-
-
[原创]010Editor 分析 附注册机
-
发表于: 2013-8-14 05:18
-
【文章标题】010Editor 分析 附注册机
【联系作者】zhong_sf@sina.com
【软件名称】010Editor 4.04
【附件下载】http://www.sweetscape.com/download/previous/
【注册机源码下载】 keygen to 010Editor.rar
010Editor这款编辑器个人觉得挺不错的,特别是写shelllcode时非常方便,比起ue 等,我还是比较认可它的, 之前以为是免费软件,用得很爽,这些天突然提示试用期到期,必须注册才能继续使用.到官网看了下价格,新用户至少也得近50美元, 我穷书生一个,买不起,
, 先crack ,等以后搬砖赚够钱了再买吧.
先bp ShowWindow ,经过几次回溯之后来到下面:
00CFFE20 > >push -0x1
00CFFE22 . >push 010Edito.00E351D2 ; SE 处理程序安装
00CFFE27 . >mov eax,dword ptr fs:[0]
00CFFE2D . >push eax
00CFFE2E . >mov dword ptr fs:[0],esp
00CFFE35 . >sub esp,0x1C
00CFFE38 . >push ebx
00CFFE39 . >push ebp
00CFFE3A . >xor ebx,ebx
00CFFE3C . >mov dword ptr ss:[esp+0x14],ebx
00CFFE40 . >mov eax,dword ptr ds:[<&QtCore4.QString::shared_>
00CFFE45 . >push esi
00CFFE46 . >mov esi,ecx
00CFFE48 . >push edi
00CFFE49 . >mov dword ptr ss:[esp+0x14],eax
00CFFE4D . >mov ecx,0x1
00CFFE52 . >lock xadd dword ptr ds:[eax],ecx
00CFFE56 . >mov eax,dword ptr ds:[<&QtCore4.QString::shared_>
00CFFE5B . >mov dword ptr ss:[esp+0x34],ebx
00CFFE5F . >mov dword ptr ss:[esp+0x18],eax
00CFFE63 . >mov edx,0x1
00CFFE68 . >lock xadd dword ptr ds:[eax],edx ; ---------------
00CFFE6C . >mov ecx,dword ptr ds:[esi+0x58]
00CFFE6F . >mov edi,dword ptr ds:[<&QtGui4.QLineEdit::text>] ; QtGui4.QLineEdit::text
00CFFE75 . >lea eax,dword ptr ss:[esp+0x20]
00CFFE79 . >push eax
00CFFE7A . >mov byte ptr ss:[esp+0x38],0x1
00CFFE7F . >call edi ; <&QtGui4.QLineEdit::text>
00CFFE81 . >mov ecx,dword ptr ds:[eax]
00CFFE83 . >cmp dword ptr ds:[ecx+0x8],ebx ; 判断用户名是否为空
00CFFE86 . >mov edx,dword ptr ss:[esp+0x20]
00CFFE8A . >sete bl
00CFFE8D . >or eax,0xFFFFFFFF
00CFFE90 . >lock xadd dword ptr ds:[edx],eax
00CFFE94 . >mov ebp,dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00CFFE9A . >jnz X010Edito.00CFFEA6
00CFFE9C . >mov ecx,dword ptr ss:[esp+0x20]
00CFFEA0 . >push ecx
00CFFEA1 . >call ebp ; <&QtCore4.QString::free>
00CFFEA3 . >add esp,0x4
00CFFEA6 > >test bl,bl
00CFFEA8 . >je 010Edito.00CFFF3B ; --------------
00CFFEAE . >push -0x1
00CFFEB0 . >push 010Edito.00E6F80C ; ASCII "Please enter a name."
00CFFEB5 . >call dword ptr ds:[<&QtCore4.QString::fromAscii_>; QtCore4.QString::fromAscii_helper
00CFFEBB . >mov dword ptr ss:[esp+0x24],eax
00CFFEBF . >lea edx,dword ptr ss:[esp+0x24]
00CFFEC3 . >push edx
00CFFEC4 . >mov byte ptr ss:[esp+0x40],0x2
00CFFEC9 . >call 010Edito.00BB1636
00CFFECE . >mov eax,dword ptr ss:[esp+0x28]
00CFFED2 . >add esp,0xC
00CFFED5 . >mov byte ptr ss:[esp+0x34],0x1
00CFFEDA . >or ecx,0xFFFFFFFF
00CFFEDD . >lock xadd dword ptr ds:[eax],ecx
00CFFEE1 . >jnz X010Edito.00CFFEED
00CFFEE3 . >mov edx,dword ptr ss:[esp+0x1C]
00CFFEE7 . >push edx
00CFFEE8 . >call ebp
00CFFEEA . >add esp,0x4
00CFFEED > >mov esi,dword ptr ds:[esi+0x58]
00CFFEF0 . >push 0x7
00CFFEF2 . >mov ecx,esi
00CFFEF4 . >call dword ptr ds:[<&QtGui4.QWidget::setFocus>] ; QtGui4.QWidget::setFocus
00CFFEFA . >mov eax,dword ptr ss:[esp+0x18]
00CFFEFE . >mov byte ptr ss:[esp+0x34],0x0
00CFFF03 . >or ecx,0xFFFFFFFF
00CFFF06 . >lock xadd dword ptr ds:[eax],ecx
00CFFF0A . >jnz X010Edito.00CFFF16
00CFFF0C . >mov edx,dword ptr ss:[esp+0x18]
00CFFF10 . >push edx
00CFFF11 . >call ebp
00CFFF13 . >add esp,0x4
00CFFF16 > >mov eax,dword ptr ss:[esp+0x14]
00CFFF1A . >mov dword ptr ss:[esp+0x34],-0x1
00CFFF22 . >or ecx,0xFFFFFFFF
00CFFF25 . >lock xadd dword ptr ds:[eax],ecx
00CFFF29 . >jnz 010Edito.00D00763
00CFFF2F . >mov edx,dword ptr ss:[esp+0x14]
00CFFF33 . >push edx
00CFFF34 . >call ebp
00CFFF36 . >jmp 010Edito.00D00760 ; --------------
00CFFF3B > >mov ecx,dword ptr ds:[esi+0x60]
00CFFF3E . >lea eax,dword ptr ss:[esp+0x28]
00CFFF42 . >push eax
00CFFF43 . >call edi
00CFFF45 . >mov ecx,dword ptr ds:[eax]
00CFFF47 . >cmp dword ptr ds:[ecx+0x8],0x0 ; 判断序列号是否空
00CFFF4B . >mov ebp,dword ptr ds:[<&QtCore4.QString::fromAsc>
00CFFF51 . >mov ebx,0x1
00CFFF56 . >mov byte ptr ss:[esp+0x34],0x3
00CFFF5B . >mov dword ptr ss:[esp+0x1C],ebx
00CFFF5F . >je X010Edito.00CFFFB7
00CFFF61 . >push -0x1
00CFFF63 . >push 010Edito.00E5490C
00CFFF68 . >call ebp ; <&QtCore4.QString::fromAscii_helper>
00CFFF6A . >add esp,0x8
00CFFF6D . >mov dword ptr ss:[esp+0x20],eax
00CFFF71 . >mov ecx,dword ptr ds:[esi+0x60]
00CFFF74 . >lea edx,dword ptr ss:[esp+0x24]
00CFFF78 . >push edx
00CFFF79 . >mov dword ptr ss:[esp+0x38],0x4
00CFFF81 . >mov dword ptr ss:[esp+0x20],0x3
00CFFF89 . >call edi ; QtGui4.QLineEdit::text
00CFFF8B . >push 0x1
00CFFF8D . >push 0x0
00CFFF8F . >lea ecx,dword ptr ss:[esp+0x28]
00CFFF93 . >push ecx
00CFFF94 . >mov ebx,0x7
00CFFF99 . >mov ecx,eax
00CFFF9B . >mov dword ptr ss:[esp+0x40],0x5
00CFFFA3 . >mov dword ptr ss:[esp+0x28],ebx
00CFFFA7 . >call dword ptr ds:[<&QtCore4.QString::indexOf>] ; 检查序列号中是否有空格
00CFFFAD . >mov byte ptr ss:[esp+0x13],0x0
00CFFFB2 . >cmp eax,-0x1 ; ----------------
00CFFFB5 . >je X010Edito.00CFFFBC
00CFFFB7 > >mov byte ptr ss:[esp+0x13],0x1
00CFFFBC > >mov dword ptr ss:[esp+0x34],0x4
00CFFFC4 . >test bl,0x4
00CFFFC7 . >je X010Edito.00CFFFEB
00CFFFC9 . >mov edx,dword ptr ss:[esp+0x24]
00CFFFCD . >and ebx,0xFFFFFFFB
00CFFFD0 . >mov dword ptr ss:[esp+0x1C],ebx
00CFFFD4 . >or eax,0xFFFFFFFF
00CFFFD7 . >lock xadd dword ptr ds:[edx],eax
00CFFFDB . >jnz X010Edito.00CFFFEB
00CFFFDD . >mov ecx,dword ptr ss:[esp+0x24]
00CFFFE1 . >push ecx
00CFFFE2 . >call dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00CFFFE8 . >add esp,0x4
00CFFFEB > >mov dword ptr ss:[esp+0x34],0x3
00CFFFF3 . >test bl,0x2
00CFFFF6 . >je X010Edito.00D0001A
00CFFFF8 . >mov edx,dword ptr ss:[esp+0x20]
00CFFFFC . >and ebx,0xFFFFFFFD
00CFFFFF . >mov dword ptr ss:[esp+0x1C],ebx
00D00003 . >or eax,0xFFFFFFFF
00D00006 . >lock xadd dword ptr ds:[edx],eax
00D0000A . >jnz X010Edito.00D0001A
00D0000C . >mov ecx,dword ptr ss:[esp+0x20]
00D00010 . >push ecx
00D00011 . >call dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D00017 . >add esp,0x4
00D0001A > >mov dword ptr ss:[esp+0x34],0x1
00D00022 . >test bl,0x1
00D00025 . >je X010Edito.00D00042
00D00027 . >mov edx,dword ptr ss:[esp+0x28]
00D0002B . >or eax,0xFFFFFFFF
00D0002E . >lock xadd dword ptr ds:[edx],eax
00D00032 . >jnz X010Edito.00D00042
00D00034 . >mov ecx,dword ptr ss:[esp+0x28]
00D00038 . >push ecx
00D00039 . >call dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D0003F . >add esp,0x4
00D00042 > >cmp byte ptr ss:[esp+0x13],0x0
00D00047 . >je 010Edito.00D000DC
00D0004D . >push -0x1
00D0004F . >push 010Edito.00E6F7DC ; ASCII "Please completely enter your password."
00D00054 . >call ebp
00D00056 . >mov dword ptr ss:[esp+0x28],eax
00D0005A . >lea edx,dword ptr ss:[esp+0x28]
00D0005E . >push edx
00D0005F . >mov byte ptr ss:[esp+0x40],0x6
00D00064 . >call 010Edito.00BB1636
00D00069 . >mov eax,dword ptr ss:[esp+0x2C]
00D0006D . >mov edi,dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D00073 . >add esp,0xC
00D00076 . >mov byte ptr ss:[esp+0x34],0x1
00D0007B . >or ecx,0xFFFFFFFF
00D0007E . >lock xadd dword ptr ds:[eax],ecx
00D00082 . >jnz X010Edito.00D0008E
00D00084 . >mov edx,dword ptr ss:[esp+0x20]
00D00088 . >push edx
00D00089 . >call edi
00D0008B . >add esp,0x4
00D0008E > >mov esi,dword ptr ds:[esi+0x58]
00D00091 . >push 0x7
00D00093 . >mov ecx,esi
00D00095 . >call dword ptr ds:[<&QtGui4.QWidget::setFocus>] ; QtGui4.QWidget::setFocus
00D0009B . >mov eax,dword ptr ss:[esp+0x18]
00D0009F . >mov byte ptr ss:[esp+0x34],0x0
00D000A4 . >or ecx,0xFFFFFFFF
00D000A7 . >lock xadd dword ptr ds:[eax],ecx
00D000AB . >jnz X010Edito.00D000B7
00D000AD . >mov edx,dword ptr ss:[esp+0x18]
00D000B1 . >push edx
00D000B2 . >call edi
00D000B4 . >add esp,0x4
00D000B7 > >mov eax,dword ptr ss:[esp+0x14]
00D000BB . >mov dword ptr ss:[esp+0x34],-0x1
00D000C3 . >or ecx,0xFFFFFFFF
00D000C6 . >lock xadd dword ptr ds:[eax],ecx
00D000CA . >jnz 010Edito.00D00763
00D000D0 . >mov edx,dword ptr ss:[esp+0x14]
00D000D4 . >push edx
00D000D5 . >call edi
00D000D7 . >jmp 010Edito.00D00760
00D000DC > >mov ecx,dword ptr ds:[esi+0x60]
00D000DF . >lea eax,dword ptr ss:[esp+0x28]
00D000E3 . >push eax
00D000E4 . >call edi
00D000E6 . >mov ebx,dword ptr ds:[<&QtCore4.QString::operato>
00D000EC . >push eax
00D000ED . >lea ecx,dword ptr ss:[esp+0x1C]
00D000F1 . >mov byte ptr ss:[esp+0x38],0x7
00D000F6 . >call ebx ; <&QtCore4.QString::operator=>
00D000F8 . >mov ecx,dword ptr ss:[esp+0x28]
00D000FC . >mov byte ptr ss:[esp+0x34],0x1
00D00101 . >or edx,0xFFFFFFFF
00D00104 . >lock xadd dword ptr ds:[ecx],edx
00D00108 . >jnz X010Edito.00D00118
00D0010A . >mov eax,dword ptr ss:[esp+0x28]
00D0010E . >push eax
00D0010F . >call dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D00115 . >add esp,0x4
00D00118 > >lea ecx,dword ptr ss:[esp+0x18]
00D0011C . >push ecx
00D0011D . >mov ecx,esi
00D0011F . >call 010Edito.00BB4480 ; 检查序列号 s[3]
00D00124 . >test eax,eax ; 如果s[3]==0x9C or 0xFC 则序列号只须前0x13位
00D00126 . >je X010Edito.00D00165 ; s[3]==0xAC 序列号则须0x18位
00D00128 . >push 0x13
00D0012A . >lea edx,dword ptr ss:[esp+0x2C]
00D0012E . >push edx
00D0012F . >lea ecx,dword ptr ss:[esp+0x20]
00D00133 . >call dword ptr ds:[<&QtCore4.QString::left>] ; QtCore4.QString::left
00D00139 . >push eax
00D0013A . >lea ecx,dword ptr ss:[esp+0x1C]
00D0013E . >mov byte ptr ss:[esp+0x38],0x8
00D00143 . >call ebx
00D00145 . >mov eax,dword ptr ss:[esp+0x28]
00D00149 . >mov byte ptr ss:[esp+0x34],0x1
00D0014E . >or ecx,0xFFFFFFFF
00D00151 . >lock xadd dword ptr ds:[eax],ecx
00D00155 . >jnz X010Edito.00D00165
00D00157 . >mov edx,dword ptr ss:[esp+0x28]
00D0015B . >push edx
00D0015C . >call dword ptr ds:[<&QtCore4.QString::free>]
00D00162 . >add esp,0x4
00D00165 > >mov ecx,dword ptr ds:[esi+0x58]
00D00168 . >lea eax,dword ptr ss:[esp+0x28]
00D0016C . >push eax
00D0016D . >call edi ; QtGui4.QLineEdit::text
00D0016F . >mov ecx,dword ptr ds:[0xF87E4C]
00D00175 . >push eax
00D00176 . >mov byte ptr ss:[esp+0x38],0x9
00D0017B . >call 010Edito.00BB885A ; 去除用户名中的" " or ' ' 如果有的话
00D00180 . >mov ecx,dword ptr ss:[esp+0x28]
00D00184 . >mov byte ptr ss:[esp+0x34],0x1
00D00189 . >or edx,0xFFFFFFFF
00D0018C . >lock xadd dword ptr ds:[ecx],edx
00D00190 . >jnz X010Edito.00D001A0
00D00192 . >mov eax,dword ptr ss:[esp+0x28]
00D00196 . >push eax
00D00197 . >call dword ptr ds:[<&QtCore4.QString::free>]
00D0019D . >add esp,0x4
00D001A0 > >lea ecx,dword ptr ss:[esp+0x18]
00D001A4 . >push ecx
00D001A5 . >mov ecx,dword ptr ds:[0xF87E4C]
00D001AB . >call 010Edito.00BB2379 ; 将序列号中的 o/O换成0 ,l换成1 ,如果有的话
上面是大部分是注册验证前期的初始化 ,因为是使用QT编写的(Qt我是完全不会) ,所以垃圾代码比较多,毕竟面对对象不如面对过程简洁明了. 比较简单且有注释, 就不多说了. 注册序列号是形如
xxxx-xxxx-xxxx-xxxx-xxxx , 计算时是把每两位xx当成一个byte ,这里用数组 s[] 表示, ,其中s[3]是固定的,只能为0x9C ,0xFC ,0xAC 之一.
再往下看:
00D001B0 . >mov ecx,dword ptr ds:[0xF87E4C]
00D001B6 . >push 0x3C70
00D001BB . >push 0x5
00D001BD . >call 010Edito.00BB394A ; ret1 = calc1(5 ,0x3c70)
00D001C2 . >mov ecx,dword ptr ds:[0xF87E4C]
00D001C8 . >push 0x3C70
00D001CD . >push 0x5
00D001CF . >mov ebx,eax
00D001D1 . >call 010Edito.00BB8981 ; ret2 = calc2(5 ,0x3c70)
00D001D6 . >mov ecx,dword ptr ds:[0xF87E4C]
00D001DC . >xor edx,edx
00D001DE . >mov edi,eax
00D001E0 . >mov eax,dword ptr ds:[ecx+0x34]
00D001E3 . >test eax,eax
00D001E5 . >sete dl
00D001E8 . >mov dword ptr ss:[esp+0x28],edx
00D001EC . >cmp ebx,0xE7
00D001F2 . >je 010Edito.00D00387 ; if (ret1 == 0xE7) JMP...
00D001F8 . >cmp dword ptr ds:[ecx+0x2C],0x0
00D001FC . >je 010Edito.00D00387 ; if (e_2c == 0) JMP....
00D00202 . >push 0x0 ; else
00D00204 . >call 010Edito.00BB54E3 ; 网络验证
00D00209 . >test eax,eax
00D0020B . >jge 010Edito.00D002E7 ; if (netcheck ok) JMP....
