Create a new version of paste:

https://youtu.be/u0QMe3r1N2Y

A view into how a Computer Program works with Disassembler examples.

KEYBOARD KEYS USED

Spacebar: used to change View after loading.

F7 KEY: Single Step - Steps into Call

F8 KEY: Single Step - Steps over Call

F9 KEY: Run and Break at Breakpoint

Ctrl - C KEY: Used to copy text

; Semicolon KEY: Insert a Quote - Create Debug Info: Referenced throughout program.
 
Placing mouse over a reference shows a popup, use Mouse wheel to scroll text.
Clicking on a Reference: Jumps to that Reference.

Hexplorer - F3 KEY: Used to Search again - Message Hex not Found = only Found 1 time.


CHECK LICENSE Function is a Boolean Function: The call before ( test al, al - jnz loc_43EA20 )
The is_TRIAL Function returns an Integer in AX, ( al = 0 : not Trial ), not zero is probally Days remaining.


QUESTIONS: ????

What is a Boolean Function call ? ANSWER: A Boolean Function returns true = 1, or false = 0 in Register AL

Why change the Functions, and not change the ( jz = jump if zero ), or ( jnz = jump if not zero ) after test al, al ??
ANSWER: The Functions may be called by other parts of the Program, and is_TRIAL was called several times.

In a better way to change the function: Why return a zero in Register AL, and also set the Variable to zero ?? 
ANSWER: The variable may be checked somewhere else in the Program. Both methods shown as different ways to do it, and
        it's best to also set Variable. When changing a jump after a Compare : Change the compare to a move Instruction.

Why Patch Function at END, and not at the TOP by using ( B0 01 C3 ) = mov al, 01 - the c3 = Return ??
ANSWER: The Function may need to set Variables, but if it causes problems then patch at the very top before the push Instructions.

Why was the 90 used ? What is it ? and Why change all 4 bytes, and Why was all 4 of the bytes Dark Green ??
ANSWER: Instruction ( 0F B6 41 12 ) is a 4 byte Instruction, and replaced by 2 byte Instruction ( B0 00 ) = Move ZERO to Register AL
        the other 2 bytes must be replaced with 90 = NOP which is NO OPERATION POSSIBLE, or the program will crash. 

Why subtract 400c00 from the Debugger Offset to find the File Offset ??
ANSWER: 400c00 is the memory loading offset, the start of 32-bit Programs code segment - file header.
        64 bit Programs: Windows may relocate memory loading offset, and cause a time consuming Rebase, or Reanalyzing of program.
        
        The Different methods, and the how to jump to an address and open Hex-View Tab shown for Demonstration purposes only.


Why do you do it ??  ANSWER: It's a hobby, a puzzle to solve, and done as a mental challenge.


Hope you enjoyed the EDUCATIONAL VIDEO (:-))> A view into how a Computer Program works with Disassembler examples.


Program was a very easy example, but other programs may not be easy !


Have a great day, countryboy


========================================================================================== EAMPLES USED IN BUILD BOX ==================================================================================


.text:0043D26D loc_43D26D:                             ; CODE XREF: sub_43C7D0+AF3j
.text:0043D26D                                         ; sub_43C7D0+AFEj
.text:0043D26D lea     esp, [ebp-0Ch]                  ; END FUNCTION:
.text:0043D270 mov     eax, ebx
----------------------------------------------------------    2 BYTE INSTRUCTION
0043D270  89 D8 - 5B 5E 5F 5D C3 89  F6 8D BC 27 00 00 00 00 
---  89 D8 5B 5E 5F 5D C3 89  F6 8D BC 27 00 00 00 00 -- FILE OFFSET : 3C670
0043D270  B0 01 - 5B 5E 5F 5D C3 89  F6 8D BC 27 00 00 00 00  ; MOVE A 1 TO REGISTER AL THE LOW BYTE OF REGISTER EAX 
-----------------------------------------------------------
.text:0043D272 pop     ebx
.text:0043D273 pop     esi
.text:0043D274 pop     edi
.text:0043D275 pop     ebp
.text:0043D276 retn
.text:0043D276 ; ---------------------------------------------------------------------------


===============================================================================================================================================

00402F40  0F B6 41 12 C3 90 8D 76  00 8D BC 27 00 00 00 00 

.text:00402F40 ; =============== S U B R O U T I N E =======================================
.text:00402F40
.text:00402F40 ; is_TRIAL - CHECK IF TRIAL
.text:00402F40
.text:00402F40 sub_402F40 proc near                    ; CODE XREF: sub_410065-1146p
.text:00402F40                                         ; sub_415D20+13p ...
.text:00402F40 movzx   eax, byte ptr [ecx+12h]
----------------------------------------------------------    ; MOVE A 0 = ZERO TO REGISTER EAX LOW BYTE REGISTER = AL
00402F40  0F B6 41 12 - C3 90 8D 76  00 8D BC 27 00 00 00 00 
--  0FB64112C3908D76008DBC2700000000 -- FILE OFFSET : 2340 
00402F40  B0 00 90 90 - C3 90 8D 76  00 8D BC 27 00 00 00 00  ; RETURN 0 NOT A TRIAL VERSION
----------------------------------------------------------
.text:00402F44 retn
.text:00402F44 sub_402F40 endp
.text:00402F44
.text:00402F44 ; ---------------------------------------------------------------------------
.text:00402F45 align 10h


================================================================================================= A BETTER WAY TO CHANGE FUNCTION =========================================================================


A BETTER WAY TO CHANGE THE FUNCTION than Example 1

EXAMPLE 1.

.text:00402F40
.text:00402F40 ; =============== S U B R O U T I N E =======================================
.text:00402F40
.text:00402F40 ; CHECK IF TRIAL
.text:00402F40
.text:00402F40 sub_402F40 proc near                    ; CODE XREF: sub_410065-1146p
.text:00402F40                                         ; sub_415D20+13p ...
.text:00402F40 movzx   eax, byte ptr [ecx+12h]
-----------------------------------------------------------
00402F40  0F B6 41 12 - C3 - 90 8D 76  00 8D BC 27 00 00 00 00 
---  0FB64112C3908D76008DBC2700000000 -- FILE POSTION : 2340
00402F40  B0 00 90 90 C3 90 8D 76  00 8D BC 27 00 00 00 00 
----------------------------------------------------------
.text:00402F44 retn
.text:00402F44 sub_402F40 endp
.text:00402F44
.text:00402F44 ; ---------------------------------------------------------------------------


EXAMPLE 2.

A BETTER WAY TO CHANGE THE FUNCTION : set the variable and return a 0

xor     eax, eax ------------ NOW EAX = 0, and Register AL is the Low Byte Register of EAX
mov     [ecx+12h], al ------- NOW the Byte Variable at the Address in Register ecx + 12 is = 0

USED A BYTE (90) FROM THE --- align --- Section : DEAD CODE IS NOT RUN FOR ALIGNMENT ONLY

.text:00402F34 ; ---------------------------------------------------------------------------
.text:00402F35                 align 10h    ; COMPILER ALIGNMENT CODE SECTION.
.text:00402F40
.text:00402F40 ; =============== S U B R O U T I N E =======================================
.text:00402F40
.text:00402F40 ; CHECK IF TRIAL
.text:00402F40
.text:00402F40 sub_402F40      proc near               ; CODE XREF: sub_410065-1146p
.text:00402F40                                         ; sub_415D20+13p ...
.text:00402F40                 xor     eax, eax
.text:00402F42                 mov     [ecx+12h], al
-----------------------------------------------------------
00402F40  0F B6 41 12 C3 - 90 8D 76  00 8D BC 27 00 00 00 00 
---  0FB64112C3908D76008DBC2700000000 -- FILE POSTION : 2340
00402F40  31 C0 88 41 12 C3 - 8D 76  00 8D BC 27 00 00 00 00
-----------------------------------------------------------
.text:00402F45                 retn
.text:00402F45 sub_402F40      endp
.text:00402F45
.text:00402F46 ; ---------------------------------------------------------------------------


VERSION OF BUILDBOX IN VIDEO
BuildBox_1.3.5-683_1dd8ec51dedc9255b72c89afef4e6e54

LOADER: https://mega.nz/#!1w8ziBQY!DutI9328SHJ5w5HpWvcGtHafi7-65miMnHMTIJFk2uM.