mm10121991 Posted September 27, 2012 Share Posted September 27, 2012 (edited) hellothis is a new winlicense 2.1.3 unpackme with HWID lockbut not like other because of ring 0 licensing managementgood luck on itWLK.rar Edited September 27, 2012 by mm10121991 Link to comment Share on other sites More sharing options...
LCF-AT Posted September 27, 2012 Share Posted September 27, 2012 Hi,here my unpacked and a Inline file.If the unpacked file does not work on your system maybe then run the other InLine file.Just test and tell whether its working for you.PS: The InLine file also need the WLK.dat in the same folder to run.greetzWLkeygenme HWID RISC Unpacked and InLinePatched x2.rar 4 Link to comment Share on other sites More sharing options...
mm10121991 Posted September 27, 2012 Author Share Posted September 27, 2012 wow nice work !!how did you that ??i thought all licensing management is moved to ring0i didn't thought that it will be solved at least not so fast like this since ring0 protections are always quite hardnice work again LCF-AT. Link to comment Share on other sites More sharing options...
quosego Posted September 30, 2012 Share Posted September 30, 2012 (edited) It's easy. There aren't any antidumps. And my old methods work fine.005B7734 509591BE ¾‘•P should be 333370D5 is_reg dword_100416737 098B42B9 ¹B‹. Is_reg dword_2Set them when the VM checks for correct licensing. @006E0134 ^\E9 9786FFFF JMP 006D87D0It's not moved to ring0.. It's still where it used to be..My VM interpreter output:CMP ECX,EDX || EAX; 00000106, ||| ECX; 509591BE, ||| EDX; 333370D5, ||| EBX; FF926301, // As you can see the correct value is 333370D5CMP ECX,EDX || EAX; 00000106, ||| ECX; 098B42B9, ||| EDX; 2A3B16EF, ||| EBX; FF926101, // Checks which error occured. (HWID in this case) if it passes this'll be skipped.CMP ECX,EDX || EAX; 00000106, ||| ECX; 098B42B9, ||| EDX; 41B0E024, ||| EBX; FF925E01,CMP ECX,EDX || EAX; 00000106, ||| ECX; 098B42B9, ||| EDX; 4B89D694, ||| EBX; FF925C01,Attached is a proper inline not using a loader. And only a 3 dword patch which is at the ep so people can investigate it. It does require the license. Also removed the EP obfuscation for clarity. Also it doesn't crash if the license is removed.regards,q.inline.rar Edited September 30, 2012 by quosego 2 Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now