please help

[dyn!o]

There is no problem (as always ).

First of all you have to discover how the dll communicate with the base (exe or other dll). Generally there are two possibilities:

1. The dll is physically extracted at runtime to TEMP folder and then communicate via usual way. If you encounter this one then it is more than easy - all you have to do is to find the place where this dll is extracted and make a backup during usual program execution. Then you can dance and make yourself "feel good".

2. The dll is dynamically hooked at the runtime via loader (which can be executed as part of a packer) and it is being hidden during usual program execution. You can't see it because all API calls and dll initialization moment is being handled by the loader. In this case you have more work (about 20 minutes) because you need to extract the dll at its initialization moment, thus you need to verify if import table does need rebuilding.

Bla bla...
Anyway, you can always prepare direct attack on the dll - no matter how much layers it uses. Just look at the latest Paradox SwishMax 2004.02 crack - they did fuck**g good job (as the only one). Probably you can learn a lot from this crack (multiloader).

Best regards,
dyn!o

thanks dyno ill read it also.

dyno, where do i find this tut at??? I searched this forum, nothing, did a yahoo search, nothing...

thanks,

jdog

[dyn!o]

Oops... I didn't say there is a tutorial available

I said that you should look at SwishMax 2004.02 and try to crack it - it's very good challange. If you fail then get Paradox relase and analyze their job since they've cracked it properly as the only one.

Good luck.
dyn!o

ok, will do. thanks

dyn!o
it appears that my progie is #1 of your examples, an i have found the piece of code in the dll that it creates in my temp folder, and can just nop it and it goes to "thank you for your registration" no prob, but this wont help because the dll is allways deleted after the progie is shut down, and it does not look to see if a dll is there or not when you start it up.

Im lost so could some one please help?

thanks,
jdog

I just found this in the windows box in olly, while i did a bp on my point-h:

Protected by:
Geeworks TrialMaster Standard Edition
Web:
hxxp://xxx.geeworks.com

went to their site and found this:

TrialMaster

Shipping software just got Faster, Easier, Cheaper.

Why waste weeks or even months to research, design, implement and test the perfect software distribution system? Get TrialMaster. In just a few mouse clicks, TrialMaster transforms your unprotected software product into a time-limited trial software ready for distribution. No coding required. Get it now. And Ship your product Today!
STEALTH32 -- Software Protection Technology

Stealth32 is a patent-pending technology. It's designed by ex-Microsoft Windows NT developers who know the ins-and-outs of the Windows operating system. With Stealth32, you can be sure your intellectual property is safely distributed and tried before they're purchased.


Features
Latest encryption technology: compress and encrypt your executable. In most cases, your EXE will load faster because of the smaller file size.
BIOS-Locking: an advanced feature that prevents your customers from sharing their registration key with others.
Anti-rollback system clock: Stealth32 can determine the correct date/time from the BIOS directly prevent your trial users from renewing their software by rolling back the system clock.
Anti-debugging: to maximize protection against hackers, Stealth32 empties the process memory when a debugger is attached to the protected software.
Require no changes to your code: Stealth32 works directly with the Win32 Portable Executable (PE) format so you don't need to change your source code.
No source code needed: you don't even need to have the source code around. Stealth32 injects itself directly into your executable to give you transparent protection.
Check Registration Status at Runtime: With a few simple calls, you can tell whether your app has been registered and enable/disable certain features accordingly.
Works with any Windows Win32 applications.
Tested for 95/98/Me/NT/2000/XP: so you know your protected software will work everywhere.

anyone familare with this??

thanks,

jdog