That link does not explain how they're managing to obtain the correct key from the server without paying money.

So they were able to dump a memory segment into a hex editor, and locate references to RijndaelManaged. So what?

In the screenshot, I still see:

  Server.GetKey().Key

So how did they convince the malicious server to cough up the token for free?