Shortnote

Leech is a download manager with a clean interface for OSX. The trial version uses the method enterLicense around 0x1000016d8 to display a nag screen after leech has been launched more than 25 times. That is the only limitation of the trial version.

In order to circumvent this, we simply stub the enterLicense window:

 
====== B E G I N   O F   P R O C E D U R E ======
 
 
                                       ; Basic Block Input Regs: rdi -  Killed Regs: rax r13
                                            methImpl_PMMainController_enterLicense_:
00000001000016d8 55                              push       rbp
00000001000016d9 4889E5                          mov        rbp, rsp
00000001000016dc 4157                            push       r15
00000001000016de 4156                            push       r14
00000001000016e0 4155                            push       r13
00000001000016e2 4154                            push       r12
00000001000016e4 53                              push       rbx
00000001000016e5 4883EC58                        sub        rsp, 0x58
00000001000016e9 4989FD                          mov        r13, rdi
00000001000016ec 488B0515700600                  mov        rax, qword [ds:_OBJC_IVAR_$_PMMainController.licenseWindow]
00000001000016f3 49837C050000                    cmp        qword [ds:r13+rax+0x0], 0x0
00000001000016f9 754A                            jne        0x100001745

We turn the jne into a jmp and skip the rest of the method till the return at 0x100001fa4. The necessary change is thus:

00000001000016f9 E9A6080000                      jmp        0x100001FA4
00000001000016fe 90                              nop        
00000001000016ff 90                              nop        
0000000100001700 90                              nop        
0000000100001701 90                              nop         

Also, since after the change, the Buy Leech… menu item will not work anymore, we blank it out in validateMenuItem at 0x10000eb9e:

000000010000ee62 E90F000000                      jmp        0x10000EE76                   ; @"License"
000000010000ee67 90                              nop        
000000010000ee68 90                              nop        
000000010000ee69 488D15F0690500                  lea        rdx, qword [ds:cfstring_Buy_Leech___] ; @"Buy Leech..."
000000010000ee70 84C0                            test       al, al
000000010000ee72 480F45D1                        cmovne     rdx, rcx
000000010000ee76 488B35FB100500                  mov        rsi, qword [ds:objc_sel_localizedStringForKey_value_table_] ; @selector(localizedStringForKey:value:table:) XREF=0x10000ee62

There are nicer ways of course, one could actually write something instead of having a blank menu, but this will do just fine.