About

WireTap Studio is an application created by Ambrosia Software and can record audio from any installed application.

Timer Trial

The application uses a modal window, along with a timer to nag the user into buying and unlocking the application. A debugger run, interrupted by SIGKILL shows that the application is running in a loop:

Program received signal SIGKILL, Killed.
0x96730afa in mach_msg_trap ()
(gdb) bt
#0  0x96730afa in mach_msg_trap ()
#1  0x96731267 in mach_msg ()
#2  0x990722df in __CFRunLoopRun ()
#3  0x990713c4 in CFRunLoopRunSpecific ()
#4  0x990711f1 in CFRunLoopRunInMode ()
#5  0x952e2e04 in RunCurrentEventLoopInMode ()
#6  0x952e2bb9 in ReceiveNextEventCommon ()
#7  0x952e2a3e in BlockUntilNextEventMatchingListInMode ()
#8  0x928e5595 in _DPSNextEvent ()
#9  0x928e4dd6 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#10 0x92b5e1c9 in -[NSApplication _realDoModalLoop:peek:] ()
#11 0x92b5d945 in -[NSApplication runModalForWindow:] ()
...

This can be easily skipped in appDidResignActive_ by jumping over the timer installation and thereby avoiding the entire modal window in the first place.

                                    meth_WTApplication_appDidResignActive_:
000037fe 55                              push       ebp
000037ff 89E5                            mov        ebp, esp
00003801 57                              push       edi
00003802 56                              push       esi
00003803 53                              push       ebx
00003804 83EC2C                          sub        esp, 0x2c
00003807 E9C4000000                      jmp        sub_38d0
0000380c 90                              nop        
0000380d 90                              nop        
0000380e 90                              nop        
0000380f 90                              nop        
00003810 90                              nop        
00003811 90                              nop        
...

That gets rid of any nags, even if the time is set months after the application expiry date. That's it for 1.2.0.