<html>

<head>
<title>Cracking Tutorial [Macromedia FireWorks 2]</title>
</head>

<body bgcolor="#FFFFDC" text="#000000" link="#0000FF" vlink="#800080" alink="#FF0000">
<!--VirtualAvenueBanner-->
<div align="left">

<table border="0" cellpadding="0" width="100%" cellspacing="0">
  <tr>
    <td width="100%"><p align="center"><strong><font face="Arial,Helvetica,Verdana"
    color="#000000"><big><big>Cracking Tutorial for Macromedia FireWorks 2</big></big><br>
    <big>SalesAgent Time Limit Cracking</big></font></strong><br>

<!-- BEGIN Document-View-Counter -->
<img src="http://cgi3.fxweb.com/v2-trackrun.cgi?userid=M38311&quiet=true" nosave height="1" width="1">
<!-- END Document-View Counter -->

    &nbsp;<br>
    &nbsp;</td>
  </tr>
  <tr>
    <td width="100%" bgcolor="#FFFFB4"><hr size="10" color="#C0C0C0" width="95%" noshade>
    <div align="center"><center><table border="0" cellpadding="3" width="90%" cellspacing="0">
      <tr>
        <td width="30%" valign="top" align="left" bgcolor="#FFFF80"><strong><font
        face="Arial,Helvetica,Verdana"><small>Target Program:</small></font></strong></td>
        <td width="70%" valign="top" align="left" bgcolor="#FFFF80"><font
        face="Arial,Helvetica,Verdana"><small>FireWorks 2</small></font></td>
      </tr>
      <tr>
        <td width="30%" valign="top" align="left" bgcolor="#FFFF80"><strong><font
        face="Arial,Helvetica,Verdana"><small>Description:</small></font></strong></td>
        <td width="70%" valign="top" align="left" bgcolor="#FFFF80"><font
        face="Arial,Helvetica,Verdana"><small>FireWorks creates the smallest, highest-quality JPEG
        and GIF graphics in the fewest number of steps. It is a total solution for creating and
        producing web graphics. Fireworks simplifies and streamlines the process of making web and
        screen graphics, while providing the ultimate in flexibility and editability. FireWorks
        also makes it easy to minimize file size without sacrificing quality, which results in
        faster web sites and higher satisfaction among web site visitors.</small></font></td>
      </tr>
      <tr>
        <td width="30%" valign="top" align="left" bgcolor="#FFFF80"><strong><font
        face="Arial,Helvetica,Verdana"><small>Location:</small></font></strong></td>
        <td width="70%" valign="top" align="left" bgcolor="#FFFF80"><a
        href="http://www.macromedia.com"><font face="Arial,Helvetica,Verdana"><small>http://www.macromedia.com</small></font></a></td>
      </tr>
      <tr>
        <td width="30%" valign="top" align="left" bgcolor="#FFFF80"><strong><font
        face="Arial,Helvetica,Verdana"><small>Protection:</small></font></strong></td>
        <td width="70%" valign="top" align="left" bgcolor="#FFFF80"><font
        face="Arial,Helvetica,Verdana"><small>Time Limit / NAG (SalesAgent)</small></font></td>
      </tr>
      <tr>
        <td width="30%" valign="top" align="left" bgcolor="#FFFF80"><strong><font
        face="Arial,Helvetica,Verdana"><small>Tools needed:</small></font></strong></td>
        <td width="70%" valign="top" align="left" bgcolor="#FFFF80"><font
        face="Arial,Helvetica,Verdana"><small>- SoftICE 3.24</small></font></td>
      </tr>
      <tr>
        <td width="30%" valign="top" align="left" bgcolor="#FFFF80"><strong><font
        face="Arial,Helvetica,Verdana"><small>&nbsp; </small></font></strong></td>
        <td width="70%" valign="top" align="left" bgcolor="#FFFF80"><font
        face="Arial,Helvetica,Verdana"><small>- lcc Win32 c-compiler</small></font></td>
      </tr>
      <tr>
        <td width="30%" valign="top" align="left" bgcolor="#FFFF80"><font
        face="Arial,Helvetica,Verdana"><small><strong>Ob duh:</strong></small></font></td>
        <td width="70%" valign="top" align="left" bgcolor="#FFFF80"><font
        face="Arial,Helvetica,Verdana" color="#800000"><small><em>Do I really have to remind you
        all that by BUYING and NOT stealing the software you use will ensure that these software
        houses will continue to produce even *better* software for us to use and more importantly,
        to continue offering even more challenges to breaking their often weak protection systems.<br>
        BTW, It's illegal to use cracked Software!</em></small></font><br>
        <br>
        <font face="Arial,Helvetica,Verdana" color="#800000"><small><em>If you're looking for
        cracks or serial numbers from these pages then your wasting your time, try to search
        elsewhere on the Web under Warez, Cracks, etc.</em></small></font></td>
