Sunday, September 29, 2013

Unlocking MarkdownPad 2

MarkdownPad is a is a full-featured Markdown editor for Windows. Actually is a very nice one, sadly only the professional version has the GitHub Markdown support and a bunch of other features. So, i decided to make a little change on the executable just to have a taste of the professional version.

MarkdownPad 2 Free - Limitations


Declaimer:
I am not responsible for the misuse of the material you are about to see. 
This article is only for educational purposes.

Hands on...

Tools needed:
  • .NET Decompiler (Reflector.NET, ILSpy);
  • IDA;
  • Hex editor (anyone).
Open MarkdownPad.exe with the decompiler, look around just to have some understanding about the application. Open the License Engine, partially the "VerifyLicense" method which looks like this...


As you can see, in the very first verification if the license key or the email are empty or null our license is invalid, which is our the case. So, the strategy is very simple, we will modify the "return false;" to "return true;", easy, one byte patch.
Let's open MardownPad with IDA and locate the hexadecimal sequence to the our "return false;".


To easily locate the "VerifyLicense" method just focus the "Function Window" and press ALT-T. After you locate the method, let's take a look to the mnemonics...



A very nice list of CIL instructions.

So the idea is really simple, just change the byte 0x16 to 0x17. Switch to the hex editor in the "ldc.i4.0"...


Search for the selected pattern "16 2A 02 02 ..." in the hex editor...


Now, just change the 0x16 to 0x17 (which means "ldc.i4.1") and save the file. To verify the modification open again the MarkdownPad executable with your .NET decompiler and you should see something like this in the "VerifyLicense" method...


All done! :)

Support the developers, if you want MarkdownPad 2 Pro, just go to this page (it's only 15$).

12 comments:

Unknown said...

Where do you get the IDA program that you mentioned in the post?

Anonymous said...

IDA Pro can be found here

https://www.hex-rays.com/products/ida/

This actually works! :-)

Unknown said...

This does work. Nice stuff Juza, and thanks!

I grabbed the freeware version of IDA 5.0 and I wasnt able to load up the functions like you were able to.

Basically when I load the markdownpad exe (as a portable executable file, microsoft .net assembly didnt work) all I get in my functions window is a function called 'start' so I cant find VerifyLicense anywhere.

I ended up just using a hex editor and changing the values as described in the last step and it worked however I want a deeper understanding of the workflow in this process.

Would love some extra help..

Mr. eXoDia said...

@Mario M: Just grab a pirated IDA version, you're pirating this anyway.

If you load the app as native you will only have a very simple entry point that starts the .NET interpreter. That's why you only see one function.

Rob said...

I tried this, and get a "An unexpected error has occurred. Object reference not set to an instance of an object. If the problem persists, please report the bug." .. Using version 2.4.4.40074 of MarkdownPad2 ... any suggestions?

Sam9 said...

using v2.5

But its not working, giving error:
"An unexpected error has occurred. Object reference not set to an instance of an object. If the problem persists, please report the bug."

Though ILSpy is showing "return true"

web lol said...

web lol

Anonymous said...

as Sam9 pointed out this fix is giving an error whenever the program checks for the license

Unknown said...

You should do a crack for this! instead of doing manually

Librarian said...

Nice but i have a key contact me at twitter i'll give you
@dogeblossom

Anonymous said...

I'm also getting what everyone else is getting.

"An unexpected error has occurred. Object reference not set to an instance of an object. If the problem persists, please report the bug"

This simply does not work. Thanks anyway.

Jon said...

Thanks for the tutorial but it's easier to use DnSpy and modify the C# code directly. The executable is not packed or protected so it's simple to just modify the author's code. To all those who receive the error when using this tutorial, it's okay -- it's still works it's just experiencing an error during the license validation. Check the professional features, you'll notice they work even though the error is appearing. To get rid of the error, you'll need to modify the license validation code as well.