Patching ida.wll
Target: IDA Pro Version 5.2.0.911 & Version 5.5
Some of you might encounter this error message before when you are trying to open an idb (ida database file) file. This will only happen if the idb is created by a pirated copy of IDA Pro like the screenshot below:
Someone from exetools.com has posted the patch but only limited for those who have registered as a member. Based on the description there, it is not hard to patch the pirated message actually.
The step is fairly easy:
- Find ida.wll from your IDA installation directory and load it with IDA
- Find text string "Sorry, this database has been created by a pirate version of IDA Pro" by using Shift+F12 (Strings tab)
- Enter to jump to the data section
- You should see aSorryThisDatab attribute which is already defined with the above string
- Put your cursor to the attribute and press x (Cross reference) to jump to the code section that uses this data
- You should now jump to the code which looks like this:
- Notice the jz before the "call sub_10039660", double click to enter sub_10039660 function
- You can see the 3 exported functions MD5Init, MD5Update and MD5Final.
- Go to the part where it nears the retn instruction.
- And take note how EAX is updated because this register will determine if the hash is equal or not and return to the previous function that will do the comparison, "test al, al"
- From the figure above, we know that we can avoid the pirated message if EAX is zero. So we can patch "mov al,1" to something that will give us EAX=0, eg: "xor eax, eax" ;)
- Using any hex editor that you prefer, and jump to this address and do the modification. Done!!!
Download: ida.wll.patched
Reference
Datarescue IDA pirated .idb database -- http://forum.exetools.com/showthread.php?t=12087
~Signing off
@x9090
2 comments:
or you could just convert the conditional jump to a direct jump.
Even easier, "nop" the "test al, al", "call sub_XXXXXX" and change the "jnz"/"jz" to "jmp", and then you can import those tasty IDBs... ;3
Post a Comment