This is pretty much the same as the original Aperture 2 trial hack, but with a different offset for the binary once it’s been installed. Follow the previous instructions but change the offset for the start of the performRequirementsCheck string to be 6dcd44