All we have to do is NOP the entier code for the call out. Fire up your
hexeditor, and change the offset A16 till offset A2F in 90's. (If you
don't know how to find an offset or how to nop, read some other tutorials
on this site (newbie rated))
Run editor.exe, the nag is gone! :)
Now what exactly did we do? We erased the code that calls the
dialog. So, the code of the nag is still there, but it's not used anymore
Sometimes, the program checks if the nag is called. That way the
above methode will fail. (eg PaintShopPro) Another easy way to bypass
the nag, is let the program call the dialogbox, and then end the
How? Let's find out :
How can we find the dialogbox procedure?
Easy, the address was used by DialogBoxParam! (address 401418 : push
0040122B) Ok, jump to 40122B code in W32Dasm.
We are here
0040122B 55 push ebp
0040122C 8BEC mov ebp, esp
0040122E 8B450C mov eax, dword ptr [ebp+0C]
00401231 2D10010000 sub eax, 00000110
00401236 740A je 00401242 //WM_INITDIALOG ?
00401238 48 dec eax
00401239 7433 je 0040126E //WM_COMMAND ?
0040123B 83E802 sub eax, 00000002
0040123E 741A je 0040125A //WM_TIMER ?
00401240 EB41 jmp 00401283
* Referenced by a (U)nconditional or (C)onditional Jump at Address: 00401236(C)
00401242 6A00 push 00000000
00401244 FF35E8B04000 push dword ptr [0040B0E8] //Push Timervalue.
0040124A FF35ECB04000 push dword ptr [0040B0EC]
00401250 FF7508 push [ebp+08]
* Reference To: USER32.SetTimer, Ord:0000h
00401253 E80A8F0000 Call 0040A162 //Call SetTimer
00401258 EB2D jmp 00401287 //We can change this jump
* Referenced by a (U)nconditional or (C)onditional Jump at Address: 0040123E(C)
0040125A 6A01 push 00000001
0040125C 6A01 push 00000001
0040125E FF7508 push [ebp+08]
* Reference To: USER32.GetDlgItem, Ord:0000h
00401261 E8AE8E0000 Call 0040A114
00401266 50 push eax
* Reference To: USER32.EnableWindow, Ord:0000h
00401267 E8968E0000 Call 0040A102 //Enable the button
0040126C EB19 jmp 00401287
* Referenced by a (U)nconditional or (C)onditional Jump at Address: 00401239(C)
0040126E 668B5510 mov dx, word ptr [ebp+10]
00401272 66FFCA dec dx
00401275 7510 jne 00401287
00401277 6A01 push 00000001
00401279 FF7508 push [ebp+08]
* Reference To: USER32.EndDialog, Ord:0000h
0040127C E8878E0000 Call 0040A108
00401281 EB04 jmp 00401287
We notice the SetTimer API in the WM_INITDIALOG.
If we want to exit this procedure, we have to call the EndDialog
Function (40127c). We can easily change the jump at address 401258
'jmp 401287' into 'jmp 401277' That way, we start the dialogbox, and
we close it before it is displayed :) This requires a patch of only one
byte. change 'EB 2D' in 'EB 1D' (This changes the jump to jump 10h bytes
Run the program, no nag ! :)
As you can see in
the above code, When the timer is set, we have some variable that are
pushed on the stack for it. One of them (00401244) is the time (in
How do we know that? Try to figure this one out
yourself! Use win32.hlp !
push dword ptr [0040B0E8]
To know what value is in there, we press the 'Data Hex'-button in
W32Dasm and search for 40B0E8
Since Intel uses
the 'Little Endian' way, our dword value is = 00 00 27 10 h = 10000
10000 millsec = 10 sec This is the value we want to change !
Find the value in your hexeditor, and change it too 00 00 00 00 = 0
sec. (or any other value you want)
Now run the program, we see that the nag appears but the 10 second
delay is gone... :)
I showed you three
ways to kill a nagscreen, but there are many more ways... To kill a
nagscreen the 'right way' you should also remove the DialogBox in the
Resource section. This reduces the file size :) But this is beyond the
scope of this tutorial. If you are interested in more information about
this, or if you have questions about this tutorial, post a comment or ask on the forum.
If you manage to remove the NAG, you have a fast and small texteditor
for free! :)