-
-
[原创]破解录音能手
-
发表于:
2005-7-18 17:46
8203
-
【破解作者】 yijun
【作者邮箱】 yijun8354@sina.com
【使用工具】 OD,PEID
【破解平台】 Win9x/NT/2000/XP
【软件名称】 录音能手
【下载地址】 天空
【软件简介】 通过这款软件,您可以将您的声音录下来送给自己的朋友以表祝福和心意,或者将自己的歌声和将自己用乐器弹奏的乐曲录制下来,自己可以留下来欣赏或者送给亲人或者朋友。
【软件大小】 419K
【加壳方式】 UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo
【破解声明】 我是一只小菜鸟,偶得一点心得,愿与大家分享:)
--------------------------------------------------------------------------------
【破解内容】
PEID查壳知道该软件为UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo壳,没什么难度轻松搞定!OD载入通过字符串查找很容易来到以下关键处:
004B9CD0 55
push ebp //在此下断点
004B9CD1 68 A79E4B00
push lyns__.004B9EA7
004B9CD6 64:FF30
push dword ptr fs:[
eax]
004B9CD9 64:8920
mov dword ptr fs:[
eax],
esp
004B9CDC 8D55 F8
lea edx,
dword ptr ss:[
ebp-8]
004B9CDF 8B83 08030000
mov eax,
dword ptr ds:[
ebx+308]
004B9CE5 E8 7E6AFAFF
call lyns__.00460768
; 计算注册码长度送EAX
004B9CEA 8B45 F8
mov eax,
dword ptr ss:[
ebp-8]
; 取注册码送EAX
004B9CED 8D55 FC
lea edx,
dword ptr ss:[
ebp-4]
; [ebp-4]地址送EDX
004B9CF0 E8 DFEAF4FF
call lyns__.004087D4
004B9CF5 837D FC 00
cmp dword ptr ss:[
ebp-4],0
; 注册码是否为空
004B9CF9 75 34
jnz short lyns__.004B9D2F
; 不为空就跳到4B9D2F
004B9CFB B8 209F4B00
mov eax,lyns__.004B9F20
004B9D00 E8 0B95F7FF
call lyns__.00433210
004B9D05 FF05 28074C00
inc dword ptr ds:[4C0728]
004B9D0B 833D 28074C00 0>
cmp dword ptr ds:[4C0728],4
004B9D12 7C 0E
jl short lyns__.004B9D22
004B9D14 33C0
xor eax,
eax
004B9D16 A3 28074C00
mov dword ptr ds:[4C0728],
eax
004B9D1B 8BC3
mov eax,
ebx
004B9D1D E8 7233FCFF
call lyns__.0047D094
004B9D22 33C0
xor eax,
eax
004B9D24 5A
pop edx
004B9D25 59
pop ecx
004B9D26 59
pop ecx
004B9D27 64:8910
mov dword ptr fs:[
eax],
edx
004B9D2A E9 82010000
jmp lyns__.004B9EB1
004B9D2F A1 04094C00
mov eax,
dword ptr ds:[4C0904]
004B9D34 8338 01
cmp dword ptr ds:[
eax],1
004B9D37 0F85 28010000
jnz lyns__.004B9E65
004B9D3D 8D55 F0
lea edx,
dword ptr ss:[
ebp-10]
004B9D40 8B83 08030000
mov eax,
dword ptr ds:[
ebx+308]
004B9D46 E8 1D6AFAFF
call lyns__.00460768
; 计算注册码长度送EAX
004B9D4B 8B45 F0
mov eax,
dword ptr ss:[
ebp-10]
; 注册码送EAX
004B9D4E 8D55 F4
lea edx,
dword ptr ss:[
ebp-C]
; [ebp-C]送EDX
004B9D51 E8 7EEAF4FF
call lyns__.004087D4
004B9D56 8B45 F4
mov eax,
dword ptr ss:[
ebp-C]
; 注册码送EAX
004B9D59 50
push eax ; EAX入栈
004B9D5A 8D55 E4
lea edx,
dword ptr ss:[
ebp-1C]
; [ebp-1C]送EDX
004B9D5D 8B83 00030000
mov eax,
dword ptr ds:[
ebx+300]
004B9D63 E8 006AFAFF
call lyns__.00460768
; 计算机器码长度送EAX
004B9D68 8B45 E4
mov eax,
dword ptr ss:[
ebp-1C]
; 机器码送EAX
004B9D6B 8D55 E8
lea edx,
dword ptr ss:[
ebp-18]
; [ebp-18]地址送EDX
004B9D6E E8 61EAF4FF
call lyns__.004087D4
;
004B9D73 8B45 E8
mov eax,
