winlicense 2.1.x hwid bypass ?
 

Hi
how to bypass hwid of 2.1.x winlicense protected targets ?

i have valid license for other pc

Hi.
Take a look here:
https://tuts4you.com/e107_plugins/do....php?view.3526

Hi giv
my tagert don't run in win xp , how to use lcf-at script in other windows os ?
this is my target :
but when i using lcf-at script it show me license error !
may you help me ?
thanks

friend giv , may you help me ?

Bypass the WinLicense 2.4.6.0 HWiD Check
 

Xentry.exe(VeDoc calculator) is protected by WinLicense 2.4.6.0.
It can not run in Windows XP because it imports APIs from dwmapi.dll.

I played in Windows 7 with your valid license file regkey.dat:

1. Set a hardware execution breakpoint at 0147CB7B(where ModuleBase is 00400000);
2. F9, run. waiting for user32.MessageBoxEx(NULL, "This application has been registered to\r\nSkud1 - Private 2", "WinLicense", MB_ICONINFORMATION, 0);
3. Click Ok in MessageBox, then it should land on the BP;
4. At here, modify DWORD [0130A21D]=7CBDC03A;
5. Clear the BP, F9. You are free to go!

It's so simple, so easy to bypass the HWiD Check! Sad for Oreans.

For more technical details, please refer to my post years ago at tuts4you Themida 2.2.6.0, in which attached a WinLicense 2.2.6.0 example.

Hi MistHill
Thanks a lot off
may you tell me how to find "modify DWORD [0130A21D]=7CBDC03A" ?
thanks again

The target is no longer available ... Could you please re-up it ?
I will also have a look :)

@TechLord
Mahmoudnia's link still works.

@Mahmoudnia
It's a long story. Read my post at tuts4you for some hint.
In short, address 0130A21D is the Is_Registered_DWORD1.
1. It was initialized to FALSE (value 0x5B4E0215) at first.
2. Set to TRUE(value 0x7CBDC03A) if License File: RSA decryption and signature verification, decryptions for each fields and checksums all Okay. Else FALSE again, no go further.
3. Set to FALSE if HWiD not matches, error message, exit.
4. Decrypting each setions of the application, resolving imports, relocating, and so on.

What we do is find out the Is_Registered_DWORD1 address and TRUE/FALSE values, and patch it to TRUE at some place before the check.
Easy or difficult, depending on how much understanding for the Oreans' VM architecture.

Thank you for the reply but ...

I am getting this error message :( :

Seems your ISP sucks.

Xentry.rar - OpenDrive

Thanks a lot for the upload ! :)

No.. I don't think it's the ISP... I think that the file from Mahmoudnia's link is deleted... I am able to download other files from Mediafire without issues.

In any case thanks a lot once again for the upload :)

Cheers