Cant we just use the legit dll? Or copy the modified part without the part that connects to amazon servers?

 

If you do that, it'll say that Nexus isn't activated on this machine.
You can't just "copy the modified part" because it has been packed with Themida, so the whole DLL looks completely different.

 

I see... and if its like that I suppose that ain't easy to unpack it to it original state right?
Maybe looking at the first line from the original one can give you a idea of how should the modified one be? (idk if themida is a kind of criptography)

 

I guess it's possible, but doesn't seem like a straightforward task. Cracking a "crack"? Eh...

Also, if you block the internet connection of the legit DLL but use the chinese login files, it'll display a "Your Nexus 3 activation needs to be refreshed within 24 hours" message, but won't let you open any preset. Which is normal.

Also no, you can't just look at the first line, because the whole .dll looks completely different.

 

is there any problem on running the chinese without internet? (other than nexus 2 presets not loading)

 

So far, I haven't seen it dropping more strange files besides that "mntemp" thing on ProgramData. So, besides that, I can't say anything at this moment unless someone makes a proper analysis of the .dll

You can just cut all connections to be a bit more safe using simplewall.

 

chicos de este torrent descarge la libreria en 2 hs

removed magnet!

 

Last edited by a moderator: Mar 27, 2021

Update!!!

How to Block IP using windows Firewall

https://help.liquidweb.com/s/article/Blocking-IP-Addresses-Using-Windows-Firewall

Microsoft Network Monitor 3.4
https://www.microsoft.com/en-au/download/details.aspx?id=4865

The choice is yours
Watch your traffic you will see the calls with nexus running
block them in the windows firewall
only 4 Ip calls here found here

Block inbound and Outbound

147.75.71.186
52.42.114.201
52.70.136.170
54.70.136.156



Good luck im outta here !!

 

Last edited: Mar 27, 2021

I haven't played with the Mac plugin yet.
I don't know what kind of protection is legit Nexus using, but Detect it Easy can't identify it.



How do we know that this "cracker" just wants to protect this release against copykids? Why? A release they don't even own? It's suspicious...

Also, I'm guessing that this release hasn't been cracked properly and it's just bypassing the protection using some legit details. That's why R2R hasn't released it yet.

 

Last edited: Mar 27, 2021

Question: if I remove some of the entries in the content_properties.json file then remove some of the libraries to match it, will everything still work?

 

Just delete the folders with presets and samples you don't need.

 

I can confirm (using currports) that my machine is connecting and sending data to 54.70.136.156

edit: the other IP's that are mentioned above as well

 

Last edited: Mar 27, 2021

Blocked with Kaspersky Firewall , no connection what so ever . Verified with Currports ...

 

Has anyone captured the data sent to AWS?

 

As far as I know, Nexus 3 is designed to send information in cloud on reFX

PS: I 'm sorry about my bad English

 

I dont doubt that, I'm interested to see what the payload and response is. I don't have a spare machine to install this on at the moment.

 

Windows also sends data one god knows where

 

After messing a bit with the .dll, I started to understand how does it work.
Indeed, it does sideload a few stuff so it can work (doesn't mean it's harmful but also doesn't mean it's harmless, that's still undetermined)
Also, the regkey file was something added by the releaser that was completely unnecessary, but it won't work without it.

I wasn't able to analyze the full behavior, so my journey ends here.

 

Roboto with u use it or delete it?