Techsmith Products Hook

[zen]

> only legitimate site to get my releases
Present company excluded, of course.

It seems likely that @jasi2169 protected the dll files with Themida to preserve his credits popup and prevent modification of the dll. I could not access the Iran site but I looked at the file posted here and it merely cracked the software. It is likely that since I was using a virtual machine the payload, whatever it supposedly is, did not activate. The "dirty" version.dll did not have a popup message from jasi2169 so I'm not sure it was meant to impersonate and abuse his reputation to spread malware, or not. Another consideration is that sometimes Themida itself causes detection in virus scanners. I am not saying this other version is clean but it is an interesting puzzle.

The crack is very simple, forcing a response value of "1" from TSCLicensing::LicenseType (multi-user perpetual license) and could be accomplished in several different ways. It doesn't require a loader. This is true for Camtasia and Snagit, which are native code and use this licensing dll method. I understand that the point of the jasi2169 dll was convenience. Also, for people using this software, you should change these default settings: In the File menu, Capture Preferences, and uncheck "automatically check for updates" and "send anonymous usage data". Still, whether you are using the loader or not, the software sends telemetry to my.nalpeiron.com/shafer2.asmx. This seems to be related to "Zentitle" cloud licensing.

TmC asked about "audiate" which is another Techsmith product. That it is a Electron (NodeJS) application and does not use the same method. It might be that in index.js the variable "activated" needs to be set, I don't actually know I only looked at it briefly.