Patch: Lumion 11

Pattern: 48 8B 4C 24 08 48 85 C9 74 ?? E8 ?? ?? ?? ?? 85 C0 This pattern leads to a function named IsLicenseValid() in pseudocode. The simplest patch (used in many public “cracks”) is to force the license validation function to always return true (1) and skip network activation.

Hex bytes: B0 01 5D C3 instead of 32 C0 5D C3 (where applicable).

call LumionLicense::ValidateLicense test al, al jz license_invalid Change the function prologue or the return value.

call ValidateLicense test al, al jz 0x... ; jump if invalid Patch jz to jmp always (EB opcode in x86) or NOP out the test and force the branch. Lumion 11 also tries to validate the license online at launch and every 24 hours. The patch must also disable this. patch lumion 11

This information is provided for educational and archival purposes only. Patching commercial software violates the End User License Agreement (EULA) and copyright laws. Unauthorized modification or distribution of software is illegal. Do not use this information to circumvent paying for software you have not legally licensed. Technical Write-Up: Analysis of Lumion 11 Licensing Bypass (Patch) 1. Introduction Software: Lumion 11 (versions 11.0, 11.5, 11.5.1) Developer: Act-3D B.V. Protection Type: Online activation, license file validation, trial time limit, hardware ID binding. Target of Patch: Local license verification routine (circumventing online check).

Find the ValidateLicense function entry:

mov rax, 1 ret The function ValidateHWID compares the stored hardware ID against current hardware. To avoid license invalidation after hardware changes (or to work with pre-generated license files), patch: Pattern: 48 8B 4C 24 08 48 85 C9 74

Better: redirect the function to a code cave containing:

(example – actual offsets vary by build) Original bytes: E8 49 0A 00 00 85 C0 74 15 Patch to: B0 01 90 90 90 90 90 90 90

; At SendActivationRequest entry mov eax, 1 ; return success ret 16 ; clean stack (adjust according to calling convention) Overwrite the first 5 bytes with B8 01 00 00 00 C3 . However, stack cleanup requires matching the original function's calling convention ( __cdecl or __fastcall ). The simplest patch (used in many public “cracks”)

Original:

After patching, the software shows "License: Pro" in About menu, no watermark, and export functionality is unlocked. 11. Countermeasures and Detection Lumion 11 may include integrity checks on its DLLs (CRC32 or embedded hash). If checksums are validated, the patched DLL will be rejected, and the program may crash or revert to trial.

This replaces call ... test eax, eax jz with mov al,1 and NOP sled.

original: push rbp mov rbp, rsp ... (validation logic) xor al, al ; return 0 (false) pop rbp ret patched: push rbp mov rbp, rsp ... (validation logic) ; can be NOP'd out mov al, 1 ; return 1 (true) pop rbp ret