[ConcernedCitizen]

Are you poor or just hate having to pay $100 for a text editor?

Tired of being reminded to purchase a license or having to edit the sublime_text core to get a fake license to work?

I know I was. Then I found Sublime Text v4107-4126 Windows x64 Patcher by rainbowpigeon

I tried googling everywhere for hexedit solutions and doing it myself in command line.

Sometimes it worked, others it didn't because of a specific byte difference.

Automate it yourself and never worry about having to do it again:

1. Start by downloading the git repo here and be sure to have Python (3.10 in my case) installed.

You also will obviously need Sublime Text which is available on their website for a free trial. Get x64!

Run their installer and have some coffee. I prefer Black Rifle Coffee Co.

2. Now, open powershell (not as Administrator, it isn't needed).

3. Follow these commands as outlined on the git repo.

git clone https://github.com/rainbowpigeon/sublime-text-4-patcher
cd sublime-text-4-patcher
pip3 install -r requirements.txt
python3 sublime_text_4_patcher.py

When asked for the file path, type: C:\Program Files\Sublime Text 3\sublime_text.exe

Then open Sublime Text and click "Help" and then "Enter License" and paste the following key (any one will work at this point):

—–BEGIN LICENSE—–
Patrick Carey
Unlimited User License
EA7E-18848
4982D83B6313800EBD801600D7E3CC13
F2CD59825E2B4C4A18490C5815DF68D6
A5EFCC8698CFE589E105EA829C5273C0
C5744F0857FAD2169C88620898C3845A
1F4521CFC160EEC7A9B382DE605C2E6D
DE84CD0160666D30AA8A0C5492D90BB2
75DEFB9FD0275389F74A59BB0CA2B4EF
EA91E646C7F2A688276BCF18E971E372
—–END LICENSE—–

How does this work?
Simple. It searches the byte code and checks the version.
Each version has a different set of hex locations for the crack to work.
It edits the hex values given the value of the byte code for each version.
Then it supplies itself the return value of that byte, xor'd with another few bits.

Specifically, this was using version 4126 x64:

Sublime Text v4107-4126 Windows x64 Patcher by rainbowpigeon
----------------------------------------------------------------
Enter file path to sublime_text.exe: C:\Program Files\Sublime Text 3\sublime_text.exe.bak

[=] Processing ref for sig 48 8D 05 ? ? ? ? 48 8D 95 ? ? ? ? 48 89 02 48 8D 05 ? ? ? ? 48 89 42 08 48 8D 4D ? E8 ? ? ? ? B9...
[=] Found lea: \x48\x8d\x05\xe4\x48\x75\x00\x48\x8d\x95\x58\x02\x00\x00\x48\x89\x02\x48\x8d\x05\xd7\x48\x75\x00\x48\x89\x42\x08\x48\x8d\x4d\xb0\xe8\x28\x03\x00\x00\xb9
[=] Found relative address: 0x7548e4
[=] Determined actual offset: 0x759432
[+] Sublime Text Version 4126 detected << version detection complete!
[=] Processing ref for sig 4C 8D 4D ? E8 ? ? ? ? ? 8B ? ? ? ? ? 85 C0...
[=] Found call: \x4c\x8d\x4d\x54\xe8\x0b\xe2\xff\xff\x49\x8b\x8e\x68\x02\x00\x00\x85\xc0
[=] Found relative address: 0xffffe20b
[=] Determined actual offset: 0xa7214 << determines offset for "Enter license"
[+] Applying all patches...
[=] Offset 0x711a  : patching \xe8\xe1\x36\x20\x00 with \x90\x90\x90\x90\x90
[=] Offset 0x7133  : patching \xe8\xc8\x36\x20\x00 with \x90\x90\x90\x90\x90
[=] Offset 0xa7214 : patching \x55\x41\x57\x41 with \x48\x31\xc0\xc3
[=] Offset 0xa8d53 : patching \x55\x56\x57\x48\x83\xec\x30 with \x48\x31\xc0\x48\xff\xc0\xc3
[=] Offset 0xa6e0f : patching \x55\x56\x57\x48 with \x48\x31\xc0\xc3
[=] Offset 0x400  : patching \x41 with \xc3
[+] All patches applied! << Done!

