In. net cracking, we often mention the Reflector \ SimpleAssemblyExplorer and CFF release e tools. Let's take a simple and definite Windows Form program as an example to illustrate how they are used. The Code is as follows:
?
123456789101112131415161718192021222324252627 |
public partial class Conversion : Form { public Conversion() { InitializeComponent(); } bool isTrialExpired = true ; private void button1_Click(object sender, EventArgs e) { double c = Convert.ToDouble(textBox1.Text); double f = (c * 9 / 5 ) + 32 ; label3.Text = f.ToString(); } private void TrialExpiredCheck() { if (isTrialExpired) { MessageBox.Show(@ "Trial Duration has expired! Installed Freh copy" , "!!!!Alert Message!!!!" ); Application.Exit(); } } private void Conversion_Load(object sender, EventArgs e) { TrialExpiredCheck(); } } |
The message box pops up and the program exits.
There are several methods to crack this program: 1. Set isTrialExpired to false; 2. Clear the Conversion_Load method; 3. Clear the TrialExpiredCheck method. We can implement the above three tools here:
Reflector:
Reflector must have a Reflexil plug-in. Open the program with Reflector and find the Conversion_Load method. Select Reflexil in tool:
Now we need to add an isTrialExpired = false; code in the Conversion_Load method. The operation is as follows:
Modify Conversion_Load as follows:
Click "OK" and Save:
Running result:
SimpleAssemblyExplorer:
Open the program and select class Editor:
Bool isTrialExpired = true; this code is actually two sentences: bool isTrialExpired = false; isTrialExpired = true; the second sentence is executed in the constructor method, which also corresponds to the first three commands marked here, we only need to delete the three commands.
Running result:
CFF certificate E:
Use ILDASM to open a program
Find the TrialExpiredCheck method. Here we will perform two attacks: 1. Delete Application. Exit (); 2. Delete all content in the method:
Open the program with CFF Explore
Enter 20cc at RAV:
Note:
IL_0018:/* 28 "(0A) 1_1a */call void [System. windows. forms] System. windows. forms. application: Exit (). The address is 28 1A 00 00 0A.
Change all 28 1A 00 00 0A to 00, and click Modify.
Save:
Running result:
To delete all the content of the TrialExpiredCheck method, delete the following command:
You need to change all the marked parts to 00:
Save and run the result:
You are welcome to make a picture of what is wrong with the download!