A 5 minute crack
The main purpose of this essay is to adapt yourself on the ARM processor that populate most of pocket pcs running windows ce.
You'll find all processor related doc here.
Instructions seems to be pretty close than palm device, read latigo's related essays on this site.
Install every language you want on your pocket pc, then you'll realise that the trial version shows "unregistered copy..." instead of the
translation of 1 word of 2.
Try to register on about box, and note the msg : Incorrect serial number
Launch exescope and look at the strings numbers into slovoed.exe's resource part, you note dec 40020 -> 0x9c54
Launch ida and disassemble slovoed.exe, you'll find the commctrl.dll and others after you have installed the windows ce sdk, the download is
pretty big , about 300 megs. But worth the time, there's a nice emulator and a debugger.
Seach for 0x9c54 in ida listing, you'll find nothing...
But we're on still on windows, so what api is used to load a string from a resource ? LoadstringA or LoadstringW.
Look at the ida listing and check all the refs, you'll land here :
.text:00016788 BEQ loc_167E0
.text:0001678C EOR R3, R2, R1
.text:00016790 CMP R3, R0
.text:00016794 BEQ loc_167E0
.text:00016798 LDR R0, =unk_21428
.text:0001679C MOV R1, #0x9C00
.text:000167A0 MOV R3, #0x64
.text:000167A4 LDR R0, [R0]
.text:000167A8 ADD R2, SP, #0x10
.text:000167AC ORR R1, R1, #0x54 <- 0x54 + 0x9c00 = 9c54 , bingo !
.text:000167B0 BL LoadStringW
.text:000167B4 MOV R3, #0x40000
.text:000167B8 LDR R2, =unk_22C74
.text:000167BC ORR R3, R3, #0x10
.text:000167C0 ADD R1, SP, #0x10
.text:000167C4 MOV R0, #0
.text:000167C8 BL MessageBoxW
.text:000167CC B loc_16850
So you just have to change the BEQ at 16794 to B meaning in hex 0x0a to 0xea
Use activesync to upload the modified slovoed.exe into your pocket pc, register
with any serial, and it works !!! All the words are translated.
I hope that this essay will be the first to the pocket pc series, consider buying one, especially the hp jornada 568, it's a jewel.