dword ptr ss:[
ebp-18]
; 机器码送EAX
004B9D76 E8 8DACF4FF
call lyns__.00404A08
; 测试机器码是否为空
004B9D7B 50
push eax ; 机器码入栈
004B9D7C A1 5C084C00
mov eax,
dword ptr ds:[4C085C]
004B9D81 8B00
mov eax,
dword ptr ds:[
eax]
004B9D83 50
push eax
004B9D84 E8 DB140000
call lyns__.004BB264
; 跟进
004B9D89 8BD0
mov edx,
eax
004B9D8B 8D45 EC
lea eax,
dword ptr ss:[
ebp-14]
004B9D8E E8 ADA9F4FF
call lyns__.00404740
004B9D93 8B55 EC
mov edx,
dword ptr ss:[
ebp-14]
; EDX为真码
004B9D96 58
pop eax ; 弹出假码
004B9D97 E8 B8ABF4FF
call lyns__.00404954
; 比较CALL,EDX中的为真码~~~
004B9D9C 74 49
je short lyns__.004B9DE7
; 关键跳
004B9D9E B8 4C9F4B00
mov eax,lyns__.004B9F4C
004B9DA3 E8 6894F7FF
call lyns__.00433210
004B9DA8 8B83 08030000
mov eax,
dword ptr ds:[
ebx+308]
004B9DAE 33D2
xor edx,
edx
004B9DB0 E8 E369FAFF
call lyns__.00460798
004B9DB5 FF05 28074C00
inc dword ptr ds:[4C0728]
004B9DBB 833D 28074C00 0>
cmp dword ptr ds:[4C0728],4
004B9DC2 7C 16
jl short lyns__.004B9DDA
004B9DC4 B8 749F4B00
mov eax,lyns__.004B9F74
004B9DC9 E8 4294F7FF
call lyns__.00433210
004B9DCE A1 640A4C00
mov eax,
dword ptr ds:[4C0A64]
004B9DD3 8B00
mov eax,
dword ptr ds:[
eax]
004B9DD5 E8 BE69FCFF
call lyns__.00480798
======================================================================================================
跟进004B9D84处CALL来到:
004BB264 55
push ebp
004BB265 8BEC
mov ebp,
esp
004BB267 83C4 F8
add esp,-8
004BB26A 53
push ebx
004BB26B 56
push esi
004BB26C 57
push edi
004BB26D 33C0
xor eax,
eax
004BB26F 8945 F8
mov dword ptr ss:[
ebp-8],
eax
004BB272 33C0
xor eax,
eax
004BB274 55
push ebp
004BB275 68 F3B24B00
push lyns__.004BB2F3
004BB27A 64:FF30
push dword ptr fs:[
eax]
004BB27D 64:8920
mov dword ptr fs:[
eax],
esp
004BB280 33C0
xor eax,
eax ; EAX清0
004BB282 55
push ebp
004BB283 68 D3B24B00
push lyns__.004BB2D3
004BB288 64:FF30
push dword ptr fs:[
eax]
004BB28B 64:8920
mov dword ptr fs:[
eax],
esp
004BB28E 68 08B34B00
push lyns__.004BB308
; ASCII "ILOVEYOU"
004BB293 8B45 0C
mov eax,
dword ptr ss:[
ebp+C]
; 机器码送EAX
004BB296 50
push eax ; 机器码入栈
004BB297 E8 F0D1FFFF
call lyns__.004B848C
004BB29C 8BD0
mov edx,
eax
004BB29E 8D45 F8
lea eax,
dword ptr ss:[
ebp-8]
004BB2A1 E8 9A94F4FF
call lyns__.00404740
004BB2A6 8B45 F8
mov eax,
dword ptr ss:[
ebp-8]
004BB2A9 E8 5A97F4FF
call lyns__.00404A08
004BB2AE 50
push eax
004BB2AF E8 8CE5FFFF
call lyns__.004B9840
; 跟进
004BB2B4 8BD0
mov edx,
eax
004BB2B6 8D45 F8
lea eax,
dword ptr ss:[
ebp-8]
004BB2B9 E8 8294F4FF
call lyns__.00404740
004BB2BE 8B45 F8
mov eax,
dword ptr ss:[
ebp-8]
004BB2C1 E8 4297F4FF
call lyns__.00404A08
004BB2C6 8945 FC
mov dword ptr ss:[
ebp-4],
eax
004BB2C9 33C0