      </tr>
      <tr>
        <td width="30%" valign="top" align="left" bgcolor="#FFFF80"><strong><font
        face="Arial,Helvetica,Verdana"><small>Info:</small></font></strong></td>
        <td width="70%" valign="top" align="left" bgcolor="#FFFF80"><font
        face="Arial,Helvetica,Verdana"><small>Brand and product names are trademarks or registered
        trademarks of their respective holders.</small></font></td>
      </tr>
      <tr>
        <td width="30%" valign="top" align="left" bgcolor="#FFFF80"><font
        face="Arial,Helvetica,Verdana"><small><strong>Level:</strong></small></font></td>
        <td width="70%" valign="top" align="left" bgcolor="#FFFF80"><font face="Courier New"
        color="#000080"><small>(X)<b>Beginner</b> (X)<b>Intermediate</b> ( )<b>Advanced</b> ( )<b>Expert</b></small></font></td>
      </tr>
    </table>
    </center></div><hr size="10" color="#C0C0C0" width="95%" noshade>
    </td>
  </tr>
  <tr>
    <td width="100%"><font face="Arial,Helvetica,Verdana"><small>More and more programs are
    using <a href="http://www.releasesoft.com">SalesAgent</a> as it's protection. Programs
    that have been protected with SalesAgent have been packed and there is a loader (also
    known as unpacker). If you modify anything within the EXE file of this loader, SalesAgent
    crashs. I will circumvent the crash by using a PROCESS PATCHER!<br>
    <br>
    Well, first of all we need to start the program. So do this now. As you can see a
    screen like the one for VBox pops up. Now you have three choices: <font color="#0000FF">BUY</font>
    - <font color="#0000FF">TRY</font> - <font color="#0000FF">ORDER</font>. If you press on
    BUY nothing real happens. So we can assume that there's no way to register this program.<br>
    <br>
    This dialog box seems to be an advanced one, so a <font color="#008000">BPX
    DialogBoxParamA</font> will work. Exit FireWorks and restart it. SoftICE will pop up. This
    is at the DialogBoxParamA function. Press F10 to step over this CALL. Now the <em>TRIAL
    SCREEN</em> pops up. Press on <font color="#0000FF">TRY</font>. SoftICE will pop up and
    after you've pressed F12 the following code snippet will be displayed:</small></font><br>
    &nbsp; <div align="center"><center><table border="0" width="95%" cellpadding="0"
    cellspacing="0">
      <tr>
        <td width="100%" bgcolor="#FFFFB4"><tt>&nbsp;&nbsp;:00408C53&nbsp;&nbsp;E8E8D1FFFF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CALL&nbsp;&nbsp;&nbsp;&nbsp;00405E40
        &nbsp;&nbsp;&nbsp;&nbsp; ; check time limit and display NAG<br>
        &nbsp;&nbsp;:00408C58&nbsp;&nbsp;83F8FF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CMP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;EAX,-01<br>
        &nbsp;&nbsp;:00408C5B&nbsp;&nbsp;55&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;&nbsp;&nbsp;&nbsp;EBP
        <br>
        &nbsp;&nbsp;:00408C5C&nbsp;&nbsp;750B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;JNZ&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;00408C69
        <br>
        &nbsp;&nbsp;:00408C5E&nbsp;&nbsp;FF154C924200&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CALL&nbsp;&nbsp;&nbsp;&nbsp;[USER32!PostQuitMessage]
        <br>
        &nbsp;&nbsp;:00408C64&nbsp;&nbsp;E981000000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;JMP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;00408CEA
        <br>
        &nbsp;&nbsp;:00408C69&nbsp;&nbsp;8B7C2418&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MOV&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;EDI,[ESP+18]
        <br>
        &nbsp;&nbsp;:00408C6D&nbsp;&nbsp;57&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;&nbsp;&nbsp;&nbsp;EDI
        <br>
        &nbsp;&nbsp;:00408C6E&nbsp;&nbsp;FF1534924200&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CALL&nbsp;&nbsp;&nbsp;&nbsp;[USER32!ShowWindow]
        <br>
        &nbsp;&nbsp;:00408C74&nbsp;&nbsp;57&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;&nbsp;&nbsp;&nbsp;EDI
        <br>
        &nbsp;&nbsp;:00408C75&nbsp;&nbsp;FF153C924200&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CALL&nbsp;&nbsp;&nbsp;&nbsp;[USER32!UpdateWindow]
        <br>
        &nbsp;&nbsp;:00408C7B&nbsp;&nbsp;55&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;&nbsp;&nbsp;&nbsp;EBP
        <br>
        &nbsp;&nbsp;:00408C7C&nbsp;&nbsp;55&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;&nbsp;&nbsp;&nbsp;EBP
        <br>
