Have been using WinRAR SFX archive, feeling very easy to use, but the recent addition of WinRAR ad, every time you open the archive will pop-up ads, and sometimes even when decompression pop up, pop-up ads each time will all of a sudden Caton , endure for a long time today, really I can not stand, ready to try to advertising, so the process is recorded and here I am using the latest version 5.71.
Disclaimer: This tutorial is only for technical exchanges, not for any commercial purpose, you may not following contents for commercial or illegal purposes, or peril, if you like the program, please support genuine software, purchase registration, get more genuine good service, if infringement please contact the author email!
By CreateWindowExW to advertising
1. First of all my ideas are as follows, the program will run as pop-up form, and said advertising is also a form to some extent, so guess whether this will call CreateWindowEx function to create a form of it, after using IDA verification , and it calls this function.
2. Use OD then loaded WinRAR program, the next CreateWindowExW breakpoint function.
3. Then we direct F9 key to run the program, then the program will break down, resulting in the observation of the first break, following its stack, we need to pay attention WindowName this column, it is clear that this is not.
4. Continue to press the F9 key to run the program, when you press F9 5-6 times, the stack shows the words WinRAR relevant to note here, is the main form immediately create code.
5. In this case we are in the stack window and click the right button to follow disassembly window, and at the breakpoint location] [00D516D1 and remove excess breakpoint, and then reload the program.
6. reload the program after the program is running, and step F8 slowly go down.
7. When [went] 00D51AB9 location, the program will Caton moment, and then it will pop-up ads, so we can be sure this is advertising pop-CALL key CALL
8. At this point we address this in mind the [CALL] call 00D153A0, searching all constants, and these were a few calls CALL replace NOP.
9. Save the file, save all changes, then run to perfection to advertising.
