Posted by evilTeach on January 15, 2000, 4:24 pm
, in reply to "Glad it's back."
216.67.74.56
First Observations: Target program is a .wav recorder and editor.
Protections: 30 day trial, Reg. code option. No menu option to register, must choose to register when program 1st starts.Observations:
Setting the machine's date ahead 2 months results in a message box informing the user that the program has expired, followed by the Registration box when the user presses OK.
Turning the date back restores the program's 30 day limit to the correct count.
Using QuickView, we can see two possible functions that check the date: GetLocalTime and GetSystemTimeAsFileTime. We can also note that messageboxes in this program are called using MessageBoxExA (less common than MessageBox or MessageBoxA.)
INTERESTING: I had trouble at first getting FileMon and RegMon to pick up any activity...then I realized that the task name isn't the same as the filename in this case...1st time I've ever experienced that. There's one new lesson for me :-OFirst attempts:
I decided to first work within the code that checks the date, ignoring the burning itch to attack the Reg Code. I quickly found two possible places to patch the software. The first will allow the program to run in evaluation mode forever (displaying a message like "Day 59 of a 30 Day Evaluation") The second patch makes the program think it's always on day 0 of the evaluation. Both of these are nice, but still display the Evaluate/Register Window. Next I will see if I can get the window to not display. Then, and only then, will I begin to examine the Reg. Code. :)Anyone interested in WHERE I patched the program to get these results can email me -- I wish to refrain from posting results, in the spirit of free exploration :)
L8R