:0041F669 FF15701C8C00      CALL [KERNEL32!GetSystemTime]
:0041F66F 66817C2404CE07    CMP WORD PTR [ESP+04], 07CE ;Check for 1998
:0041F676 7519              JNZ 0041F691 ;Beggar off cracker

If you check the 07CE (by typing "? 07CE" in Softice), you'll see that it is 1998. The current year. If the value at WORD PTR [ESP+04] wasn't 07CE, then the program would jump to a nasty MessageBox routine. Next, there is another compare:

:0041F678  66837C240608   CMP WORD PTR [ESP+06], 08 ;Check for August
:0041F67E  720A           JB 0041F68A
:0041F680  750F           JNZ 0041F691 ;Beggar off cracker
 
This compare (WORD PTR [ESP+06] ) checks the month. If the month is earlier than August, jump to 0041F68A, else jump to nasty MessageBox routine.
Finally, there is one last compare:
 
:0041F682  66837C240A1F   CMP WORD PTR [ESP+0A], 1F ;Check for Day = 31st
:0041F688  7307           JAE 0041F691 ;Beggar off cracker
:0041F68A  33C0           XOR EAX,EAX
:0041F68C  5B             POP EBX
:0041F68D  83C410         ADD ESP,10
:0041F690  C3             RET
 
If you type "? 1F" you'll see that 1F is 31 in decimal. What this compare does is check for the 31st day. If it is, the program will jump to the nasty Beggar off cracker routine.
 
Since this is a Beta program, there are no registration routines. To crack this program, we have to patch it. From the above code, we know that the "Program Expired" code is at 0137:0041F691, and that the good code is at 0137:0041F68A. You could add NOPs (25 of them) between the GetSystemTime call and the good code routine, but that would be very messy. Far simpler would be to change the conditional jump (to the Beggar off cracker routine) after the first compare to an unconditional jump to the good code.

0137:0041F676   7519   JNZ 0041F691

changed to:

0137:0041F676   EB12   JMP 0041F68A

NOTE: EB12 means jump 12 bytes forward.

To get the number of bytes to jump, type "? 0041F68A - 0041F678". Remember, 0041F68A is the start of the good code routine, and 0041F678 is the instruction right after the JNZ instruction that we are changing.
 
To do the actual patching, load Rh_Main.exe in your favorite hex-editor (I use HIEW) and go to offset 0041F676.
 
Place the cursor over 7519 (JNZ 0041F691) and change it to EB12.
 
Finally hit F9 to update the file and exit (F10). Back at the desktop, advance your system's date 2 months and run Rhino.exe. It runs beautifully. Program cracked.
 

The 'Crack'

 
Load up Rh_Main.exe into your favorite Hex-Editor ( I prefer hiew v5.66) but just about any Hex-Editor will do..
 
SEARCH FOR THE FOLLOWING BYTES : 66817C2404CE077519
REPLACE WITH HIGHLIGHTED BYTES : 66817C2404CE07EB12
 
 

Final Notes

 
Rhino Beta 1.0 has practically no protection. As you saw, it has only simple compare routines to determine whether to expire or not.

 
My thanks and gratitude goes to:-
 
Fravia+ for providing possibly the greatest source of Reverse Engineering
knowledge on the Web.
 
+ORC for showing me the light at the end of the tunnel.
 

Ob Duh

 
 
Do I really have to remind you all that by buying and NOT stealing the software you use will ensure that these software houses will continue to  produce even *better* software for us to use and more importantly, to continue offering even more challenges to breaking their often weak protection systems.
 
If your looking for cracks or serial numbers from these pages then your wasting your time, try searching elsewhere on the Web under Warze, Cracks etc.