Checksum of WinLicnese 2.1.0.10
 

I tried to inline patch the main program of WinLicense 2.1.0.10 today.
However, I found that old tricks are not working now.

I tried the following two methods, but all in vain.

1. CheckSumMappedFile method

2. FreeLibrary method

Anyone knows how to defeat the checksum on WinLicense 2.1.0.10?

I think they have changed it after quesego's tutorial is released.

Trace the VM compares. I doubt they changed it that much.
Break on checksummappedfile, then bp in the VM (CISC)
cmp ecx,eax
pushfd

In RISC it'll be slightly different, can't remember something like cmp eax, ebx or so.

The correct checksum will be the one that differs from the original. :)