On The Job is a time-tracking and invoicing software. The protection is minimal, a search for updateTrial
seems to reveal a method SSMainWindowController_updateTrial
which is invoked by objc_msg_updateTrial
. On a closer inspection of the object_msg_updateTrial
, there are two calls at 0x1d694
and another one at 0x1d6d5
.
The whole block encompassing both messages can be avoided by turning the ja
into a jmp
at 0x1d68e
.
0001d68e 0F87C3000000 ja 0x1D757 ; Basic Block Input Regs: ebx ebp - Killed Regs: eax ecx edx esp esi edi 0001d694 8B834F3A0900 mov eax, dword [ds:ebx-0x1cfd9+objc_msg_updateTrial] ; @selector(updateTrial)
However, a jump further to 0x1D871
gets us over the instructions responsible for showing the "Register On The Job…" menu item:
0001d68e E9DE010000 jmp 0x1D871 0001d693 90 nop ... 0001d7f2 8954240C mov dword [ss:esp+0xC], edx 0001d7f6 8D931BF80800 lea edx, dword [ds:ebx+0x8F81B] ; @"Register On The Job..." 0001d7fc 89542408 mov dword [ss:esp+0x8], edx
That pretty much turns the application into full-mode and all trial banners and nags go away.