File monitoring, the solution of the restricted share Software-bug warning-the black bar safety net

ID MYHACK58:6220066062
Type myhack58
Reporter 佚名
Modified 2006-01-04T00:00:00


In the last issue of shareware crack articles, we recounted how the through the registry monitoring method, direct Lift sharing software use time and number restrictions. In fact, now there are many similar shared software uses more covert methods, in addition to in the registry to write software frequency of use or the current time mark, they will be in the hard disk to write some special files, the file not the user of the note, but records the user's frequency of use and time. This time we will as we explain how to find out the recorded file, so crack sharing software using a number and time limit of the method. A hard disk file Monitoring software Regshot Hard disk monitoring software role with the foregoing description of the registry monitoring software is similar, is also in the software before use and after use respectively of a hard disk file storage case for a snapshot, and then through the old and new file snapshot comparison between, find the new or modified file, the file is probably using the time and frequency of use of the recording file. The more commonly used hard disk file monitor software is“Regshot”, this software not only can be used to monitor registry file changes, and can also monitor hard disk partition files changes for registry and file monitoring is very suitable. Second, the hard disk file Monitoring law to crack instance This time we want to crack the software called“time recording V4. 0”, This software is a handy Windows timer, recording and Memo software, with a variety of useful features, unfortunately the software can only be used 4 5 times as shown in Figure 1, and each time you run the software in the program interface at the bottom will show the remaining number of trial times, the software will not be used. Here let us to hack it off the number of uses limitations! ! 1. Scan hard disk file snapshot Run Regshot software, first choose the record file save format, select the HTML file comparison is easy to view comparison results as shown in Figure 2)。 Check the software interface of“scan directory”option specifies that you want to scan the file record of a directory or hard disk partition. Due to the General shared software are in the system partition add a record to the file, so I specify the scan directory is C disk. Then set the scan record file save path, and you can add comment text to be distinguished. After setting, click“snapshot”button in the pop-up menu, select“Scan and save”command, the software start scanning the system registry and hard drive files, and save the recording file. ! Generating a first record of the file, we then run a“time recording V4. 0”, then display only 2 or 3 times the time of use. Don't worry about it, switch back to the Regshot software, click interface in the“snapshot”button, for the second scan. 2. Comparison of snapshot records After scanning, the software interface in the“compare”button becomes optional as shown in Figure 3)。 Click the button Regshot that

! You can start comparing the two scan records, in the pop-up comparison results page displays a run the Regshot software in the system registry and file changes, such as Figure 4)。

! You can see the system there are a total of 1 6 at the change, wherein the registry change have 5, added new 3 file modify 8 file. After careful analysis and testing, and all the registry change the key value of the software is the remaining number of times has no effect; and new add the 3 files are temporary files, and software frequency of use does not matter; and finally only the remaining modified 8 files. From the diagram it can be seen, wherein there are two files is FlashGet Internet Download Shuttle run modified; and software. LOG, SOFTWARE, etc. four file is a registry file. To exclude this 6 files left after 2 files:“C:\WINDOWS\ system32\RunTimeErr. log”,“C:\Iotmrd.sys”the software number of Records a certain will in this 2 files. 3. Analysis of the log file Open the“RunTimeErr. log”, found that this file is the original since it is KV2005 antivirus error message file, then the final analysis the target is placed in the“Iotmrd.sys”this file on. This file is hidden attribute, as the system file stored in C drive root directory, use Notepad to open the file, but not seen this file by which software calls, record is most likely a software configuration file, as shown in Figure 5)。 Since the installation of“time recording V4. 0”before the C drive under the root directory is never found by this file, and therefore concluded that the file probably is the“time record”of the configuration file. ! 4. Crack the software using the number of Analysis“Iotmrd.sys”file for a long time, but in the document simply do not see which is the recording software number of items. So just the file will be renamed after re-running the“time recording”software, the result a miracle happened!-- The software not only running the error prompt, and at the bottom of the prompt box displays the remaining number of times, and re-restored to the initial 4 to 5 times! 5. Completely remove the software using limit the number of Find the“time recording”software used to save the software to use the number of log files, after every time over the use of the number of restrictions you cannot use the software, delete off the C drive under the“Iotmrd.sys”the file you can re-use the software. But this manual removal is very troublesome, there is no easy bit of the way? Method one: create a batch file method If we can in each run of the“time recording”software, will“Iotmrd.sys”deleted, then the software of the remaining number of times will always remain in the 4 to 5 times. How to achieve in software before starting the automatic deletion“Iotmrd.sys”file? We can use a batch program to complete this function. The first in time to record the software installation directory under the newly created one named“TimeRecorder . bat”file, use Notepad to open the file for editing, write the following command, as shown in Figure 6: The

! “del C:\Iotmrd.sys C:\Program Files\ 时间 记录 \TimeRecorder.exe” These two commands mean surely we all understand! Is delete using the number of recording files and executing the software program mean. After you save the file, the desktop time recording software shortcut associated to the just created the BAT file. After double clicking on the desktop program shortcut, it will automatically run between the recording software, and run in before delete“Iotmrd.sys”files, emptied software the frequency of use. Method two: modify the file attribute method Since the software each used once it will modify at once“Iotmrd.sys”file, then we just let the software is unable to modify the file, it always keeping the remaining number of times is 4 to 5 times. Very simple, need only will“Iotmrd.sys”the file attribute to read only, the software will not be able to read and write the file. Xiaobian comments: in addition to these two articles describes the registry and the hard disk file monitor extrajudicial, there are many crack share software using a number of methods, such as directly modify the system time, using specialized crack time limit software, etc. Due to the relatively simple without too much description, in fact as long as a good grasp of the aforementioned two methods, most of the shared software can be cracked!!