Xfer Records Serum 2 v2.0.23 V.R Patched Plus Plus Plus Like Notepad-TCD

 

The calls to phone home can be patched very easily in a debugger. Just search for "intermodular calls" in the binary
and type in "ws2_", "wininet", "winhttp", "internet" and "shellexec" to find respective calls. Everything with the name
"connect" in the findings can easily be nop'ed (replaced with a 'no operation point' instruction).

Last one (shellexec) should be handled with care because it's also used to load/save presets, settings, etc.
In those cases I just patch the call that calls the shellexec call from an URL string or so.

In case of Serum it's a little more hidden. You won't find a 'connect' call like "internetconnect" or "wsaconnect"
but you can find those in the screenshot below and others that execute/open URL's in your browser.



I just don't know why I'm the only one who does this.
When I release a plugin, I always make sure it can't phone home, update itself or check the license.

R2R does it now with their Network Block runtime and that's smart AF because they don't have to patch every call on its own
but in case of Serum2, the runtime doesn't work as it doesn't cover "InternetStatusCallbackW" in the API emulation.

To use the runtime, only the name of respective api dll's has to be patched, made a little patcher for this
so I can test it on the plugins on my machine. If anyone wants this, pm me ;)

 

Last edited: Nov 8, 2025 at 3:03 PM

Sorry, that was my mistake, I meant global.

 

Can you explain a bit what you mean in this comment? Could you make it a bit simpler for someone who doesn't have expertise in security? I mean the first part, the one with the big image.