File monitoring and restriction sharing software

In the previous article on Shared Software cracking, we talked about how to use the registry monitoring method to directly remove the restrictions on the time and number of times of using the shared software. In fact, many similar shared software use more concealed methods, except for the number of times the software is written in the registry or the current time mark, they write some special files into the hard disk. This file is not noticed by the user, but records the user's usage and time. This time, we will explain how to find record files to crack the usage and time limit of shared software.
I. Hard Disk Files
Monitoring Software Regshot
The role of the hard disk monitoring software is similar to the Registry monitoring software described earlier. It also takes a snapshot of the hard disk file storage before and after use, and then compares the New and Old File snapshots, find a new or modified file, which is probably a record of the time and number of times of use.
The commonly used hard disk file monitoring software is "Regshot". This software can be used not only to monitor registration file changes, but also to monitor hard disk partition file changes, it is very suitable for registry and file monitoring.
Ii. Hard Disk Files
Monitoring Method cracking instance
The software we want to crack this time is called "time record V4.0". This software is a convenient Windows timing, recording and memo software with a variety of practical functions, unfortunately, the software can only be used for 45 times (1). The remaining number of times of use is displayed at the bottom of the program interface each time the software is run. The software cannot be used if the number of times of trial is exceeded. Let's crack the limit on the number of times it is used!
 
1. Scan hard disk file snapshots
Run the Regshot software. First, select the file storage format for Record Comparison. If you select HTML file, it is easier to view the comparison result (2 ). Select the scan directory option on the software interface to specify the directory or hard disk partition of the file to be scanned. Generally, the shared software adds record files to the system partition. Therefore, the scan directory is specified as drive C. Then, you can set the path for saving the scan record file and add comments to differentiate them. After the configuration is complete, click "snapshot 1" and select the "scan and save" command in the pop-up menu. The software can scan the system registry and hard disk files and save them as record files.
 
After the first record file is generated, we run "time record V4.0" again, and only 23 usage times are displayed. Switch back to Regshot without worrying about it. Click "snapshot 2" on the page to perform the second scan.
2. Compare snapshot records
After scanning, the "Compare" button on the software interface becomes optional (3 ). Click this button.
 

You can start to compare the two scan records. The displayed comparison result page shows the registry and file changes in the system after the Regshot software is run (4 ).
 

We can see that there are 16 changes in the system, 5 of which are registry changes, 3 new files, and 8 modified files. After careful analysis and experimentation, all the registry key values have no impact on the number of remaining software attempts, and the three newly added files are temporary files, which have no relationship with the number of software usage; at last, there are only eight modified files.
As shown in the figure, two files are modified by the flash get Internet download Express, and four files, including software. LOG and SOFTWARE, are registry files. After the six files are excluded, there are still two files: "C: WINDOWS system32RunTimeErr. log, C: Iotmrd. sys ", the number of software records must be in these two files.
3. analysis record file
Open "RunTimeErr. log" and find that this file is the KV2005 antivirus software error file, then the final analysis target is placed on the "Iotmrd. sys" file. This file is hidden. It is stored as a system file in the root directory of drive C. After you open the file with notepad, you cannot see which software called the file, probably the configuration file of a software (5 ). Since this file was never found in the C root directory before "time record V4.0" was installed, it is inferred that this file is probably a configuration file of "time record.
 
4. cracking software usage
The "Iotmrd. sys" file has been analyzed for a long time, but the root of the file does not see a project that records the number of software times. So I simply renamed the file and re-run the "time record" software. The result was a miracle! -- The software not only has no running error prompt, but also shows the remaining usage times in the prompt bar at the bottom, and resumes to the first 45 times!
5. Completely clear the software usage limit
The "time record" software is found to save the software usage record file. When the software usage limit is exceeded, the "Iotmrd" under drive C will be deleted. sys File to re-use the software. However, manual deletion is troublesome. Is there a simple solution?
Method 1: Create a batch file Method
If we can delete "Iotmrd. sys" before each running of the "time record" software, the remaining usage of the software will always be kept 45 times. How can I automatically delete the "Iotmrd. sys" file before the software starts? We can use a batch processing program to complete this function.
First, create a new file named "TimeRecorder. bat" under the time record software installation directory, open the file in Notepad for editing, and write the following command (6) in it ):
 
"Del C: Iotmrd. sys
C: Program Files time record \ TimeRecorder.exe"
The meaning of these two commands must be clear to everyone! Delete the usage record file and execute the software program. After saving the file, associate the time record software shortcut on the desktop with the BAT file just created. After you double-click the program shortcut on the desktop, the system automatically records the software running time, deletes the "Iotmrd. sys" file before running, and clears the software usage.
Method 2: Modify the file signature method
Since the "Iotmrd. sys" file will be modified every time the software is used, as long as the software cannot be modified, the remaining number of times will always be 45. It's easy. You only need to change the file attribute of "Iotmrd. sys" to read-only, and the software cannot read or write the file.
In addition to the registry and Hard Disk File monitoring methods described in these two articles, there are also many methods to crack the usage of shared software, for example, you can directly modify the system time and use software with special cracking time limits. Since it is relatively simple, I will not discuss it too much. In fact, as long as you have mastered the above two methods, most of the shared software can be cracked!