Almost all (?) protection ultimately requires some kind of feedback that you can work backwards from, so it was always a losing battle for developers. In a similar vein, I remember having the Grand Theft Auto 1 demo. Because it was an open world, it had a time limit on how long you could play the game.
The countdown was displayed in red digits in the corner of the screen. I used SoftICE to set a memory write breakpoint on the video framebuffer at the location where the timer was displayed. That allowed me to locate the code printing out the timer. That in turn gave me the address of the timer variable, against which I set another memory breakpoint, which brought me to the routine that was counting down the timer. A 1 byte patch effectively disabled the timer and allowed me to play for hours.
The countdown was displayed in red digits in the corner of the screen. I used SoftICE to set a memory write breakpoint on the video framebuffer at the location where the timer was displayed. That allowed me to locate the code printing out the timer. That in turn gave me the address of the timer variable, against which I set another memory breakpoint, which brought me to the routine that was counting down the timer. A 1 byte patch effectively disabled the timer and allowed me to play for hours.