Buddhadll 64 Bit Free Patched
Instead of emulating the validation, patch IsLicensed to always return 1.
Disassemble IsLicensed in IDA:
; buddha64.IsLicensed
mov eax, [some_global_flag]
test eax, eax
jz short unregistered
mov eax, 1
retn
unregistered:
xor eax, eax
retn
The some_global_flag is set via another function ValidateLicense() which reads registry/files. buddhadll 64 bit free patched
89 C0 mov eax, eax ; prologue (unimportant)
8B 05 3A 1B 00 00 mov eax, [0x1B3A] ; load flag
85 C0 test eax, eax
74 07 jz 0x7
B8 01 00 00 00 mov eax, 1
C3 ret
31 C0 xor eax, eax ; unregistered path
C3 ret
B8 01 00 00 00 mov eax, 1
C3 ret
(rest filled with 0x90 NOPs)