"The default value to clean the seeds variable is 3D4DA1D6h. A lot of vendors are lazy or foolish and don't change this default value. So, a very easy way is just search the pattern 3D4DA1D6h in disassembled codes. You'll get a lot of codes like this : mov [ebp-xxxx], 3D4DA1D6h. Just break on every instance containing this value and ....... run. If the program is checking the license, write down the value in [ebp-xxxx] when the first breakpoint is reached. It's your seed1 (not XORed with key5, it's original seed1). The second breakpoint you get, it's seed2. And trace a little back to the function entry, the keys (1~4) are in the parameters. Anyway, this method won't work for every case, but for beginner, it's easy to learn. ;-)."