Results 1 to 7 of 7

Thread: uk-info 6.5 info required...

  1. #1
    sadsack
    Guest

    uk-info 6.5 info required...

    hi guyz, well this iz me first post, and i bet i dont get any luck here either, its concerning uk-info disk v 6.5 or 4.1, does anybody know how 2 find the protection on this poxy proggy, as i aint got no hair left 2 pull out,... the 6.5 version came from pc format magazine, not that its gonna help much, it wont even let me reinstall it as it knows ive gone past the 7 day trail limit, also req serial number infomation.. any help at all would be great..

    thanx in advance

    londinium
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2

    Thumbs up

    Hiya londinium,

    Well, if the prog performs some sort of check prior to reinstallation there's a high probablility that this information is stored in 1) the registry or 2) a hidden file.

    Have you tried Regmon (registry monitor) or Filemon (file monitor)? If you don't have them, they can be obtained at sysinternals.com. You can likewise follow up on any suspicious registry or file accesses via an API monitor. An API monitor will guide you toward an optimal selection of breakpoints.

    Regards,
    Clandestiny

  3. #3
    sadsack
    Guest

    Unhappy thanx m8

    hi clandestiny m8, ill try them out but i dont hold out much hope, i tried "check disk" done a comparison but that wasnt much help either, i checked out the registry and removed all info regarding i-cd (there the makers of the proggy), and that still didnt work, ive got an old p75 did a quick reformat of a 800 meg drive, and it installed fine, now i only have 6 days left before i have to reformat the hd again.... anyone care 2 give any more help pleeze...
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    Scally6
    Guest

    UK-no info

    Hi Sadsack,
    This baby/pig is protected with Crypkey. There are a couple of tuts out there relating to other versions but not the one from the pc format cover. It supposed to be easy but I got not joy after trying both tuts I found & trying to ident other 'get authorization' code in the thing. I guess some of the guys on the list with more experience will be lol but I spent around 8 hours before I d'l'd the crypkey protection wrapper to have a look at it. I got nowhere much. Using filemon you'll see that after expiry it checks for randomly named files all over your hd. (That makes me mad) I deleted at least 20 of these <1k randomly named suckers (e.g in c:\iou.sys & others everywhere) & also what I could see in the reg but never managed to achieve a successful reinstall. Doing the above you get back to the 'pro trial' (with no days left) rather than the reduced se version but I never got further than that.
    I also loaded it on an old machine & tried to look for differences in sice but there were so many & the machines so different that I got pissed with it & gave up/moved on.
    I deleted it now but if I remember right it first unpacks the cryp95e.dll * crp9516.dll creating a temp file for the last one. This checks the jsm95*.*in c:\windows\system, the ukid.ini in c:\windows & the several *.rst/ent/41s files scattered in the i-cd/map & the other directory (bt, I think) against the ones in its own directory.
    If anyone's interested I'll reload it & have another go
    Scally
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  5. #5
    sadsack
    Guest

    Unhappy

    well ive been cross ref using disk master again, jeez so many filez, wot a nitemare, many of the filez i found in program_files/installshieldinstallationinfomation/0987124f ****ect/ as well as prog filez/ common filez/installshield ECT,
    and other numerous places, many of the filez had time diff & crc diff, after being installed and deleted, & yes m8 we prob r being laffed at...... if i get any furver ill let u know...

    sadsack
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  6. #6
    Scally6
    Guest
    Hi Sadsack,
    You could try reinstalling with regmon & filemon. These may show what else it's leaving on the HD to show its expired. If it aint in the reg or a file, it may be writing to the hd directly. I think some virii do this & aren't easilly detected by av progs but I doubt its that evil. I think that it was a dos prog I saw do this but can't remember what it was.
    I guess its much more likely to be a random key in the reg, so regmon is your best bet. If I remember right, the thing checks for a previous version on first run rather than when its installed.
    Scally
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  7. #7
    sadsack
    Guest

    Wink ill give it a go

    fanx 4 the info m8, ill give it a go, summit i did notice the program installs to same dir, (wherever u install 2) the same main .exe 3 times in same place, but only 1 file u find, (all hidden turned on) cant work that wun out....
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. CRC Checkup...Need some info!
    By RedStorm in forum Malware Analysis and Unpacking Forum
    Replies: 6
    Last Post: April 9th, 2004, 07:39
  2. Some info about USB
    By Polaris in forum Advanced Reversing and Programming
    Replies: 4
    Last Post: November 17th, 2003, 17:13
  3. need info on ROR and ROL
    By javelin in forum Malware Analysis and Unpacking Forum
    Replies: 2
    Last Post: October 21st, 2001, 04:38
  4. Further info
    By Hoof Arted in forum Advanced Reversing and Programming
    Replies: 1
    Last Post: April 10th, 2001, 05:38
  5. i need info
    By mustapha in forum Advanced Reversing and Programming
    Replies: 3
    Last Post: February 16th, 2001, 03:02

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •