Welcome back.
Today's topic is how does the program do registration check.
Let's run the program again and see what happens.
And your program starts up.
It already knows that it is unregistered if you click about button.
He also knows that it is unregistered.
So the question now becomes how does the program know that it is unrealistic.
So let us analyze this program in ecstasy for BBG.
Now we run to the entry point by clicking on the run button or pressing have nine
yeah.
Now the entry of mine so we are going to step through line by line by pressing F it and watch when the
window begins to appear.
I'm just pressing F A to step through every line and keeping a lookout for the window
and so far nothing has happened.
Given pressing it to step through.
And now the window has a bit so the window appears when this call is being made.
So this is a good place to put a breakpoint.
So let's put a brake fine here and you can see at this point in time he already knows that it is unregistered
so we shall not restart and analyze this call to see what happens in it.
So let's restart
f press F nine hole click Run and this run to the point and Vienna stop and the brake point.
So let's press F seven to enter the step into this call F seven and now we are at the start of the call.
Keep on pressing FIA to step through it.
And here there's a Windows function to create a dialogue.
And here we are.
You can sure we do and notice what I've been after this car window is shown but the contents are still
empty.
And now it seems there is going to push some parameters to this day getting ready to call in next the
next function
and now is calling the next function and notice this thing here one of the barometer seems to be a file
called key father GST DFC and it is pushing all this barometer for this function coalesce analyse this
function call first and look it up so let's open the browser and look it up.
Time MSD and create file
click the first result and here heavy create.
Just a note.
He so the great file functions access 1 2 3 4 5 6 7 parameters let's check it is 1 2 3 4 5 6 7 parameters.
Correct.
So let's look had the documentation so great file will accept some parameters found in the design access
and the D.A. says they screwed up and see what he means.
Design says can be either open to create a file for read or write
read or write.
So the second parameter Telstra is a barometer that tells you whether to open a file for reading or
writing.
Let's go back and take a look.
So our second parameter is a followed by all the zeros at the back.
So is this read or write so we can make a guess.
If we were to look further down there is a re file refile function down here so if I had to guess this
create file is actually opening this file for reading so after it opens a file you will find out here
is a father's noises.
Then you will skip all this.
This in my Skip already OK let's go back to the create file again.
Nuclear file will return a handle.
So what is what is being written.
Let's scroll down read the written
return value is the function so see the return value isn't one handle to the specified file device named
by a minister.
If the function fields the return value is invalid handle value so let's run through the code again.
So every function call returns something in the E X register.
So now let's start to recall and see where all this step true f you are now here and yes the register
has gone negative 1 so negative 1 means that something has gone wrong that means farther than this.
So there is a hint for you that is looking for this key file that the SD and if it doesn't exist it
means that the program is unregistered.
So let's confirm that by stepping through a and true enough over here days a gem and this gem is based
on the test here it is testing for this whether it is a equal or not equal.
So if the heat what is it.
Yes he is negative one because we move negative one to the essay and so now he is negative one.
So now he wants to compare whether negative one is starting ESEA or not.
So we study essay then he would jump because we have come the CMB instruction compares to different
values either.
If they are the same then it is set to zero flight to one and that and therefore January may.
So that means that if the file is not found because it is a negative one therefore it will Javanese
like this.
And you can see it is jumping or some interesting string down here.
OK so now we know enough that we can solve this for temporary by creating a key father.
GST will do that in the next lesson.
And thank you for watching.