Posted by [Op2]BTS on 1/18/2000, 3:34 am
, in reply to "Task II, my understandings"
192.71.20.27
II.2 Change your date and bypass the "Evaluation period expired" nag
Find a patch that makes the program never expire.Base on the works done for I.5, we already know what API is called to obtain the
Current system time.Before you fire up your proggie, press Ctrl+D switch to SoftIce
(Or whatever Debugger you prefer to use), set the break point @ getsystemtimeasfiletime
by entering ' bpx getsystemtimeasfiletime ' then leave SoftIce by typing 'x'.
Run the babe. The proggie will break due to the break point we set before even it displays
the Nag. :) We land here;Break due to BPX KERNEL32!GetSystemTimeAsFileTime (ET=6.64 seconds)
KERNEL32!GetSystemTimeAsFileTime <------ Press F11 to skip over the API call
Break due to G (ET=321.24 microseconds)
015F:00446C08 MOV ECX,[EBP-0C] <--- We land here. It's inside the Acoustica.exe. Load key value 'C'
015F:00446C0B CMP ECX,00024BCB <--- When should we get C=H'24BCB ???
015F:00446C11 JNZ 00446C61 (JUMP )
015F:00446C61 MOV EAX,[EBP-04] <--- Load UTC format of the time you installed the babe. Key Cross.
in my case it's 01BD46A3 (1998/03/02)
015F:00446C64 MOV EDX,[EBP-10] <--- Load UTC format of the current system time.
015F:00446C67 SUB EAX,EDX <--- 'No. of days you've been trying it' calculation starts here!
015F:00446C69 MOV ECX,000000CA
015F:00446C6E XOR EDX,EDX
015F:00446C70 DIV ECX
015F:00446C72 MOV ECX,EAX <--- 'No. of days you've been trying it' stored in ECX
015F:00446C74 MOV [004A8DF6],ECX
015F:00446C7A CMP ECX,1E <--- Compare with 30 days.
015F:00446C7D SETLE AL
015F:00446C80 AND EAX,01
015F:00446C83 MOV ESP,EBP
015F:00446C85 POP EBP
015F:00446C86 RET
015F:00446E75 POP ECX
015F:00446E76 TEST AL,AL <--- Expired? AL=0 Yes AL=1 No.
015F:00446E78 JNZ 00447027 (JUMP )
015F:00447027 TEST BL,BLMy patch is to change the code @ 00446C67 from
00446C67 2BC2 SUB EAX,EDX
to
00446C67 29C0 SUB EAX,EAX
It's only 2 Bytes change. The program will always stay on day 0 of the 30 day trial no matter
what the date is.