Shortnote

On The Job is a time-tracking and invoicing software. The protection is minimal, a search for updateTrial seems to reveal a method SSMainWindowController_updateTrial which is invoked by objc_msg_updateTrial. On a closer inspection of the object_msg_updateTrial, there are two calls at 0x1d694 and another one at 0x1d6d5.

The whole block encompassing both messages can be avoided by turning the ja into a jmp at 0x1d68e.

0001d68e 0F87C3000000                    ja         0x1D757
                                       ; Basic Block Input Regs: ebx ebp -  Killed Regs: eax ecx edx esp esi edi
0001d694 8B834F3A0900                    mov        eax, dword [ds:ebx-0x1cfd9+objc_msg_updateTrial] ; @selector(updateTrial)

However, a jump further to 0x1D871 gets us over the instructions responsible for showing the “Register On The Job...” menu item:

0001d68e E9DE010000                      jmp        0x1D871
0001d693 90                              nop        
...
0001d7f2 8954240C                        mov        dword [ss:esp+0xC], edx
0001d7f6 8D931BF80800                    lea        edx, dword [ds:ebx+0x8F81B]           ; @"Register On The Job..."
0001d7fc 89542408                        mov        dword [ss:esp+0x8], edx

That pretty much turns the application into full-mode and all trial banners and nags go away.


cracks/on_the_job.txt · Last modified: 2017/02/22 18:30 (external edit)

Access website using Tor


For the copyright, license, warranty and privacy terms for the usage of this website please see the license and privacy pages.