Programs kills itself - how to avoid that?

[aldente]

Hello!

There is a software NAT router (http://www.nat32.com/download/nat32e.zip) which demo-version is limited by a maximum runtime of one hour. After that, the program terminates itself.

I played around in WDASM and searched for all calls to Kernel32.ExitProcess, but that was no real help. There is also a call to SetTimer, but I had no success with that either.

The programs kills itself after one hour - manipulating the system clock does not help.

Are there any other ways to delay an action for one hour? How does a program end itself (is there anything I can have a look for)?


Or maybe even someone of you may have a look at NAT32 directly...

[cyberbob]

Originally Posted by Big_or_what

How does a program end itself (is there anything I can have a look for)?

Maybe try to look for:
Sleep
GetCurrentProcessId
OpenProcess
TerminateProcess

Try giving a look also for:
PostQuitMessage
PostMessage(WM_QUIT/WM_CLOSE/WM_DESTROY)
EndDialog

Using an API Monitor program will probably make your life easier.
A nice one should be found on: hxxp://www.rohitab.com/apimonitor

or a nice trick, TerminateThread. I have seen some programs terminating themself by killing its own threads one-by-one using TerminateThread

[aldente]

OK, User32.PostQuitMessage is called before termination, I guess this was a great help for my further research.

Thank you all for your help!

Maybe possible that prog does GetTickCount. Moves initial value to some data field. Then repeats GetTickCount at specified intervals comparing new value with old. Just a thought.

[hosiminh]

hxxp://www.diamondcs.com.au/freeutilities/apt-techniques.php

try with:

softsnoop by yoda
"SoftSnoop is a small debugger which uses the Debug API's to show the normal debug events but SoftSnoop is also able to spy API calls."
h++p://y0da.cjb.net/
h++p://scifi.pages.at/yoda9k/files/SS13.zip

autodebug
"Automatic recording input parameters and output result of the traced APIs in the target program. not need to rebuild the source code, you can monitor the input and output of APIs."
h++p://www.autodebug.com/download.php

[aldente]

Originally Posted by pluscontrol

autodebug
"Automatic recording input parameters and output result of the traced APIs in the target program. not need to rebuild the source code, you can monitor the input and output of APIs."
h++p://www.autodebug.com/download.php

looks quite interesting...

you got a working keygen for that? the one i found causes the newer versions to kill themselves ( )...

Originally Posted by Big_or_what

looks quite interesting...

you got a working keygen for that? the one i found causes the newer versions to kill themselves ( )...

I have an old version, i have version 3..... tell me if you want it.

May be: than stack is aligned, used "ret" -> after system calls "ExitThread".

Process may generate exception and catch it, and in SEH jump onto "exit place" in system dll's.