xor eax,
eax
004BB2CB 5A
pop edx
004BB2CC 59
pop ecx
004BB2CD 59
pop ecx
004BB2CE 64:8910
mov dword ptr fs:[
eax],
edx
004BB2D1 EB 0A
jmp short lyns__.004BB2DD
004BB2D3 ^ E9 A089F4FF
jmp lyns__.00403C78
004BB2D8 E8 038DF4FF
call lyns__.00403FE0
004BB2DD 33C0
xor eax,
eax
004BB2DF 5A
pop edx
004BB2E0 59
pop ecx
004BB2E1 59
pop ecx
004BB2E2 64:8910
mov dword ptr fs:[
eax],
edx
004BB2E5 68 FAB24B00
push lyns__.004BB2FA
004BB2EA 8D45 F8
lea eax,
dword ptr ss:[
ebp-8]
004BB2ED E8 5692F4FF
call lyns__.00404548
004BB2F2 C3
retn
======================================================================================================
跟进004BB2AF处CALL来到:
004B9840 55
push ebp
004B9841 8BEC
mov ebp,
esp
004B9843 83C4 E8
add esp,-18
004B9846 53
push ebx
004B9847 56
push esi
004B9848 57
push edi
004B9849 33C0
xor eax,
eax
004B984B 8945 F8
mov dword ptr ss:[
ebp-8],
eax
004B984E 33C0
xor eax,
eax
004B9850 55
push ebp
004B9851 68 B5984B00
push lyns__.004B98B5
004B9856 64:FF30
push dword ptr fs:[
eax]
004B9859 64:8920
mov dword ptr fs:[
eax],
esp
004B985C 33C0
xor eax,
eax
004B985E 55
push ebp
004B985F 68 95984B00
push lyns__.004B9895
004B9864 64:FF30
push dword ptr fs:[
eax]
004B9867 64:8920
mov dword ptr fs:[
eax],
esp
004B986A 8D55 E8
lea edx,
dword ptr ss:[
ebp-18]
004B986D 8B45 08
mov eax,
dword ptr ss:[
ebp+8]
004B9870 E8 67FEFFFF
call lyns__.004B96DC
004B9875 8D45 E8
lea eax,
dword ptr ss:[
ebp-18]
004B9878 8D55 F8
lea edx,
dword ptr ss:[
ebp-8]
004B987B E8 F4FEFFFF
call lyns__.004B9774
; 跟进
004B9880 8B45 F8
mov eax,
dword ptr ss:[
ebp-8]
004B9883 E8 80B1F4FF
call lyns__.00404A08
; 此处的EAX中保存的就是真码^-^
004B9888 8945 FC
mov dword ptr ss:[
ebp-4],
eax
004B988B 33C0
xor eax,
eax
004B988D 5A
pop edx
004B988E 59
pop ecx
004B988F 59
pop ecx
004B9890 64:8910
mov dword ptr fs:[
eax],
edx
004B9893 EB 0A
jmp short lyns__.004B989F
004B9895 ^ E9 DEA3F4FF
jmp lyns__.00403C78
004B989A E8 41A7F4FF
call lyns__.00403FE0
004B989F 33C0
xor eax,
eax
004B98A1 5A
pop edx
004B98A2 59
pop ecx
004B98A3 59
pop ecx
004B98A4 64:8910
mov dword ptr fs:[
eax],
edx
004B98A7 68 BC984B00
push lyns__.004B98BC
004B98AC 8D45 F8
lea eax,
dword ptr ss:[
ebp-8]
004B98AF E8 94ACF4FF
call lyns__.00404548
004B98B4 C3
retn
======================================================================================================
跟进004B987B处CALL来到:
004B9774 55
push ebp
004B9775 8BEC
mov ebp,
esp
004B9777 83C4 E8
add esp,-18
004B977A 53
push ebx
004B977B 56
push esi
004B977C 57
push edi
004B977D 33C9
xor ecx,
ecx
004B977F 894D EC
mov dword ptr ss:[
ebp-14],
ecx
004B9782 894D E8
mov dword ptr ss:[
ebp-18],
ecx
004B9785 8BF0
