Software use restriction cracking method (1)

When some member software tests, the software has time limit, what should I do?

The first crack time limit software principle: generally share the software to achieve the purpose of the computer user usage or time, usually the current time mark or the number of times the user uses the software during installation, concealed storage In the registry or in a file. Every time you use the software, you will be reminded how many times you can use the software. If we can find out the software to call hidden flags and record locations from the registry, modify the time stamp and the number of uses, you can achieve unlimited use.

Second registry monitoring software: how to Is the time stamp or usage count of the software found in the registry? We only need to use a software called RegSnap to make a snapshot of the registry before and after the software runs. By comparing the two registry snapshots, we can determine which key value of the time stamp or usage count of the software is changed. This mark and record can be used to crack the time and number of times the shareware is used.

The third person can find a piece of software on it. Now start.

Step 1: Create After running a RepSnap in a registry snapshot, click the menu "File" "New", in the pop-up save snapshot dialog box, select the snapshot item as "registry only", and enter the snapshot description text for later distinction (for example, input: use 50 times) Then click the "OK" button to start scanning and saving the contents of the registry. After scanning, click the menu "File" "Save" command to save the current snapshot.

Step 2: Create a second snapshot Run the software you want to crack, you can run it multiple times. When the number of available software changes has changed, use the same method as above to save a registry snapshot.

Step 3: Compare Registry Snapshots This step is very important. Now you need to compare the two registry snapshots to find out the differences in the registry. This is the key to cracking the usage limit. Of course, we will not go to manual comparison. You can directly use RepSnap's snapshot comparison function. Click the menu "File" "Compare" command to open the snapshot comparison dialog. RepSnap will automatically compare the last two saved snapshots. In the report options, you can choose to display the modified key name, or display the key name and key value. If you want to get detailed comparison content, select the second item "Show modified key name and key value". Next, click "OK". After pressing the button, you can start comparing the differences between the contents of the two registry snapshots. After the completion, the detailed report information is displayed.

Step 4: Find the number of records From the report you can see that 11 key values ​​have changed in the registry. After careful review, I found an important registry change project (we should look carefully) where "49" and "48" are not the remaining usage of the software.

Step 5: Determine the number of record locations In the RepSnap, click the "Load Registry Editor" button on the toolbar, open the registry editor in the system, expand the registration project "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\IE4\\Setup\\" and find the key value "KEYFSTIMES". First shut down we want to modify the software, and then run again, return to the registry, refresh the key value, you can see that the key value is also reduced by 1, so you can be sure that this is the key to record the remaining number of software.

Step 6: Modify the registry (the most feared by the stone) Try to modify the registry key "KEYFSTIMES" first, and change to the first 50 times. If it is correct, it can be restarted. Come on. There is a kind of software that is very bad. The recorded files have two places. Then look at the snapshot comparison results, and found two changes under the key value:

HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\ WindowsNT\\CurrentVersion\\Prefetcher\\TracesProcessed New: DWORD: 6 (0 by 31) Old: DWORD: 5 (0 by c)

HKEY_LOCAL_MACHIND\\SOFTWARE\\Microsoft\\WindowsNT\\CurrentVersion\\Prefetcher\\TracesSuccessful New: DWORD: 6 (0 by e) Old: D

WORD: 5 (0 by 9) and the two key values ​​correspond exactly to the number of software we have used. That is, we have to change both At the key value, you can reach the limit of the number of times the software is completely broken. Later, when we can't use the software 50 times, we can change the "KEYFSTIMES" key value to 50 times, and the other two keys will be changed to 0.