Screen Studio license activation vulnerability

by Sherlock Luk on 26-12-2023

This is entirely for educational purposes, I've reported this vulnerability to the developer and it's expected to be fixed soon

Screen Studio is a screen recording software developed by Adam Pietrasiak that has been made famous on Twitter thanks to the people in the software engineering industry despite its higher asking price of $89 USD when there's literally free alternatives like OBS Studio and Streamlabs. $89 USD!??? A bit too much for a fancy screen recording app if you ask me, but fine I'll give it a try.

Upon exporting the recorded video, I was greeted with this window. The free trial apparently doesn't include the functionality of exporting recordings. Right at this moment, I knew exactly what I had to do - starting my journey of security research all for educational purposes (i promise)

I knew the app was powered by Electron, noticed it by its subpar responsiveness and the UI that would be too hard to be crafted with native UI toolkits. It's all experience. I went on to give it a double check, went into the app bundle, checked its Frameworks folder and saw all the evidence I needed in there

I can't lie tho, this app is really well written, the UI looks nice and it has most of the functionalities that anyone would need in a screen recording software

Anyway, let's get to the point. The app is written in JavaScript since it's Electron-based which means I can easily edit its code without having to decompile it like I have to with a native app written in a compiled programming language like Swift or C++. All I need to do is open up the app.asar file that's in every Electron app and edit the JavaScript code

_{I don't think I can show the code here}

It only took me about 10 minutes to figure which function determines if Screen Studio is activated and easy enough it was called hasActiveLicense, I only had to do a bit of Ctrl+F, hunt down the function return value and change it to true. Voila!

Here's the commands needed to activate Screen Studio - don't do it, it's considered piracy

SCREEN_STUDIO_PATH="/Applications/Screen Studio.app"
TMP_EX_PATH="$(mktemp -d "$TMPDIR/app.XXXXXX")"
OLD_REPLACING_FUNC="hasActiveLicense(){return!!zi.activeLicense}"
NEW_REPLACING_FUNC="hasActiveLicense(){return true}"
OG_ASAR_PATH="$SCREEN_STUDIO_PATH/Contents/Resources/app.asar"
BKUP_ASAR_PATH="$SCREEN_STUDIO_PATH/Contents/Resources/app.asar.bkup"

# Check preconditions
if [ ! -d "$SCREEN_STUDIO_PATH" ]; then
    echo "Screen Studio path not found."
    exit 1
fi

if ! command -v asar &> /dev/null; then
    echo "asar command not found."
    exit 1
fi

if [ ! -f "$OG_ASAR_PATH" ]; then
    echo "Original ASAR file not found."
    exit 1
fi

# Extract, modify, and repack ASAR file
asar extract "$OG_ASAR_PATH" "$TMP_EX_PATH" || exit 1
trap 'rm -rf "$TMP_EX_PATH"' EXIT

mv "$OG_ASAR_PATH" "$BKUP_ASAR_PATH" || exit 1
sed -i '' "s/$OLD_REPLACING_FUNC/$NEW_REPLACING_FUNC/g" "$TMP_EX_PATH/dist-electron/index.js" || exit 1
asar pack "$TMP_EX_PATH" "$OG_ASAR_PATH" || exit 1

echo "Screen Studio successfully modified."