Applestore applications check for a certificate found in MASReceipt in order to test whether the application has been bought on the current machine.
Previously, this check has been circumvented by downloading a free application from the app store and then copying the receipt file into the MASReceipt folder of the application to be nulled. This method is not good enough because it still contains a receipt file which may cause problems with application updates, for example, stuck AppStore badge.
For the named app (photosweeper) the subroutine at 0x100002f63 takes care of reading the file and refusing to start if the file is not present or valid.
0000000100002fc8 488D1561E10F00 lea rdx, qword [ds:cfstring_Contents__MASReceipt_receipt] ; @"Contents/_MASReceipt/receipt" 0000000100002fcf 488B35EA420F00 mov rsi, qword [ds:objc_sel_stringByAppendingPathComponent_] ; @selector(stringByAppendingPathComponent:) 0000000100002fd6 4889C7 mov rdi, rax 0000000100002fd9 FFD3 call rbx
The check is easily bypassed by jumping over the entire subroutine:
sub_100002f63: 0000000100002f63 55 push rbp ; XREF=0x10000135f 0000000100002f64 4889E5 mov rbp, rsp 0000000100002f67 4157 push r15 0000000100002f69 4156 push r14 0000000100002f6b 4155 push r13 0000000100002f6d 4154 push r12 0000000100002f6f 53 push rbx 0000000100002f70 4883EC78 sub rsp, 0x78 0000000100002f74 E902070000 jmp 0x10000367B
which leads to the end of the subroutine:
000000010000367b 488B35663D0F00 mov rsi, qword [ds:objc_sel_drain] ; @selector(drain) XREF=0x100002f74 0000000100003682 488B7D80 mov rdi, qword [ss:rbp+0xFFFFFFFFFFFFFF80] 0000000100003686 FF1544FD0C00 call qword [ds:imp___got__objc_msgSend] 000000010000368c 8BBD74FFFFFF mov edi, dword [ss:rbp+0xFFFFFFFFFFFFFF74] 0000000100003692 488BB568FFFFFF mov rsi, qword [ss:rbp+0xFFFFFFFFFFFFFF68] 0000000100003699 E8BC8C0800 call imp___stubs__NSApplicationMain 000000010000369e 4883C478 add rsp, 0x78 00000001000036a2 5B pop rbx 00000001000036a3 415C pop r12 00000001000036a5 415D pop r13 00000001000036a7 415E pop r14 00000001000036a9 415F pop r15 00000001000036ab 5D pop rbp 00000001000036ac C3 ret