        &nbsp;&nbsp;:00408C7D&nbsp;&nbsp;68208D4000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;&nbsp;&nbsp;&nbsp;00408D20
        <br>
        &nbsp;&nbsp;:00408C82&nbsp;&nbsp;E8557F0100&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CALL&nbsp;&nbsp;&nbsp;&nbsp;00420BDC
        </tt></td>
      </tr>
    </table>
    </center></div><p><font face="Arial,Helvetica,Verdana"><small><em>Now we can circumvent
    the time limit by just changing the JNZ instruction at 408C5C to a JMP instruction, right?</em><br>
    No! If your time limit has expired, the program will be quited before returning
    from that CALL. However we can bypass the NAG and time limit by just chaning one
    instruction. If you don't know why, think again ... then read on!<br>
    <br>
    If we change the CALL 405E40 at 408C53, where the NAG is generated, into JMP 408C69
    then we will bypass the NAG and also the time limit check. Now we know that the memory
    address of our patch is 408C53 and that we want to execute JMP 408C69 there! So exit and
    restart the FireWorks. At 408C53, do the following:<br>
    <br>
    <font color="#008040">&nbsp;&nbsp;&nbsp;&nbsp; A &lt;ENTER&gt;<br>
    &nbsp;&nbsp;&nbsp;&nbsp; JMP &lt;408C69&gt;<br>
    &nbsp;&nbsp;&nbsp;&nbsp; &lt;ENTER&gt;</font><br>
    <br>
    Now SoftICE displayed EB14 as the code ... so we know everything for our PROCESS
    PATCHER, didn't we?<br>
    <br>
    I'm almost sure that you will remember the thing with the CRC check I told you at
    the beginning of that essay. Well it has a CRC check - but we can still overwrite the code
    in memory <em>(we could also use Victor Porguen's technique, but this essay is for
    Newbies!!)</em>. This sounds as if we can use a PROCESS PATCHER! If you have enough free
    time, code your own process patcher - otherwise use the one Gi0 coded and change it.</small></font></p>
    <div align="center"><center><table border="0" width="95%" cellpadding="0" cellspacing="0">
      <tr>
        <td width="100%" bgcolor="#FFDDDD"><tt>// *
        ================================================================== *<br>
        // * MANY THANKS TO Gi0 FOR RELEASING HIS PROCESS PATCHER SOURCE CODE!! *<br>
        // * IT SAVED ME THE TIME FOR CODING MY ONE!
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<br>
        // * ================================================================== *<br>
        <br>
        #include &lt;windows.h&gt;<br>
        <br>
        void main(void)<br>
        {<br>
        STARTUPINFO si;<br>
        char* cl;<br>
        PROCESS_INFORMATION pi;<br>
        <br>
        ZeroMemory(&amp;si,sizeof(si));<br>
        si.cb = sizeof(si);<br>
        cl = GetCommandLine();<br>
        <br>
        if (CreateProcess(&quot;FIREWORKS 2.EXE&quot;, cl, NULL, NULL,FALSE,
        NORMAL_PRIORITY_CLASS,<br>
        NULL, NULL, &amp;si, &amp;pi))<br>
        {<br>
        <br>
        // PATCH IT IN MEMORY<br>
        WriteProcessMemory (pi. hProcess, (LPVOID) 0x408C53, &quot;\xEB\x14&quot;, 2, NULL);<br>
        <br>
        CloseHandle (pi.hProcess);<br>
        CloseHandle (pi.hThread);<br>
        }<br>
        <br>
        else<br>
        <br>
        MessageBox(NULL,<br>
        &quot;FIREWORKS 2.EXE not found!\nRun process patcher in the program directory!&quot;,<br>
        &quot;Macromedia FireWorks 2 CRACK by TORN@DO&quot;, MB_OK);<br>
        <br>
        }</tt> </td>
      </tr>
    </table>
    </center></div><p><font face="Arial,Helvetica,Verdana"><small>You can crack most of the
    programs out with the usage of a process patcher. Altough I just recommend patching packed
    files or files with a not so easy to circumvent CRC check with such a patcher.</small><br>
    <br>
    <br>
    <small>Another target has been Reverse Engineerd. <a
    href="http://disc.server.com/discussion.cgi?id=42877">Any questions</a> <em><font
    color="#FF0000">(no crack requests)</font></em></small></font>?<br>
    <br>
    </td>
  </tr>
  <tr>
    <td width="100%"><p align="center">&nbsp;<br>
    <small><font face="Arial,Helvetica,Verdana" color="#800000"><strong>If you're USING
    FireWorks BEYOND it's FREE TRIAL PERIOD, then please BUY IT.</strong></font></small></td>
  </tr>
  <tr>
    <td width="100%"><hr noshade size="1" color="#000000">
    </td>
  </tr>
  <tr>
    <td width="100%"><font face="Arial,Helvetica,Verdana" color="#000000"><strong><small><p
    align="center">Copyright &copy; 1999 by TORN@DO and The Immortal Descendants. All Rights
    Reserved.</small></strong></font></td>
  </tr>
</table>
</div>
</body>
</html>
