Sunday, September 29, 2013

Unlocking MarkdownPad 2

MarkdownPad is a is a full-featured Markdown editor for Windows. Actually is a very nice one, sadly only the professional version has the GitHub Markdown support and a bunch of other features. So, i decided to make a little change on the executable just to have a taste of the professional version.

MarkdownPad 2 Free - Limitations

I am not responsible for the misuse of the material you are about to see. 
This article is only for educational purposes.

Hands on...

Tools needed:
  • .NET Decompiler (Reflector.NET, ILSpy);
  • IDA;
  • Hex editor (anyone).
Open MarkdownPad.exe with the decompiler, look around just to have some understanding about the application. Open the License Engine, partially the "VerifyLicense" method which looks like this...

As you can see, in the very first verification if the license key or the email are empty or null our license is invalid, which is our the case. So, the strategy is very simple, we will modify the "return false;" to "return true;", easy, one byte patch.
Let's open MardownPad with IDA and locate the hexadecimal sequence to the our "return false;".

To easily locate the "VerifyLicense" method just focus the "Function Window" and press ALT-T. After you locate the method, let's take a look to the mnemonics...

A very nice list of CIL instructions.

So the idea is really simple, just change the byte 0x16 to 0x17. Switch to the hex editor in the "ldc.i4.0"...

Search for the selected pattern "16 2A 02 02 ..." in the hex editor...

Now, just change the 0x16 to 0x17 (which means "ldc.i4.1") and save the file. To verify the modification open again the MarkdownPad executable with your .NET decompiler and you should see something like this in the "VerifyLicense" method...

All done! :)

Support the developers, if you want MarkdownPad 2 Pro, just go to this page (it's only 15$).


Nicholas Hubbard said...

Where do you get the IDA program that you mentioned in the post?

Anonymous said...

IDA Pro can be found here

This actually works! :-)

Mario M said...

This does work. Nice stuff Juza, and thanks!

I grabbed the freeware version of IDA 5.0 and I wasnt able to load up the functions like you were able to.

Basically when I load the markdownpad exe (as a portable executable file, microsoft .net assembly didnt work) all I get in my functions window is a function called 'start' so I cant find VerifyLicense anywhere.

I ended up just using a hex editor and changing the values as described in the last step and it worked however I want a deeper understanding of the workflow in this process.

Would love some extra help..

Mr. eXoDia said...

@Mario M: Just grab a pirated IDA version, you're pirating this anyway.

If you load the app as native you will only have a very simple entry point that starts the .NET interpreter. That's why you only see one function.

Rob said...

I tried this, and get a "An unexpected error has occurred. Object reference not set to an instance of an object. If the problem persists, please report the bug." .. Using version of MarkdownPad2 ... any suggestions?