昨天看到一个软件,用aspack2.12加的壳,还具有反调试功能。在win2003下用aspackdie脱壳成功,这回用win32 dasm8.93可以察看其代码了。通过查找关键字,来到以下地方:
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00606B4D(C)
|
:00606B48 6A00 push 00000000
:00606B4A 6A00 push 00000000
:00606B4C 49 dec ecx
:00606B4D 75F9 jne 00606B48
:00606B4F 51 push ecx
:00606B50 53 push ebx
:00606B51 56 push esi
:00606B52 57 push edi
:00606B53 8BD8 mov ebx, eax
:00606B55 33C0 xor eax, eax
:00606B57 55 push ebp
:00606B58 68E96F6000 push 00606FE9
:00606B5D 64FF30 push dword ptr fs:[eax]
:00606B60 648920 mov dword ptr fs:[eax], esp
:00606B63 B201 mov dl, 01
:00606B65 A1F0E04400 mov eax, dword ptr [0044E0F0]
:00606B6A E88176E4FF call 0044E1F0
:00606B6F 8945FC mov dword ptr [ebp-04], eax
:00606B72 33C0 xor eax, eax
:00606B74 55 push ebp
:00606B75 68F26E6000 push 00606EF2
:00606B7A 64FF30 push dword ptr fs:[eax]
:00606B7D 648920 mov dword ptr fs:[eax], esp
:00606B80 8D55EC lea edx, dword ptr [ebp-14]
:00606B83 8B8308030000 mov eax, dword ptr [ebx+00000308]
:00606B89 E87E6DE8FF call 0048D90C
:00606B8E 8B45EC mov eax, dword ptr [ebp-14]
:00606B91 8D55F0 lea edx, dword ptr [ebp-10]
:00606B94 E8F72DE0FF call 00409990
:00606B99 8B45F0 mov eax, dword ptr [ebp-10]
:00606B9C 8D4DF4 lea ecx, dword ptr [ebp-0C]
* Possible StringData Ref from Code Obj ->"HDDBIP"
|
:00606B9F BA04706000 mov edx, 00607004
:00606BA4 E863750600 call 0066E10C
:00606BA9 8B45F4 mov eax, dword ptr [ebp-0C]
:00606BAC 50 push eax
:00606BAD 8D55E4 lea edx, dword ptr [ebp-1C]
:00606BB0 8B8304030000 mov eax, dword ptr [ebx+00000304]
:00606BB6 E8516DE8FF call 0048D90C
:00606BBB 8B45E4 mov eax, dword ptr [ebp-1C]
:00606BBE 8D55E8 lea edx, dword ptr [ebp-18]
:00606BC1 E8CA2DE0FF call 00409990
:00606BC6 8B55E8 mov edx, dword ptr [ebp-18]
:00606BC9 58 pop eax
:00606BCA E80DE4DFFF call 00404FDC
:00606BCF 0F85EA000000 jne 00606CBF
:00606BD5 33C0 xor eax, eax
:00606BD7 55 push ebp
:00606BD8 68B06C6000 push 00606CB0
:00606BDD 64FF30 push dword ptr fs:[eax]
:00606BE0 648920 mov dword ptr fs:[eax], esp
:00606BE3 BA02000080 mov edx, 80000002
:00606BE8 8B45FC mov eax, dword ptr [ebp-04]
:00606BEB E8A076E4FF call 0044E290
:00606BF0 B101 mov cl, 01
* Possible StringData Ref from Code Obj ->"SoftWare\Dbimp\Dbimp1.0"
|
:00606BF2 BA14706000 mov edx, 00607014
:00606BF7 8B45FC mov eax, dword ptr [ebp-04]
:00606BFA E8F576E4FF call 0044E2F4
:00606BFF 84C0 test al, al
:00606C01 7429 je 00606C2C
:00606C03 8D55DC lea edx, dword ptr [ebp-24]
:00606C06 8B8304030000 mov eax, dword ptr [ebx+00000304]
:00606C0C E8FB6CE8FF call 0048D90C
:00606C11 8B45DC mov eax, dword ptr [ebp-24]
:00606C14 8D55E0 lea edx, dword ptr [ebp-20]
:00606C17 E8742DE0FF call 00409990
:00606C1C 8B4DE0 mov ecx, dword ptr [ebp-20]
* Possible StringData Ref from Code Obj ->"RegName"
|
:00606C1F BA34706000 mov edx, 00607034
:00606C24 8B45FC mov eax, dword ptr [ebp-04]
:00606C27 E86478E4FF call 0044E490
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00606C01(C)
|
:00606C2C 8D55D4 lea edx, dword ptr [ebp-2C]
:00606C2F 8B8308030000 mov eax, dword ptr [ebx+00000308]
:00606C35 E8D26CE8FF call 0048D90C
:00606C3A 8B45D4 mov eax, dword ptr [ebp-2C]
:00606C3D 8D55D8 lea edx, dword ptr [ebp-28]
:00606C40 E84B2DE0FF call 00409990
:00606C45 8B4DD8 mov ecx, dword ptr [ebp-28]
* Possible StringData Ref from Code Obj ->"RegID"
|
:00606C48 BA44706000 mov edx, 00607044
:00606C4D 8B45FC mov eax, dword ptr [ebp-04]
:00606C50 E83B78E4FF call 0044E490
:00606C55 8B45FC mov eax, dword ptr [ebp-04]
:00606C58 E80376E4FF call 0044E260
:00606C5D 6A00 push 00000000
* Possible StringData Ref from Code Obj ->"用户注册"
|
:00606C5F B94C706000 mov ecx, 0060704C
* Possible StringData Ref from Code Obj ->"注册码成功!"
|
:00606C64 BA58706000 mov edx, 00607058
:00606C69 A1243C6A00 mov eax, dword ptr [006A3C24]
:00606C6E 8B00 mov eax, dword ptr [eax]
:00606C70 E8937FEAFF call 004AEC08
:00606C75 8B83F8020000 mov eax, dword ptr [ebx+000002F8]
:00606C7B 33D2 xor edx, edx
:00606C7D 8B08 mov ecx, dword ptr [eax]
:00606C7F FF5164 call [ecx+64]
:00606C82 A158376A00 mov eax, dword ptr [006A3758]
:00606C87 C6402801 mov [eax+28], 01
:00606C8B 8B45FC mov eax, dword ptr [ebp-04]
:00606C8E E849D0DFFF call 00403CDC
:00606C93 33C0 xor eax, eax
:00606C95 5A pop edx
:00606C96 59 pop ecx
:00606C97 59 pop ecx
:00606C98 648910 mov dword ptr fs:[eax], edx
:00606C9B 33C0 xor eax, eax
:00606C9D 5A pop edx
:00606C9E 59 pop ecx
:00606C9F 59 pop ecx
:00606CA0 648910 mov dword ptr fs:[eax], edx
:00606CA3 E97A020000 jmp 00606F22
:00606CA8 33C0 xor eax, eax
:00606CAA 5A pop edx
:00606CAB 59 pop ecx
:00606CAC 59 pop ecx
:00606CAD 648910 mov dword ptr fs:[eax], edx
:00606CB0 E907D5DFFF jmp 004041BC
:00606CB5 E82ED9DFFF call 004045E8
:00606CBA E929020000 jmp 00606EE8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00606BCF(C)
|
:00606CBF A158376A00 mov eax, dword ptr [006A3758]
:00606CC4 833800 cmp dword ptr [eax], 00000000
:00606CC7 0F841B020000 je 00606EE8
:00606CCD 8D55F8 lea edx, dword ptr [ebp-08]
:00606CD0 A158376A00 mov eax, dword ptr [006A3758]
:00606CD5 8B00 mov eax, dword ptr [eax]
:00606CD7 E80439E0FF call 0040A5E0
:00606CDC 8D45F8 lea eax, dword ptr [ebp-08]
:00606CDF 50 push eax
:00606CE0 8B55F8 mov edx, dword ptr [ebp-08]
:00606CE3 B870706000 mov eax, 00607070
:00606CE8 E8E7E4DFFF call 004051D4
:00606CED 8BC8 mov ecx, eax
:00606CEF 49 dec ecx
:00606CF0 BA01000000 mov edx, 00000001
:00606CF5 8B45F8 mov eax, dword ptr [ebp-08]
:00606CF8 E8F3E3DFFF call 004050F0
:00606CFD 33C0 xor eax, eax
:00606CFF 55 push ebp
:00606D00 68DE6E6000 push 00606EDE
:00606D05 64FF30 push dword ptr fs:[eax]
:00606D08 648920 mov dword ptr fs:[eax], esp
:00606D0B 8D55C8 lea edx, dword ptr [ebp-38]
:00606D0E 8B8308030000 mov eax, dword ptr [ebx+00000308]
:00606D14 E8F36BE8FF call 0048D90C
:00606D19 8B45C8 mov eax, dword ptr [ebp-38]
:00606D1C 8D55CC lea edx, dword ptr [ebp-34]
:00606D1F E86C2CE0FF call 00409990
:00606D24 8B45CC mov eax, dword ptr [ebp-34]
:00606D27 8D4DD0 lea ecx, dword ptr [ebp-30]
:00606D2A 8B55F8 mov edx, dword ptr [ebp-08]
:00606D2D E8DA730600 call 0066E10C
:00606D32 8B45D0 mov eax, dword ptr [ebp-30]
:00606D35 50 push eax
:00606D36 8D55C0 lea edx, dword ptr [ebp-40]
:00606D39 8B8304030000 mov eax, dword ptr [ebx+00000304]
:00606D3F E8C86BE8FF call 0048D90C
:00606D44 8B45C0 mov eax, dword ptr [ebp-40]
:00606D47 8D55C4 lea edx, dword ptr [ebp-3C]
:00606D4A E8412CE0FF call 00409990
:00606D4F 8B55C4 mov edx, dword ptr [ebp-3C]
:00606D52 58 pop eax
:00606D53 E884E2DFFF call 00404FDC
:00606D58 7463 je 00606DBD
:00606D5A 8D55B4 lea edx, dword ptr [ebp-4C]
:00606D5D 8B8308030000 mov eax, dword ptr [ebx+00000308]
:00606D63 E8A46BE8FF call 0048D90C
:00606D68 8B45B4 mov eax, dword ptr [ebp-4C]
:00606D6B 8D55B8 lea edx, dword ptr [ebp-48]
:00606D6E E81D2CE0FF call 00409990
:00606D73 8B45B8 mov eax, dword ptr [ebp-48]
:00606D76 8D4DBC lea ecx, dword ptr [ebp-44]
:00606D79 8B55F8 mov edx, dword ptr [ebp-08]
:00606D7C E88B730600 call 0066E10C
:00606D81 8B45BC mov eax, dword ptr [ebp-44]
:00606D84 50 push eax
:00606D85 8D55A8 lea edx, dword ptr [ebp-58]
:00606D88 8B8304030000 mov eax, dword ptr [ebx+00000304]
:00606D8E E8796BE8FF call 0048D90C
:00606D93 8B4DA8 mov ecx, dword ptr [ebp-58]
:00606D96 8D45AC lea eax, dword ptr [ebp-54]
:00606D99 BA7C706000 mov edx, 0060707C
:00606D9E E839E1DFFF call 00404EDC
:00606DA3 8B45AC mov eax, dword ptr [ebp-54]
:00606DA6 8D55B0 lea edx, dword ptr [ebp-50]
:00606DA9 E8E22BE0FF call 00409990
:00606DAE 8B55B0 mov edx, dword ptr [ebp-50]
:00606DB1 58 pop eax
:00606DB2 E825E2DFFF call 00404FDC
:00606DB7 0F8517010000 jne 00606ED4
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00606D58(C)
|
:00606DBD 837DFC00 cmp dword ptr [ebp-04], 00000000
:00606DC1 740A je 00606DCD
:00606DC3 8B45FC mov eax, dword ptr [ebp-04]
:00606DC6 E89574E4FF call 0044E260
:00606DCB EB0F jmp 00606DDC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00606DC1(C)
|
:00606DCD B201 mov dl, 01
:00606DCF A1F0E04400 mov eax, dword ptr [0044E0F0]
:00606DD4 E81774E4FF call 0044E1F0
:00606DD9 8945FC mov dword ptr [ebp-04], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00606DCB(U)
|
:00606DDC 33C0 xor eax, eax
:00606DDE 55 push ebp
:00606DDF 68CA6E6000 push 00606ECA
:00606DE4 64FF30 push dword ptr fs:[eax]
:00606DE7 648920 mov dword ptr fs:[eax], esp
:00606DEA BA02000080 mov edx, 80000002
:00606DEF 8B45FC mov eax, dword ptr [ebp-04]
:00606DF2 E89974E4FF call 0044E290
:00606DF7 8D45A4 lea eax, dword ptr [ebp-5C]
:00606DFA 8B4DF8 mov ecx, dword ptr [ebp-08]
* Possible StringData Ref from Code Obj ->"SoftWare\Dbimp\"
|
:00606DFD BA88706000 mov edx, 00607088
:00606E02 E8D5E0DFFF call 00404EDC
:00606E07 8B55A4 mov edx, dword ptr [ebp-5C]
:00606E0A B101 mov cl, 01
:00606E0C 8B45FC mov eax, dword ptr [ebp-04]
:00606E0F E8E074E4FF call 0044E2F4
:00606E14 84C0 test al, al
:00606E16 7429 je 00606E41
:00606E18 8D559C lea edx, dword ptr [ebp-64]
:00606E1B 8B8304030000 mov eax, dword ptr [ebx+00000304]
:00606E21 E8E66AE8FF call 0048D90C
:00606E26 8B459C mov eax, dword ptr [ebp-64]
:00606E29 8D55A0 lea edx, dword ptr [ebp-60]
:00606E2C E85F2BE0FF call 00409990
:00606E31 8B4DA0 mov ecx, dword ptr [ebp-60]
* Possible StringData Ref from Code Obj ->"RegName"
|
:00606E34 BA34706000 mov edx, 00607034
:00606E39 8B45FC mov eax, dword ptr [ebp-04]
:00606E3C E84F76E4FF call 0044E490
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00606E16(C)
|
:00606E41 8D5594 lea edx, dword ptr [ebp-6C]
:00606E44 8B8308030000 mov eax, dword ptr [ebx+00000308]
:00606E4A E8BD6AE8FF call 0048D90C
:00606E4F 8B4594 mov eax, dword ptr [ebp-6C]
:00606E52 8D5598 lea edx, dword ptr [ebp-68]
:00606E55 E8362BE0FF call 00409990
:00606E5A 8B4D98 mov ecx, dword ptr [ebp-68]
* Possible StringData Ref from Code Obj ->"RegID"
|
:00606E5D BA44706000 mov edx, 00607044
:00606E62 8B45FC mov eax, dword ptr [ebp-04]
:00606E65 E82676E4FF call 0044E490
:00606E6A 8B45FC mov eax, dword ptr [ebp-04]
:00606E6D E8EE73E4FF call 0044E260
:00606E72 6A00 push 00000000
* Possible StringData Ref from Code Obj ->"用户注册"
|
:00606E74 B94C706000 mov ecx, 0060704C
* Possible StringData Ref from Code Obj ->"注册码成功!"
|
:00606E79 BA58706000 mov edx, 00607058
:00606E7E A1243C6A00 mov eax, dword ptr [006A3C24]
:00606E83 8B00 mov eax, dword ptr [eax]
:00606E85 E87E7DEAFF call 004AEC08
:00606E8A 8B83F8020000 mov eax, dword ptr [ebx+000002F8]
:00606E90 33D2 xor edx, edx
:00606E92 8B08 mov ecx, dword ptr [eax]
:00606E94 FF5164 call [ecx+64]
:00606E97 A158376A00 mov eax, dword ptr [006A3758]
:00606E9C C6402801 mov [eax+28], 01
:00606EA0 8B45FC mov eax, dword ptr [ebp-04]
:00606EA3 E834CEDFFF call 00403CDC
:00606EA8 33C0 xor eax, eax
:00606EAA 5A pop edx
:00606EAB 59 pop ecx
:00606EAC 59 pop ecx
:00606EAD 648910 mov dword ptr fs:[eax], edx
:00606EB0 33C0 xor eax, eax
:00606EB2 5A pop edx
:00606EB3 59 pop ecx
:00606EB4 59 pop ecx
:00606EB5 648910 mov dword ptr fs:[eax], edx
:00606EB8 33C0 xor eax, eax
:00606EBA 5A pop edx
:00606EBB 59 pop ecx
:00606EBC 59 pop ecx
:00606EBD 648910 mov dword ptr fs:[eax], edx
:00606EC0 EB60 jmp 00606F22
:00606EC2 33C0 xor eax, eax
:00606EC4 5A pop edx
:00606EC5 59 pop ecx
:00606EC6 59 pop ecx
:00606EC7 648910 mov dword ptr fs:[eax], edx
:00606ECA E9EDD2DFFF jmp 004041BC
:00606ECF E814D7DFFF call 004045E8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00606DB7(C)
|
:00606ED4 33C0 xor eax, eax
:00606ED6 5A pop edx
:00606ED7 59 pop ecx
:00606ED8 59 pop ecx
:00606ED9 648910 mov dword ptr fs:[eax], edx
:00606EDC EB0A jmp 00606EE8
:00606EDE E9D9D2DFFF jmp 004041BC
:00606EE3 E800D7DFFF call 004045E8
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00606CBA(U), :00606CC7(C), :00606EDC(U)
|
:00606EE8 33C0 xor eax, eax
:00606EEA 5A pop edx
:00606EEB 59 pop ecx
:00606EEC 59 pop ecx
:00606EED 648910 mov dword ptr fs:[eax], edx
:00606EF0 EB0A jmp 00606EFC
:00606EF2 E9C5D2DFFF jmp 004041BC
:00606EF7 E8ECD6DFFF call 004045E8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00606EF0(U)
|
:00606EFC 837DFC00 cmp dword ptr [ebp-04], 00000000
:00606F00 7408 je 00606F0A
:00606F02 8B45FC mov eax, dword ptr [ebp-04]
:00606F05 E8D2CDDFFF call 00403CDC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00606F00(C)
|
:00606F0A 6A00 push 00000000
* Possible StringData Ref from Code Obj ->"用户注册"
|
:00606F0C B94C706000 mov ecx, 0060704C
* Possible StringData Ref from Code Obj ->"注册码失败!请核对注册名与注册码。"
|
:00606F11 BA98706000 mov edx, 00607098
:00606F16 A1243C6A00 mov eax, dword ptr [006A3C24]
:00606F1B 8B00 mov eax, dword ptr [eax]
:00606F1D E8E67CEAFF call 004AEC08
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00606CA3(U), :00606EC0(U)
|
:00606F22 33C0 xor eax, eax
:00606F24 5A pop edx
:00606F25 59 pop ecx
:00606F26 59 pop ecx
:00606F27 648910 mov dword ptr fs:[eax], edx
:00606F2A 68F36F6000 push 00606FF3
给我感觉,这个软件的注册机制是读取用户名和注册码进行比较,但注册成功的地方有两处,注册失败的地方却只有一处。我强行修改了跳转,结果程序崩溃了。请高手给一些思路,谢谢!
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)