Many patches edit the hosts file located in C:\Windows\System32\drivers\etc\ . This file acts as a local phonebook for your PC. The patch redirects Wondershare's activation servers (e.g., activation.wondershare.com ) to 127.0.0.1 (your own computer). Since the software can't reach the real server, it fails to verify that the license is fraudulent.