1

I have a DLL that call GetSystemTimeAsFileTime and set it for check time to prevent program runing Now I want to replace it with fixed date and time for example 07/25/2017 instead of real and dynamic time

Is this possible ?

Screenshot

which one should be change and to what?

  • uninformed.org/index.cgi?v=7&a=2&p=5 – blabb Jul 28 '17 at 15:52
  • How this link can help me? – sIiiS Jul 28 '17 at 18:24
  • you are looking at gs cookie generation . it is a standard api every application that was compiled in windows post vc2010 will have this . the cookie generation procedure is described i the link . you should be looking elsewhere not here for why your program is being blocked . – blabb Jul 28 '17 at 19:38
3

I'm going to reply to this without making any assumptions. I have had to do this very thing before for a client regarding non-copyrighted abandonware. Your results may vary.

As for your specific question, yes, it's possible, but probably not the most optimal (or easiest) solution for what you want to achieve. Regardless, consider the following, bearing in mind that these are just potential solutions:

1. Read into codecaves. This very common technique avails you the memory and functionality to craft, inject, redirect, and execute custom code you write.

2. Trace the execution of that routine. Note any values of interest to you that are residing in registers and/or on the stack, especially return values from call instructions. Depending on what you find, you can create an injection that only modifies existing bytes.

For instance, perhaps the bytes from 1009A467-1009A474 are enough to create a custom mov instruction that puts a value you want into eax prior to the mov instruction at 1009A477.

Or, if you've studied that bit of code enough, perhaps there's something in another register that you can specify at 1009A477, i.e. mov [ebp+var_4], ebx or mov [ebp+var_4], edx, etc.

3. What happens if you nop the two jz instructions? See how they both jump to that segment of code at loc_1009A467? Note that there may be unintended results like instantly triggering the end of a trial period or corrupting data. This is when it can help to monitor the footprint of an application when installing it so you can identify how it maintains persistence with functionality like activation. Maybe it's a temp file, a registry key, or something else.

Finally, the two and instructions you're pointing to at 1009A442 and 1009A446 are zeroing the memory addresses being referenced at [ebp+offsets], respectively. This is just setting them up for use somewhere afterward. Anything you and with 0 will equal 0. It's a common method in Assembly for clearing a register, as is when you xor a register with itself, i.e. xor eax, eax. You can read more about the binary operation and here.

| improve this answer | |
  • new image with full view added. hope it help more to understand.. – sIiiS Jul 28 '17 at 18:23
  • Unfortunately, none of you method works! – sIiiS Aug 2 '17 at 15:05
-1

Here is an example for you.

A friend and I made this a long time ago, to bypass trial on a certain program (not naming it). It modifies the value that GetSystemTimeAsFileTime returned.

GetSystemTimeAsFileTime Hotpatch

| improve this answer | |
  • Thank you for your reply and code but really I don't know how can I use this code in the DLL?! Can you please explain more? – sIiiS Jul 30 '17 at 12:03
  • You want to modify GetSystemTimeAsFileTime, so the date does not change, yes? One way to do this; hooking GetSystemTimeAsFileTime itself, so you control the values it returns. My DLL example, does just this, simply compile it with Visual C++ and attach it to the Import table of application, with a tool such as CFF_Explorer. – fyyre Jul 30 '17 at 13:44
  • See the void WINAPI GetSystemTimeAsFileTimeFake(PFILETIME fileTime) function of my DLL for how to set a fixed date. – fyyre Jul 30 '17 at 14:08
  • I want to set date&time for example 04/25/2017 instead of the date of today... I have not an application, this is a DLL file that control php file for time expiration – sIiiS Jul 30 '17 at 16:10
  • Again, look at the example in my code "GetSystemTimeAsFileTimeFake". Setting wDay = 27; wMonth = 4; wYear = 2017; should accomplish what you needed. – fyyre Jul 30 '17 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.