This time, we have to choose some different approach to crack the native executable.

We can’t use ILDASM or Reflector in order to analyze its opcodes. We can easily conclude that this is a native executable and it is not executing under CLR. We can engage CFF explorer, which displays some significant information such as that this software is developed by using VC++ language, as shown below. We don’t know in which programming language or under which platform this software is developed, so the first task is to identify its origin. As you can see, the following trial software application is expired and not working further and it shows an error message when we try to execute it. In order to explain reverse engineering, we have downloaded the beta version of software from the Internet that is operative for 30 days. One type of copy protection common in trial or beta software allows a program to run only until a certain date. The copy protection mechanism often involves a process in which the software checks whether it should run and, if it should, which functionality should be allowed. The following sample shows a way of bypassing or removing the copy protection in order to use the product without extending the trial duration or, in fact, without purchasing the full version. The vendor stipulates a time restriction on the beta software in order to avoid license misuse and to permit the product to run only in a reduced-functionality mode until the user registers. In copy protection, the user is typically obliged to register the product before use. A familiar type of restriction built into software is copy protection, which is normally forced by the software vendor in order to test the robustness of the software copy protection. When the source code is not provided, it is still possible to patch the corresponding software binaries in order to remove various security restrictions imposed by the vendor, as well as fixing the inherent bugs in the source code. It is expected that the machine is configured with the following tools: The security researcher must have a rigorous knowledge of assembly programming language.

Ollydbg tutorial italiano