Analysis on Cracking of AptEdit pro 5.1.0 Build 394

The PEid shell display is: Microsoft Visual C ++ 7.0 [debugging]
No shell, load with OD directly, run F9, click on the window, there is no registration prompt, so find the string "Unregistered", locate 2:

For the text string, refer to aptedit:. text, Project 10
Address = 00401EF7
Disassembly = push aptedit.007953B0
Text string = UNICODE "Unregistered trial version:
You have % d day left ."

For details about text strings, see aptedit:. text, project 11.
Address = 00401F14
Disassembly = push aptedit.00795348
Text string = UNICODE "Unregistered trial version:
You have % d days left ."

 

Therefore, the program is interrupted at two locations, and then the window is re-opened, and the program is interrupted:

00401EF6 |. 51 push ecx;/Arg3
00401EF7 |. 68 B0537900 push aptedit.007953B0; | Arg2 = 007953B0
00401EFC |. 8D95 7 CFFFFFF lea edx, dword ptr ss: [ebp-84]; |
00401F02 |. 52 push edx; | Arg1
00401F03 |. E8 38D50000 call aptedit.0040F440; aptedit.0040F440
00401F08 |. 83C4 0C add esp, 0C
00401F0B |. EB 1B jmp short aptedit.00401F28
00401F0D |> 8B85 48 FBFFFF mov eax, dword ptr ss: [ebp-4B8]
00401F13 |. 50 push eax;/Arg3
00401F14 |. 68 48537900 push aptedit.00795348; | Arg2 = 00795348: interrupt in
00401F19 |. 8D8D 7 CFFFFFF lea ecx, dword ptr ss: [ebp-84]; |
00401F1F |. 51 push ecx; | Arg1
00401F20 |. E8 1BD50000 call aptedit.0040F440; aptedit.0040F440

 

Locate the line at the top of the line:

00401280/. 55 push ebp
00401281 |. 8BEC mov ebp, esp
00401283 |. 6A FF push-1
00401285 |. 68 559B7700 push aptedit.00779B55; SE handle Installation
0040128A |. 64: A1 00000000 mov eax, dword ptr fs: [0]

 

Once again, open the window, stop at the beginning of the field, and then perform a one-step tracking with F8. You will soon find it here:

0040199D |> 8B95 E0F5FFFF mov edx, dword ptr ss: [ebp-A20]
004019A3 |. 8B42 70 mov eax, dword ptr ds: [edx + 70]
004019A6 |. 8985 B0F8FFFF mov dword ptr ss: [ebp-750], eax
004019AC |. 68 B8547900 push aptedit.007954B8; UNICODE

"AE5B082B5EFA5439CD6335B578EFEEF5"
004019B1 |. 8B8D B0F8FFFF mov ecx, dword ptr ss: [ebp-750]
004019B7 |. 51 push ecx
004019B8 |. E8 506C3300 call aptedit.0070000d; this is a key CALL and multiple calls
004019BD |. 83C4 08 add esp, 8; but not the place for registration verification
004019C0 |. F7D8 neg eax
004019C2 |. 1BC0 sbb eax, eax
004019C4 |. 40 inc eax
004019C5 |. 0FB6D0 movzx edx, al
004019C8 |. 85D2 test edx, edx
004019CA |. 74 1F je short aptedit.004019EB
004019CC |. A1 504E8200 mov eax, dword ptr ds: [rje50]
004019D1 |. 50 push eax;/Arg3 => 00000000
004019D2 |. 68 7C547900 push aptedit.0079547C; | Arg2 = 0079547C
004019D7 |. 8D8D 7 CFFFFFF lea ecx, dword ptr ss: [ebp-84]; |
004019DD |. 51 push ecx; | Arg1
004019DE |. E8 5DDA0000 call aptedit.0040F440; aptedit.0040F440
004019E3 |. 83C4 0C add esp, 0C
004019E6 |. E9 3D050000