The only reason a full patch was possible was their poor HASP implementation. and have stuff in their registry, don't set off the emu detection) maintenance time,etc,etc. ( that was redirecting dongles calls, building a fake dongle internally, taking care of the self protection, s/n blacklist, emu detection ( so the users that have previously run emu's. MC7 圆4 MU2 patching was just shy of 400 bytes. Yes, as you've discovered, a few NOP's here an there and patching some jumps aren't going to cut it :-) I'd be interested in your findings on patching 8/9 if you care to share? Not to say x7 MU2 was just a couple lines either, however. 500 bytes doesn't sound as horrible as redirecting each routine somewhere else and then writing code within the executable to, for lack of better terms, emulate an emulator. Unless one were inclined to really patch a LOT more of it than you say. It has to read some kind of value instead of NOP'ing an instruction or redirection to another sub. Quite a bit of stuff to dredge through without debugging as you said. That would explain some of my issues I was having before. ( my apologies if you're already on that track)
Not nuclear physics but a lot of time and work. ) If you're really interested, I'd start by debugging an EMU setup and see how it behaves. ( CRC, EMU check, Blacklist, full HASP patch ie copying all the dongle info into each file, patching user_type,maintenance_time, get_productenablebits etc, etc, redirecting dongle calls, patching various other routines. You'll have to patch 500 or so bytes in each of 3 files. While the structure is somewhat similar, there have been a few significant changes.
( I haven't seen any full patches beyond that) That won't really help too much with X8 & X9 though.
0 kommentar(er)
