Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Proof of concept console application that bypasses program trials protected by ASProtect.
using Microsoft.Win32;
using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Threading;
namespace ResetASProtectTrial
{
class Program
{
// Run elevated to allow system time to be set
// Usage: ResetASProtectTrial.exe "C:\Program Files\Path\To\Trial\Protected by ASProtect\App.exe"
static void Main(string[] args)
{
var exePath = args[0];
var si = new STARTUPINFO();
var pi = new PROCESS_INFORMATION();
// Start protected program in a suspended state
var success = NativeMethods.CreateProcess(exePath, null,
IntPtr.Zero, IntPtr.Zero, false,
ProcessCreationFlags.CREATE_SUSPENDED,
IntPtr.Zero, null, ref si, out pi);
// Delete the ASProtect Registry Tree
var keyName = @"Software\ASProtect";
Registry.CurrentUser.DeleteSubKeyTree(keyName);
// Get the date creation/install date of protected program
var installDate = Directory.GetCreationTime(Path.GetDirectoryName(exePath));
var sysTime = new SYSTEMTIME();
var localTime = new SYSTEMTIME();
// Get both system and local times
NativeMethods.GetSystemTime(ref sysTime);
NativeMethods.GetLocalTime(ref localTime);
// Save a copy of the current times
var origSysTime = sysTime;
var origLocalTime = localTime;
// Set the system date to the install date
sysTime.wYear = (short)installDate.Year;
sysTime.wMonth = (short)installDate.Month;
sysTime.wDay = (short)installDate.Day;
sysTime.wDayOfWeek = (short)installDate.DayOfWeek;
NativeMethods.SetSystemTime(ref sysTime);
// Set the local date to the install date
localTime.wYear = (short)installDate.Year;
localTime.wMonth = (short)installDate.Month;
localTime.wDay = (short)installDate.Day;
localTime.wDayOfWeek = (short)installDate.DayOfWeek;
NativeMethods.SetLocalTime(ref localTime);
// Resume the process
IntPtr ThreadHandle = pi.hThread;
NativeMethods.ResumeThread(ThreadHandle);
// Wait a second
Thread.Sleep(1000);
// Set the times back to originals
NativeMethods.SetSystemTime(ref origSysTime);
NativeMethods.SetLocalTime(ref origLocalTime);
}
}
public static class NativeMethods
{
[DllImport("kernel32.dll")]
public static extern bool CreateProcess(string lpApplicationName,
string lpCommandLine, IntPtr lpProcessAttributes,
IntPtr lpThreadAttributes,
bool bInheritHandles, ProcessCreationFlags dwCreationFlags,
IntPtr lpEnvironment, string lpCurrentDirectory,
ref STARTUPINFO lpStartupInfo,
out PROCESS_INFORMATION lpProcessInformation);
[DllImport("kernel32.dll")]
public static extern uint ResumeThread(IntPtr hThread);
[DllImport("kernel32.dll")]
public static extern uint SuspendThread(IntPtr hThread);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool SetSystemTime(ref SYSTEMTIME st);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool GetSystemTime(ref SYSTEMTIME st);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool SetLocalTime(ref SYSTEMTIME st);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool GetLocalTime(ref SYSTEMTIME st);
}
[Flags]
public enum ProcessCreationFlags : uint
{
ZERO_FLAG = 0x00000000,
CREATE_BREAKAWAY_FROM_JOB = 0x01000000,
CREATE_DEFAULT_ERROR_MODE = 0x04000000,
CREATE_NEW_CONSOLE = 0x00000010,
CREATE_NEW_PROCESS_GROUP = 0x00000200,
CREATE_NO_WINDOW = 0x08000000,
CREATE_PROTECTED_PROCESS = 0x00040000,
CREATE_PRESERVE_CODE_AUTHZ_LEVEL = 0x02000000,
CREATE_SEPARATE_WOW_VDM = 0x00001000,
CREATE_SHARED_WOW_VDM = 0x00001000,
CREATE_SUSPENDED = 0x00000004,
CREATE_UNICODE_ENVIRONMENT = 0x00000400,
DEBUG_ONLY_THIS_PROCESS = 0x00000002,
DEBUG_PROCESS = 0x00000001,
DETACHED_PROCESS = 0x00000008,
EXTENDED_STARTUPINFO_PRESENT = 0x00080000,
INHERIT_PARENT_AFFINITY = 0x00010000
}
public struct STARTUPINFO
{
public uint cb;
public string lpReserved;
public string lpDesktop;
public string lpTitle;
public uint dwX;
public uint dwY;
public uint dwXSize;
public uint dwYSize;
public uint dwXCountChars;
public uint dwYCountChars;
public uint dwFillAttribute;
public uint dwFlags;
public short wShowWindow;
public short cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}
public struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public uint dwProcessId;
public uint dwThreadId;
}
[StructLayout(LayoutKind.Sequential)]
public struct SYSTEMTIME
{
public short wYear;
public short wMonth;
public short wDayOfWeek;
public short wDay;
public short wHour;
public short wMinute;
public short wSecond;
public short wMilliseconds;
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.