I'm looking at Corel's Knockout 30 day trial protected by vbox 4.3. In particular, at this point, I'm trying to find where vbox hides it's time counter. I've tracked with Regmon and Filemon to no avail. I used Amok's vbox cleaner 1.0 to scan and remove vbox files but when prog reinstalled the day countdown remained the same.
As an aside, why can't I disassemble prog. with w32asm - just hangs. I've heard this description by others with challenged by vbox.


Any clues?

P

Nevermind. Found it!

Thanks anyway,

P

I've faced the same problem. Since you found the solution, could
you please tell it to me also.

Thanks in advance,
Hemo

vbox places license files in the c:\windows\vbox usually and are hashed dates.
jomamameister

Deleting the licence files doesn't reset the time counter. As far as I can see, there are two vbox entries that need to be deleted (deleting just one or the other doesn't do it). One is a *.bin file in the root directory (C:\) (for Knockout it's os683439.bin - though this likely varies, and the other is a registry entry HCR/CLSID/615557C3.....
-again this probably varies from prog to prog.

P

Hi

There are a lot of tuts around re Vbox4.2/3/5.... esp. +Tsehp

I have the older VboxBuilder 4.2 and 4.3 (4.5 is/was not public)
and I also have a prv file so it is possible to play with making
a protected notepad (duh !) and then register it, unpack it, learn the time trial tricks etc blah blah whatever..........

I did a web search for these files but failed to find any real link to anyother site than Previewsoft :-( ...... maybe someone found it ?

If anyone is REALLY interested in doing this then I will find a ftp
to place the original files for you. I'm sure Li Wei Bin Bam whatever won't mind Maybe exetools will host them ???

+SplAj

I've tested new rv on latest vbox I could find and it still works, even if the last essay talked about mangled iat scheme, I didn't saw this on lastest version.

It's easy to locate the reg entries that you have to delete, just check your regmon and look for bizarre entries inside key regs like :
kjshfksjhfdsdf65s4df6sqdfsdf¤$$^^%%% for example

gosh I just love those new smileys

Today downloaded

www.ontrack.com/freesoftware/icl2eval.exe Pfff 15MB for a
prog of nothing (cleans cookies etc..) but Yes V-boxed with 5.0 ! (so that's nice)
Dumped and rebuilded with rev., about 12 api's didn,t resolve
So easily found them and fixed them manually.

Just for the info, Grrrreeetz.......SpeKKeL......

BTW I shall not ask tseph about the new RV maybe i litlle tired
after all the Mb-work........

it's fully working now, with a new feature against the new aspr
api emulation.

I only have to debug the section realigner + add some code to dump targets and it's there. Tracer is much more stable then before (less unstable is better said )

soon here