tse_2001.htm: Eyeball grasping rebuked

	copernic 2001 pro version "If Unregistered then ads"	Anti Advertisement
March 2001	by +Tsehp	edited by Fravia+
	Courtesy of Fravia's searchlores.org
"they improved the protection just beyond human imagination goes : They put two registry checks instead of one..." Well, "Eyeball grasping" is all the rage nowadays, and more and more dirty tricks are used to force you to look at completely useless banners and idiotical advertisements that noone in his right mind would click onto. Why this actually happens beats me: in my experience and world, in order to find the sort of people that would really eventually click onto one of these banners you would have to visit a center for mentally handicapped in their terminal phase. Maybe I'm wrong, though, and in the real "Guinea Pigs" world that the advertisers dream of, there really exist hundred thousands of slaves who happily click on any commercial abomination they see and then - drooling for pleasure - buy the crap they deserve. I doubt it, though. Anyway it is our holy duty to destroy these tricksters: they grasp our eyeballs? We'll grasp their - quite sensible - commercial balls. Here you go with a simple, but effective, essay by +Tsehp
There is a crack, a crack in everything That's how the light gets in
Rating	(x)Beginner (x)Intermediate ( )Advanced ( )Expert ( )~S~

Ads are sneaked more and more inside your computer. Even if you pay for a program, its conceptors now don't hesitate to forward advertisement you NEVER WANTED to you. The money they get from their applications is not enough: they need you to click on their "big bucks" banners.

Lets just put an end to this...

copernic 2001 pro version
If Unregistered then ads
Written by +Tsehp

Introduction

Almost everybody knows this application, it's ane asy to use "meta search bot" that uses the most current search engines to perform your search. It's one of the most used, therefore, similar to what Micro$oft does, they (try to) use an almost monopolistic situation with the aim to transform your computer into a mall.
Without asking you if they are authorised to.

Just try this : download the copernic 2000 pro version 4.0 (it will self update to 4.1) Use a regular, non burned serial (a lot of keygens exists), at first launch, it shows no ads and everything is working fine. But this tool is auto updating to have the last links to search engines, and when it does it shows you at the next searches beautiful banners at the top of your screen. Of course you bought it and you can disable the ads : tools,options,uncheck display ads while searching. But at the next update (almost every day) it will self check this option and show you again the ads, so they are sure you will see at least one. You'll be bored to uncheck this option everytime and will give up, covered by ads.

Of course it is possible to destroy all this devious - and illegal - doing, and since you should have the right to control what happens inside your pc, I will show how to perform an easy crack.

Tools required

Softice (latest version 4.01)
windasm 8.93
regmon

The crack has been performed on my actual OS: win 2000 build 2195.3

Target's URL/FTP

[http://www.copernic.com/] Install the free version and use it - against itself - in order to find the pro version ;-)

Program History

The older versions of this target were gentle towards user. This does not happen any more after version 4.1
Now we're on march 2001 so we're talking on this update about the copernic 2001 pro version, one year passed since this first essay and they improved the protection just beyond human imagination goes : They put two registry checks instead of one...

Essay

The first step is not to hurry on softices breakpointing. Sit down, use some good ole "zen cracking" attitude and think a little about the facts you know.

Now, since there is a feature to remove the ads - for people rich enough to escape the advertisement hell reserved for slaves and poor sods - this means that this target MUST keep a flag for it, a flag that decides wether the owner has enough money to escape advertisement or not. Of course this flag (let's say either true "poor_sucker=0 give him hell" or false "poor_sucker=1 he may escape without ads") must be either inside a kore or less "hidden" file or inside the registry.
Dead easy, of course: We use the regmon tool and check and uncheck the display ads option. Bingo! it's inside the registry.
In fact it is located at
HKEY_CURRENT_USER\Software\Copernic Technologies\Copernic4Plus\Preferences\showad

If this key contains ffffffff, copernic will show them, if contains 00000000 it will not.

You can also simply delete this key: the ad banners will be gone.

Unfortunately, at the next links update, this crap key appears again.
Let's kill it.

Fire softice, bpx regqueryvalueExa do "d esp->8"

Update a search, keep updating until showad is visible inside the data section.

Do several p rets until you land here :

CODE:0057FD7B                 call    sub_46681C
CODE:0057FD80                 test    al, al <-reg contains 0 ?
CODE:0057FD82 
CODE:0057FD82                                  
CODE:0057FD82                 jmp     loc_57FE51 <- patch this to jmp, so ads are not showed.
CODE:0057FD82 ; ---------------------------------------------------------------------------
CODE:0057FD87                 db    0 ;  
CODE:0057FD88 ; ---------------------------------------------------------------------------
CODE:0057FD88                 call    sub_4714B8
CODE:0057FD8D                 test    al, al
CODE:0057FD8F                 jnz     loc_57FE51
CODE:0057FD95                 cmp     ds:byte_5B5A98, 0
CODE:0057FD9C                 jnz     loc_57FE51
CODE:0057FDA2                 mov     eax, ds:dword_5B5AD8
CODE:0057FDA7                 cmp     byte ptr [eax+0Ch], 0
CODE:0057FDAB                 jz      short loc_57FDD5
CODE:0057FDAD                 mov     eax, ds:dword_5B5AD8
CODE:0057FDB2                 mov     edx, [eax]
CODE:0057FDB4                 call    dword ptr [edx+4]

And now, the real innovation, a second check is done elsewhere :

CODE:0058465D call sub_46681C
CODE:00584662 test al, al <-showad reg contains 0 ?

CODE:00584664 jmp short loc_584689 ; <- patch this to jmp
CODE:00584666 ; ---------------------------------------------------------------------------
CODE:00584666 mov edx, 1388h
CODE:0058466B mov eax, [ebp-4]
CODE:0058466E mov eax, [eax+52Ch]
CODE:00584674 call sub_45B6C0
CODE:00584679 mov dl, 1
CODE:0058467B mov eax, [ebp+var_4]
CODE:0058467E mov eax, [eax+52Ch]
CODE:00584684 call sub_45B6B0
CODE:00584689
CODE:00584689 loc_584689: ; CODE XREF: sub_5844C0+1A4j
CODE:00584689 pop ecx
CODE:0058468A pop ecx
CODE:0058468B pop ebp
CODE:0058468C retn
CODE:0058468C sub_5844C0 endp ; sp = 4

And see you next year for the copernic 2002 version with maybe three checks next time ;-)

Final Notes

I usually don't like cracks, sauf for mere learning purposes, and ususally I would encourage readers to buy programs, but our patience is really tested by these guys, who take your money and at the same time spit on your faces with this awful banner autoshow feature. So I encourage you to create this patch and spread it with the keygen, until those guys remove the feature on the next version.

+Tsehp

Ob Duh

I wont even bother explaining you that you should BUY this target program if you intend to use it for a longer period than the allowed one. Should you want to STEAL this software instead, you don't need to crack its protection scheme at all: you'll find it on most Warez sites, complete and already regged, farewell, don't come back.

Fravia+

Anti Advertisement