All the commercial programs used within this document have been used only for the purpose of demonstrating the theories and methods described. No distribution of patched applications has been done under any media or host. The applications used were most of the times already been patched, and cracked versions were available since a lot of time.
Every now and then, when I see components for .Net platform, I always try to download the Trial version and install it to study how the company implemented the Licensing of their product. Often times, you may be dismayed by how simple they implemented it and in just a matter of minutes, you already know the algorithm behind their licensing.
For this article, I will be taking .Net component products by Components4U.
Most of their .Net components are little utilities compiled into a separate DLL to stand as a component and be sold separately. I will be taking Credit Card Validator .NET Component as my target demonstration.
When you first run the application, the screen will show like this:
You will notice that there’s no Nag message pop-ups on their 15-day Trial. So by adjusting our System clock manually, this will give us a throw message exception like this:
So, the question is, where does the application store the information for determining the number of days in my Trial period? By looking/browsing to the source code through Reflector, we will see that they are storing the information in the Windows Registry:
This tells us that the Time/Date data is stored on the CKV Registry entry for CCValidator component. And by looking again on the Reflector, the value of CKV is the Date and Time the component was first used.
And the value of CKV will then test against the 15-days Trial limit. We can compute the Days remaining of CKV by:
1: DateTime time = new DateTime(long.Parse(CKVValue));
3: long x = (((((DateTime.Now.Ticks - time.Ticks)/10000000)/60)/60)/24);
If the value of x is less than 15 days, the application will still run but if it reached greater than 15, the throw message exception will show signaling the component usage expiration.
With this information at hand, without much thinking, the .net component trial expiration can easily be bypassed by setting a negative value in the CKV. This is achieved by setting a DateTime greater than the Date today:
Giving a 1/1/9999 will give us
3155063616000000000 or equivalent to -2918491 Days remaining. Of course, a negative number will never reached a 15 Days Trial mark!
With this value copied to the CKV data in the Windows Registry, the CCValidator component be used until it reached 1/1/9999.
It’s very surprising to me that all their products uses the same Licensing scheme that can easily be bypassed in a minute. For me, a $120 worth of single component is not worth purchasing considering the fact that this can be done by Regular Expression alone and the security of the component is very very weak.