Code:

class Patch:     """     Replaces bytes     """     CALL_LEN = 5  # E8 | xx xx xx xx     LEA_LEN = 7  # LEA: 48 8D xx | xx xx xx xx     patch_types = {         "nop": "90" * CALL_LEN,         "ret": "C3",  # ret         "ret0": "48 31 C0 C3",  # xor rax, rax; ret         "ret1": "48 31 C0 48 FF C0 C3",  # xor rax, rax; inc rax; ret     }     patch_types.update((k, bytes.fromhex(v)) for k, v in patch_types.items())     def __init__(self, sig: Sig, patch_type: str, file=None):         self.sig = sig         if file:             self.file = file             self.offset = Finder(self.file, self.sig).locate()         if patch_type not in Patch.patch_types:             raise ValueError("Unsupported patch type {}".format(patch_type))         self.patch_type = patch_type         self.new_bytes = Patch.patch_types[self.patch_type]     def apply(self, file=None):         if not hasattr(self, 'file') and not file:             raise ValueError("No file provided")         elif not hasattr(self, 'file') and file:             self.file = file             self.offset = Finder(self.file, self.sig).locate()         end_offset = self.offset + len(self.new_bytes)         logger.debug(             "Offset {:<8}: patching {} with {}".format(hex(self.offset),                                                       PrettyBytes(self.file.data[self.offset:end_offset]),                                                       PrettyBytes(self.new_bytes))         )         self.file.data[self.offset:end_offset] = self.new_bytes

The above code contains the function responsible for overwriting the bytes at specific offsets. In this case it was successfully changed.

This is due to the code here:

Code:

class PatchDB:     CHANNELS = {         "dev": (4109, 4110, 4111, 4112, 4114, 4115, 4116, 4117, 4118, 4119, 4120, 4122, 4123, 4124, 4125),         "stable": (4107, 4113, 4121, 4126),     }

...which determines the program's limitations of versions, which, it supports almost all versions ^4107.

And here:

Code:

class Patch:     """     Replaces bytes     """     CALL_LEN = 5  # E8 | xx xx xx xx     LEA_LEN = 7  # LEA: 48 8D xx | xx xx xx xx     patch_types = {         "nop": "90" * CALL_LEN,         "ret": "C3",  # ret         "ret0": "48 31 C0 C3",  # xor rax, rax; ret         "ret1": "48 31 C0 48 FF C0 C3",  # xor rax, rax; inc rax; ret     }     patch_types.update((k, bytes.fromhex(v)) for k, v in patch_types.items())

...is where the actual magic takes place. It sets different values for the bytes:

The actual values replaced here are as follows.

>> \xe8\xe1\x36\x20\x00 << \x90\x90\x90\x90\x90
>> \xe8\xc8\x36\x20\x00 << \x90\x90\x90\x90\x90
>> \x55\x41\x57\x41 << \x48\x31\xc0\xc3
>> \x55\x56\x57\x48\x83\xec\x30 << \x48\x31\xc0\x48\xff\xc0\xc3
>> \x55\x56\x57\x48 << \x48\x31\xc0\xc3
>> \x41 << \xc3

nop does nothing except delay the program and provide an entry point for the program
xor rax, rax uses xor to zero the register
ret or return the entry value to place into the stack
xor rax, rax; ret to place the returned value into the stack
and finally, we can return the value of the new bytes

For each offset: sets that same register to another value and returns the value on the stack.
Then the stack has been edited and it puts the whole thing back into the patched binary.
That's the highest level explanation I can give to what's happening within the byte replacement.

[+] Backing up original file at C:\Program Files\Sublime Text 3\sublime_text.exe.bak << Let's backup the original!
[+] Patched file written at C:\Program Files\Sublime Text 3\sublime_text.exe << Write patched binary with edited byte codes!

Fuck the establishment! Enjoy your free warez!