I have a DLL that call
GetSystemTimeAsFileTime and set it for check time to prevent program runing
Now I want to replace it with fixed date and time for example 07/25/2017 instead of real and dynamic time
Is this possible ?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
I'm going to reply to this without making any assumptions. I have had to do this very thing before for a client regarding non-copyrighted abandonware. Your results may vary.
As for your specific question, yes, it's possible, but probably not the most optimal (or easiest) solution for what you want to achieve. Regardless, consider the following, bearing in mind that these are just potential solutions:
1. Read into codecaves. This very common technique avails you the memory and functionality to craft, inject, redirect, and execute custom code you write.
2. Trace the execution of that routine. Note any values of interest to you that are residing in registers and/or on the stack, especially return values from
call instructions. Depending on what you find, you can create an injection that only modifies existing bytes.
For instance, perhaps the bytes from
1009A474 are enough to create a custom
mov instruction that puts a value you want into
eax prior to the
mov instruction at
Or, if you've studied that bit of code enough, perhaps there's something in another register that you can specify at
mov [ebp+var_4], ebx or
mov [ebp+var_4], edx, etc.
3. What happens if you
nop the two
jz instructions? See how they both jump to that segment of code at
loc_1009A467? Note that there may be unintended results like instantly triggering the end of a trial period or corrupting data. This is when it can help to monitor the footprint of an application when installing it so you can identify how it maintains persistence with functionality like activation. Maybe it's a temp file, a registry key, or something else.
Finally, the two
and instructions you're pointing to at
1009A446 are zeroing the memory addresses being referenced at
[ebp+offsets], respectively. This is just setting them up for use somewhere afterward. Anything you
and with 0 will equal 0. It's a common method in Assembly for clearing a register, as is when you
xor a register with itself, i.e.
xor eax, eax. You can read more about the binary operation
Here is an example for you.
A friend and I made this a long time ago, to bypass trial on a certain program (not naming it). It modifies the value that