00D00211 . >push 0xA
00D00213 . >push eax
00D00214 . >lea eax,dword ptr ss:[esp+0x24]
00D00218 . >push eax
00D00219 . >call dword ptr ds:[<&QtCore4.QString::number>] ; QtCore4.QString::number
00D0021F . >mov esi,eax
00D00221 . >push -0x1
00D00223 . >push 010Edito.00E6F6D0 ; ASCII "Could not contact the webserver. Please check your internet connection. If your internet connection is currently working, the server may be down. If this problem persists, please visit 'http://www.sweetscape.com/support/' ("
00D00228 . >mov byte ptr ss:[esp+0x48],0xA
00D0022D . >call ebp
00D0022F . >mov dword ptr ss:[esp+0x34],eax
00D00233 . >push esi
00D00234 . >lea ecx,dword ptr ss:[esp+0x38]
00D00238 . >push ecx
00D00239 . >lea edx,dword ptr ss:[esp+0x40]
00D0023D . >push edx
00D0023E . >mov byte ptr ss:[esp+0x54],0xB
00D00243 . >call 010Edito.00BB5687
00D00248 . >push 010Edito.00E6F6CC ; ASCII ")."
00D0024D . >push eax
00D0024E . >lea eax,dword ptr ss:[esp+0x50]
00D00252 . >mov bl,0xC
00D00254 . >push eax
00D00255 . >mov byte ptr ss:[esp+0x60],bl
00D00259 . >call 010Edito.00BB4688
00D0025E . >push eax
00D0025F . >mov byte ptr ss:[esp+0x64],0xD
00D00264 . >call 010Edito.00BB6965
00D00269 . >mov ecx,dword ptr ss:[esp+0x58]
00D0026D . >mov esi,dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D00273 . >add esp,0x30
00D00276 . >mov byte ptr ss:[esp+0x34],bl
00D0027A . >or edx,0xFFFFFFFF
00D0027D . >lock xadd dword ptr ds:[ecx],edx
00D00281 . >jnz X010Edito.00D0028D
00D00283 . >mov eax,dword ptr ss:[esp+0x28]
00D00287 . >push eax
00D00288 . >call esi
00D0028A . >add esp,0x4
00D0028D > >mov ecx,dword ptr ss:[esp+0x24]
00D00291 . >mov byte ptr ss:[esp+0x34],0xB
00D00296 . >or edx,0xFFFFFFFF
00D00299 . >lock xadd dword ptr ds:[ecx],edx
00D0029D . >jnz X010Edito.00D002A9
00D0029F . >mov eax,dword ptr ss:[esp+0x24]
00D002A3 . >push eax
00D002A4 . >call esi
00D002A6 . >add esp,0x4
00D002A9 > >mov ecx,dword ptr ss:[esp+0x20]
00D002AD . >mov byte ptr ss:[esp+0x34],0xA
00D002B2 . >or edx,0xFFFFFFFF
00D002B5 . >lock xadd dword ptr ds:[ecx],edx
00D002B9 . >jnz X010Edito.00D002C5
00D002BB . >mov eax,dword ptr ss:[esp+0x20]
00D002BF . >push eax
00D002C0 . >call esi
00D002C2 . >add esp,0x4
00D002C5 > >mov ecx,dword ptr ss:[esp+0x1C]
00D002C9 . >mov byte ptr ss:[esp+0x34],0x1
00D002CE . >or edx,0xFFFFFFFF
00D002D1 . >lock xadd dword ptr ds:[ecx],edx
00D002D5 . >jnz 010Edito.00D0072C
00D002DB . >mov eax,dword ptr ss:[esp+0x1C]
00D002DF . >push eax
00D002E0 . >call esi
00D002E2 . >jmp 010Edito.00D00729
00D002E7 > >jnz 010Edito.00D0036D
00D002ED . >push -0x1 ; -------------------
00D002EF . >push 010Edito.00E6F5C8 ; ASCII "010 Editor has detected that you have entered an invalid license. Please check to see if your license is entered correctly and try again. If this problem persists, please visit 'http://www.sweetscape.com/support/'."
00D002F4 . >call ebp
00D002F6 . >mov dword ptr ss:[esp+0x28],eax
00D002FA . >lea ecx,dword ptr ss:[esp+0x28]
00D002FE . >push ecx
00D002FF . >mov byte ptr ss:[esp+0x40],0xE
00D00304 . >call 010Edito.00BB6965
00D00309 . >mov edx,dword ptr ss:[esp+0x2C]
00D0030D . >mov esi,dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D00313 . >add esp,0xC
00D00316 . >mov byte ptr ss:[esp+0x34],0x1
00D0031B . >or eax,0xFFFFFFFF
00D0031E . >lock xadd dword ptr ds:[edx],eax
00D00322 . >jnz X010Edito.00D0032E
00D00324 . >mov ecx,dword ptr ss:[esp+0x20]
00D00328 . >push ecx
00D00329 . >call esi
00D0032B . >add esp,0x4
00D0032E > >mov edx,dword ptr ss:[esp+0x18]
00D00332 . >mov byte ptr ss:[esp+0x34],0x0
00D00337 . >or eax,0xFFFFFFFF
00D0033A . >lock xadd dword ptr ds:[edx],eax
00D0033E . >jnz X010Edito.00D0034A
00D00340 . >mov ecx,dword ptr ss:[esp+0x18]
00D00344 . >push ecx
00D00345 . >call esi
00D00347 . >add esp,0x4
00D0034A > >mov edx,dword ptr ss:[esp+0x14]
00D0034E . >mov dword ptr ss:[esp+0x34],-0x1
00D00356 . >or eax,0xFFFFFFFF
00D00359 . >lock xadd dword ptr ds:[edx],eax
00D0035D . >jnz 010Edito.00D00763
00D00363 . >mov ecx,dword ptr ss:[esp+0x14]
00D00367 . >push ecx
00D00368 . >jmp 010Edito.00D0075E
00D0036D > >mov ecx,dword ptr ds:[0xF87E4C]
00D00373 . >push 0x3C70
00D00378 . >push 0x5
00D0037A . >call 010Edito.00BB8981
00D0037F . >mov ecx,dword ptr ds:[0xF87E4C] ; if (ret2==0xDB)
00D00385 . >mov edi,eax ; 则 注册成功
00D00387 > >cmp edi,0xDB
00D0038D . >jnz X010Edito.00D003C7 ; 若注册成功时必须且只能经过这个出口
00D0038F . >push -0x1 ; 同时也是爆破点
00D00391 . >push 010Edito.00E6F584 ; ASCII "Password accepted. Thank you for purchasing 010 Editor!"
00D00396 . >call ebp
00D00398 . >mov dword ptr ss:[esp+0x28],eax
00D0039C . >lea edx,dword ptr ss:[esp+0x28]
00D003A0 . >push edx
00D003A1 . >mov byte ptr ss:[esp+0x40],0xF
先说下这软件使用了一个对象来保存注册信息, 这里用 e_xx 表示对象中的每个成员 ,xx表示偏移值 ,其中 e_4 ----用户名 , e_8 ----序列号 .
从上面可以看出,要注册成功 ,必须经过0xD003D8处,且不跳转,所以也就是说必须ret2==0xDB ,
00D0037F . >mov ecx,dword ptr ds:[0xF87E4C]
00D00385 . >mov edi,eax ; ; if (ret2==0xDB)
00D00387 > >cmp edi,0xDB 则 注册成功
00D0038D . >jnz X010Edito.00D003C7 ; 若注册成功时必须且只能经过这个出口
ret1 ,ret2分别是上面calc1() ,calc2()的返回值 , 所以先到calc2()处看看:
00DBEC80 > >push esi
00DBEC81 . >mov esi,ecx
00DBEC83 . >cmp dword ptr ds:[esi+0x2C],0x0
00DBEC87 . >je X010Edito.00DBEC92 ; if (e_2c == 1)
00DBEC89 . >mov eax,0x113 ; return 0x113
00DBEC8E . >pop esi
00DBEC8F . >retn 0x8
00DBEC92 > >mov eax,dword ptr ss:[esp+0xC]
00DBEC96 . >push edi
00DBEC97 . >mov edi,dword ptr ss:[esp+0xC]
00DBEC9B . >push eax
00DBEC9C . >push edi
00DBEC9D . >call 010Edito.00BB394A ; ret1 = Calc1(5 ,0x3c70)
00DBECA2 . >cmp eax,0x2D ; Switch (cases 2D..E7)
00DBECA5 . >je 010Edito.00DBED44 ; if (ret1 == 0x2D) return 0xDB
00DBECAB . >cmp eax,0x4E
00DBECAE . >je X010Edito.00DBED20
00DBECB0 . >cmp eax,0xE7
00DBECB5 . >je X010Edito.00DBED16
00DBECB7 . >push edi ; Default case of switch 00DBECA2
00DBECB8 . >mov ecx,esi
00DBECBA . >call 010Edito.00BB231A
00DBECBF . >cmp eax,0x17 ; Switch (cases 17..138)
00DBECC2 . >je X010Edito.00DBED0C
00DBECC4 . >cmp eax,0x2A
00DBECC7 . >je X010Edito.00DBECEF
00DBECC9 . >cmp eax,0x138
00DBECCE . >jnz X010Edito.00DBED16
00DBECD0 . >mov ecx,esi ; Case 138 of switch 00DBECBF
00DBECD2 . >call 010Edito.00BB8D91
00DBECD7 . >sub eax,0x1A3
00DBECDC . >neg eax
00DBECDE . >sbb eax,eax
00DBECE0 . >and eax,0xFFFFFF36
00DBECE5 . >pop edi
00DBECE6 . >add eax,0xF9
00DBECEB . >pop esi
00DBECEC . >retn 0x8
00DBECEF > >mov ecx,esi ; Case 2A of switch 00DBECBF
00DBECF1 . >call 010Edito.00BB8D91
00DBECF6 . >sub eax,0x1A3
00DBECFB . >neg eax
00DBECFD . >sbb eax,eax
00DBECFF . >and eax,0x7E
00DBED02 . >pop edi
00DBED03 . >add eax,0xF9
00DBED08 . >pop esi
00DBED09 . >retn 0x8
00DBED0C > >pop edi ; Case 17 of switch 00DBECBF
00DBED0D . >mov eax,0x71
00DBED12 . >pop esi
00DBED13 . >retn 0x8
00DBED16 > >pop edi ; Default case of switch 00DBECBF
00DBED17 . >mov eax,0x177
00DBED1C . >pop esi
00DBED1D . >retn 0x8
00DBED20 > >push edi ; Case 4E of switch 00DBECA2
00DBED21 . >mov ecx,esi
00DBED23 . >call 010Edito.00BB231A
00DBED28 . >cmp eax,0x17
00DBED2B . >je X010Edito.00DBED3A
00DBED2D . >pop edi
00DBED2E . >cmp eax,0x2A
00DBED31 . >mov eax,0xED
00DBED36 . >pop esi
00DBED37 . >retn 0x8
00DBED3A > >pop edi
00DBED3B . >mov eax,0x20C
00DBED40 . >pop esi
00DBED41 . >retn 0x8
00DBED44 > >pop edi ; Case 2D of switch 00DBECA2
00DBED45 . >mov eax,0xDB
00DBED4A . >pop esi
00DBED4B . >retn 0x8
可以看出 ,当且仅当ret1 == 0x2D 时, 才可能有 ret2 == 0xDB ,所以ret1也必须等于 0x2D :
00D001F2 . >je 010Edito.00D00387 ; if (ret1 == 0xE7) JMP...
00D001F8 . >cmp dword ptr ds:[ecx+0x2C],0x0
00D001FC . >je 010Edito.00D00387 ; if (e_2c == 0) JMP....
00D00202 . >push 0x0 ; else
00D00204 . >call 010Edito.00BB54E3 ; 网络验证
因此 0x00D001 F2 处的 if(ret1 ==0xE7 )不应该成立 ,只能通过下面的 00D001FC 处的 if (e2c == 0) 成立来 jmp 到 00D00387 处的出口处 ,e_2c我们暂时不知道是什么意义 ,暂时假设 e_2c == 0 .
那我们继续来看 ret1 = calc1(5 ,0x3c70) 按照我们假设, ret1 必须等于 0x2D , F7 跟进:
00DBD180 > >mov eax,dword ptr fs:[0]
00DBD186 . >push -0x1
00DBD188 . >push 010Edito.00E446D9
00DBD18D . >push eax
00DBD18E . >mov dword ptr fs:[0],esp
00DBD195 . >sub esp,0x14
00DBD198 . >push ebx
00DBD199 . >push ebp
00DBD19A . >push esi
00DBD19B . >mov esi,ecx
00DBD19D . >mov eax,dword ptr ds:[esi+0x4]
00DBD1A0 . >xor ebp,ebp
00DBD1A2 . >lea ebx,dword ptr ds:[esi+0x4]
00DBD1A5 . >mov dword ptr ds:[esi+0x30],ebp
00DBD1A8 . >mov dword ptr ds:[esi+0x18],ebp
00DBD1AB . >mov dword ptr ds:[esi+0x34],ebp
00DBD1AE . >cmp dword ptr ds:[eax+0x8],ebp
00DBD1B1 . >je 010Edito.00DBD50F
00DBD1B7 . >mov ecx,dword ptr ds:[esi+0x8]
00DBD1BA . >cmp dword ptr ds:[ecx+0x8],ebp
00DBD1BD . >je 010Edito.00DBD50F
00DBD1C3 . >push edi
00DBD1C4 . >lea edx,dword ptr ss:[esp+0x18]
00DBD1C8 . >push edx
00DBD1C9 . >mov ecx,esi
00DBD1CB . >call 010Edito.00BB88A0
00DBD1D0 . >mov edi,010Edito.00F7FF20
00DBD1D5 > >mov eax,dword ptr ds:[edi]
00DBD1D7 . >push eax
00DBD1D8 . >mov ecx,ebx
00DBD1DA . >call dword ptr ds:[<&QtCore4.QString::o>; QtCore4.QString::operator==
00DBD1E0 . >test al,al
00DBD1E2 . >jnz 010Edito.00DBD3A9
00DBD1E8 . >add edi,0x4
00DBD1EB . >cmp edi,010Edito.00F7FF24
00DBD1F1 .^>jl X010Edito.00DBD1D5
00DBD1F3 . >mov al,byte ptr ss:[esp+0x1B] ; al = s[3]
00DBD1F7 . >mov bl,byte ptr ss:[esp+0x1D] ; bl = s[4]
00DBD1FB . >cmp al,0x9C ; Switch (cases 9C..FC)
00DBD1FD . >jnz X010Edito.00DBD279
00DBD1FF . >mov dl,byte ptr ss:[esp+0x1F] ; Case 9C of switch 00DBD1FB
00DBD203 . >xor dl,byte ptr ss:[esp+0x19]
00DBD207 . >mov cl,byte ptr ss:[esp+0x1E]
00DBD20B . >xor cl,byte ptr ss:[esp+0x18]
00DBD20F . >movzx ax,dl
00DBD213 . >mov byte ptr ss:[esp+0x14],cl
00DBD217 . >mov ecx,0x100
00DBD21C . >imul ax,cx
00DBD220 . >mov dl,bl
00DBD222 . >xor dl,byte ptr ss:[esp+0x1A]
00DBD226 . >movzx cx,dl
00DBD22A . >mov edx,dword ptr ss:[esp+0x14]
00DBD22E . >add ax,cx
00DBD231 . >push edx
00DBD232 . >movzx edi,ax
00DBD235 . >call 010Edito.00BB6D6B
00DBD23A . >movzx eax,al
00DBD23D . >push edi ; e_1c = (s[0]^s[6]^0x18+0x3D)^0xA
00DBD23E . >mov dword ptr ds:[esi+0x1C],eax
00DBD241 . >call 010Edito.00BB77D4
00DBD246 . >mov ecx,dword ptr ds:[esi+0x1C]
00DBD249 . >movzx eax,ax
00DBD24C . >add esp,0x8
00DBD24F . >mov dword ptr ds:[esi+0x20],eax ; p2 =e_20 =((((s[1]^s[7])<<0x8 + s[2]^s[5])^
00DBD252 . >test ecx,ecx ; 0x7892 + 0x4D30)^0x3421)/0xB 或 0
00DBD254 . >je 010Edito.00DBD3A9
00DBD25A . >test eax,eax ; if (e_1c ==0 || e_20 == 0 || e_20 > 0x3E8)
00DBD25C . >je 010Edito.00DBD3A9 ; jmp fail
00DBD262 . >cmp eax,0x3E8
00DBD267 . >ja 010Edito.00DBD3A9
00DBD26D . >cmp ecx,0x2
00DBD270 . >sbb edi,edi
00DBD272 . >and edi,ecx ; p1 = edi
00DBD274 . >jmp 010Edito.00DBD32C ; =============
00DBD279 > >cmp al,0xFC
00DBD27B . >jnz X010Edito.00DBD295
00DBD27D . >mov eax,0x1 ; Case FC of switch 00DBD1FB
00DBD282 . >mov edi,0xFF
00DBD287 . >mov dword ptr ds:[esi+0x1C],edi ; e_1c = -1 ,e_20 = 2_30 = 0
00DBD28A . >mov dword ptr ds:[esi+0x20],eax
00DBD28D . >mov dword ptr ds:[esi+0x30],eax
00DBD290 . >jmp 010Edito.00DBD32C ; ==============
00DBD295 > >cmp al,0xAC
00DBD297 . >jnz 010Edito.00DBD3A9
00DBD29D . >mov cl,byte ptr ss:[esp+0x1F] ; Case AC of switch 00DBD1FB
00DBD2A1 . >xor cl,byte ptr ss:[esp+0x19]
00DBD2A5 . >mov eax,0x100
00DBD2AA . >movzx dx,cl
00DBD2AE . >imul dx,ax
00DBD2B2 . >mov cl,bl
00DBD2B4 . >xor cl,byte ptr ss:[esp+0x1A]
00DBD2B8 . >mov dword ptr ds:[esi+0x1C],0x2 ; e_1c = 0x2
00DBD2BF . >movzx ax,cl
00DBD2C3 . >add dx,ax
00DBD2C6 . >movzx eax,dx
00DBD2C9 . >push eax
00DBD2CA . >call 010Edito.00BB77D4
00DBD2CF . >movzx eax,ax
00DBD2D2 . >add esp,0x4
00DBD2D5 . >mov dword ptr ds:[esi+0x20],eax ; p2=e_20 =((((s[1]^s[7])<<0x8 + s[2]^s[5])^
00DBD2D8 . >test eax,eax ; 0x7892 + 0x4D30)^0x3421)/0xB 或 0
00DBD2DA . >je 010Edito.00DBD3A9
00DBD2E0 . >cmp eax,0x3E8 ; if (e_20 == 0 || e_20 > 0x3E8)
00DBD2E5 . >ja 010Edito.00DBD3A9 ; jmp fail
00DBD2EB . >movzx ecx,byte ptr ss:[esp+0x21]
00DBD2F0 . >movzx eax,byte ptr ss:[esp+0x1C]
00DBD2F5 . >movzx edx,bl
00DBD2F8 . >xor ecx,edx
00DBD2FA . >movzx edx,byte ptr ss:[esp+0x20]
00DBD2FF . >xor eax,edx
00DBD301 . >movzx edx,byte ptr ss:[esp+0x18]
00DBD306 . >shl ecx,0x8
00DBD309 . >add ecx,eax
00DBD30B . >movzx eax,byte ptr ss:[esp+0x1E]
00DBD310 . >shl ecx,0x8
00DBD313 . >xor eax,edx
00DBD315 . >add ecx,eax
00DBD317 . >push 0x5B8C27
00DBD31C . >push ecx
00DBD31D . >call 010Edito.00BB3869
00DBD322 . >mov ebp,eax ; a=(s[5]^s[9]<<8 + s[4]^s[8])<<8+s[0]^s[6]
00DBD324 . >add esp,0x8 ; b=(a^0x5b8c27^0x22c078-0x2c175)^0xee53167
00DBD327 . >mov dword ptr ds:[esi+0x34],ebp ; p1=e_34=HIGH(b*0xf0f0f0f1)>>0x4 或 0
00DBD32A . >mov edi,ebp
00DBD32C > >lea eax,dword ptr ss:[esp+0x10]
00DBD330 . >push eax
00DBD331 . >lea ecx,dword ptr ds:[esi+0x4]
00DBD334 . >call dword ptr ds:[<&QtCore4.QString::t>; QtCore4.QString::toUtf8
00DBD33A . >lea ecx,dword ptr ss:[esp+0x10]
00DBD33E . >mov dword ptr ss:[esp+0x2C],0x0
00DBD346 . >call dword ptr ds:[<&QtCore4.QByteArray>; QtCore4.QByteArray::detach
00DBD34C . >mov ecx,dword ptr ss:[esp+0x10]
00DBD350 . >mov eax,dword ptr ds:[ecx+0xC]
00DBD353 . >mov edx,dword ptr ds:[esi+0x20]
00DBD356 . >xor ecx,ecx
00DBD358 . >cmp byte ptr ss:[esp+0x1B],0xFC
00DBD35D . >push edx
00DBD35E . >setne cl
00DBD361 . >push edi
00DBD362 . >push ecx
00DBD363 . >push eax
00DBD364 . >call 010Edito.00BB263F ; namecalc = _Calcname(szname ,*** ,p1 ,p2)
00DBD369 . >add esp,0x10
00DBD36C . >cmp byte ptr ss:[esp+0x1C],al ; if (s[4] == namecalc[0]) else fail
00DBD370 . >jnz X010Edito.00DBD386
00DBD372 . >mov edx,eax
00DBD374 . >shr edx,0x8
00DBD377 . >cmp bl,dl
00DBD379 . >jnz X010Edito.00DBD3CE ; if (s[5] == namecalc[1]) else fail
00DBD37B . >mov ecx,eax
00DBD37D . >shr ecx,0x10
00DBD380 . >cmp byte ptr ss:[esp+0x1E],cl
00DBD384 . >je X010Edito.00DBD3C3 ; if (s[6] == namecalc[2]) else fail
00DBD386 > >mov edx,dword ptr ss:[esp+0x10]
00DBD38A . >mov dword ptr ss:[esp+0x2C],-0x1
00DBD392 . >or eax,0xFFFFFFFF
00DBD395 . >lock xadd dword ptr ds:[edx],eax
00DBD399 . >jnz X010Edito.00DBD3A9
00DBD39B . >mov ecx,dword ptr ss:[esp+0x10]
00DBD39F . >push ecx ; /block
00DBD3A0 > >call dword ptr ds:[<&QtCore4.qFree>] ; \free
00DBD3A6 . >add esp,0x4
00DBD3A9 > >pop edi ; Default case of switch 00DBD1FB
00DBD3AA . >pop esi
00DBD3AB . >pop ebp
00DBD3AC . >mov eax,0xE7
00DBD3B1 . >pop ebx
00DBD3B2 . >mov ecx,dword ptr ss:[esp+0x14]
00DBD3B6 . >mov dword ptr fs:[0],ecx
00DBD3BD . >add esp,0x20
00DBD3C0 . >retn 0x8
00DBD3C3 > >mov edx,eax
00DBD3C5 . >shr edx,0x18
00DBD3C8 . >cmp byte ptr ss:[esp+0x1F],dl
00DBD3CC . >je X010Edito.00DBD3EA ; if (s[7] == namecalc[3]) else fail
00DBD3CE > >mov eax,dword ptr ss:[esp+0x10]
00DBD3D2 . >mov dword ptr ss:[esp+0x2C],-0x1
00DBD3DA . >or ecx,0xFFFFFFFF
00DBD3DD . >lock xadd dword ptr ds:[eax],ecx
00DBD3E1 .^>jnz X010Edito.00DBD3A9
00DBD3E3 . >mov edx,dword ptr ss:[esp+0x10]
00DBD3E7 . >push edx
00DBD3E8 .^>jmp X010Edito.00DBD3A0
00DBD3EA > >mov cl,byte ptr ss:[esp+0x1B] ; cl = s[3]
00DBD3EE . >cmp cl,0x9C ; Switch (cases 9C..FC)
00DBD3F1 . >jnz X010Edito.00DBD402
00DBD3F3 . >mov eax,dword ptr ss:[esp+0x34] ; Case 9C of switch 00DBD3EE
00DBD3F7 . >or edx,0xFFFFFFFF
00DBD3FA . >cmp eax,dword ptr ds:[esi+0x1C]
00DBD3FD . >jmp 010Edito.00DBD482 ; if (e_1c <= 5) fail
00DBD402 > >cmp cl,0xFC
00DBD405 . >jnz X010Edito.00DBD472
00DBD407 . >movzx ecx,byte ptr ss:[esp+0x1A] ; Case FC of switch 00DBD3EE
00DBD40C . >movzx edx,byte ptr ss:[esp+0x19]
00DBD411 . >shl ecx,0x8
00DBD414 . >push eax
00DBD415 . >movzx eax,byte ptr ss:[esp+0x1C]
00DBD41A . >add ecx,edx
00DBD41C . >shl ecx,0x8
00DBD41F . >add ecx,eax
00DBD421 . >push ecx
00DBD422 . >call 010Edito.00BB3869
00DBD427 . >mov ecx,dword ptr ss:[esp+0x18]
00DBD42B . >add esp,0x8 ; 可以看出,当s[3]==0xFC (即case 0xFC)
00DBD42E . >or edx,0xFFFFFFFF ; 返回值为 0x93,而不能是 0x2D ,所以s[3]!=0x9C
00DBD431 . >mov dword ptr ss:[esp+0x2C],-0x1
00DBD439 . >test eax,eax
00DBD43B . >je 010Edito.00DBD4FB
00DBD441 . >mov dword ptr ds:[esi+0x18],eax
00DBD444 . >lock xadd dword ptr ds:[ecx],edx
00DBD448 . >jnz X010Edito.00DBD458
00DBD44A . >mov eax,dword ptr ss:[esp+0x10]
00DBD44E . >push eax ; /block
00DBD44F . >call dword ptr ds:[<&QtCore4.qFree>] ; \free
00DBD455 . >add esp,0x4
00DBD458 > >pop edi
00DBD459 . >pop esi
00DBD45A . >pop ebp
00DBD45B . >mov eax,0x93 ; 0x93
00DBD460 . >pop ebx
00DBD461 . >mov ecx,dword ptr ss:[esp+0x14]
00DBD465 . >mov dword ptr fs:[0],ecx
00DBD46C . >add esp,0x20
00DBD46F . >retn 0x8
00DBD472 > >cmp cl,0xAC
00DBD475 . >jnz X010Edito.00DBD4EC
00DBD477 . >test ebp,ebp ; Case AC of switch 00DBD3EE
00DBD479 . >je X010Edito.00DBD4EC
00DBD47B . >or edx,0xFFFFFFFF
00DBD47E . >cmp dword ptr ss:[esp+0x38],ebp ; if ((p1=e_34) < 0x3C70) fail
00DBD482 > >mov ecx,dword ptr ss:[esp+0x10]
00DBD486 . >mov dword ptr ss:[esp+0x2C],-0x1
00DBD48E . >jbe X010Edito.00DBD4BE ; ======
00DBD490 . >lock xadd dword ptr ds:[ecx],edx
00DBD494 . >jnz X010Edito.00DBD4A4
00DBD496 . >mov eax,dword ptr ss:[esp+0x10]
00DBD49A . >push eax ; /block
00DBD49B . >call dword ptr ds:[<&QtCore4.qFree>] ; \free
00DBD4A1 . >add esp,0x4
00DBD4A4 > >pop edi
00DBD4A5 . >pop esi
00DBD4A6 . >pop ebp
00DBD4A7 . >mov eax,0x4E ; return 0x4E
00DBD4AC . >pop ebx
00DBD4AD . >mov ecx,dword ptr ss:[esp+0x14]
00DBD4B1 . >mov dword ptr fs:[0],ecx
00DBD4B8 . >add esp,0x20
00DBD4BB . >retn 0x8
00DBD4BE > >lock xadd dword ptr ds:[ecx],edx
00DBD4C2 . >jnz X010Edito.00DBD4D2
00DBD4C4 . >mov eax,dword ptr ss:[esp+0x10]
00DBD4C8 . >push eax ; /block
00DBD4C9 . >call dword ptr ds:[<&QtCore4.qFree>] ; \free
00DBD4CF . >add esp,0x4
00DBD4D2 > >pop edi
00DBD4D3 . >pop esi
00DBD4D4 . >pop ebp
00DBD4D5 . >mov eax,0x2D ; return 0x2D
00DBD4DA . >pop ebx
00DBD4DB . >mov ecx,dword ptr ss:[esp+0x14]
00DBD4DF . >mov dword ptr fs:[0],ecx
00DBD4E6 . >add esp,0x20
00DBD4E9 . >retn 0x8
00DBD4EC > >mov ecx,dword ptr ss:[esp+0x10] ; Default case of switch 00DBD3EE
00DBD4F0 . >mov dword ptr ss:[esp+0x2C],-0x1
00DBD4F8 . >or edx,0xFFFFFFFF
00DBD4FB > >lock xadd dword ptr ds:[ecx],edx
00DBD4FF .^>jnz 010Edito.00DBD3A9
00DBD505 . >mov eax,dword ptr ss:[esp+0x10]
00DBD509 . >push eax
00DBD50A .^>jmp 010Edito.00DBD3A0
00DBD50F > >mov ecx,dword ptr ss:[esp+0x20]
00DBD513 . >pop esi
00DBD514 . >pop ebp
00DBD515 . >mov eax,0x93 ; return 0x93
00DBD51A . >pop ebx
00DBD51B . >mov dword ptr fs:[0],ecx
00DBD522 . >add esp,0x20
00DBD525 . >retn 0x8
总结一下这个函数吧, p1 ,p2 ,分别是调用namecalc= _Calcname(.....) 的两个参数:
1.当s[3]==0x9C 时 , e_1c = (s[0]^s[6]^0x18+0x3D)^0xA ; p1 = 0 ;
p2 =e_20 =((((s[1]^s[7])<<0x8 + s[2]^s[5])^0x7892+0x4D30)^0x3421)/0xB 或 0 , 当然等于0就fail了
=>namecalc=_Calcname(szname ,*** ,p1 ,p2)
=>s[4]=namecalc[0] ,s[5]=namecalc[1] ,s[6]=namcalc[2] ,s[7]=namecalc[3]
=>s[0] 满足 : (s[0]^s[6]+0x18+0x3D)^0xA >= 5
=>s[1] ,s[5] 满足: s[1]^s[7]<<0x18+s[2]^s[5]=((p2*0xB)^0x3421-0x4D30)^0x7892
解释下p1=0:
00DBD26D . >cmp ecx,0x2 ; ecx=e_1c
00DBD270 . >sbb edi,edi
00DBD272 . >and edi,ecx ; p1 = edi
在这里, p1=edi 要么为0(当e_1c>=2时) ,要么为0xFFFFFFF(当e_1c<2时)
又因为:
00DBD3FA . >cmp eax,dword ptr ds:[esi+0x1C]
00DBD3FD . >jmp 010Edito.00DBD482 ; if (e_1c < 5) fail
所以,要注册成功的话 ,e_1c>=5 是必须的, 所以p1=edi=0;
2.当s[3]==0xFC 时: 因为s[3]==0xfc 时cal1(...) 不可能返回0x2D ,所以 不能是s[3]==0xFC.
3.当s[3]==0xAC时: a=(s[5]^s[9]<<8 + s[4]^s[8])<<8+s[0]^s[6] ,
b=(a^0x5b8c27^0x22c078-0x2c175)^0xee53167
p1 = p1=e_34=HIGH(b*0xf0f0f0f1)>>0x4 或 0;
e_p2=e_20 =((((s[1]^s[7])<<0x8 + s[2]^s[5])^0x7892+0x4D30)^0x3421)/0xB 或0;
=>namecalc=_Calcname(szname ,*** ,p1 ,p2)
=>s[4]=namecalc[0] ,s[5]=namecalc[1] ,s[6]=namcalc[2] ,s[7]=namecalc[3]
=>s[1] ,s[5] 满足: s[1]^s[7]<<0x18+s[2]^s[5]=((p2*0xB)^0x3421-0x4D30)^0x7892
=>s[0] ,s[8] ,s[9] 满足: 往下看....
解释下P1吧 , 先F7跟进 0xDBD31D处的 call (a)
00DBB9AF >int3 ; a=(s[5]^s[9]<<8 + s[4]^s[8])<<8+s[0]^s[6]
00DBB9B0 > >mov ecx,dword ptr ss:[esp+0x4]
00DBB9B4 . >xor ecx,dword ptr ss:[esp+0x8]
00DBB9B8 . >mov eax,0xF0F0F0F1
00DBB9BD . >xor ecx,0x22C078
00DBB9C3 . >sub ecx,0x2C175
00DBB9C9 . >xor ecx,0xFFE53167
00DBB9CF . >and ecx,0xFFFFFF ; b=ecx=(a^0x5b8c27^0x22c078-0x2c175)^0xee53167
00DBB9D5 . >mul ecx
00DBB9D7 . >shr edx,0x4 ; edx=HIGH(b*0xF0F0F0F1)/0x10
00DBB9DA . >push esi
00DBB9DB . >mov esi,edx
00DBB9DD . >shl esi,0x4
00DBB9E0 . >add esi,edx ; esi=HIGH(b*0xF0F0F0F1)/0x10 * 0x11
00DBB9E2 . >mov eax,ecx
00DBB9E4 . >sub eax,esi ; eax= b-(HIGH(b*0xF0F0F0F1)/0x10 * 0x11)
00DBB9E6 . >neg eax
00DBB9E8 . >sbb eax,eax
00DBB9EA . >not eax
00DBB9EC . >and eax,edx
00DBB9EE . >pop esi
00DBB9EF . >retn
当eax !=0(即b!=(HIGH(b*0xF0F0F0F1)/0x10 * 0x11))时 ,neg eax => cf =1 , sbb eax ,eax => eax = 0xFFFFFFFF , not eax => eax =0 , and eax ,edx => eax=0,即p1==0 ,又因为
00DBD47E . >cmp dword ptr ss:[esp+0x38],ebp ; if ((p1=e_34) < 0x3C70) fail
所以 ,eax =0(即b=(HIGH(b*0xF0F0F0F1)/0x10 * 0x11)) 是必须的 ,此时 ,neg eax => cf=0 ,sbb eax ,eax => eax=0 ,not eax => eax=0xFFFFFFFF ,and eax ,edx => eax=p1=edx = HIGH(b*0xF0F0F0F1)/0x10;
=>s[0] ,s[8] ,s[9] 满足: 使得b满足: b=b=(HIGH(b*0xF0F0F0F1)/0x10*0x11即可;
接下来就是namecalc = _Calcname(szname ,*** ,p1 ,p2) 了,这个就直接贴源码了吧:
uint _calcname(
char* szname,
uint ***,
uint p1,
uint p2
)
{
//tb 为一个常数表
uint t1=0 ,t2=0 ,nret=0;
uint k1=17*p1 ,k2=15*p2;
int len=strlen(szname);
uchar* nm=(uchar*)szname;
for (int i=0 ;i<len ;i++)
{
//to upper
if (szname[i]>0x60&&szname[i]<0x7b)
szname[i]=szname[i]-0x20;
if (***==1)
{
nret=((tb[nm[i]]+nret)^tb[(nm[i]+0xD)&0xFF])*
tb[(nm[i]+0x2F)&0xFF]+tb[k1&0xFF]+tb[k2&0xFF]+tb[t1&0xFF];
}
else
{
nret=((tb[nm[i]]+nret)^tb[(nm[i]+0x3F)&0xFF])*
tb[(nm[i]+0x17)&0xFF]+tb[k1&0xFF]+tb[k2&0xFF]+tb[t1&0xFF];
}
k1+=0x9 ,k2+=0xD ,t1+=0x13 ,t2+=0x7;
}
return nret;
}
根据上述描述逆推s[0] - s[9]过程用c语言描述如下,用代码说应该更清晰些:
void _calc(
char* szname
)
{
uchar szserial[0x10]={0};
uint p1=0 ,p2=0 ,a ,b ,namecalc ,tmp;
//1.s[3]==0x9C;
for (szserial[3]=0x9C,p2=1 ;p2<0x3E8 ;p2++)
{
namecalc=_calcname(szname ,1 ,p1 ,p2);
//s[1] ,s[2]
szserial[4]=namecalc&0xFF;
szserial[5]=(namecalc>>0x8)&0xFF;
szserial[6]=(namecalc>>0x10)&0xFF;
szserial[7]=(namecalc>>0x18)&0xFF;
tmp=(((p2*0xB)^0x3421)-0x4D30)^0x7892;
szserial[2]=((tmp&0xFF)^szserial[5])&0xFF;
szserial[1]=(((tmp>>0x8)&0xFF)^szserial[7])&0xFF;
//s[0]
int n=0;
for (uint i=0 ;i<0x100 ;i++)
{
szserial[0]=i;
if ((szserial[0]^szserial[6]^0x18+0x3D)^0xA>0x5)
_output(szserial[3] ,szserial);
return;
}
}
//s[3]==0xAC;
for (szserial[3]=0xAC ,p2=1 ;p2<0x3E8 ;p2++)
{
for (b=0x40370 ;b<0xFFFFFF ;b++)
{
__asm
{
mov eax ,0xF0F0F0F1
mov ecx ,b
mul ecx
mov tmp ,edx
}
if ((b-((tmp>>0x4)*0x11))||(tmp>>0x4)<0x3c70)
continue;
p1=tmp>>0x4;
namecalc=_calcname(szname ,1 ,p1 ,p2);
szserial[4]=namecalc&0xFF;
szserial[5]=(namecalc>>0x8)&0xFF;
szserial[6]=(namecalc>>0x10)&0xFF;
szserial[7]=(namecalc>>0x18)&0xFF;
tmp=(((p2*0xB)^0x3421)-0x4D30)^0x7892;
szserial[2]=((tmp&0xFF)^szserial[5])&0xFF;
szserial[1]=(((tmp>>0x8)&0xFF)^szserial[7])&0xFF;
a=(((b^0xE53167)+0x2C175)^0x22C078)^0x5B8C27;
szserial[0]=((a&0xFF)^szserial[6])&0xFF;
szserial[8]=(((a>>0x8)&0xFF)^szserial[4])&0xFF;
szserial[9]=(((a>>0x10)&0xFF)^szserial[5])&0xFF;
_output(0xAC ,szserial);
}
}
}
可以看出一个username可以对应相当多个serial.
还没完呢
......如果调试过整个注册过程的话就会知道问题出在哪里, 会发现只有第一次注册会成功 ,之后即使用同一个username和serial再试就通过不了了, 这是因为我们在前面假设
00D001F8 . >cmp dword ptr ds:[ecx+0x2C],0x0
00D001FC . >je 010Edito.00D00387 ; if (e_2c == 0) JMP....
00D00202 . >push 0x0 ; else
00D00204 . >call 010Edito.00BB54E3 ; 网络验证
e_2c ==0 来使注册过程跳转到 :
00D0037F . >mov ecx,dword ptr ds:[0xF87E4C] ; if (ret2==0xDB)
00D00385 . >mov edi,eax ; 则 注册成功
00D00387 > >cmp edi,0xDB
00D0038D . >jnz X010Edito.00D003C7 ; 若注册成功时必须且只能经过这个出口
这个出口,而且也只能走这一条路 ,失败的原因就是因为 e_2c==0并不成立 ,而是e_2c==1 ,这样的话就进入网络验证通道了,
F7跟进分析之后发现程序会向:
http://www.sweetscape.com/cgibin/010editor_check_license_9b.php?name=xxxxxx&pwd=xxxx-xxxx-xxxx-xxxx-xxxx&id=0&chk=xxxxx&typ=0
其中name是经过个另变形的username:
空格 ----> '+'
其它非数字/字母字符 -----> x>>4 >10? x>>4+0x30 : x>>4+0x37 和 x<<4 >10?x<<4+0x30 : x<<4+0x37 两个字符
chk为原username经过计算得到的一个数值 , 计算过程为:
00DBCC40 > >push ebx
00DBCC41 . >mov ebx,dword ptr ss:[esp+0x8]
00DBCC45 . >push esi
00DBCC46 . >mov eax,ebx
00DBCC48 . >push edi
00DBCC49 . >lea edx,dword ptr ds:[eax+0x1]
00DBCC4C . >lea esp,dword ptr ss:[esp]
00DBCC50 > >mov cl,byte ptr ds:[eax]
00DBCC52 . >inc eax
00DBCC53 . >test cl,cl
00DBCC55 .^>jnz X010Edito.00DBCC50
00DBCC57 . >sub eax,edx
00DBCC59 . >mov edi,eax
00DBCC5B . >xor ecx,ecx
00DBCC5D . >xor esi,esi
00DBCC5F . >test edi,edi
00DBCC61 . >jle X010Edito.00DBCCA1 ; while( namelen )
00DBCC63 > >movzx eax,byte ptr ds:[esi+ebx] ; {
00DBCC67 . >mov edx,eax
00DBCC69 . >shl edx,0x4
00DBCC6C . >add edx,eax
00DBCC6E . >lea eax,dword ptr ds:[ecx+ecx*4]
00DBCC71 . >lea ecx,dword ptr ds:[edx+eax+0x9] ; ret=name[i]<<0x4+name[i]+5*ret+9
00DBCC75 . >cmp ecx,0xFFFF
00DBCC7B . >jle X010Edito.00DBCC9C ; if (ret > 0xFFFF)
00DBCC7D . >lea edx,dword ptr ds:[ecx+0xFFFF0000] ; ret+=0xFFFF0001-((HIGH((ret+0xFFFF0000)*
00DBCC83 . >mov eax,0x80008001 ; 0x800008001)>>0xF)*0xFFFF)
00DBCC88 . >mul edx
00DBCC8A . >shr edx,0xF
00DBCC8D . >imul edx,edx,0xFFFF
00DBCC93 . >mov eax,0xFFFF0001
00DBCC98 . >sub eax,edx
00DBCC9A . >add ecx,eax
00DBCC9C > >inc esi
00DBCC9D . >cmp esi,edi
00DBCC9F .^>jl X010Edito.00DBCC63 ; }
00DBCCA1 > >pop edi
00DBCCA2 . >pop esi
00DBCCA3 . >mov eax,ecx
00DBCCA5 . >pop ebx
00DBCCA6 . >retn 0x4
请求得到的验证结果数据最初会保存在:
C:\Users\pc用户名\AppData\Local\Temp\010xxxx.tmp ,xxxx我不知道是不是固定的,要突破这种验证除了在OD中改程序执行流程或数据之外, 可以修改这个文件内容 ,但这个文件在程序读取完其中的内容之后会马上将其删除, 我们可以在进入网络验证之前 bp ReadFile 就可以得到
将文件中的invalid 改为除 "error" ,"invalid" 之外的任何都行, 不一定非得valid ,因为跟踪程序会发现 ,程序只验证 "error" ,和"invalid" ,而将其它都视为valid, 这种修改似乎是永久有效的 ,如果你在调试强制将 e_2c 改为 0 ,即使注册成功 ,下次打开时依旧是未注册的 ,又得再次修改e_2c 值 ,也就是说,通过这样改来注册成功,"成功是一次性的" .........
除了修改文件来突破这种验证之外还有一种方法 ,就是修改注册表:
先F7跟进: 00D00204 . >call 010Edito.00BB54E3 ; 网络验证
这个函数先是构造请求数据的网址,再构造注册表地址,将返回结果加密后存入注册表的一个字段中
多次跟进之后来到:
00DC0790 > >push -0x1
00DC0792 . >push 010Edito.00E44ADD ; SE 处理程序安装
00DC0797 . >mov eax,dword ptr fs:[0]
00DC079D . >push eax
00DC079E . >mov dword ptr fs:[0],esp
00DC07A5 . >sub esp,0x64
00DC07A8 . >mov eax,dword ptr ss:[esp+0x78]
00DC07AC . >push ebp
00DC07AD . >push esi
00DC07AE . >push edi
00DC07AF . >push eax ; /<%u>
00DC07B0 . >mov esi,ecx ; |
00DC07B2 . >lea ecx,dword ptr ss:[esp+0x24] ; |
00DC07B6 . >push 010Edito.00E834D4 ; |format = "%u"
00DC07BB . >push ecx ; |s
00DC07BC . >call dword ptr ds:[<&MSVCR90.sprintf>] ; \sprintf
00DC07C2 . >add esp,0xC
00DC07C5 . >lea edx,dword ptr ss:[esp+0x84]
00DC07CC . >push edx
00DC07CD . >push 0x0
00DC07CF . >lea eax,dword ptr ss:[esp+0x14]
00DC07D3 . >push eax
00DC07D4 . >mov ecx,esi
00DC07D6 . >call 010Edito.00BB4A70 ; 构造注册表地址
00DC07DB . >mov edi,dword ptr ds:[<&QtCore4.QString>; QtCore4.QString::fromAscii_helper
00DC07E1 . >or ebp,0xFFFFFFFF
00DC07E4 . >lea ecx,dword ptr ss:[esp+0x20]
00DC07E8 . >push ebp
00DC07E9 . >push ecx
00DC07EA . >mov dword ptr ss:[esp+0x80],0x0
00DC07F5 . >call edi ; <&QtCore4.QString::fromAscii_helper>
00DC07F7 . >mov dword ptr ss:[esp+0x1C],eax
00DC07FB . >push ebp
00DC07FC . >push 010Edito.00E86558 ; ASCII "ThreadingModel"
00DC0801 . >mov byte ptr ss:[esp+0x88],0x1
00DC0809 . >call edi
00DC080B . >mov dword ptr ss:[esp+0x20],eax
00DC080F . >mov edx,dword ptr ss:[esp+0x90]
00DC0816 . >push edx
00DC0817 . >lea eax,dword ptr ss:[esp+0x20]
00DC081B . >push eax
00DC081C . >lea ecx,dword ptr ss:[esp+0x34]
00DC0820 . >push ecx
00DC0821 . >mov byte ptr ss:[esp+0x94],0x2
00DC0829 . >call 010Edito.00BB4688 ; 构造注册表地址字符串
00DC082E . >push 010Edito.00E86540 ; ASCII "\InProcServer32A\"
00DC0833 . >push eax
00DC0834 . >lea edx,dword ptr ss:[esp+0x3C]
00DC0838 . >push edx
00DC0839 . >mov byte ptr ss:[esp+0xA0],0x3
00DC0841 . >call 010Edito.00BB4688 ; 继续构造注册表地址字符串
00DC0846 . >add esp,0x28
00DC0849 . >mov ecx,dword ptr ss:[esp+0x84]
00DC0850 . >push ecx ; 2
00DC0851 . >push 0x0 ; 0
00DC0853 . >lea edx,dword ptr ss:[esp+0x1C] ; p1
00DC0857 . >push edx
00DC0858 . >lea ecx,dword ptr ss:[esp+0x1C]
00DC085C . >push ecx ; "ThreadingModel"----Qstring
00DC085D . >push eax ; 注册表地址 ----- Qstring
00DC085E . >mov ecx,esi
00DC0860 . >mov byte ptr ss:[esp+0x8C],0x4
00DC0868 . >call 010Edito.00BB3AF3 ; 操作注册表 再F7跟进
00DC086D . >mov edx,dword ptr ss:[esp+0x18]
可以看出这里是向:Software\SweetScape\010 Editor\CLASSES\CLSID\{FA1395FC-83C3-0732-7D11-0134937462A0}\InProcServer32A\ 处写入数据 ,写入什么? 什么字段?根目录是什么? 继续F7:
00DBF890 > >mov eax,dword ptr ss:[esp+0x14]
00DBF894 . >push ebx
00DBF895 . >push ebp
00DBF896 . >push esi
00DBF897 . >cmp eax,0x1
00DBF89A . >jnz X010Edito.00DBF8A3
00DBF89C . >mov ebx,0x80000000
00DBF8A1 . >jmp X010Edito.00DBF8B1
00DBF8A3 > >xor ebx,ebx
00DBF8A5 . >cmp eax,0x2
00DBF8A8 . >setne bl
00DBF8AB . >add ebx,0x80000001 ; 根目录: HKEY_CURRENT_USER
00DBF8B1 > >mov ebp,dword ptr ss:[esp+0x10] ; 注册表地址
00DBF8B5 . >mov esi,dword ptr ds:[<&QtCore4.QString>; QtCore4.QString::utf16
00DBF8BB . >lea eax,dword ptr ss:[esp+0x20]
00DBF8BF . >push eax
00DBF8C0 . >push 0x2001F
00DBF8C5 . >push 0x0
00DBF8C7 . >mov ecx,ebp
00DBF8C9 . >call esi ; <&QtCore4.QString::utf16>
00DBF8CB . >push eax ; |Subkey
00DBF8CC . >push ebx ; |hKey
00DBF8CD . >call dword ptr ds:[<&ADVAPI32.RegOpenKe>; \RegOpenKeyExW
00DBF8D3 . >test eax,eax
00DBF8D5 . >je X010Edito.00DBF92F
00DBF8D7 . >push edi
00DBF8D8 . >xor edi,edi
00DBF8DA . >cmp dword ptr ss:[esp+0x20],edi
00DBF8DE . >je X010Edito.00DBF8E7
00DBF8E0 . >call 010Edito.00BB8193
00DBF8E5 . >mov edi,eax
00DBF8E7 > >lea ecx,dword ptr ss:[esp+0x14]
00DBF8EB . >push ecx
00DBF8EC . >lea edx,dword ptr ss:[esp+0x28]
00DBF8F0 . >push edx
00DBF8F1 . >push edi
00DBF8F2 . >push 0x2001F
00DBF8F7 . >push 0x0
00DBF8F9 . >push 0x0
00DBF8FB . >push 0x0
00DBF8FD . >mov ecx,ebp
00DBF8FF . >call esi
00DBF901 . >push eax ; |Subkey
00DBF902 . >push ebx ; |hKey
00DBF903 . >call dword ptr ds:[<&ADVAPI32.RegCreate>; \RegCreateKeyExW
00DBF909 . >mov ebx,eax
00DBF90B . >test edi,edi
00DBF90D . >je X010Edito.00DBF921
00DBF90F . >mov eax,dword ptr ds:[edi+0x4]
00DBF912 . >push eax
00DBF913 . >call <jmp.&MSVCR90.operator delete>
00DBF918 . >push edi
00DBF919 . >call <jmp.&MSVCR90.operator delete>
00DBF91E . >add esp,0x8
00DBF921 > >pop edi
00DBF922 . >test ebx,ebx
00DBF924 . >je X010Edito.00DBF92F
00DBF926 . >pop esi
00DBF927 . >pop ebp
00DBF928 . >or eax,0xFFFFFFFF
00DBF92B . >pop ebx
00DBF92C . >retn 0x14
00DBF92F > >mov ecx,dword ptr ss:[esp+0x18]
00DBF933 . >mov edx,dword ptr ds:[ecx]
00DBF935 . >mov eax,dword ptr ds:[edx+0x8]
00DBF938 . >lea eax,dword ptr ds:[eax+eax+0x2]
00DBF93C . >push eax
00DBF93D . >call esi
00DBF93F . >mov ecx,dword ptr ss:[esp+0x18]
00DBF943 . >push eax ; 写入的数据
00DBF944 . >push 0x1
00DBF946 . >push 0x0
00DBF948 . >call esi
00DBF94A . >mov ecx,dword ptr ss:[esp+0x30] ; |
00DBF94E . >push eax ; |字段为 "ThreadingModel"
00DBF94F . >push ecx ; |hKey
00DBF950 . >call dword ptr ds:[<&ADVAPI32.RegSetVal>; \RegSetValueExW
00DBF956 . >mov edx,dword ptr ss:[esp+0x20]
00DBF95A . >mov esi,eax
00DBF95C . >neg esi
00DBF95E . >push edx ; /hKey
00DBF95F . >sbb esi,esi ; |
00DBF961 . >call dword ptr ds:[<&ADVAPI32.RegCloseK>; \RegCloseKey
00DBF967 . >mov eax,esi
00DBF969 . >pop esi
00DBF96A . >pop ebp
00DBF96B . >pop ebx
00DBF96C . >retn 0x14
到这里我们唯一还不确定的就是写入的数据是什么了, 其实是一个整数 ,这个整数初如值a为, 网络验证返回的字符"xxxx" 如果为"invalid" or "error" ,则a=1 ,否则a=0 ,同时程序会将这个a的值写入到 e_2c 中,
00DBDC6C > >mov ecx,010Edito.00E860C8 ; ASCII "invalid"
00DBDC71 . >lea eax,dword ptr ss:[esp+0x414] ; eax -> 网络验证 返回的字符串
00DBDC78 > >mov dl,byte ptr ds:[eax]
00DBDC7A . >cmp dl,byte ptr ds:[ecx]
00DBDC7C . >jnz X010Edito.00DBDC98
00DBDC7E . >test dl,dl
00DBDC80 . >je X010Edito.00DBDC94
00DBDC82 . >mov dl,byte ptr ds:[eax+0x1]
00DBDC85 . >cmp dl,byte ptr ds:[ecx+0x1]
00DBDC88 . >jnz X010Edito.00DBDC98
00DBDC8A . >add eax,0x2
00DBDC8D . >add ecx,0x2
00DBDC90 . >test dl,dl
00DBDC92 .^>jnz X010Edito.00DBDC78
00DBDC94 > >xor eax,eax
00DBDC96 . >jmp X010Edito.00DBDC9D
00DBDC98 > >sbb eax,eax
00DBDC9A . >sbb eax,-0x1
00DBDC9D > >mov esi,0x1
00DBDCA2 . >test eax,eax
00DBDCA4 . >jnz X010Edito.00DBDCAB
00DBDCA6 . >mov dword ptr ds:[edi+0x2C],esi
00DBDCA9 . >jmp X010Edito.00DBDCB2
00DBDCAB > >mov dword ptr ds:[edi+0x2C],0x0
00DBDCB2 > >mov ecx,dword ptr ds:[edi+0x2C]
00DBDCB5 . >push ecx
00DBDCB6 . >call 010Edito.00BB7C2F ; GetPointer
00DBDCBB . >mov ecx,eax
00DBDCBD . >call 010Edito.00BB397C ; 经过 加密 写入注册表
00DBDCC2 . >cmp dword ptr ds:[edi+0x2C],esi
00DBDCC5 . >jnz X010Edito.00DBDCD5
00DBDCC7 . >pop edi
00DBDCC8 . >pop esi
00DBDCC9 . >xor eax,eax
00DBDCCB . >pop ebx
00DBDCCC . >add esp,0xC08
00DBDCD2 . >retn 0x10
加密过程为:
00DBB8F0 > >mov eax,dword ptr ss:[esp+0x4]
00DBB8F4 . >imul eax,eax,0x3519
00DBB8FA . >xor eax,0x7C4280C0
00DBB8FF . >add eax,0x2749B4FF
00DBB904 . >xor eax,0xC7329CD4
00DBB909 . >retn
即b=(((a*0x3519)^0x7c42800)&0x2749b4ff)^0xc7329cd4
写入注册表的为b的十进制值的字符串形式 ,如果网络验证返回 "invalid" 情况下 ,e_2c=a=1; =>b=0x64BEF60C (1690236428) , 如果 a=0 => b=0x64BEA96B(1690216811) ,如果强制将 注册表: HKEY_CURRENT_USER\Software\SweetScape\010 Editor\CLASSES\CLSID\{FA1395FC-83C3-0732-7D11-0134937462A0}\InProcServer32A\ 的 ThreadingModel 字段值改为 1690216811 ,重启程序之后 就可以正常注册了 ,而且以后也不用再注册了:
就先这样了,一口气写了这么多了,累死我了,
无图无真相:
【注册机源码下载】 keygen to 010Editor.rar
注: 本次调试加载基址为: 0xBB0000
【联系作者】zhong_sf@sina.com
【软件名称】010Editor 4.04
【附件下载】http://www.sweetscape.com/download/previous/
【注册机源码下载】 keygen to 010Editor.rar
010Editor这款编辑器个人觉得挺不错的,特别是写shelllcode时非常方便,比起ue 等,我还是比较认可它的, 之前以为是免费软件,用得很爽,这些天突然提示试用期到期,必须注册才能继续使用.到官网看了下价格,新用户至少也得近50美元, 我穷书生一个,买不起,
, 先crack ,等以后搬砖赚够钱了再买吧.先bp ShowWindow ,经过几次回溯之后来到下面:
00CFFE20 > >push -0x1
00CFFE22 . >push 010Edito.00E351D2 ; SE 处理程序安装
00CFFE27 . >mov eax,dword ptr fs:[0]
00CFFE2D . >push eax
00CFFE2E . >mov dword ptr fs:[0],esp
00CFFE35 . >sub esp,0x1C
00CFFE38 . >push ebx
00CFFE39 . >push ebp
00CFFE3A . >xor ebx,ebx
00CFFE3C . >mov dword ptr ss:[esp+0x14],ebx
00CFFE40 . >mov eax,dword ptr ds:[<&QtCore4.QString::shared_>
00CFFE45 . >push esi
00CFFE46 . >mov esi,ecx
00CFFE48 . >push edi
00CFFE49 . >mov dword ptr ss:[esp+0x14],eax
00CFFE4D . >mov ecx,0x1
00CFFE52 . >lock xadd dword ptr ds:[eax],ecx
00CFFE56 . >mov eax,dword ptr ds:[<&QtCore4.QString::shared_>
00CFFE5B . >mov dword ptr ss:[esp+0x34],ebx
00CFFE5F . >mov dword ptr ss:[esp+0x18],eax
00CFFE63 . >mov edx,0x1
00CFFE68 . >lock xadd dword ptr ds:[eax],edx ; ---------------
00CFFE6C . >mov ecx,dword ptr ds:[esi+0x58]
00CFFE6F . >mov edi,dword ptr ds:[<&QtGui4.QLineEdit::text>] ; QtGui4.QLineEdit::text
00CFFE75 . >lea eax,dword ptr ss:[esp+0x20]
00CFFE79 . >push eax
00CFFE7A . >mov byte ptr ss:[esp+0x38],0x1
00CFFE7F . >call edi ; <&QtGui4.QLineEdit::text>
00CFFE81 . >mov ecx,dword ptr ds:[eax]
00CFFE83 . >cmp dword ptr ds:[ecx+0x8],ebx ; 判断用户名是否为空
00CFFE86 . >mov edx,dword ptr ss:[esp+0x20]
00CFFE8A . >sete bl
00CFFE8D . >or eax,0xFFFFFFFF
00CFFE90 . >lock xadd dword ptr ds:[edx],eax
00CFFE94 . >mov ebp,dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00CFFE9A . >jnz X010Edito.00CFFEA6
00CFFE9C . >mov ecx,dword ptr ss:[esp+0x20]
00CFFEA0 . >push ecx
00CFFEA1 . >call ebp ; <&QtCore4.QString::free>
00CFFEA3 . >add esp,0x4
00CFFEA6 > >test bl,bl
00CFFEA8 . >je 010Edito.00CFFF3B ; --------------
00CFFEAE . >push -0x1
00CFFEB0 . >push 010Edito.00E6F80C ; ASCII "Please enter a name."
00CFFEB5 . >call dword ptr ds:[<&QtCore4.QString::fromAscii_>; QtCore4.QString::fromAscii_helper
00CFFEBB . >mov dword ptr ss:[esp+0x24],eax
00CFFEBF . >lea edx,dword ptr ss:[esp+0x24]
00CFFEC3 . >push edx
00CFFEC4 . >mov byte ptr ss:[esp+0x40],0x2
00CFFEC9 . >call 010Edito.00BB1636
00CFFECE . >mov eax,dword ptr ss:[esp+0x28]
00CFFED2 . >add esp,0xC
00CFFED5 . >mov byte ptr ss:[esp+0x34],0x1
00CFFEDA . >or ecx,0xFFFFFFFF
00CFFEDD . >lock xadd dword ptr ds:[eax],ecx
00CFFEE1 . >jnz X010Edito.00CFFEED
00CFFEE3 . >mov edx,dword ptr ss:[esp+0x1C]
00CFFEE7 . >push edx
00CFFEE8 . >call ebp
00CFFEEA . >add esp,0x4
00CFFEED > >mov esi,dword ptr ds:[esi+0x58]
00CFFEF0 . >push 0x7
00CFFEF2 . >mov ecx,esi
00CFFEF4 . >call dword ptr ds:[<&QtGui4.QWidget::setFocus>] ; QtGui4.QWidget::setFocus
00CFFEFA . >mov eax,dword ptr ss:[esp+0x18]
00CFFEFE . >mov byte ptr ss:[esp+0x34],0x0
00CFFF03 . >or ecx,0xFFFFFFFF
00CFFF06 . >lock xadd dword ptr ds:[eax],ecx
00CFFF0A . >jnz X010Edito.00CFFF16
00CFFF0C . >mov edx,dword ptr ss:[esp+0x18]
00CFFF10 . >push edx
00CFFF11 . >call ebp
00CFFF13 . >add esp,0x4
00CFFF16 > >mov eax,dword ptr ss:[esp+0x14]
00CFFF1A . >mov dword ptr ss:[esp+0x34],-0x1
00CFFF22 . >or ecx,0xFFFFFFFF
00CFFF25 . >lock xadd dword ptr ds:[eax],ecx
00CFFF29 . >jnz 010Edito.00D00763
00CFFF2F . >mov edx,dword ptr ss:[esp+0x14]
00CFFF33 . >push edx
00CFFF34 . >call ebp
00CFFF36 . >jmp 010Edito.00D00760 ; --------------
00CFFF3B > >mov ecx,dword ptr ds:[esi+0x60]
00CFFF3E . >lea eax,dword ptr ss:[esp+0x28]
00CFFF42 . >push eax
00CFFF43 . >call edi
00CFFF45 . >mov ecx,dword ptr ds:[eax]
00CFFF47 . >cmp dword ptr ds:[ecx+0x8],0x0 ; 判断序列号是否空
00CFFF4B . >mov ebp,dword ptr ds:[<&QtCore4.QString::fromAsc>
00CFFF51 . >mov ebx,0x1
00CFFF56 . >mov byte ptr ss:[esp+0x34],0x3
00CFFF5B . >mov dword ptr ss:[esp+0x1C],ebx
00CFFF5F . >je X010Edito.00CFFFB7
00CFFF61 . >push -0x1
00CFFF63 . >push 010Edito.00E5490C
00CFFF68 . >call ebp ; <&QtCore4.QString::fromAscii_helper>
00CFFF6A . >add esp,0x8
00CFFF6D . >mov dword ptr ss:[esp+0x20],eax
00CFFF71 . >mov ecx,dword ptr ds:[esi+0x60]
00CFFF74 . >lea edx,dword ptr ss:[esp+0x24]
00CFFF78 . >push edx
00CFFF79 . >mov dword ptr ss:[esp+0x38],0x4
00CFFF81 . >mov dword ptr ss:[esp+0x20],0x3
00CFFF89 . >call edi ; QtGui4.QLineEdit::text
00CFFF8B . >push 0x1
00CFFF8D . >push 0x0
00CFFF8F . >lea ecx,dword ptr ss:[esp+0x28]
00CFFF93 . >push ecx
00CFFF94 . >mov ebx,0x7
00CFFF99 . >mov ecx,eax
00CFFF9B . >mov dword ptr ss:[esp+0x40],0x5
00CFFFA3 . >mov dword ptr ss:[esp+0x28],ebx
00CFFFA7 . >call dword ptr ds:[<&QtCore4.QString::indexOf>] ; 检查序列号中是否有空格
00CFFFAD . >mov byte ptr ss:[esp+0x13],0x0
00CFFFB2 . >cmp eax,-0x1 ; ----------------
00CFFFB5 . >je X010Edito.00CFFFBC
00CFFFB7 > >mov byte ptr ss:[esp+0x13],0x1
00CFFFBC > >mov dword ptr ss:[esp+0x34],0x4
00CFFFC4 . >test bl,0x4
00CFFFC7 . >je X010Edito.00CFFFEB
00CFFFC9 . >mov edx,dword ptr ss:[esp+0x24]
00CFFFCD . >and ebx,0xFFFFFFFB
00CFFFD0 . >mov dword ptr ss:[esp+0x1C],ebx
00CFFFD4 . >or eax,0xFFFFFFFF
00CFFFD7 . >lock xadd dword ptr ds:[edx],eax
00CFFFDB . >jnz X010Edito.00CFFFEB
00CFFFDD . >mov ecx,dword ptr ss:[esp+0x24]
00CFFFE1 . >push ecx
00CFFFE2 . >call dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00CFFFE8 . >add esp,0x4
00CFFFEB > >mov dword ptr ss:[esp+0x34],0x3
00CFFFF3 . >test bl,0x2
00CFFFF6 . >je X010Edito.00D0001A
00CFFFF8 . >mov edx,dword ptr ss:[esp+0x20]
00CFFFFC . >and ebx,0xFFFFFFFD
00CFFFFF . >mov dword ptr ss:[esp+0x1C],ebx
00D00003 . >or eax,0xFFFFFFFF
00D00006 . >lock xadd dword ptr ds:[edx],eax
00D0000A . >jnz X010Edito.00D0001A
00D0000C . >mov ecx,dword ptr ss:[esp+0x20]
00D00010 . >push ecx
00D00011 . >call dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D00017 . >add esp,0x4
00D0001A > >mov dword ptr ss:[esp+0x34],0x1
00D00022 . >test bl,0x1
00D00025 . >je X010Edito.00D00042
00D00027 . >mov edx,dword ptr ss:[esp+0x28]
00D0002B . >or eax,0xFFFFFFFF
00D0002E . >lock xadd dword ptr ds:[edx],eax
00D00032 . >jnz X010Edito.00D00042
00D00034 . >mov ecx,dword ptr ss:[esp+0x28]
00D00038 . >push ecx
00D00039 . >call dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D0003F . >add esp,0x4
00D00042 > >cmp byte ptr ss:[esp+0x13],0x0
00D00047 . >je 010Edito.00D000DC
00D0004D . >push -0x1
00D0004F . >push 010Edito.00E6F7DC ; ASCII "Please completely enter your password."
00D00054 . >call ebp
00D00056 . >mov dword ptr ss:[esp+0x28],eax
00D0005A . >lea edx,dword ptr ss:[esp+0x28]
00D0005E . >push edx
00D0005F . >mov byte ptr ss:[esp+0x40],0x6
00D00064 . >call 010Edito.00BB1636
00D00069 . >mov eax,dword ptr ss:[esp+0x2C]
00D0006D . >mov edi,dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D00073 . >add esp,0xC
00D00076 . >mov byte ptr ss:[esp+0x34],0x1
00D0007B . >or ecx,0xFFFFFFFF
00D0007E . >lock xadd dword ptr ds:[eax],ecx
00D00082 . >jnz X010Edito.00D0008E
00D00084 . >mov edx,dword ptr ss:[esp+0x20]
00D00088 . >push edx
00D00089 . >call edi
00D0008B . >add esp,0x4
00D0008E > >mov esi,dword ptr ds:[esi+0x58]
00D00091 . >push 0x7
00D00093 . >mov ecx,esi
00D00095 . >call dword ptr ds:[<&QtGui4.QWidget::setFocus>] ; QtGui4.QWidget::setFocus
00D0009B . >mov eax,dword ptr ss:[esp+0x18]
00D0009F . >mov byte ptr ss:[esp+0x34],0x0
00D000A4 . >or ecx,0xFFFFFFFF
00D000A7 . >lock xadd dword ptr ds:[eax],ecx
00D000AB . >jnz X010Edito.00D000B7
00D000AD . >mov edx,dword ptr ss:[esp+0x18]
00D000B1 . >push edx
00D000B2 . >call edi
00D000B4 . >add esp,0x4
00D000B7 > >mov eax,dword ptr ss:[esp+0x14]
00D000BB . >mov dword ptr ss:[esp+0x34],-0x1
00D000C3 . >or ecx,0xFFFFFFFF
00D000C6 . >lock xadd dword ptr ds:[eax],ecx
00D000CA . >jnz 010Edito.00D00763
00D000D0 . >mov edx,dword ptr ss:[esp+0x14]
00D000D4 . >push edx
00D000D5 . >call edi
00D000D7 . >jmp 010Edito.00D00760
00D000DC > >mov ecx,dword ptr ds:[esi+0x60]
00D000DF . >lea eax,dword ptr ss:[esp+0x28]
00D000E3 . >push eax
00D000E4 . >call edi
00D000E6 . >mov ebx,dword ptr ds:[<&QtCore4.QString::operato>
00D000EC . >push eax
00D000ED . >lea ecx,dword ptr ss:[esp+0x1C]
00D000F1 . >mov byte ptr ss:[esp+0x38],0x7
00D000F6 . >call ebx ; <&QtCore4.QString::operator=>
00D000F8 . >mov ecx,dword ptr ss:[esp+0x28]
00D000FC . >mov byte ptr ss:[esp+0x34],0x1
00D00101 . >or edx,0xFFFFFFFF
00D00104 . >lock xadd dword ptr ds:[ecx],edx
00D00108 . >jnz X010Edito.00D00118
00D0010A . >mov eax,dword ptr ss:[esp+0x28]
00D0010E . >push eax
00D0010F . >call dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D00115 . >add esp,0x4
00D00118 > >lea ecx,dword ptr ss:[esp+0x18]
00D0011C . >push ecx
00D0011D . >mov ecx,esi
00D0011F . >call 010Edito.00BB4480 ; 检查序列号 s[3]
00D00124 . >test eax,eax ; 如果s[3]==0x9C or 0xFC 则序列号只须前0x13位
00D00126 . >je X010Edito.00D00165 ; s[3]==0xAC 序列号则须0x18位
00D00128 . >push 0x13
00D0012A . >lea edx,dword ptr ss:[esp+0x2C]
00D0012E . >push edx
00D0012F . >lea ecx,dword ptr ss:[esp+0x20]
00D00133 . >call dword ptr ds:[<&QtCore4.QString::left>] ; QtCore4.QString::left
00D00139 . >push eax
00D0013A . >lea ecx,dword ptr ss:[esp+0x1C]
00D0013E . >mov byte ptr ss:[esp+0x38],0x8
00D00143 . >call ebx
00D00145 . >mov eax,dword ptr ss:[esp+0x28]
00D00149 . >mov byte ptr ss:[esp+0x34],0x1
00D0014E . >or ecx,0xFFFFFFFF
00D00151 . >lock xadd dword ptr ds:[eax],ecx
00D00155 . >jnz X010Edito.00D00165
00D00157 . >mov edx,dword ptr ss:[esp+0x28]
00D0015B . >push edx
00D0015C . >call dword ptr ds:[<&QtCore4.QString::free>]
00D00162 . >add esp,0x4
00D00165 > >mov ecx,dword ptr ds:[esi+0x58]
00D00168 . >lea eax,dword ptr ss:[esp+0x28]
00D0016C . >push eax
00D0016D . >call edi ; QtGui4.QLineEdit::text
00D0016F . >mov ecx,dword ptr ds:[0xF87E4C]
00D00175 . >push eax
00D00176 . >mov byte ptr ss:[esp+0x38],0x9
00D0017B . >call 010Edito.00BB885A ; 去除用户名中的" " or ' ' 如果有的话
00D00180 . >mov ecx,dword ptr ss:[esp+0x28]
00D00184 . >mov byte ptr ss:[esp+0x34],0x1
00D00189 . >or edx,0xFFFFFFFF
00D0018C . >lock xadd dword ptr ds:[ecx],edx
00D00190 . >jnz X010Edito.00D001A0
00D00192 . >mov eax,dword ptr ss:[esp+0x28]
00D00196 . >push eax
00D00197 . >call dword ptr ds:[<&QtCore4.QString::free>]
00D0019D . >add esp,0x4
00D001A0 > >lea ecx,dword ptr ss:[esp+0x18]
00D001A4 . >push ecx
00D001A5 . >mov ecx,dword ptr ds:[0xF87E4C]
00D001AB . >call 010Edito.00BB2379 ; 将序列号中的 o/O换成0 ,l换成1 ,如果有的话
上面是大部分是注册验证前期的初始化 ,因为是使用QT编写的(Qt我是完全不会) ,所以垃圾代码比较多,毕竟面对对象不如面对过程简洁明了. 比较简单且有注释, 就不多说了. 注册序列号是形如
xxxx-xxxx-xxxx-xxxx-xxxx , 计算时是把每两位xx当成一个byte ,这里用数组 s[] 表示, ,其中s[3]是固定的,只能为0x9C ,0xFC ,0xAC 之一.
再往下看:
00D001B0 . >mov ecx,dword ptr ds:[0xF87E4C]
00D001B6 . >push 0x3C70
00D001BB . >push 0x5
00D001BD . >call 010Edito.00BB394A ; ret1 = calc1(5 ,0x3c70)
00D001C2 . >mov ecx,dword ptr ds:[0xF87E4C]
00D001C8 . >push 0x3C70
00D001CD . >push 0x5
00D001CF . >mov ebx,eax
00D001D1 . >call 010Edito.00BB8981 ; ret2 = calc2(5 ,0x3c70)
00D001D6 . >mov ecx,dword ptr ds:[0xF87E4C]
00D001DC . >xor edx,edx
00D001DE . >mov edi,eax
00D001E0 . >mov eax,dword ptr ds:[ecx+0x34]
00D001E3 . >test eax,eax
00D001E5 . >sete dl
00D001E8 . >mov dword ptr ss:[esp+0x28],edx
00D001EC . >cmp ebx,0xE7
00D001F2 . >je 010Edito.00D00387 ; if (ret1 == 0xE7) JMP...
00D001F8 . >cmp dword ptr ds:[ecx+0x2C],0x0
00D001FC . >je 010Edito.00D00387 ; if (e_2c == 0) JMP....
00D00202 . >push 0x0 ; else
00D00204 . >call 010Edito.00BB54E3 ; 网络验证
00D00209 . >test eax,eax
00D0020B . >jge 010Edito.00D002E7 ; if (netcheck ok) JMP....
00D00211 . >push 0xA
00D00213 . >push eax
00D00214 . >lea eax,dword ptr ss:[esp+0x24]
00D00218 . >push eax
00D00219 . >call dword ptr ds:[<&QtCore4.QString::number>] ; QtCore4.QString::number
00D0021F . >mov esi,eax
00D00221 . >push -0x1
00D00223 . >push 010Edito.00E6F6D0 ; ASCII "Could not contact the webserver. Please check your internet connection. If your internet connection is currently working, the server may be down. If this problem persists, please visit 'http://www.sweetscape.com/support/' ("
00D00228 . >mov byte ptr ss:[esp+0x48],0xA
00D0022D . >call ebp
00D0022F . >mov dword ptr ss:[esp+0x34],eax
00D00233 . >push esi
00D00234 . >lea ecx,dword ptr ss:[esp+0x38]
00D00238 . >push ecx
00D00239 . >lea edx,dword ptr ss:[esp+0x40]
00D0023D . >push edx
00D0023E . >mov byte ptr ss:[esp+0x54],0xB
00D00243 . >call 010Edito.00BB5687
00D00248 . >push 010Edito.00E6F6CC ; ASCII ")."
00D0024D . >push eax
00D0024E . >lea eax,dword ptr ss:[esp+0x50]
00D00252 . >mov bl,0xC
00D00254 . >push eax
00D00255 . >mov byte ptr ss:[esp+0x60],bl
00D00259 . >call 010Edito.00BB4688
00D0025E . >push eax
00D0025F . >mov byte ptr ss:[esp+0x64],0xD
00D00264 . >call 010Edito.00BB6965
00D00269 . >mov ecx,dword ptr ss:[esp+0x58]
00D0026D . >mov esi,dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D00273 . >add esp,0x30
00D00276 . >mov byte ptr ss:[esp+0x34],bl
00D0027A . >or edx,0xFFFFFFFF
00D0027D . >lock xadd dword ptr ds:[ecx],edx
00D00281 . >jnz X010Edito.00D0028D
00D00283 . >mov eax,dword ptr ss:[esp+0x28]
00D00287 . >push eax
00D00288 . >call esi
00D0028A . >add esp,0x4
00D0028D > >mov ecx,dword ptr ss:[esp+0x24]
00D00291 . >mov byte ptr ss:[esp+0x34],0xB
00D00296 . >or edx,0xFFFFFFFF
00D00299 . >lock xadd dword ptr ds:[ecx],edx
00D0029D . >jnz X010Edito.00D002A9
00D0029F . >mov eax,dword ptr ss:[esp+0x24]
00D002A3 . >push eax
00D002A4 . >call esi
00D002A6 . >add esp,0x4
00D002A9 > >mov ecx,dword ptr ss:[esp+0x20]
00D002AD . >mov byte ptr ss:[esp+0x34],0xA
00D002B2 . >or edx,0xFFFFFFFF
00D002B5 . >lock xadd dword ptr ds:[ecx],edx
00D002B9 . >jnz X010Edito.00D002C5
00D002BB . >mov eax,dword ptr ss:[esp+0x20]
00D002BF . >push eax
00D002C0 . >call esi
00D002C2 . >add esp,0x4
00D002C5 > >mov ecx,dword ptr ss:[esp+0x1C]
00D002C9 . >mov byte ptr ss:[esp+0x34],0x1
00D002CE . >or edx,0xFFFFFFFF
00D002D1 . >lock xadd dword ptr ds:[ecx],edx
00D002D5 . >jnz 010Edito.00D0072C
00D002DB . >mov eax,dword ptr ss:[esp+0x1C]
00D002DF . >push eax
00D002E0 . >call esi
00D002E2 . >jmp 010Edito.00D00729
00D002E7 > >jnz 010Edito.00D0036D
00D002ED . >push -0x1 ; -------------------
00D002EF . >push 010Edito.00E6F5C8 ; ASCII "010 Editor has detected that you have entered an invalid license. Please check to see if your license is entered correctly and try again. If this problem persists, please visit 'http://www.sweetscape.com/support/'."
00D002F4 . >call ebp
00D002F6 . >mov dword ptr ss:[esp+0x28],eax
00D002FA . >lea ecx,dword ptr ss:[esp+0x28]
00D002FE . >push ecx
00D002FF . >mov byte ptr ss:[esp+0x40],0xE
00D00304 . >call 010Edito.00BB6965
00D00309 . >mov edx,dword ptr ss:[esp+0x2C]
00D0030D . >mov esi,dword ptr ds:[<&QtCore4.QString::free>] ; QtCore4.QString::free
00D00313 . >add esp,0xC
00D00316 . >mov byte ptr ss:[esp+0x34],0x1
00D0031B . >or eax,0xFFFFFFFF
00D0031E . >lock xadd dword ptr ds:[edx],eax
00D00322 . >jnz X010Edito.00D0032E
00D00324 . >mov ecx,dword ptr ss:[esp+0x20]
00D00328 . >push ecx
00D00329 . >call esi
00D0032B . >add esp,0x4
00D0032E > >mov edx,dword ptr ss:[esp+0x18]
00D00332 . >mov byte ptr ss:[esp+0x34],0x0
00D00337 . >or eax,0xFFFFFFFF
00D0033A . >lock xadd dword ptr ds:[edx],eax
00D0033E . >jnz X010Edito.00D0034A
00D00340 . >mov ecx,dword ptr ss:[esp+0x18]
00D00344 . >push ecx
00D00345 . >call esi
00D00347 . >add esp,0x4
00D0034A > >mov edx,dword ptr ss:[esp+0x14]
00D0034E . >mov dword ptr ss:[esp+0x34],-0x1
00D00356 . >or eax,0xFFFFFFFF
00D00359 . >lock xadd dword ptr ds:[edx],eax
00D0035D . >jnz 010Edito.00D00763
00D00363 . >mov ecx,dword ptr ss:[esp+0x14]
00D00367 . >push ecx
00D00368 . >jmp 010Edito.00D0075E
00D0036D > >mov ecx,dword ptr ds:[0xF87E4C]
00D00373 . >push 0x3C70
00D00378 . >push 0x5
00D0037A . >call 010Edito.00BB8981
00D0037F . >mov ecx,dword ptr ds:[0xF87E4C] ; if (ret2==0xDB)
00D00385 . >mov edi,eax ; 则 注册成功
00D00387 > >cmp edi,0xDB
00D0038D . >jnz X010Edito.00D003C7 ; 若注册成功时必须且只能经过这个出口
00D0038F . >push -0x1 ; 同时也是爆破点
00D00391 . >push 010Edito.00E6F584 ; ASCII "Password accepted. Thank you for purchasing 010 Editor!"
00D00396 . >call ebp
00D00398 . >mov dword ptr ss:[esp+0x28],eax
00D0039C . >lea edx,dword ptr ss:[esp+0x28]
00D003A0 . >push edx
00D003A1 . >mov byte ptr ss:[esp+0x40],0xF
先说下这软件使用了一个对象来保存注册信息, 这里用 e_xx 表示对象中的每个成员 ,xx表示偏移值 ,其中 e_4 ----用户名 , e_8 ----序列号 .
从上面可以看出,要注册成功 ,必须经过0xD003D8处,且不跳转,所以也就是说必须ret2==0xDB ,
00D0037F . >mov ecx,dword ptr ds:[0xF87E4C]
00D00385 . >mov edi,eax ; ; if (ret2==0xDB)
00D00387 > >cmp edi,0xDB 则 注册成功
00D0038D . >jnz X010Edito.00D003C7 ; 若注册成功时必须且只能经过这个出口
ret1 ,ret2分别是上面calc1() ,calc2()的返回值 , 所以先到calc2()处看看:
00DBEC80 > >push esi
00DBEC81 . >mov esi,ecx
00DBEC83 . >cmp dword ptr ds:[esi+0x2C],0x0
00DBEC87 . >je X010Edito.00DBEC92 ; if (e_2c == 1)
00DBEC89 . >mov eax,0x113 ; return 0x113
00DBEC8E . >pop esi
00DBEC8F . >retn 0x8
00DBEC92 > >mov eax,dword ptr ss:[esp+0xC]
00DBEC96 . >push edi
00DBEC97 . >mov edi,dword ptr ss:[esp+0xC]
00DBEC9B . >push eax
00DBEC9C . >push edi
00DBEC9D . >call 010Edito.00BB394A ; ret1 = Calc1(5 ,0x3c70)
00DBECA2 . >cmp eax,0x2D ; Switch (cases 2D..E7)
00DBECA5 . >je 010Edito.00DBED44 ; if (ret1 == 0x2D) return 0xDB
00DBECAB . >cmp eax,0x4E
00DBECAE . >je X010Edito.00DBED20
00DBECB0 . >cmp eax,0xE7
00DBECB5 . >je X010Edito.00DBED16
00DBECB7 . >push edi ; Default case of switch 00DBECA2
00DBECB8 . >mov ecx,esi
00DBECBA . >call 010Edito.00BB231A
00DBECBF . >cmp eax,0x17 ; Switch (cases 17..138)
00DBECC2 . >je X010Edito.00DBED0C
00DBECC4 . >cmp eax,0x2A
00DBECC7 . >je X010Edito.00DBECEF
00DBECC9 . >cmp eax,0x138
00DBECCE . >jnz X010Edito.00DBED16
00DBECD0 . >mov ecx,esi ; Case 138 of switch 00DBECBF
00DBECD2 . >call 010Edito.00BB8D91
00DBECD7 . >sub eax,0x1A3
00DBECDC . >neg eax
00DBECDE . >sbb eax,eax
00DBECE0 . >and eax,0xFFFFFF36
00DBECE5 . >pop edi
00DBECE6 . >add eax,0xF9
00DBECEB . >pop esi
00DBECEC . >retn 0x8
00DBECEF > >mov ecx,esi ; Case 2A of switch 00DBECBF
00DBECF1 . >call 010Edito.00BB8D91
00DBECF6 . >sub eax,0x1A3
00DBECFB . >neg eax
00DBECFD . >sbb eax,eax
00DBECFF . >and eax,0x7E
00DBED02 . >pop edi
00DBED03 . >add eax,0xF9
00DBED08 . >pop esi
00DBED09 . >retn 0x8
00DBED0C > >pop edi ; Case 17 of switch 00DBECBF
00DBED0D . >mov eax,0x71
00DBED12 . >pop esi
00DBED13 . >retn 0x8
00DBED16 > >pop edi ; Default case of switch 00DBECBF
00DBED17 . >mov eax,0x177
00DBED1C . >pop esi
00DBED1D . >retn 0x8
00DBED20 > >push edi ; Case 4E of switch 00DBECA2
00DBED21 . >mov ecx,esi
00DBED23 . >call 010Edito.00BB231A
00DBED28 . >cmp eax,0x17
00DBED2B . >je X010Edito.00DBED3A
00DBED2D . >pop edi
00DBED2E . >cmp eax,0x2A
00DBED31 . >mov eax,0xED
00DBED36 . >pop esi
00DBED37 . >retn 0x8
00DBED3A > >pop edi
00DBED3B . >mov eax,0x20C
00DBED40 . >pop esi
00DBED41 . >retn 0x8
00DBED44 > >pop edi ; Case 2D of switch 00DBECA2
00DBED45 . >mov eax,0xDB
00DBED4A . >pop esi
00DBED4B . >retn 0x8
可以看出 ,当且仅当ret1 == 0x2D 时, 才可能有 ret2 == 0xDB ,所以ret1也必须等于 0x2D :
00D001F2 . >je 010Edito.00D00387 ; if (ret1 == 0xE7) JMP...
00D001F8 . >cmp dword ptr ds:[ecx+0x2C],0x0
00D001FC . >je 010Edito.00D00387 ; if (e_2c == 0) JMP....
00D00202 . >push 0x0 ; else
00D00204 . >call 010Edito.00BB54E3 ; 网络验证
因此 0x00D001 F2 处的 if(ret1 ==0xE7 )不应该成立 ,只能通过下面的 00D001FC 处的 if (e2c == 0) 成立来 jmp 到 00D00387 处的出口处 ,e_2c我们暂时不知道是什么意义 ,暂时假设 e_2c == 0 .
那我们继续来看 ret1 = calc1(5 ,0x3c70) 按照我们假设, ret1 必须等于 0x2D , F7 跟进:
00DBD180 > >mov eax,dword ptr fs:[0]
00DBD186 . >push -0x1
00DBD188 . >push 010Edito.00E446D9
00DBD18D . >push eax
00DBD18E . >mov dword ptr fs:[0],esp
00DBD195 . >sub esp,0x14
00DBD198 . >push ebx
00DBD199 . >push ebp
00DBD19A . >push esi
00DBD19B . >mov esi,ecx
00DBD19D . >mov eax,dword ptr ds:[esi+0x4]
00DBD1A0 . >xor ebp,ebp
00DBD1A2 . >lea ebx,dword ptr ds:[esi+0x4]
00DBD1A5 . >mov dword ptr ds:[esi+0x30],ebp
00DBD1A8 . >mov dword ptr ds:[esi+0x18],ebp
00DBD1AB . >mov dword ptr ds:[esi+0x34],ebp
00DBD1AE . >cmp dword ptr ds:[eax+0x8],ebp
00DBD1B1 . >je 010Edito.00DBD50F
00DBD1B7 . >mov ecx,dword ptr ds:[esi+0x8]
00DBD1BA . >cmp dword ptr ds:[ecx+0x8],ebp
00DBD1BD . >je 010Edito.00DBD50F
00DBD1C3 . >push edi
00DBD1C4 . >lea edx,dword ptr ss:[esp+0x18]
00DBD1C8 . >push edx
00DBD1C9 . >mov ecx,esi
00DBD1CB . >call 010Edito.00BB88A0
00DBD1D0 . >mov edi,010Edito.00F7FF20
00DBD1D5 > >mov eax,dword ptr ds:[edi]
00DBD1D7 . >push eax
00DBD1D8 . >mov ecx,ebx
00DBD1DA . >call dword ptr ds:[<&QtCore4.QString::o>; QtCore4.QString::operator==
00DBD1E0 . >test al,al
00DBD1E2 . >jnz 010Edito.00DBD3A9
00DBD1E8 . >add edi,0x4
00DBD1EB . >cmp edi,010Edito.00F7FF24
00DBD1F1 .^>jl X010Edito.00DBD1D5
00DBD1F3 . >mov al,byte ptr ss:[esp+0x1B] ; al = s[3]
00DBD1F7 . >mov bl,byte ptr ss:[esp+0x1D] ; bl = s[4]
00DBD1FB . >cmp al,0x9C ; Switch (cases 9C..FC)
00DBD1FD . >jnz X010Edito.00DBD279
00DBD1FF . >mov dl,byte ptr ss:[esp+0x1F] ; Case 9C of switch 00DBD1FB
00DBD203 . >xor dl,byte ptr ss:[esp+0x19]
00DBD207 . >mov cl,byte ptr ss:[esp+0x1E]
00DBD20B . >xor cl,byte ptr ss:[esp+0x18]
00DBD20F . >movzx ax,dl
00DBD213 . >mov byte ptr ss:[esp+0x14],cl
00DBD217 . >mov ecx,0x100
00DBD21C . >imul ax,cx
00DBD220 . >mov dl,bl
00DBD222 . >xor dl,byte ptr ss:[esp+0x1A]
00DBD226 . >movzx cx,dl
00DBD22A . >mov edx,dword ptr ss:[esp+0x14]
00DBD22E . >add ax,cx
00DBD231 . >push edx
00DBD232 . >movzx edi,ax
00DBD235 . >call 010Edito.00BB6D6B
00DBD23A . >movzx eax,al
00DBD23D . >push edi ; e_1c = (s[0]^s[6]^0x18+0x3D)^0xA
00DBD23E . >mov dword ptr ds:[esi+0x1C],eax
00DBD241 . >call 010Edito.00BB77D4
00DBD246 . >mov ecx,dword ptr ds:[esi+0x1C]
00DBD249 . >movzx eax,ax
00DBD24C . >add esp,0x8
00DBD24F . >mov dword ptr ds:[esi+0x20],eax ; p2 =e_20 =((((s[1]^s[7])<<0x8 + s[2]^s[5])^
00DBD252 . >test ecx,ecx ; 0x7892 + 0x4D30)^0x3421)/0xB 或 0
00DBD254 . >je 010Edito.00DBD3A9
00DBD25A . >test eax,eax ; if (e_1c ==0 || e_20 == 0 || e_20 > 0x3E8)
00DBD25C . >je 010Edito.00DBD3A9 ; jmp fail
00DBD262 . >cmp eax,0x3E8
00DBD267 . >ja 010Edito.00DBD3A9
00DBD26D . >cmp ecx,0x2
00DBD270 . >sbb edi,edi
00DBD272 . >and edi,ecx ; p1 = edi
00DBD274 . >jmp 010Edito.00DBD32C ; =============
00DBD279 > >cmp al,0xFC
00DBD27B . >jnz X010Edito.00DBD295
00DBD27D . >mov eax,0x1 ; Case FC of switch 00DBD1FB
00DBD282 . >mov edi,0xFF
00DBD287 . >mov dword ptr ds:[esi+0x1C],edi ; e_1c = -1 ,e_20 = 2_30 = 0
00DBD28A . >mov dword ptr ds:[esi+0x20],eax
00DBD28D . >mov dword ptr ds:[esi+0x30],eax
00DBD290 . >jmp 010Edito.00DBD32C ; ==============
00DBD295 > >cmp al,0xAC
00DBD297 . >jnz 010Edito.00DBD3A9
00DBD29D . >mov cl,byte ptr ss:[esp+0x1F] ; Case AC of switch 00DBD1FB
00DBD2A1 . >xor cl,byte ptr ss:[esp+0x19]
00DBD2A5 . >mov eax,0x100
00DBD2AA . >movzx dx,cl
00DBD2AE . >imul dx,ax
00DBD2B2 . >mov cl,bl
00DBD2B4 . >xor cl,byte ptr ss:[esp+0x1A]
00DBD2B8 . >mov dword ptr ds:[esi+0x1C],0x2 ; e_1c = 0x2
00DBD2BF . >movzx ax,cl
00DBD2C3 . >add dx,ax
00DBD2C6 . >movzx eax,dx
00DBD2C9 . >push eax
00DBD2CA . >call 010Edito.00BB77D4
00DBD2CF . >movzx eax,ax
00DBD2D2 . >add esp,0x4
00DBD2D5 . >mov dword ptr ds:[esi+0x20],eax ; p2=e_20 =((((s[1]^s[7])<<0x8 + s[2]^s[5])^
00DBD2D8 . >test eax,eax ; 0x7892 + 0x4D30)^0x3421)/0xB 或 0
00DBD2DA . >je 010Edito.00DBD3A9
00DBD2E0 . >cmp eax,0x3E8 ; if (e_20 == 0 || e_20 > 0x3E8)
00DBD2E5 . >ja 010Edito.00DBD3A9 ; jmp fail
00DBD2EB . >movzx ecx,byte ptr ss:[esp+0x21]
00DBD2F0 . >movzx eax,byte ptr ss:[esp+0x1C]
00DBD2F5 . >movzx edx,bl
00DBD2F8 . >xor ecx,edx
00DBD2FA . >movzx edx,byte ptr ss:[esp+0x20]
00DBD2FF . >xor eax,edx
00DBD301 . >movzx edx,byte ptr ss:[esp+0x18]
00DBD306 . >shl ecx,0x8
00DBD309 . >add ecx,eax
00DBD30B . >movzx eax,byte ptr ss:[esp+0x1E]
00DBD310 . >shl ecx,0x8
00DBD313 . >xor eax,edx
00DBD315 . >add ecx,eax
00DBD317 . >push 0x5B8C27
00DBD31C . >push ecx
00DBD31D . >call 010Edito.00BB3869
00DBD322 . >mov ebp,eax ; a=(s[5]^s[9]<<8 + s[4]^s[8])<<8+s[0]^s[6]
00DBD324 . >add esp,0x8 ; b=(a^0x5b8c27^0x22c078-0x2c175)^0xee53167
00DBD327 . >mov dword ptr ds:[esi+0x34],ebp ; p1=e_34=HIGH(b*0xf0f0f0f1)>>0x4 或 0
00DBD32A . >mov edi,ebp
00DBD32C > >lea eax,dword ptr ss:[esp+0x10]
00DBD330 . >push eax
00DBD331 . >lea ecx,dword ptr ds:[esi+0x4]
00DBD334 . >call dword ptr ds:[<&QtCore4.QString::t>; QtCore4.QString::toUtf8
00DBD33A . >lea ecx,dword ptr ss:[esp+0x10]
00DBD33E . >mov dword ptr ss:[esp+0x2C],0x0
00DBD346 . >call dword ptr ds:[<&QtCore4.QByteArray>; QtCore4.QByteArray::detach
00DBD34C . >mov ecx,dword ptr ss:[esp+0x10]
00DBD350 . >mov eax,dword ptr ds:[ecx+0xC]
00DBD353 . >mov edx,dword ptr ds:[esi+0x20]
00DBD356 . >xor ecx,ecx
00DBD358 . >cmp byte ptr ss:[esp+0x1B],0xFC
00DBD35D . >push edx
00DBD35E . >setne cl
00DBD361 . >push edi
00DBD362 . >push ecx
00DBD363 . >push eax
00DBD364 . >call 010Edito.00BB263F ; namecalc = _Calcname(szname ,*** ,p1 ,p2)
00DBD369 . >add esp,0x10
00DBD36C . >cmp byte ptr ss:[esp+0x1C],al ; if (s[4] == namecalc[0]) else fail
00DBD370 . >jnz X010Edito.00DBD386
00DBD372 . >mov edx,eax
00DBD374 . >shr edx,0x8
00DBD377 . >cmp bl,dl
00DBD379 . >jnz X010Edito.00DBD3CE ; if (s[5] == namecalc[1]) else fail
00DBD37B . >mov ecx,eax
00DBD37D . >shr ecx,0x10
00DBD380 . >cmp byte ptr ss:[esp+0x1E],cl
00DBD384 . >je X010Edito.00DBD3C3 ; if (s[6] == namecalc[2]) else fail
00DBD386 > >mov edx,dword ptr ss:[esp+0x10]
00DBD38A . >mov dword ptr ss:[esp+0x2C],-0x1
00DBD392 . >or eax,0xFFFFFFFF
00DBD395 . >lock xadd dword ptr ds:[edx],eax
00DBD399 . >jnz X010Edito.00DBD3A9
00DBD39B . >mov ecx,dword ptr ss:[esp+0x10]
00DBD39F . >push ecx ; /block
00DBD3A0 > >call dword ptr ds:[<&QtCore4.qFree>] ; \free
00DBD3A6 . >add esp,0x4
00DBD3A9 > >pop edi ; Default case of switch 00DBD1FB
00DBD3AA . >pop esi
00DBD3AB . >pop ebp
00DBD3AC . >mov eax,0xE7
00DBD3B1 . >pop ebx
00DBD3B2 . >mov ecx,dword ptr ss:[esp+0x14]
00DBD3B6 . >mov dword ptr fs:[0],ecx
00DBD3BD . >add esp,0x20
00DBD3C0 . >retn 0x8
00DBD3C3 > >mov edx,eax
00DBD3C5 . >shr edx,0x18
00DBD3C8 . >cmp byte ptr ss:[esp+0x1F],dl
00DBD3CC . >je X010Edito.00DBD3EA ; if (s[7] == namecalc[3]) else fail
00DBD3CE > >mov eax,dword ptr ss:[esp+0x10]
00DBD3D2 . >mov dword ptr ss:[esp+0x2C],-0x1
00DBD3DA . >or ecx,0xFFFFFFFF
00DBD3DD . >lock xadd dword ptr ds:[eax],ecx
00DBD3E1 .^>jnz X010Edito.00DBD3A9
00DBD3E3 . >mov edx,dword ptr ss:[esp+0x10]
00DBD3E7 . >push edx
00DBD3E8 .^>jmp X010Edito.00DBD3A0
00DBD3EA > >mov cl,byte ptr ss:[esp+0x1B] ; cl = s[3]
00DBD3EE . >cmp cl,0x9C ; Switch (cases 9C..FC)
00DBD3F1 . >jnz X010Edito.00DBD402
00DBD3F3 . >mov eax,dword ptr ss:[esp+0x34] ; Case 9C of switch 00DBD3EE
00DBD3F7 . >or edx,0xFFFFFFFF
00DBD3FA . >cmp eax,dword ptr ds:[esi+0x1C]
00DBD3FD . >jmp 010Edito.00DBD482 ; if (e_1c <= 5) fail
00DBD402 > >cmp cl,0xFC
00DBD405 . >jnz X010Edito.00DBD472
00DBD407 . >movzx ecx,byte ptr ss:[esp+0x1A] ; Case FC of switch 00DBD3EE
00DBD40C . >movzx edx,byte ptr ss:[esp+0x19]
00DBD411 . >shl ecx,0x8
00DBD414 . >push eax
00DBD415 . >movzx eax,byte ptr ss:[esp+0x1C]
00DBD41A . >add ecx,edx
00DBD41C . >shl ecx,0x8
00DBD41F . >add ecx,eax
00DBD421 . >push ecx
00DBD422 . >call 010Edito.00BB3869
00DBD427 . >mov ecx,dword ptr ss:[esp+0x18]
00DBD42B . >add esp,0x8 ; 可以看出,当s[3]==0xFC (即case 0xFC)
00DBD42E . >or edx,0xFFFFFFFF ; 返回值为 0x93,而不能是 0x2D ,所以s[3]!=0x9C
00DBD431 . >mov dword ptr ss:[esp+0x2C],-0x1
00DBD439 . >test eax,eax
00DBD43B . >je 010Edito.00DBD4FB
00DBD441 . >mov dword ptr ds:[esi+0x18],eax
00DBD444 . >lock xadd dword ptr ds:[ecx],edx
00DBD448 . >jnz X010Edito.00DBD458
00DBD44A . >mov eax,dword ptr ss:[esp+0x10]
00DBD44E . >push eax ; /block
00DBD44F . >call dword ptr ds:[<&QtCore4.qFree>] ; \free
00DBD455 . >add esp,0x4
00DBD458 > >pop edi
00DBD459 . >pop esi
00DBD45A . >pop ebp
00DBD45B . >mov eax,0x93 ; 0x93
00DBD460 . >pop ebx
00DBD461 . >mov ecx,dword ptr ss:[esp+0x14]
00DBD465 . >mov dword ptr fs:[0],ecx
00DBD46C . >add esp,0x20
00DBD46F . >retn 0x8
00DBD472 > >cmp cl,0xAC
00DBD475 . >jnz X010Edito.00DBD4EC
00DBD477 . >test ebp,ebp ; Case AC of switch 00DBD3EE
00DBD479 . >je X010Edito.00DBD4EC
00DBD47B . >or edx,0xFFFFFFFF
00DBD47E . >cmp dword ptr ss:[esp+0x38],ebp ; if ((p1=e_34) < 0x3C70) fail
00DBD482 > >mov ecx,dword ptr ss:[esp+0x10]
00DBD486 . >mov dword ptr ss:[esp+0x2C],-0x1
00DBD48E . >jbe X010Edito.00DBD4BE ; ======
00DBD490 . >lock xadd dword ptr ds:[ecx],edx
00DBD494 . >jnz X010Edito.00DBD4A4
00DBD496 . >mov eax,dword ptr ss:[esp+0x10]
00DBD49A . >push eax ; /block
00DBD49B . >call dword ptr ds:[<&QtCore4.qFree>] ; \free
00DBD4A1 . >add esp,0x4
00DBD4A4 > >pop edi
00DBD4A5 . >pop esi
00DBD4A6 . >pop ebp
00DBD4A7 . >mov eax,0x4E ; return 0x4E
00DBD4AC . >pop ebx
00DBD4AD . >mov ecx,dword ptr ss:[esp+0x14]
00DBD4B1 . >mov dword ptr fs:[0],ecx
00DBD4B8 . >add esp,0x20
00DBD4BB . >retn 0x8
00DBD4BE > >lock xadd dword ptr ds:[ecx],edx
00DBD4C2 . >jnz X010Edito.00DBD4D2
00DBD4C4 . >mov eax,dword ptr ss:[esp+0x10]
00DBD4C8 . >push eax ; /block
00DBD4C9 . >call dword ptr ds:[<&QtCore4.qFree>] ; \free
00DBD4CF . >add esp,0x4
00DBD4D2 > >pop edi
00DBD4D3 . >pop esi
00DBD4D4 . >pop ebp
00DBD4D5 . >mov eax,0x2D ; return 0x2D
00DBD4DA . >pop ebx
00DBD4DB . >mov ecx,dword ptr ss:[esp+0x14]
00DBD4DF . >mov dword ptr fs:[0],ecx
00DBD4E6 . >add esp,0x20
00DBD4E9 . >retn 0x8
00DBD4EC > >mov ecx,dword ptr ss:[esp+0x10] ; Default case of switch 00DBD3EE
00DBD4F0 . >mov dword ptr ss:[esp+0x2C],-0x1
00DBD4F8 . >or edx,0xFFFFFFFF
00DBD4FB > >lock xadd dword ptr ds:[ecx],edx
00DBD4FF .^>jnz 010Edito.00DBD3A9
00DBD505 . >mov eax,dword ptr ss:[esp+0x10]
00DBD509 . >push eax
00DBD50A .^>jmp 010Edito.00DBD3A0
00DBD50F > >mov ecx,dword ptr ss:[esp+0x20]
00DBD513 . >pop esi
00DBD514 . >pop ebp
00DBD515 . >mov eax,0x93 ; return 0x93
00DBD51A . >pop ebx
00DBD51B . >mov dword ptr fs:[0],ecx
00DBD522 . >add esp,0x20
00DBD525 . >retn 0x8
总结一下这个函数吧, p1 ,p2 ,分别是调用namecalc= _Calcname(.....) 的两个参数:
1.当s[3]==0x9C 时 , e_1c = (s[0]^s[6]^0x18+0x3D)^0xA ; p1 = 0 ;
p2 =e_20 =((((s[1]^s[7])<<0x8 + s[2]^s[5])^0x7892+0x4D30)^0x3421)/0xB 或 0 , 当然等于0就fail了
=>namecalc=_Calcname(szname ,*** ,p1 ,p2)
=>s[4]=namecalc[0] ,s[5]=namecalc[1] ,s[6]=namcalc[2] ,s[7]=namecalc[3]
=>s[0] 满足 : (s[0]^s[6]+0x18+0x3D)^0xA >= 5
=>s[1] ,s[5] 满足: s[1]^s[7]<<0x18+s[2]^s[5]=((p2*0xB)^0x3421-0x4D30)^0x7892
解释下p1=0:
00DBD26D . >cmp ecx,0x2 ; ecx=e_1c
00DBD270 . >sbb edi,edi
00DBD272 . >and edi,ecx ; p1 = edi
在这里, p1=edi 要么为0(当e_1c>=2时) ,要么为0xFFFFFFF(当e_1c<2时)
又因为:
00DBD3FA . >cmp eax,dword ptr ds:[esi+0x1C]
00DBD3FD . >jmp 010Edito.00DBD482 ; if (e_1c < 5) fail
所以,要注册成功的话 ,e_1c>=5 是必须的, 所以p1=edi=0;
2.当s[3]==0xFC 时: 因为s[3]==0xfc 时cal1(...) 不可能返回0x2D ,所以 不能是s[3]==0xFC.
3.当s[3]==0xAC时: a=(s[5]^s[9]<<8 + s[4]^s[8])<<8+s[0]^s[6] ,
b=(a^0x5b8c27^0x22c078-0x2c175)^0xee53167
p1 = p1=e_34=HIGH(b*0xf0f0f0f1)>>0x4 或 0;
e_p2=e_20 =((((s[1]^s[7])<<0x8 + s[2]^s[5])^0x7892+0x4D30)^0x3421)/0xB 或0;
=>namecalc=_Calcname(szname ,*** ,p1 ,p2)
=>s[4]=namecalc[0] ,s[5]=namecalc[1] ,s[6]=namcalc[2] ,s[7]=namecalc[3]
=>s[1] ,s[5] 满足: s[1]^s[7]<<0x18+s[2]^s[5]=((p2*0xB)^0x3421-0x4D30)^0x7892
=>s[0] ,s[8] ,s[9] 满足: 往下看....
解释下P1吧 , 先F7跟进 0xDBD31D处的 call (a)
00DBB9AF >int3 ; a=(s[5]^s[9]<<8 + s[4]^s[8])<<8+s[0]^s[6]
00DBB9B0 > >mov ecx,dword ptr ss:[esp+0x4]
00DBB9B4 . >xor ecx,dword ptr ss:[esp+0x8]
00DBB9B8 . >mov eax,0xF0F0F0F1
00DBB9BD . >xor ecx,0x22C078
00DBB9C3 . >sub ecx,0x2C175
00DBB9C9 . >xor ecx,0xFFE53167
00DBB9CF . >and ecx,0xFFFFFF ; b=ecx=(a^0x5b8c27^0x22c078-0x2c175)^0xee53167
00DBB9D5 . >mul ecx
00DBB9D7 . >shr edx,0x4 ; edx=HIGH(b*0xF0F0F0F1)/0x10
00DBB9DA . >push esi
00DBB9DB . >mov esi,edx
00DBB9DD . >shl esi,0x4
00DBB9E0 . >add esi,edx ; esi=HIGH(b*0xF0F0F0F1)/0x10 * 0x11
00DBB9E2 . >mov eax,ecx
00DBB9E4 . >sub eax,esi ; eax= b-(HIGH(b*0xF0F0F0F1)/0x10 * 0x11)
00DBB9E6 . >neg eax
00DBB9E8 . >sbb eax,eax
00DBB9EA . >not eax
00DBB9EC . >and eax,edx
00DBB9EE . >pop esi
00DBB9EF . >retn
当eax !=0(即b!=(HIGH(b*0xF0F0F0F1)/0x10 * 0x11))时 ,neg eax => cf =1 , sbb eax ,eax => eax = 0xFFFFFFFF , not eax => eax =0 , and eax ,edx => eax=0,即p1==0 ,又因为
00DBD47E . >cmp dword ptr ss:[esp+0x38],ebp ; if ((p1=e_34) < 0x3C70) fail
所以 ,eax =0(即b=(HIGH(b*0xF0F0F0F1)/0x10 * 0x11)) 是必须的 ,此时 ,neg eax => cf=0 ,sbb eax ,eax => eax=0 ,not eax => eax=0xFFFFFFFF ,and eax ,edx => eax=p1=edx = HIGH(b*0xF0F0F0F1)/0x10;
=>s[0] ,s[8] ,s[9] 满足: 使得b满足: b=b=(HIGH(b*0xF0F0F0F1)/0x10*0x11即可;
接下来就是namecalc = _Calcname(szname ,*** ,p1 ,p2) 了,这个就直接贴源码了吧:
uint _calcname(
char* szname,
uint ***,
uint p1,
uint p2
)
{
//tb 为一个常数表
uint t1=0 ,t2=0 ,nret=0;
uint k1=17*p1 ,k2=15*p2;
int len=strlen(szname);
uchar* nm=(uchar*)szname;
for (int i=0 ;i<len ;i++)
{
//to upper
if (szname[i]>0x60&&szname[i]<0x7b)
szname[i]=szname[i]-0x20;
if (***==1)
{
nret=((tb[nm[i]]+nret)^tb[(nm[i]+0xD)&0xFF])*
tb[(nm[i]+0x2F)&0xFF]+tb[k1&0xFF]+tb[k2&0xFF]+tb[t1&0xFF];
}
else
{
nret=((tb[nm[i]]+nret)^tb[(nm[i]+0x3F)&0xFF])*
tb[(nm[i]+0x17)&0xFF]+tb[k1&0xFF]+tb[k2&0xFF]+tb[t1&0xFF];
}
k1+=0x9 ,k2+=0xD ,t1+=0x13 ,t2+=0x7;
}
return nret;
}
根据上述描述逆推s[0] - s[9]过程用c语言描述如下,用代码说应该更清晰些:
void _calc(
char* szname
)
{
uchar szserial[0x10]={0};
uint p1=0 ,p2=0 ,a ,b ,namecalc ,tmp;
//1.s[3]==0x9C;
for (szserial[3]=0x9C,p2=1 ;p2<0x3E8 ;p2++)
{
namecalc=_calcname(szname ,1 ,p1 ,p2);
//s[1] ,s[2]
szserial[4]=namecalc&0xFF;
szserial[5]=(namecalc>>0x8)&0xFF;
szserial[6]=(namecalc>>0x10)&0xFF;
szserial[7]=(namecalc>>0x18)&0xFF;
tmp=(((p2*0xB)^0x3421)-0x4D30)^0x7892;
szserial[2]=((tmp&0xFF)^szserial[5])&0xFF;
szserial[1]=(((tmp>>0x8)&0xFF)^szserial[7])&0xFF;
//s[0]
int n=0;
for (uint i=0 ;i<0x100 ;i++)
{
szserial[0]=i;
if ((szserial[0]^szserial[6]^0x18+0x3D)^0xA>0x5)
_output(szserial[3] ,szserial);
return;
}
}
//s[3]==0xAC;
for (szserial[3]=0xAC ,p2=1 ;p2<0x3E8 ;p2++)
{
for (b=0x40370 ;b<0xFFFFFF ;b++)
{
__asm
{
mov eax ,0xF0F0F0F1
mov ecx ,b
mul ecx
mov tmp ,edx
}
if ((b-((tmp>>0x4)*0x11))||(tmp>>0x4)<0x3c70)
continue;
p1=tmp>>0x4;
namecalc=_calcname(szname ,1 ,p1 ,p2);
szserial[4]=namecalc&0xFF;
szserial[5]=(namecalc>>0x8)&0xFF;
szserial[6]=(namecalc>>0x10)&0xFF;
szserial[7]=(namecalc>>0x18)&0xFF;
tmp=(((p2*0xB)^0x3421)-0x4D30)^0x7892;
szserial[2]=((tmp&0xFF)^szserial[5])&0xFF;
szserial[1]=(((tmp>>0x8)&0xFF)^szserial[7])&0xFF;
a=(((b^0xE53167)+0x2C175)^0x22C078)^0x5B8C27;
szserial[0]=((a&0xFF)^szserial[6])&0xFF;
szserial[8]=(((a>>0x8)&0xFF)^szserial[4])&0xFF;
szserial[9]=(((a>>0x10)&0xFF)^szserial[5])&0xFF;
_output(0xAC ,szserial);
}
}
}
可以看出一个username可以对应相当多个serial.
还没完呢
......如果调试过整个注册过程的话就会知道问题出在哪里, 会发现只有第一次注册会成功 ,之后即使用同一个username和serial再试就通过不了了, 这是因为我们在前面假设00D001F8 . >cmp dword ptr ds:[ecx+0x2C],0x0
00D001FC . >je 010Edito.00D00387 ; if (e_2c == 0) JMP....
00D00202 . >push 0x0 ; else
00D00204 . >call 010Edito.00BB54E3 ; 网络验证
e_2c ==0 来使注册过程跳转到 :
00D0037F . >mov ecx,dword ptr ds:[0xF87E4C] ; if (ret2==0xDB)
00D00385 . >mov edi,eax ; 则 注册成功
00D00387 > >cmp edi,0xDB
00D0038D . >jnz X010Edito.00D003C7 ; 若注册成功时必须且只能经过这个出口
这个出口,而且也只能走这一条路 ,失败的原因就是因为 e_2c==0并不成立 ,而是e_2c==1 ,这样的话就进入网络验证通道了,
F7跟进分析之后发现程序会向:
http://www.sweetscape.com/cgibin/010editor_check_license_9b.php?name=xxxxxx&pwd=xxxx-xxxx-xxxx-xxxx-xxxx&id=0&chk=xxxxx&typ=0
其中name是经过个另变形的username:
空格 ----> '+'
其它非数字/字母字符 -----> x>>4 >10? x>>4+0x30 : x>>4+0x37 和 x<<4 >10?x<<4+0x30 : x<<4+0x37 两个字符
chk为原username经过计算得到的一个数值 , 计算过程为:
00DBCC40 > >push ebx
00DBCC41 . >mov ebx,dword ptr ss:[esp+0x8]
00DBCC45 . >push esi
00DBCC46 . >mov eax,ebx
00DBCC48 . >push edi
00DBCC49 . >lea edx,dword ptr ds:[eax+0x1]
00DBCC4C . >lea esp,dword ptr ss:[esp]
00DBCC50 > >mov cl,byte ptr ds:[eax]
00DBCC52 . >inc eax
00DBCC53 . >test cl,cl
00DBCC55 .^>jnz X010Edito.00DBCC50
00DBCC57 . >sub eax,edx
00DBCC59 . >mov edi,eax
00DBCC5B . >xor ecx,ecx
00DBCC5D . >xor esi,esi
00DBCC5F . >test edi,edi
00DBCC61 . >jle X010Edito.00DBCCA1 ; while( namelen )
00DBCC63 > >movzx eax,byte ptr ds:[esi+ebx] ; {
00DBCC67 . >mov edx,eax
00DBCC69 . >shl edx,0x4
00DBCC6C . >add edx,eax
00DBCC6E . >lea eax,dword ptr ds:[ecx+ecx*4]
00DBCC71 . >lea ecx,dword ptr ds:[edx+eax+0x9] ; ret=name[i]<<0x4+name[i]+5*ret+9
00DBCC75 . >cmp ecx,0xFFFF
00DBCC7B . >jle X010Edito.00DBCC9C ; if (ret > 0xFFFF)
00DBCC7D . >lea edx,dword ptr ds:[ecx+0xFFFF0000] ; ret+=0xFFFF0001-((HIGH((ret+0xFFFF0000)*
00DBCC83 . >mov eax,0x80008001 ; 0x800008001)>>0xF)*0xFFFF)
00DBCC88 . >mul edx
00DBCC8A . >shr edx,0xF
00DBCC8D . >imul edx,edx,0xFFFF
00DBCC93 . >mov eax,0xFFFF0001
00DBCC98 . >sub eax,edx
00DBCC9A . >add ecx,eax
00DBCC9C > >inc esi
00DBCC9D . >cmp esi,edi
00DBCC9F .^>jl X010Edito.00DBCC63 ; }
00DBCCA1 > >pop edi
00DBCCA2 . >pop esi
00DBCCA3 . >mov eax,ecx
00DBCCA5 . >pop ebx
00DBCCA6 . >retn 0x4
请求得到的验证结果数据最初会保存在:
C:\Users\pc用户名\AppData\Local\Temp\010xxxx.tmp ,xxxx我不知道是不是固定的,要突破这种验证除了在OD中改程序执行流程或数据之外, 可以修改这个文件内容 ,但这个文件在程序读取完其中的内容之后会马上将其删除, 我们可以在进入网络验证之前 bp ReadFile 就可以得到
将文件中的invalid 改为除 "error" ,"invalid" 之外的任何都行, 不一定非得valid ,因为跟踪程序会发现 ,程序只验证 "error" ,和"invalid" ,而将其它都视为valid, 这种修改似乎是永久有效的 ,如果你在调试强制将 e_2c 改为 0 ,即使注册成功 ,下次打开时依旧是未注册的 ,又得再次修改e_2c 值 ,也就是说,通过这样改来注册成功,"成功是一次性的" .........
除了修改文件来突破这种验证之外还有一种方法 ,就是修改注册表:
先F7跟进: 00D00204 . >call 010Edito.00BB54E3 ; 网络验证
这个函数先是构造请求数据的网址,再构造注册表地址,将返回结果加密后存入注册表的一个字段中
多次跟进之后来到:
00DC0790 > >push -0x1
00DC0792 . >push 010Edito.00E44ADD ; SE 处理程序安装
00DC0797 . >mov eax,dword ptr fs:[0]
00DC079D . >push eax
00DC079E . >mov dword ptr fs:[0],esp
00DC07A5 . >sub esp,0x64
00DC07A8 . >mov eax,dword ptr ss:[esp+0x78]
00DC07AC . >push ebp
00DC07AD . >push esi
00DC07AE . >push edi
00DC07AF . >push eax ; /<%u>
00DC07B0 . >mov esi,ecx ; |
00DC07B2 . >lea ecx,dword ptr ss:[esp+0x24] ; |
00DC07B6 . >push 010Edito.00E834D4 ; |format = "%u"
00DC07BB . >push ecx ; |s
00DC07BC . >call dword ptr ds:[<&MSVCR90.sprintf>] ; \sprintf
00DC07C2 . >add esp,0xC
00DC07C5 . >lea edx,dword ptr ss:[esp+0x84]
00DC07CC . >push edx
00DC07CD . >push 0x0
00DC07CF . >lea eax,dword ptr ss:[esp+0x14]
00DC07D3 . >push eax
00DC07D4 . >mov ecx,esi
00DC07D6 . >call 010Edito.00BB4A70 ; 构造注册表地址
00DC07DB . >mov edi,dword ptr ds:[<&QtCore4.QString>; QtCore4.QString::fromAscii_helper
00DC07E1 . >or ebp,0xFFFFFFFF
00DC07E4 . >lea ecx,dword ptr ss:[esp+0x20]
00DC07E8 . >push ebp
00DC07E9 . >push ecx
00DC07EA . >mov dword ptr ss:[esp+0x80],0x0
00DC07F5 . >call edi ; <&QtCore4.QString::fromAscii_helper>
00DC07F7 . >mov dword ptr ss:[esp+0x1C],eax
00DC07FB . >push ebp
00DC07FC . >push 010Edito.00E86558 ; ASCII "ThreadingModel"
00DC0801 . >mov byte ptr ss:[esp+0x88],0x1
00DC0809 . >call edi
00DC080B . >mov dword ptr ss:[esp+0x20],eax
00DC080F . >mov edx,dword ptr ss:[esp+0x90]
00DC0816 . >push edx
00DC0817 . >lea eax,dword ptr ss:[esp+0x20]
00DC081B . >push eax
00DC081C . >lea ecx,dword ptr ss:[esp+0x34]
00DC0820 . >push ecx
00DC0821 . >mov byte ptr ss:[esp+0x94],0x2
00DC0829 . >call 010Edito.00BB4688 ; 构造注册表地址字符串
00DC082E . >push 010Edito.00E86540 ; ASCII "\InProcServer32A\"
00DC0833 . >push eax
00DC0834 . >lea edx,dword ptr ss:[esp+0x3C]
00DC0838 . >push edx
00DC0839 . >mov byte ptr ss:[esp+0xA0],0x3
00DC0841 . >call 010Edito.00BB4688 ; 继续构造注册表地址字符串
00DC0846 . >add esp,0x28
00DC0849 . >mov ecx,dword ptr ss:[esp+0x84]
00DC0850 . >push ecx ; 2
00DC0851 . >push 0x0 ; 0
00DC0853 . >lea edx,dword ptr ss:[esp+0x1C] ; p1
00DC0857 . >push edx
00DC0858 . >lea ecx,dword ptr ss:[esp+0x1C]
00DC085C . >push ecx ; "ThreadingModel"----Qstring
00DC085D . >push eax ; 注册表地址 ----- Qstring
00DC085E . >mov ecx,esi
00DC0860 . >mov byte ptr ss:[esp+0x8C],0x4
00DC0868 . >call 010Edito.00BB3AF3 ; 操作注册表 再F7跟进
00DC086D . >mov edx,dword ptr ss:[esp+0x18]
可以看出这里是向:Software\SweetScape\010 Editor\CLASSES\CLSID\{FA1395FC-83C3-0732-7D11-0134937462A0}\InProcServer32A\ 处写入数据 ,写入什么? 什么字段?根目录是什么? 继续F7:
00DBF890 > >mov eax,dword ptr ss:[esp+0x14]
00DBF894 . >push ebx
00DBF895 . >push ebp
00DBF896 . >push esi
00DBF897 . >cmp eax,0x1
00DBF89A . >jnz X010Edito.00DBF8A3
00DBF89C . >mov ebx,0x80000000
00DBF8A1 . >jmp X010Edito.00DBF8B1
00DBF8A3 > >xor ebx,ebx
00DBF8A5 . >cmp eax,0x2
00DBF8A8 . >setne bl
00DBF8AB . >add ebx,0x80000001 ; 根目录: HKEY_CURRENT_USER
00DBF8B1 > >mov ebp,dword ptr ss:[esp+0x10] ; 注册表地址
00DBF8B5 . >mov esi,dword ptr ds:[<&QtCore4.QString>; QtCore4.QString::utf16
00DBF8BB . >lea eax,dword ptr ss:[esp+0x20]
00DBF8BF . >push eax
00DBF8C0 . >push 0x2001F
00DBF8C5 . >push 0x0
00DBF8C7 . >mov ecx,ebp
00DBF8C9 . >call esi ; <&QtCore4.QString::utf16>
00DBF8CB . >push eax ; |Subkey
00DBF8CC . >push ebx ; |hKey
00DBF8CD . >call dword ptr ds:[<&ADVAPI32.RegOpenKe>; \RegOpenKeyExW
00DBF8D3 . >test eax,eax
00DBF8D5 . >je X010Edito.00DBF92F
00DBF8D7 . >push edi
00DBF8D8 . >xor edi,edi
00DBF8DA . >cmp dword ptr ss:[esp+0x20],edi
00DBF8DE . >je X010Edito.00DBF8E7
00DBF8E0 . >call 010Edito.00BB8193
00DBF8E5 . >mov edi,eax
00DBF8E7 > >lea ecx,dword ptr ss:[esp+0x14]
00DBF8EB . >push ecx
00DBF8EC . >lea edx,dword ptr ss:[esp+0x28]
00DBF8F0 . >push edx
00DBF8F1 . >push edi
00DBF8F2 . >push 0x2001F
00DBF8F7 . >push 0x0
00DBF8F9 . >push 0x0
00DBF8FB . >push 0x0
00DBF8FD . >mov ecx,ebp
00DBF8FF . >call esi
00DBF901 . >push eax ; |Subkey
00DBF902 . >push ebx ; |hKey
00DBF903 . >call dword ptr ds:[<&ADVAPI32.RegCreate>; \RegCreateKeyExW
00DBF909 . >mov ebx,eax
00DBF90B . >test edi,edi
00DBF90D . >je X010Edito.00DBF921
00DBF90F . >mov eax,dword ptr ds:[edi+0x4]
00DBF912 . >push eax
00DBF913 . >call <jmp.&MSVCR90.operator delete>
00DBF918 . >push edi
00DBF919 . >call <jmp.&MSVCR90.operator delete>
00DBF91E . >add esp,0x8
00DBF921 > >pop edi
00DBF922 . >test ebx,ebx
00DBF924 . >je X010Edito.00DBF92F
00DBF926 . >pop esi
00DBF927 . >pop ebp
00DBF928 . >or eax,0xFFFFFFFF
00DBF92B . >pop ebx
00DBF92C . >retn 0x14
00DBF92F > >mov ecx,dword ptr ss:[esp+0x18]
00DBF933 . >mov edx,dword ptr ds:[ecx]
00DBF935 . >mov eax,dword ptr ds:[edx+0x8]
00DBF938 . >lea eax,dword ptr ds:[eax+eax+0x2]
00DBF93C . >push eax
00DBF93D . >call esi
00DBF93F . >mov ecx,dword ptr ss:[esp+0x18]
00DBF943 . >push eax ; 写入的数据
00DBF944 . >push 0x1
00DBF946 . >push 0x0
00DBF948 . >call esi
00DBF94A . >mov ecx,dword ptr ss:[esp+0x30] ; |
00DBF94E . >push eax ; |字段为 "ThreadingModel"
00DBF94F . >push ecx ; |hKey
00DBF950 . >call dword ptr ds:[<&ADVAPI32.RegSetVal>; \RegSetValueExW
00DBF956 . >mov edx,dword ptr ss:[esp+0x20]
00DBF95A . >mov esi,eax
00DBF95C . >neg esi
00DBF95E . >push edx ; /hKey
00DBF95F . >sbb esi,esi ; |
00DBF961 . >call dword ptr ds:[<&ADVAPI32.RegCloseK>; \RegCloseKey
00DBF967 . >mov eax,esi
00DBF969 . >pop esi
00DBF96A . >pop ebp
00DBF96B . >pop ebx
00DBF96C . >retn 0x14
到这里我们唯一还不确定的就是写入的数据是什么了, 其实是一个整数 ,这个整数初如值a为, 网络验证返回的字符"xxxx" 如果为"invalid" or "error" ,则a=1 ,否则a=0 ,同时程序会将这个a的值写入到 e_2c 中,
00DBDC6C > >mov ecx,010Edito.00E860C8 ; ASCII "invalid"
00DBDC71 . >lea eax,dword ptr ss:[esp+0x414] ; eax -> 网络验证 返回的字符串
00DBDC78 > >mov dl,byte ptr ds:[eax]
00DBDC7A . >cmp dl,byte ptr ds:[ecx]
00DBDC7C . >jnz X010Edito.00DBDC98
00DBDC7E . >test dl,dl
00DBDC80 . >je X010Edito.00DBDC94
00DBDC82 . >mov dl,byte ptr ds:[eax+0x1]
00DBDC85 . >cmp dl,byte ptr ds:[ecx+0x1]
00DBDC88 . >jnz X010Edito.00DBDC98
00DBDC8A . >add eax,0x2
00DBDC8D . >add ecx,0x2
00DBDC90 . >test dl,dl
00DBDC92 .^>jnz X010Edito.00DBDC78
00DBDC94 > >xor eax,eax
00DBDC96 . >jmp X010Edito.00DBDC9D
00DBDC98 > >sbb eax,eax
00DBDC9A . >sbb eax,-0x1
00DBDC9D > >mov esi,0x1
00DBDCA2 . >test eax,eax
00DBDCA4 . >jnz X010Edito.00DBDCAB
00DBDCA6 . >mov dword ptr ds:[edi+0x2C],esi
00DBDCA9 . >jmp X010Edito.00DBDCB2
00DBDCAB > >mov dword ptr ds:[edi+0x2C],0x0
00DBDCB2 > >mov ecx,dword ptr ds:[edi+0x2C]
00DBDCB5 . >push ecx
00DBDCB6 . >call 010Edito.00BB7C2F ; GetPointer
00DBDCBB . >mov ecx,eax
00DBDCBD . >call 010Edito.00BB397C ; 经过 加密 写入注册表
00DBDCC2 . >cmp dword ptr ds:[edi+0x2C],esi
00DBDCC5 . >jnz X010Edito.00DBDCD5
00DBDCC7 . >pop edi
00DBDCC8 . >pop esi
00DBDCC9 . >xor eax,eax
00DBDCCB . >pop ebx
00DBDCCC . >add esp,0xC08
00DBDCD2 . >retn 0x10
加密过程为:
00DBB8F0 > >mov eax,dword ptr ss:[esp+0x4]
00DBB8F4 . >imul eax,eax,0x3519
00DBB8FA . >xor eax,0x7C4280C0
00DBB8FF . >add eax,0x2749B4FF
00DBB904 . >xor eax,0xC7329CD4
00DBB909 . >retn
即b=(((a*0x3519)^0x7c42800)&0x2749b4ff)^0xc7329cd4
写入注册表的为b的十进制值的字符串形式 ,如果网络验证返回 "invalid" 情况下 ,e_2c=a=1; =>b=0x64BEF60C (1690236428) , 如果 a=0 => b=0x64BEA96B(1690216811) ,如果强制将 注册表: HKEY_CURRENT_USER\Software\SweetScape\010 Editor\CLASSES\CLSID\{FA1395FC-83C3-0732-7D11-0134937462A0}\InProcServer32A\ 的 ThreadingModel 字段值改为 1690216811 ,重启程序之后 就可以正常注册了 ,而且以后也不用再注册了:
就先这样了,一口气写了这么多了,累死我了,
无图无真相:
【注册机源码下载】 keygen to 010Editor.rar
注: 本次调试加载基址为: 0xBB0000
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
+1
|
|
|
|
|
|
她都不爱我....
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
为什么我的不行，win7 x64.
 |
|
|
|
|
|
出现这个提示 ,不是序列号错误问题, 你可以照我文章中方法去改下注册表中的那个字段值!
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
