In the main: ".text:000000000008F1A4 CheckTrialTimeOver"
At the end, it calls sub_1898C, this function returns a bool, if the trial is over or not.
so, patch this function:
Code:
.text:000000000001898C sub_1898C ; CODE XREF: CheckTrialTimeOver+A0↓p
.text:000000000001898C ; __unwind {
.text:000000000001898C MOV W8, #0x2A2F
.text:0000000000018990 CMP W1, W8
.text:0000000000018994 CSET W0, GT
.text:0000000000018998 RET
.text:0000000000018998 ; } // starts at 1898C
.text:0000000000018998 ; End of function sub_1898C
bool __fastcall sub_1898C(__int64 a1, signed int a2)
{
return a2 > 10799; //10800 = 3 hours in seconds
}
or patch the check:
Code:
.text:000000000008F244 BL sub_1898C
.text:000000000008F248 AND W8, W0, #1
to have an unlimited trial
in short, use nx2elf.exe to get the elf, then use a hex editor to patch the elf:
Code:
0x8F9D0:
change
08 00 00 12 //AND W8, W0, #1
to
08 00 80 52 //MOV W8, 0
Of couse i just used a little bit ida pro, i didn't test if this works and i have no save over 3 hours.
