Keyboard Maestro uses the following code-block to determine whether the application is registered or not:
0000000100022503 E8B0D9FFFF call __ZN8KMSerial12IsRegisteredEv_10001feb8 ; KMSerial::IsRegistered() 0000000100022508 84C0 test al, al 000000010002250a 756A jne 0x100022576
the instruction jne
can also appear as je
. The jumps have the following outcome:
jne
jump is executed if the application is registered so replace with jmp
je
jump is executed if the application is not registered so nop
And that is all you need to crack this application. You then follow XREFs for ZN8KMSerial12IsRegisteredEv_10001feb8
, we will have the and apply the logic above to every instance.
====== Decorations ======
By performing the procedure above for all
jne and
jes after
ZN8KMSerial12IsRegisteredEv_10001feb8About Keyboard Maestro
popup show the following:
So, we use NIBUnlocker and decompile /Applications/Keyboard Maestro.app/Contents/Resources/English.lproj/About.nib
to About.xib
in order to remove the line containing the Registered to
string:
--- About.xib 2015-01-04 01:02:03.000000000 +0000 +++ About.xib 2015-01-04 01:01:26.000000000 +0000 @@ -108,8 +108,6 @@ <bool key="NSAllowsLogicalLayoutDirection">NO</bool> <object class="NSTextFieldCell" key="NSCell" id="19"> <int key="NSCellFlags">69206081</int> - <reference key="NSControlView" ref="17"/> - <string key="NSContents">Registered To</string> <int key="NSCellFlags2">138414080</int> <reference key="NSBackgroundColor" ref="56"/> <object class="NSFont" key="NSSupport" id="59"> @@ -206,7 +204,7 @@ <object class="NSTextFieldCell" key="NSCell" id="42"> <int key="NSCellFlags">68157504</int> <reference key="NSControlView" ref="41"/> - <string type="base64-UTF8" key="NSContents">wqkgU3RhaXJ3YXlzIFNvZnR3YXJlIFB0eSBMdGQuIDIwMDQtMjAxMw</string> + <string type="base64-UTF8" key="NSContents">wqkgU3RhaXJ3YXlzIFNvZnR3YXJlIFB0eSBMdGQuIDIwMDQtMjAxM8</string> <int key="NSCellFlags2">138413056</int> <reference key="NSBackgroundColor" ref="56"/> <object class="NSFont" key="NSSupport" id="64"> @@ -270,14 +268,6 @@ </object> <object class="IBConnectionRecord"> <object class="IBOutletConnection" key="connection"> - <string key="label">registeredToTextField</string> - <reference key="source" ref="2"/> - <reference key="destination" ref="17"/> - </object> - <int key="connectionID">63</int> - </object> - <object class="IBConnectionRecord"> - <object class="IBOutletConnection" key="connection"> <string key="label">timeSavedTextField</string> <reference key="source" ref="2"/> <reference key="destination" ref="23"/> @@ -326,14 +316,6 @@ </object> <object class="IBConnectionRecord"> <object class="IBActionConnection" key="connection"> - <string key="label">openConvert:</string> - <reference key="source" ref="2"/> - <reference key="destination" ref="17"/> - </object> - <int key="connectionID">70</int> - </object> - <object class="IBConnectionRecord"> - <object class="IBActionConnection" key="connection"> <string key="label">openApplicationWebSite:</string> <reference key="source" ref="2"/> <reference key="destination" ref="29"/> @@ -393,7 +375,6 @@ <reference ref="23"/> <reference ref="29"/> <reference ref="35"/> - <reference ref="17"/> <reference ref="41"/> <reference ref="7"/> </object> @@ -456,20 +437,6 @@ <reference key="parent" ref="35"/> </object> <object class="IBObjectRecord"> - <int key="objectID">54</int> - <reference key="object" ref="17"/> - <object class="NSMutableArray" key="children"> - <bool key="EncodedWithXMLCoder">YES</bool> - <reference ref="19"/> - </object> - <reference key="parent" ref="6"/> - </object> - <object class="IBObjectRecord"> - <int key="objectID">55</int> - <reference key="object" ref="19"/> - <reference key="parent" ref="17"/> - </object> - <object class="IBObjectRecord"> <int key="objectID">56</int> <reference key="object" ref="41"/> <object class="NSMutableArray" key="children">
Recompiling with ibtool –notices –output-format human-readable-text –compile About.nib About.xib
we replace the original About.nib
with the newly generated About.nib
and obtain:
That's all.