mov esi,
eax
004B9787 8D7D F0
lea edi,
dword ptr ss:[
ebp-10]
004B978A A5
movs dword ptr es:[
edi],
dword ptr d>
004B978B A5
movs dword ptr es:[
edi],
dword ptr d>
004B978C A5
movs dword ptr es:[
edi],
dword ptr d>
004B978D A5
movs dword ptr es:[
edi],
dword ptr d>
004B978E 8BFA
mov edi,
edx
004B9790 33C0
xor eax,
eax
004B9792 55
push ebp
004B9793 68 31984B00
push lyns__.004B9831
004B9798 64:FF30
push dword ptr fs:[
eax]
004B979B 64:8920
mov dword ptr fs:[
eax],
esp
004B979E 33C0
xor eax,
eax
004B97A0 55
push ebp
004B97A1 68 0C984B00
push lyns__.004B980C
004B97A6 64:FF30
push dword ptr fs:[
eax]
004B97A9 64:8920
mov dword ptr fs:[
eax],
esp
004B97AC 8BC7
mov eax,
edi
004B97AE E8 95ADF4FF
call lyns__.00404548
004B97B3 B3 10
mov bl,10
; BL=10
004B97B5 8D75 F0
lea esi,
dword ptr ss:[
ebp-10]
004B97B8 FF37
push dword ptr ds:[
edi]
; [edi]入栈,以下循环出真码^-^
004B97BA 8D45 EC
lea eax,
dword ptr ss:[
ebp-14]
; [ebp-14]送EAX
004B97BD 33D2
xor edx,
edx ; EDX清0
004B97BF 8A16
mov dl,
byte ptr ds:[
esi]
; [esi]送DL
004B97C1 C1EA 04
shr edx,4
; EDX右移动4位
004B97C4 83E2 0F
and edx,0F
; EDX和0F与
004B97C7 8A92 18074C00
mov dl,
byte ptr ds:[
edx+4C0718]
; [edx+4C0718]送DL
004B97CD E8 5EAFF4FF
call lyns__.00404730
004B97D2 FF75 EC
push dword ptr ss:[
ebp-14]
004B97D5 8D45 E8
lea eax,
dword ptr ss:[
ebp-18]
004B97D8 8A16
mov dl,
byte ptr ds:[
esi]
; [esi]送DL
004B97DA 80E2 0F
and dl,0F
; DL和0F与
004B97DD 81E2 FF000000
and edx,0FF
; EDX和0FF与
004B97E3 8A92 18074C00
mov dl,
byte ptr ds:[
edx+4C0718]
; [edx+4C0718]送DL
004B97E9 E8 42AFF4FF
call lyns__.00404730
004B97EE FF75 E8
push dword ptr ss:[
ebp-18]
004B97F1 8BC7
mov eax,
edi
004B97F3 BA 03000000
mov edx,3
; EDX=3
004B97F8 E8 CBB0F4FF
call lyns__.004048C8
; 跟进
004B97FD 46
inc esi ; ESI加一
004B97FE FECB
dec bl ; BL减一
004B9800 ^ 75 B6
jnz short lyns__.004B97B8
; BL不为0就继续循环
004B9802 33C0
xor eax,
eax
004B9804 5A
pop edx
004B9805 59
pop ecx
004B9806 59
pop ecx
004B9807 64:8910
mov dword ptr fs:[
eax],
edx
004B980A EB 0A
jmp short lyns__.004B9816
004B980C ^ E9 67A4F4FF
jmp lyns__.00403C78
004B9811 E8 CAA7F4FF
call lyns__.00403FE0
004B9816 33C0
xor eax,
eax
004B9818 5A
pop edx
004B9819 59
pop ecx
004B981A 59
pop ecx
004B981B 64:8910
mov dword ptr fs:[
eax],
edx
004B981E 68 38984B00
push lyns__.004B9838
004B9823 8D45 E8
lea eax,
dword ptr ss:[
ebp-18]
004B9826 BA 02000000
mov edx,2
004B982B E8 3CADF4FF
call lyns__.0040456C
004B9830 C3
retn
======================================================================================================
跟进004B97F8处CALL来到:
004048C8 53
push ebx
004048C9 56
push esi
004048CA 57
push edi
004048CB 52
push edx
