---------------------------------
NaG KiLL by Iczelion & Plushmm PC
---------------------------------
version 1


What is NaG KiLL?

NaG KiLL is a utility designed by Iczelion & Plushmm to KiLL *certain* NaG screens.  When you first run NaG KiLL on any PE file, it will ask you various questions on whether "is the current window a NaG", "was the previous MessageBox a NaG", etc.  Simply answer accordingly.  A NaGKiLL.ini file will be created in the application's directory.  The next time you run NaG KiLL on the target, viola!  all the NaGs you defined are gone ;)

NaG KiLL will also simulate your "clicks" on a NaG.  For example, users of NetScape Gold 3 (old, but its small and fast) will be familar with the MessageBox "Do you want to accept this cookie xyz?".  If in the NaG defination process you clicked on the button "No", and then define that MessageBox to be a NaG, the next time the occurence of a cookie appears, you will not see that NaG, but NaG KiLL will "inform" the program that, in this case, the "No" button was pressed ;)

Only manually edit NaGKiLL.ini IF you know what you are doing.  You may delete NaGKiLL.ini in order to re-run the NaG defination procedure again.


How to use NaG KiLL

NaG KiLL consists of 4 parts.  The exe, dll, bmpdll & ini
NaGKiLL.exe   : Target/DLL Loader (GUI & Commandline)
NaGKiLL.dll   : DLL (does all of the 'work')
NaGKiLLbmp.dll: NaG KiLL logo done by DaVinci
NaGKiLL.ini   : will be created if it dont exist.  Stores NaG definations

We strongly suggest that you put NaGKiLL.exe, NaGKiLL.dll & NaGKiLLbmp.dll in either at the windows directory (eg. c:\windows\) or at the target's directory.

You may run the NaGKiLL loader in its GUI-form or from the commandline. Obviously it makes more sense that you run the GUI-loader if you running a new target application for the first time.  The commandline is most useful when the NaGKiLL.ini has been created and you wanna start the application without the hassle of going thru the GUI-loader.

You could create a batch file (.bat) to load NaGKiLL and the application.

For example, create NaGKiLL.bat in the application's directory.
Then, assuming your application's name is VuePro32.exe, type this as the body of MaGKiLL.bat:
NaGKiLL VuePro32

When that's done, right-click on "NaGKiLL.bat", choose "Properties", select the "Program" tab and check "Close on exit"

Now, just double-clck on "NaGKiLL.bat".  Its that simple.



Imitations

Just like there are *many* ways your wife/girlfriend/mother/etc can NaG at you, an application can use *many* different APIs to activate a NaG.
This program will attempt to "hook" the 3 most common NaG activators, namely:
1)  ShowWindow
2)  DialogBoxParamA
3)  MessageBoxA

Other APIs are not "hooked" and hence are free to NaG at you at will.

In addition, NaG KiLL assumes that your PE file is "well-behaved".  It will "hook" a PE-encrypted file if and only if the import section is *not* encrypted. More importantly, it assumes that *you* will make the correct choices.  It is a new tool, and it might take some time getting used to.  Play with it.  No physical changes are happening to your target program.

This is a 32bit application and thus it will not work on 8 or 16bit target programs such as your .com and NE files.  If you attempt this, the Loader will report a "Cannot Create Process:  Error Code 87"

If it asks you if a certain window is a NaG, but you dont see any windows on the screen, then click on "NO" because its obviously not a NaG.

NOTE:  If the program needs a NaG in order to operation, then killing the NaG may cause your program to be in a state-of-suspension because, for some reason, it *needs* the NaG.




Future Versions

Future versions (if time allows & interest still exist) may include:
1)  A TiMe-KiLLer as well
2)  "Hooking" more APIs
3)  ...etc...



Disclaimer

We disclaim *everything*




Comments?  Suggestions?  Bug Reports?

You may contact the authors Iczelion & Plushmm at EFNET:#Win32Asm or EFNET:#PhrozenCrew

Alternatively, you may email the authors at: iczelion@galaxycorp.com or plushmm@hotmail.com

Coded Entirely in Win32 Assembly by
Iczelion & Plushmm PC


[released 21 Dec 1998 (Merry Christmas & a Happy New Year)]