WinLicense v3.2.2 (Window Function Through an External Plugin)

[lengyue]

View File

WinLicense v3.2.2 (Window Function Through an External Plugin)

---

This is a WinLicense 3.2.2/sample, set by default, without adding an SDK in the source code, only adding a window function through an external plugin. I don't know if bypass can be cracked, I tested it and it doesn't. Shedding may be more complicated.Please use your own way to crack it. Whether it's molting, bypass, or keygen, they are all the best methods. No need to upload your proposal, posting a picture is the best answer. I will strive to learn towards your achievements. HWID：1031-E184-1D1E-92A8-AA82-151F-E2BC-34EE NAME：Mr.Leng .RegistCode:2FGP7NTY-22AMY4QL-XXEHAOKD-ZJKHKDKR-VY66SHXY-YTEQXVBF-GAXAEFIA-7BQWOTA5-5CE344K4-VBGMG25R-5TGP26WS-AIKQB3S5-5LDUHEHX-S6KSKH3H-OPPHIFAX-N6WPWIAM

 

 

WinLicense3.2.2_sample.rar

 

---

• Submitter
  lengyue
• Submitted
  02/07/2025
• Category
  CrackMe

 

[Noob boy]

This plugin is much more powerful than the original WinLicense. 80-90% of people can’t get around it!

[Noob boy]

This is a sample encrypted by default and without anti-debugging enabled.WinLicense3.22.rar
6FF2-7FBC-317A-E404-40AC-57D7-D049-706D

Edited March 12 by Noob boy

[karan]

Among the anti-debug techniques, there's an interesting one worth noting.

A dummy thread is created and then it calls Sleep(0x32).
(The goal is for the created thread to be detected by tools like x64dbg.)

Then, it calls NtQueryObject with the ObjectBasicInformation class using the thread handle.

If the returned HandleCount is greater than 1, it determines that debugging is in progress.

 

void dummy()
{
	Sleep(8000);
}

bool CheckCreateThreadHandleCount()
{
	HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)dummy, NULL, 0, NULL);
	if (hThread == NULL)
	{
		return false;
	}

	Sleep(0x32);

	PUBLIC_OBJECT_BASIC_INFORMATION objInfo;

	NTSTATUS status = NtQueryObject(hThread, ObjectBasicInformation, &objInfo, sizeof(objInfo), NULL);

	if (!NT_SUCCESS(status))
	{
		CloseHandle(hThread);
		return false;
	}

	std::cout << "Handle Count: " << objInfo.HandleCount << std::endl;

	if (objInfo.HandleCount > 1)
	{
		CloseHandle(hThread);
		return true;
	}

	CloseHandle(hThread);
	return false;
}

 

[lengyue]

21 hours ago, karan said:

Among the anti-debug techniques, there's an interesting one worth noting.

A dummy thread is created and then it calls Sleep(0x32).
(The goal is for the created thread to be detected by tools like x64dbg.)

Then, it calls NtQueryObject with the ObjectBasicInformation class using the thread handle.

If the returned HandleCount is greater than 1, it determines that debugging is in progress.

 

void dummy()
{
	Sleep(8000);
}

bool CheckCreateThreadHandleCount()
{
	HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)dummy, NULL, 0, NULL);
	if (hThread == NULL)
	{
		return false;
	}

	Sleep(0x32);

	PUBLIC_OBJECT_BASIC_INFORMATION objInfo;

	NTSTATUS status = NtQueryObject(hThread, ObjectBasicInformation, &objInfo, sizeof(objInfo), NULL);

	if (!NT_SUCCESS(status))
	{
		CloseHandle(hThread);
		return false;
	}

	std::cout << "Handle Count: " << objInfo.HandleCount << std::endl;

	if (objInfo.HandleCount > 1)
	{
		CloseHandle(hThread);
		return true;
	}

	CloseHandle(hThread);
	return false;
}

 

You are wonderful.

[jackyjask]

time to add new anti-dbg trick into ScyllaHide plugin !?!?

 

[boot]

I have also released a simple demo WL plugin. This is a protected example.

_released.zip

 

Edited 3 hours ago by boot

[Kanes]

2 hours ago, boot said:

I have also released a simple demo version plugin.

This is a protected example.

Could you upload it to mediafire, mega or google drive? i am not from china and i have not been able to download your examples. If you can upload the plugin and the protected example would be great, thank you.