WireTap Studio is an application created by Ambrosia Software and can record audio from any installed application.
The application uses a modal window, along with a timer to nag the user into buying and unlocking the application. A debugger run, interrupted by
SIGKILL shows that the application is running in a loop:
Program received signal SIGKILL, Killed. 0x96730afa in mach_msg_trap () (gdb) bt #0 0x96730afa in mach_msg_trap () #1 0x96731267 in mach_msg () #2 0x990722df in __CFRunLoopRun () #3 0x990713c4 in CFRunLoopRunSpecific () #4 0x990711f1 in CFRunLoopRunInMode () #5 0x952e2e04 in RunCurrentEventLoopInMode () #6 0x952e2bb9 in ReceiveNextEventCommon () #7 0x952e2a3e in BlockUntilNextEventMatchingListInMode () #8 0x928e5595 in _DPSNextEvent () #9 0x928e4dd6 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] () #10 0x92b5e1c9 in -[NSApplication _realDoModalLoop:peek:] () #11 0x92b5d945 in -[NSApplication runModalForWindow:] () ...
This can be easily skipped in
appDidResignActive_ by jumping over the timer installation and thereby avoiding the entire modal window in the first place.
meth_WTApplication_appDidResignActive_: 000037fe 55 push ebp 000037ff 89E5 mov ebp, esp 00003801 57 push edi 00003802 56 push esi 00003803 53 push ebx 00003804 83EC2C sub esp, 0x2c 00003807 E9C4000000 jmp sub_38d0 0000380c 90 nop 0000380d 90 nop 0000380e 90 nop 0000380f 90 nop 00003810 90 nop 00003811 90 nop ...
That gets rid of any nags, even if the time is set months after the application expiry date. That's it for