word ptr [bp-1C] ; Adress Correct Code>(ACC)
68AF call USER.LSTRCMP ; *** Compare BOTH serial no's..
68B4 or ax, ax
68B6 je 68BB
68B8 jmp 696E

*** If you do D OFC:AFC you see the code your entered in my case 12341234
and if you do a D OCO:ACC you see the correct code in my case 01805882

Final Notes

This essay was meant to show you that if the normal breakpoints bpx getdlgitemtext and bpx getwindowtext don't sometimes work in a program then HWND makes an excellent alternative to getting inside a difficult program.
 
 

Till next time lownoise '98
 

 
 
 [ Return ]