Xfer Records Serum 2 v2.0.23 V.R Patched Plus Plus Plus Like Notepad-TCD

 

The calls to phone home can be patched very easily in a debugger. Just search for "intermodular calls" in the binary
and type in "ws2_", "wininet", "winhttp", "internet" and "shellexec" to find respective calls. Everything with the name
"connect" in the findings can easily be nop'ed (replaced with a 'no operation point' instruction).

Last one (shellexec) should be handled with care because it's also used to load/save presets, settings, etc.
In those cases I just patch the call that calls the shellexec call from an URL string or so.

In case of Serum it's a little more hidden. You won't find a 'connect' call like "internetconnect" or "wsaconnect"
but you can find those in the screenshot below and others that execute/open URL's in your browser.



I just don't know why I'm the only one who does this.
When I release a plugin, I always make sure it can't phone home, update itself or check the license.

R2R does it now with their Network Block runtime and that's smart AF because they don't have to patch every call on its own
but in case of Serum2, the runtime doesn't work as it doesn't cover "InternetStatusCallbackW" in the API emulation.

To use the runtime, only the name of respective api dll's has to be patched, made a little patcher for this
so I can test it on the plugins on my machine. If anyone wants this, pm me ;)

 

Last edited: Nov 8, 2025 at 3:03 PM

Sorry, that was my mistake, I meant global.

 

Can you explain a bit what you mean in this comment? Could you make it a bit simpler for someone who doesn't have expertise in security? I mean the first part, the one with the big image.

 

Can't believe I looked in there and studied hard for some time and didn't know I could scroll down in there haha... thanks very much

 

Very curious indeed. In your expert opinion in the case of a mess like Serum2, what percentage of deliberately placed show-stopper bombs/bugs as opposed to just flat out phone calls to the mothership are present in these serum2 releases? Just a ballpark guess - obviously there's no way to know the real numbers on this out of the blue I'm sure...

That is a nifty little tool of yours as well. But per capita, how many apps these days just rely on simply calling the mothership as opposed to requiring applying generated keys, or challenge/response codes etc?

 

Last edited: Nov 9, 2025 at 12:28 AM

So if one patches only the InternetStatusCallbackW calls and then apply your patcher that redirect the rest to R2R's internet blockers the net aspect is done?

Damn, this is so cool I almost wet my underpants...

 

I remember that version. I used that final one for quite a while (and still have it installed) until the newest serum2 "fully" working V.R.-TCD-X .19 release is now the one being used.. All others bombed, timed, "melted", or just crashed mid-project.

I'd be down for helping test on similar deal for the v2 if it's possible to do it... Just let me know when/where and I'm there.

 

It's a patcher that basically just replaces calling the windows API with calling R2R's API if any of this is called in a dll, vst3 or exe file.
That way R2R's Network Block runtime is called when the plugin tries to connect to the net and the result of this is:
the plugin can't phone home anymore and no firewall or hosts editing is required.

But since R2R's network api emulation doesn't cover up the full api, in some plugins/programs it can create errors on loading.
Messages like this can appear then:

As of now I found those errors in Serum2, Ableton, FL Studio and other DAW's
but for most plugins it worked.

When I try to patch something, I now 1st patch it to call R2R's runtime and then start diggin.
Previously I first patched calls like wininet.InternetConnectW, ws2_32.WSAconnect, winhttp.InternetConnect,...
so I can digg in an offline mode and now it's just hitting the patch button.

 

Does that mean that now that we've installed R2R's Network Block runtime, the serum can't have any conect?

Does this mean we will have a patch from you in the future?

 

Last night i started a new project in Cubase and let it sequence a track of Serum Plus Plus Plus version .
I ve been tweaking some fx settings,changing presets..no troubles at all.
Then i let it run for about 3 and a half hour,and again no troubles at all..no demo mode no nuttin..so far it seems to work fine for me at least.

 

I wish. But like @r4e said, R2R's runtime doesn't have all the features the original Windows runtime have.
The thing is when a program/plugin call these dll's it's not enough for them to say "ok! all's good". I mean, that's the gist of it, but internally there're several functions that can be called and they return something more complex. That's the API.
In this case, "InternetSetStatusCallbackW" is a function that serum 2 calls and has not been implemented in R2R's dll, so it would trigger an error.

Besides that, vaccinating a plugin is more than that. Blocking internet calls is only a part, more important every day.

 

Nope, only when Serum gets released from R2R. As I said before, serum2 doesn't even load when patched to call the network block runtime.

 

I found another bug, though I’m not exactly sure if it’s correct or not. IN +++TCD

I remember that in version 2.0.20 of VR, in the CLIP section, you could edit notes you had written using some shortcuts. For example, you could move a note up or down using the up and down arrow keys, or by holding Shift and pressing the up key, you could raise the note by one octave.
But I should also mention that I’m not entirely sure about this, I might have mixed it up with Ableton or maybe it wasn't like that at all. My memory is a bit fuzzy on this.

Some more bugs in the presets

Preset 303 DIRTY MACROS in the Factor + Base + Acid section
The CLIP section has a bug when you click
When you click on the key, they change but don't do the animation
also don't even show the other key notes

I think we should take a look at the CLIP section, I don't know if the bugs are from Steve or TCD.

Guys, please check to see if it's a bug or if it's like this on my system.

 

Last edited: Nov 10, 2025 at 6:25 AM