BeXL 1.20

or getting db to do the job :)
Introduction (from BeBits):
 

"BeXL is a GUI Visual IDE, generating code for standard BeOS objects and for BeXL own modules. This
 free yourself from writing code for your GUI and let you write code for your application."

You can get it at BeBits.

Your favourite text editor (as usual)
dasm, or RevEng (both are disassemblers).Get them here
Your favourite HEX editor (as usual) (you can get some Hex Editors here)
db, terminal-based Be debugger (included with BeOS).

Background

The app gets registered by reading a keylfile in home/settings folder.
If you dont register, you'll get Save/Exports funcs disabled, and a nag each time you "build".
Here we won't try to fake the app when it loads that a keyfile has been loaded, intead we'll patch each function.
 

Debugging

dasm the executable, OK.
some greps on "Reg" or "Code" doesn't give something interesting.
No effective 80xxx func to track, so we gonna use db, which gonna give us a way to track dynamically loaded funcs.
(if you need some info on db basic commands, you can check this essay)
So fire BeXL, try to save/export/build and you get an Alert box , which means for us : a dynamically loaded function from a native be library, a.k.a : a function with "Alert" inside tis name.
So fire db ("db BeXL" from the command line), click debug, and your db window should pop up.
Now we're looking for an "Alert" library function, so typing "sd alert" (means : symbol dump alert) gives a list of every dynamically loaded func with alert in its name.The one we're looking for looks like:

ecxxxxxx    text AlertPosition__6BAlertff (replace with the right offset)

set a berakpoint on it:

>bp ecxxxxxx

run the app:

>g

try to save (for example), and db pop ups, since it came accross an Alert Box.

now, with a stack crawl :

>sc

you can get the last app offset from where the library call to the Alert box was issued, and if you look at the dead listing from dasm, it will become pretty clear that the latest jump instruction comes after a test which is the same on every disabled function.

So : Save function :

800xxxxx:        jnz    000xxxx <Save__4BeXL+0xxx>

(comes after a cmp - "compare")

->patch to je

The 2 "export" functions (come in the same function in fact)

800xxxxx:        jnz     0x800xxxxx <BeXL::Export(bool, bool)+0x000000xx>

->patch to je

The "build" function (anyhow it works with the nag, but as it's the same method...)

800xxxxx:        jnz     0x800xxxxx <BeXL::MessageReceived(BMessage *Ð+0x00000xxx>

->patch to je


It works :)



I know another method would be to find&&patch the func responsible for the regfile parsing, and it's left as "an exercise to the reader". (didn't find it personally).

This essay tries to be developper-friendly, that's why offset are not published, i.e. : WE DO NOT PROMOTE CRACKS/WAREZ DISTRIBUTION.

Feel free to react by mail/ or on the webboard.

Lenny