#1
|
|||
|
|||
Programs kills itself - how to avoid that?
Hello!
There is a software NAT router (http://www.nat32.com/download/nat32e.zip) which demo-version is limited by a maximum runtime of one hour. After that, the program terminates itself. I played around in WDASM and searched for all calls to Kernel32.ExitProcess, but that was no real help. There is also a call to SetTimer, but I had no success with that either. The programs kills itself after one hour - manipulating the system clock does not help. Are there any other ways to delay an action for one hour? How does a program end itself (is there anything I can have a look for)? Or maybe even someone of you may have a look at NAT32 directly... |
#2
|
||||
|
||||
Quote:
Sleep GetCurrentProcessId OpenProcess TerminateProcess |
#3
|
|||
|
|||
Try giving a look also for:
PostQuitMessage PostMessage(WM_QUIT/WM_CLOSE/WM_DESTROY) EndDialog Using an API Monitor program will probably make your life easier. A nice one should be found on: hxxp://www.rohitab.com/apimonitor |
#4
|
|||
|
|||
or a nice trick, TerminateThread. I have seen some programs terminating themself by killing its own threads one-by-one using TerminateThread
|
#5
|
|||
|
|||
OK, User32.PostQuitMessage is called before termination, I guess this was a great help for my further research.
Thank you all for your help! |
#6
|
|||
|
|||
Maybe possible that prog does GetTickCount. Moves initial value to some data field. Then repeats GetTickCount at specified intervals comparing new value with old. Just a thought.
|
#7
|
|||
|
|||
hxxp://www.diamondcs.com.au/freeutilities/apt-techniques.php
|
#8
|
|||
|
|||
try with:
softsnoop by yoda "SoftSnoop is a small debugger which uses the Debug API's to show the normal debug events but SoftSnoop is also able to spy API calls." h++p://y0da.cjb.net/ h++p://scifi.pages.at/yoda9k/files/SS13.zip autodebug "Automatic recording input parameters and output result of the traced APIs in the target program. not need to rebuild the source code, you can monitor the input and output of APIs." h++p://www.autodebug.com/download.php |
#9
|
|||
|
|||
Quote:
you got a working keygen for that? the one i found causes the newer versions to kill themselves ( )... |
#10
|
|||
|
|||
Quote:
I have an old version, i have version 3..... tell me if you want it. |
#11
|
|||
|
|||
May be: than stack is aligned, used "ret" -> after system calls "ExitThread".
Process may generate exception and catch it, and in SEH jump onto "exit place" in system dll's. |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
avoid rapishare.de waiting | Shub-Nigurrath | General Discussion | 52 | 04-03-2005 11:57 |
How to avoid RAR corruption? | Rhodium | General Discussion | 3 | 10-27-2003 03:20 |
SoftIce kills Mouse | aldente | General Discussion | 11 | 09-03-2003 16:13 |