004048CC 50
push eax
004048CD 89D3
mov ebx,
edx
004048CF 31FF
xor edi,
edi ; EDI清0
004048D1 8B4C94 14
mov ecx,
dword ptr ss:[
esp+
edx*4+14]
; 已经循环出的注册码送ECX
004048D5 85C9
test ecx,
ecx
004048D7 74 0C
je short lyns__.004048E5
; 为0就跳
004048D9 3908
cmp dword ptr ds:[
eax],
ecx ; [eax]和ECX比较
004048DB 75 08
jnz short lyns__.004048E5
; 不等就跳
004048DD 89CF
mov edi,
ecx ; ECX送EDI
004048DF 8B41 FC
mov eax,
dword ptr ds:[
ecx-4]
; [ecx-4]送EAX
004048E2 4A
dec edx ; EDX减一
004048E3 EB 02
jmp short lyns__.004048E7
004048E5 31C0
xor eax,
eax
004048E7 8B4C94 14
mov ecx,
dword ptr ss:[
esp+
edx*4+14]
; [esp+edx*4+14]送ECX(逐位把真码送到ECX)
004048EB 85C9
test ecx,
ecx
004048ED 74 09
je short lyns__.004048F8
004048EF 0341 FC
add eax,
dword ptr ds:[
ecx-4]
; EAX加[ecx-4]=1送EAX(已经计算出的真码长度)
004048F2 39CF
cmp edi,
ecx ; ECX和EDI比较
004048F4 75 02
jnz short lyns__.004048F8
; 不等就跳
004048F6 31FF
xor edi,
edi
004048F8 4A
dec edx
004048F9 ^ 75 EC
jnz short lyns__.004048E7
; EDX不为0就继续
004048FB 85FF
test edi,
edi
004048FD 74 17
je short lyns__.00404916
004048FF 89C2
mov edx,
eax
00404901 8B0424
mov eax,
dword ptr ss:[
esp]
00404904 8B77 FC
mov esi,
dword ptr ds:[
edi-4]
00404907 E8 88020000
call lyns__.00404B94
0040490C 8B3C24
mov edi,
dword ptr ss:[
esp]
0040490F FF37
push dword ptr ds:[
edi]
00404911 0337
add esi,
dword ptr ds:[
edi]
; [edi]加ESI
00404913 4B
dec ebx ; EBX减一
00404914 EB 08
jmp short lyns__.0040491E
00404916 E8 F1FCFFFF
call lyns__.0040460C
0040491B 50
push eax
0040491C 89C6
mov esi,
eax
0040491E 8B449C 18
mov eax,
dword ptr ss:[
esp+
ebx*4+18]
; 计算出的真码保存在EAX
00404922 89F2
mov edx,
esi
00404924 85C0
test eax,
eax
00404926 74 0A
je short lyns__.00404932
00404928 8B48 FC
mov ecx,
dword ptr ds:[
eax-4]
; ECX=1
0040492B 01CE
add esi,
ecx ; ESI加ECX
0040492D E8 32E0FFFF
call lyns__.00402964
;
00404932 4B
dec ebx
00404933 ^ 75 E9
jnz short lyns__.0040491E
; EBX不为0继续
00404935 5A
pop edx
00404936 58
pop eax
00404937 85FF
test edi,
edi
00404939 75 0C
jnz short lyns__.00404947
0040493B 85D2
test edx,
edx
0040493D 74 03
je short lyns__.00404942
0040493F FF4A F8
dec dword ptr ds:[
edx-8]
00404942 E8 55FCFFFF
call lyns__.0040459C
00404947 5A
pop edx
00404948 5F
pop edi
00404949 5E
pop esi
0040494A 5B
pop ebx
0040494B 58
pop eax
0040494C 8D2494
lea esp,
dword ptr ss:[
esp+
edx*4]
0040494F FFE0
jmp eax
00404951 C3
retn--------------------------------------------------------------------------------
【破解总结】
注册机:
中断地址:4B9D97
中断次数:1
第一字节:E8
指令长度:5
内存方式:寄存器EDX
--------------------------------------------------------------------------------
【版权声明】 本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课