Copernic 4.1 reversing
 "If Unregistered then ads"

Anti Advertisement
February 2000

by +Tsehp

edited by Fravia+
Courtesy of Fravia's

Well, "Eyeball grasping" is all the rage nowadays, and more and more dirty tricks are used to force you to look at completely useless banners and idiotical advertisements that noone in his right mind would click onto. Why this actually happens beats me: in my experience and world, in order to find the sort of people that would really eventually click onto one of these banners you would have to visit a center for mentally handicapped in their terminal phase. Maybe I'm wrong, though, and in the real "Guinea Pigs" world that the advertisers dream of, there really exist hundred thousands of slaves who happily click on any commercial abomination they see and then - drooling for pleasure - buy the crap they deserve. I doubt it, though.
Anyway it is our holy duty to destroy these tricksters: they grasp our eyeballs? We'll grasp their - quite sensible - commercial balls. Here you go with a simple, but effective, essay by +Tsehp

There is a crack, a crack in everything That's how the light gets in
(x)Beginner   (x)Intermediate   ( )Advanced   ( )Expert   ( )~S~

Ads are sneaked more and more inside your computer. Even if you pay for a program, its conceptors now don't hesitate to forward advertisement you NEVER WANTED to you. The money they get from their applications is not enough: they need you to click on their "big bucks" banners.

Lets just put an end to this...

Copernic 4.1 reversing
 If Unregistered then ads
Written by +Tsehp

Almost everybody knows this application, it's ane asy to use "meta search bot" that uses the most current search engines to perform your search. It's one of the most used, therefore, similar to what Micro$oft does, they (try to) use an almost monopolistic situation with the aim to transform your computer into a mall.
Without asking you if they are authorised to.

Just try this : download the copernic 2000 pro version 4.0 (it will self update to 4.1) Use a regular, non burned serial (a lot of keygens exists), at first launch, it shows no ads and everything is working fine. But this tool is auto updating to have the last links to search engines, and when it does it shows you at the next searches beautiful banners at the top of your screen. Of course you bought it and you can disable the ads : tools,options,uncheck display ads while searching. But at the next update (almost every day) it will self check this option and show you again the ads, so they are sure you will see at least one. You'll be bored to uncheck this option everytime and will give up, covered by ads.

Of course it is possible to destroy all this devious - and illegal - doing, and since you should have the right to control what happens inside your pc, I will show how to perform an easy crack.

Tools required
Softice (latest version 4.01)
windasm 8.93

The crack has been performed on my actual OS: win 2000 build 2195.3

Target's URL/FTP
[]    Install the free version and use it - against itself - in order to find the pro version ;-) 

Program History
The older versions of this target were gentle towards user. This does not happen any more after version 4.1


The first step is not to hurry on softices breakpointing. Sit down, use some good ole "zen cracking" attitude and think a little about the facts you know.

Now, since there is a feature to remove the ads - for people rich enough to escape the advertisement hell reserved for slaves and poor sods - this means that this target MUST keep a flag for it, a flag that decides wether the owner has enough money to escape advertisement or not. Of course this flag (let's say either true "poor_sucker=0 give him hell" or false "poor_sucker=1 he may escape without ads") must be either inside a kore or less "hidden" file or inside the registry.
Dead easy, of course: We use the regmon tool and check and uncheck the display ads option. Bingo! it's inside the registry.
In fact it is located at
HKEY_CURRENT_USER\Software\Copernic Technologies\Copernic4Plus\Preferences\showad

If this key contains ffffffff, copernic will show them, if contains 00000000 it will not.

You can also simply delete this key: the ad banners will be gone.

Unfortunately, at the next links update, this crap key appears again.
Let's kill it.

Fire softice, bpx regqueryvalueExa do "d esp->8"

Update a search, keep updating until showad is visible inside the data section.

Do several p rets until you land here :
CODE:0056EA46                 call    sub_0_464E68
CODE:0056EA4B                 test    al, al      <-land here
CODE:0056EA4D                 jz      loc_0_56EB06 
CODE:0056EA53                 call    sub_0_46F6E8
CODE:0056EA58                 test    al, al
CODE:0056EA5A                 jnz     loc_0_56EB06
CODE:0056EA60                 cmp     ds:byte_0_599878, 0
CODE:0056EA67                 jnz     loc_0_56EB06
CODE:0056EA6D                 mov     eax, ds:dword_0_5998B0
CODE:0056EA72                 cmp     byte ptr [eax+0Ch], 0
CODE:0056EA76                 jz      short loc_0_56EAA0

The call 464e68 checks for the showad key, created if your serial is not registered into their server, then al contains 1 if so, the jz to 56eb06 is not taken and it shows the ads.

If you force the jz to jump, the ads will never be showed.
Final Notes
I usually don't like cracks, sauf for mere learning purposes, and ususally I would encourage readers to buy programs, but our patience is really tested by these guys, who take your money and at the same time spit on your faces with this awful banner autoshow feature. So I encourage you to create this patch and spread it with the keygen, until those guys remove the feature on the next version.


Ob Duh
I wont even bother explaining you that you should BUY this target program if you intend to use it for a longer period than the allowed one. Should you want to STEAL this software instead, you don't need to crack its protection scheme at all: you'll find it on most Warez sites, complete and already regged, farewell, don't come back.


Anti Advertisement

(c) 2000: [fravia+], all rights reserved