If you have ever written code in a text editor, you must have surely come across the legendary editor – Sublime Text at some point in your life. The native support for myriads of languages, customisable interface, hot plugins, neat interface, soothing colour scheme! You name it, Sublime has it all.
Disclaimer
This blog post has been written to brief the readers about the process of cracking and is meant purely for educational purposes. I am not the first one to crack this neither will be the last. This is just a demonstrtation of one of the many ways of cracking a software. Also, I do not promote cracking. The developers deserve every bit of the license fee for the hard work they put in while building such magnificient softwares. Having said that, this is not really a keygen kind of a crack but a demonstration of getting rid of the nag window. Nag what?
Once upon a time, there lived a man named Crack Jack in the Eastern Ghats of the Peninsular region. Adroit programmer who preferred a text editor over an IDE. The mightiest of all – The Sublime text editor but still just an editor. One fine evening, Mr. Jack was questioning his life decisions just like any other programmer when he was stuck on an hour long debugging session when it appeared and Mr. Jack totally lost his sh*t. The Nag window.
The nag window
That window.. Yes. Good software and all but nobody likes clicking the cancel button again and again. In this post, we will attempt to get rid of the nag window and save Mr. Jack from the misery.
This blog post refers to the latest version – v3.2.2 Build 3211 (Linux variant).
If you are following this blog post, please do not refer to the exact address in memory as mine as it may change in your case.
Let’s crack some!
Just like any other crack, there are multiple ways an individual may pursue depending on the skills and the end goal. As mentioned, this blog post aims at removing the nag window and registering the user.
If you haven’t noticed already, if you press ctrl+s or try to save your code in sublime for more than eight times, you will be presented with the nag window. Yes, if haven’t tried yet, go give it a shot! Make sure you have a fresh window of Sublime opened.
There seems to be some routine running in the background which checks for the save operation and compares the count with eight. If it is more than eight, a call is made to the function responsible to set up the message box.
Let’s fire up our debugger and hunt for the particular check.
I will be using EDB and Hopper throughout this article. Later, when we will dive into the Windows binary, I will be using x64dbg. Feel free to use your favourite disassmblers and debuggers.
Opening up the binary in Hopper, let’s quickly do a string search for the message shown in the message box. Searching for “Thanks” leads us to 0x20d903 which has been cross referenced at 0x51e589
Hopping onto the XREF, we can see that it is a part of the function which starts at 0x51e55f. By the looks of it, it looks like the function sets up the appropriate message for the message box depedning on the case for which it is being invoked.
In our case, we know the nag window reads “Hello! Thanks for trying out Sublime Text. This is an unregistered evaluation version and although…” after attempting to save the code for more than eight times. Hence a check for the same would exist which would ultimately call the function which we are currently inspecting.
Looking at the call graph and the pseudo code, it becomes evident that a cmp instruction passes the control to the above function if it succeeds. Spot on! Just what we were looking for.
Now it is just a matter of patching the value 0x8 with a larger figure. Or we can NOP fill the the entire function. Or we can also return the function as soon as cmp instruction succeeds and the call passes to the nag window. Multiple options hermano!
In here, I chose to patch the value 0x8 with 0xFF which is 255. I achieved the same using IDA. Open up the binary in IDA, goto the address where the cmp instruction takes place, patch the assembly and save the modified binary. Do remember to replace it with the original at the same location. Now when you open up our newly ‘cracked’ Sublime, it will not show the nag window unless we save the file 256 times. 😉
Also, apart from the above check, it is worth noting that Sublime has another time based check running in the backgroud which passes the control to the nag window after a certain time is passed. Leaving it as an exercise for the curious minds.
But my Sublime still says I am Unregistered. 🙁
Yeah, becasue we just patched the ctrl+s check. In the next blog post, we will go a step further and register ourselves as a legit user.
Stay safe folks!