Skip to content

Instantly share code, notes, and snippets.

@ryhanson
Created February 26, 2017 23:13
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save ryhanson/40a855ee9fd4e1336e302de256c2ddd3 to your computer and use it in GitHub Desktop.
Save ryhanson/40a855ee9fd4e1336e302de256c2ddd3 to your computer and use it in GitHub Desktop.
Proof of concept console application that bypasses program trials protected by ASProtect.
using Microsoft.Win32;
using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Threading;
namespace ResetASProtectTrial
{
class Program
{
// Run elevated to allow system time to be set
// Usage: ResetASProtectTrial.exe "C:\Program Files\Path\To\Trial\Protected by ASProtect\App.exe"
static void Main(string[] args)
{
var exePath = args[0];
var si = new STARTUPINFO();
var pi = new PROCESS_INFORMATION();
// Start protected program in a suspended state
var success = NativeMethods.CreateProcess(exePath, null,
IntPtr.Zero, IntPtr.Zero, false,
ProcessCreationFlags.CREATE_SUSPENDED,
IntPtr.Zero, null, ref si, out pi);
// Delete the ASProtect Registry Tree
var keyName = @"Software\ASProtect";
Registry.CurrentUser.DeleteSubKeyTree(keyName);
// Get the date creation/install date of protected program
var installDate = Directory.GetCreationTime(Path.GetDirectoryName(exePath));
var sysTime = new SYSTEMTIME();
var localTime = new SYSTEMTIME();
// Get both system and local times
NativeMethods.GetSystemTime(ref sysTime);
NativeMethods.GetLocalTime(ref localTime);
// Save a copy of the current times
var origSysTime = sysTime;
var origLocalTime = localTime;
// Set the system date to the install date
sysTime.wYear = (short)installDate.Year;
sysTime.wMonth = (short)installDate.Month;
sysTime.wDay = (short)installDate.Day;
sysTime.wDayOfWeek = (short)installDate.DayOfWeek;
NativeMethods.SetSystemTime(ref sysTime);
// Set the local date to the install date
localTime.wYear = (short)installDate.Year;
localTime.wMonth = (short)installDate.Month;
localTime.wDay = (short)installDate.Day;
localTime.wDayOfWeek = (short)installDate.DayOfWeek;
NativeMethods.SetLocalTime(ref localTime);
// Resume the process
IntPtr ThreadHandle = pi.hThread;
NativeMethods.ResumeThread(ThreadHandle);
// Wait a second
Thread.Sleep(1000);
// Set the times back to originals
NativeMethods.SetSystemTime(ref origSysTime);
NativeMethods.SetLocalTime(ref origLocalTime);
}
}
public static class NativeMethods
{
[DllImport("kernel32.dll")]
public static extern bool CreateProcess(string lpApplicationName,
string lpCommandLine, IntPtr lpProcessAttributes,
IntPtr lpThreadAttributes,
bool bInheritHandles, ProcessCreationFlags dwCreationFlags,
IntPtr lpEnvironment, string lpCurrentDirectory,
ref STARTUPINFO lpStartupInfo,
out PROCESS_INFORMATION lpProcessInformation);
[DllImport("kernel32.dll")]
public static extern uint ResumeThread(IntPtr hThread);
[DllImport("kernel32.dll")]
public static extern uint SuspendThread(IntPtr hThread);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool SetSystemTime(ref SYSTEMTIME st);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool GetSystemTime(ref SYSTEMTIME st);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool SetLocalTime(ref SYSTEMTIME st);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool GetLocalTime(ref SYSTEMTIME st);
}
[Flags]
public enum ProcessCreationFlags : uint
{
ZERO_FLAG = 0x00000000,
CREATE_BREAKAWAY_FROM_JOB = 0x01000000,
CREATE_DEFAULT_ERROR_MODE = 0x04000000,
CREATE_NEW_CONSOLE = 0x00000010,
CREATE_NEW_PROCESS_GROUP = 0x00000200,
CREATE_NO_WINDOW = 0x08000000,
CREATE_PROTECTED_PROCESS = 0x00040000,
CREATE_PRESERVE_CODE_AUTHZ_LEVEL = 0x02000000,
CREATE_SEPARATE_WOW_VDM = 0x00001000,
CREATE_SHARED_WOW_VDM = 0x00001000,
CREATE_SUSPENDED = 0x00000004,
CREATE_UNICODE_ENVIRONMENT = 0x00000400,
DEBUG_ONLY_THIS_PROCESS = 0x00000002,
DEBUG_PROCESS = 0x00000001,
DETACHED_PROCESS = 0x00000008,
EXTENDED_STARTUPINFO_PRESENT = 0x00080000,
INHERIT_PARENT_AFFINITY = 0x00010000
}
public struct STARTUPINFO
{
public uint cb;
public string lpReserved;
public string lpDesktop;
public string lpTitle;
public uint dwX;
public uint dwY;
public uint dwXSize;
public uint dwYSize;
public uint dwXCountChars;
public uint dwYCountChars;
public uint dwFillAttribute;
public uint dwFlags;
public short wShowWindow;
public short cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}
public struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public uint dwProcessId;
public uint dwThreadId;
}
[StructLayout(LayoutKind.Sequential)]
public struct SYSTEMTIME
{
public short wYear;
public short wMonth;
public short wDayOfWeek;
public short wDay;
public short wHour;
public short wMinute;
public short wSecond;
public short wMilliseconds;
}
}
@bezik46
Copy link

bezik46 commented Oct 30, 2019

Once compiled, it runs fine, but at least on ASProtect 2.77 it does not reset counter to zero

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment