While reading +sandman's newbie message board I came across a thread talking about Rhino 1.1 so I decided to help out and gave it a shot. After doing some tracing I found the protection and here I will explain how it works and how to reverse it. All the protection consists of is a key in the registry starting at 25 and every time you save, export, save as and the such it will decrement until it reaches zero and you are shit out of luck. Other then that the program is fully functional.
What you will need:
-------------------
- Rhinoceros 1.1 (http://www.rhino3d.com)
- SoftIce
- Hex Editor
The crack:
----------
Let begin, first we run the program then we goto Save and then we get a message box saying that we
only have 25 times to save. Well that kinda sucks because we want to save more since we are so
talented and will be making Star Wars animations with this program so we really need that Save
function. Anyhow, so first we try to BPX MessageBoxA and no luck SoftIce didn't break, ok well
you can try to use all the APIs you know of until one works for you or do what I did and go into
SI and type HWND this will show you all the handles of all the currently opened windows. So scroll
down until you see Rhino.exe in the list under Owner and to the right of it under Class-Name you
needs to say "Button" then look all the way on the left side under Window-Handle and remember that
number now ESC out of the list and set a breakpoint on the window message that will result from us
pressing the button. I used this: BMSG handle WM_DESTROY this will cause SI to break right after
the message box is destroyed.
Ok if you didn't get all of that then use BPX ShowWindow that will work aswell. Ok after SI broke
F12 a few times until you are inside Rhino.EXE you should be at 00458647 33C9 XOR ECX, ECX now
lets look at the code around that CALL especially before it, it looks something like this:
