Also if you have the original file (most cracked software conveniently provides the crack separately) you can run something like ida + diaphora[0] and see the work the crackers did nicely isolated. Sometimes its little as altering a single conditional jump.

[0]: https://github.com/joxeankoret/diaphora

> the keygen/patches can be scanned by virustotal.

Wouldnt open source be better?

Because not all cracks are opensource, and not all games/software is opensource.

If you need a media player, you can get an opensource one (vlc, mpv,...). If you need excell, because of incompatibilities, macros, whatever, and don't want to pay (or don't want to buy a new one, since 2010 version works fine), you must crack it.

There are a lot of open source tools that more or less automate the removal of certain protections, especially from games. I "audited" a few myself. I'd link them here but some self righteous bootlicker would probably report it.