Target: Intel C/C++ Compiler 4.0
File(s) to patch: icl.exe
File offset: $A8D0 (43216)
Code offset: $40B4D0 (4240592)
Limitation: trial period limited to 14 days
Rating: My grandmother says, it took her 5 minutes to crack that.
Used tools: WDASM 8.93
I'm too lazy to show original and patched bytes and opcodes. I simply
patched the function at $40B4D0 that it immediately returns eax=1.
At first, I launched all executables from the compiler package. OK -
just the compiler itself, icl.exe, moaned about being a trial version
and that I was on my 1st evaluation day of 14. I set the date to
something beyond 2000, indeed - as Intel says, their evaluation release
of their funny compiler is really run limited to 14 days. Nevertheless,
it produces code without any annoying additions to it.
Very very very often (99,9999%), time evaluations are really easy to
crack. So, I disassembled icl.exe with WDASM. At first, I looked the
string reference table up but did not find anything that looked
suspicious and related to our problem. OK, why not? I studied the
imported functions - voilα, "GetSystemTimeAsFileTime". This function
is referenced at $40B54B what is in the beginning of a quite long
routine what actually does perform the time check and messes your
screen up with annoying messages about your trial period.
So, I scrolled a few lines back and I saw WDASM telling me "Referenced
by CALL at Address: 0040A132". I went to that address, YES - that's it!
After the call there's MOVZW EAX, AL and TEST EAX, EAX. That looks very
suspicious, so I loaded icl.exe into the integrated debugger and set a
breakpoint to this TEST EAX, EAX. With a normal date, this function
returns EAX=1, maybe, EAX even represents the evaluation day you are
currently on. If EAX is 0, the compiler evaluation regards itself as
expired and ceases to do what YOU want.
Now comes the patching. I set a breakpoint to the beginning of this
function $40B4D0. When it was reached, I patched the instructions to
MOV EAX,1 and RET. That's it. My crack does exactly the same.
Have fun with it. Pardon for this terrible tutorial.
The AntiXryst