【原创】XX围棋客户端的去功能限制
【软件名称】：新浪围棋
【软件下载】：http://sports.sina.com.cn/chess
【软件语言】：简体中文
【软件类别】：国产软件
【破解工具】：PEiD, OllyDbg, W32DSM
【破解作者】：blackeyes
【作者声明】：初学Crack，只是感兴趣，没有其它目的。失误之处敬请诸位大侠赐教！
来这儿的人, 有上网下围棋的吗? 本人水平臭, 但还是偶尔上网下一下, 消遣一下.
新浪围棋真的做的不错, 但未注册用户在网上下棋时有好多限制, 如:
不能进行棋势分析,
不能试下,
不能自动邀请对局.
...
其中, 棋势分析与试下, 真的很好用, 但....
本地棋谱观赏时, 棋势分析与试下都是有效的,说明这些功能都在客户端, 只是被限制住了.
那还有什么好说的, 开始破破破...
1. 首先用PEiD: Borland Delphi 4.0 - 5.0, 无壳, 好说
2. 再 W32DSM 反汇编, 最后 OLLYDB 动态跟踪, 没有 anti-debug, 更好说了, 只是 String
都是中文, 还有窗口及各种按钮等都是非 Windows 标准的, 全是自绘窗口, 有点讨厌.
3. 上网找人对局, 然后进行棋势分析, 几次以后就会弹出一窗口, 说什么
未注册用户不可以使用该项功能, 是否要交费什么的
有提示, 找关键代码就容易多了.
在 W32DSM 的反汇编结果中 Search "http://www.sinago.com/mypage/money/money_01.asp"
或在OD 中下断 shell32.ShellExecuteA
很容易就找到下面的这段 CODE
* Referenced by a CALL at Addresses:
|:00600BF9 , :0060CA22 , :00621393 , :006214D1 , :006214F8
|:006260C3 , :006390A2 , :0066242D , :006626A5
|
:00621160 55 push ebp
:00621161 8BEC mov ebp, esp
:00621163 83C4E0 add esp, FFFFFFE0
:00621166 33C9 xor ecx, ecx
:00621168 894DF4 mov dword ptr [ebp-0C], ecx
:0062116B 8955F0 mov dword ptr [ebp-10], edx
:0062116E 8945FC mov dword ptr [ebp-04], eax
:00621171 33C0 xor eax, eax
:00621173 55 push ebp
:00621174 6831126200 push 00621231
:00621179 64FF30 push dword ptr fs:[eax]
:0062117C 648920 mov dword ptr fs:[eax], esp
:0062117F 8B4DFC mov ecx, dword ptr [ebp-04]
:00621182 B201 mov dl, 01
* Possible StringData Ref from Code Obj ->"?C"
|
:00621184 A11C4B5E00 mov eax, dword ptr [005E4B1C]
:00621189 E87AC6E2FF call 0044D808
:0062118E 8945F8 mov dword ptr [ebp-08], eax
* Possible Reference to String Resource ID=00030: "┬?
|
:00621191 6A1E push 0000001E
:00621193 A14CFB6800 mov eax, dword ptr [0068FB4C]
:00621198 8B00 mov eax, dword ptr [eax]
:0062119A 8B9030200100 mov edx, dword ptr [eax+00012030]
* Possible Reference to String Resource ID=00001: "SM"
|
:006211A0 B901000000 mov ecx, 00000001
:006211A5 8B45F8 mov eax, dword ptr [ebp-08]
:006211A8 E8933BFCFF call 005E4D40
:006211AD 8B45F8 mov eax, dword ptr [ebp-08]
:006211B0 8B10 mov edx, dword ptr [eax]
:006211B2 FF92D8000000 call dword ptr [edx+000000D8]
:006211B8 48 dec eax
:006211B9 7558 jne 00621213
:006211BB 8B45F8 mov eax, dword ptr [ebp-08]
:006211BE 83B8EC02000002 cmp dword ptr [eax+000002EC], 00000002
:006211C5 752E jne 006211F5
:006211C7 8D55F4 lea edx, dword ptr [ebp-0C]
* Possible Reference to String Resource ID=01194: "http://www.sinago.com/mypage/money/money_01.asp"
|
:006211CA B8AA040000 mov eax, 000004AA
:006211CF E838EA0500 call 0067FC0C
* Possible Reference to String Resource ID=00001: "SM"
|
:006211D4 6A01 push 00000001
:006211D6 6A00 push 00000000
:006211D8 6A00 push 00000000
:006211DA 8B45F4 mov eax, dword ptr [ebp-0C]
:006211DD E8E630DEFF call 004042C8
:006211E2 50 push eax
:006211E3 683C126200 push 0062123C
* Reference To: user32.GetDesktopWindow, Ord:0000h
|
:006211E8 E84369DEFF Call 00407B30
:006211ED 50 push eax
* Reference To: shell32.ShellExecuteA, Ord:0000h
|
:006211EE E8E948E3FF Call 00455ADC
:006211F3 EB1E jmp 00621213
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:006211C5(C)
|
:006211F5 8D55E0 lea edx, dword ptr [ebp-20]
:006211F8 A114FE6800 mov eax, dword ptr [0068FE14]
:006211FD 8B00 mov eax, dword ptr [eax]
:006211FF E83479F3FF call 00558B38
:00621204 8D55E0 lea edx, dword ptr [ebp-20]
:00621207 A14CFB6800 mov eax, dword ptr [0068FB4C]
:0062120C 8B00 mov eax, dword ptr [eax]
:0062120E E855B60500 call 0067C868
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:006211B9(C), :006211F3(U)
|
:00621213 8B45F8 mov eax, dword ptr [ebp-08]
:00621216 E81D1FDEFF call 00403138
:0062121B 33C0 xor eax, eax
:0062121D 5A pop edx
:0062121E 59 pop ecx
:0062121F 59 pop ecx
:00621220 648910 mov dword ptr fs:[eax], edx
:00621223 6838126200 push 00621238
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00621236(U)
|
:00621228 8D45F4 lea eax, dword ptr [ebp-0C]
:0062122B E8542CDEFF call 00403E84
:00621230 C3 ret
:00621231 E96226DEFF jmp 00403898
:00621236 EBF0 jmp 00621228
:00621238 8BE5 mov esp, ebp
:0062123A 5D pop ebp
:0062123B C3 ret
只要到了这段 CODE, 就会出现提示窗口, 那就要看是从哪 CALL 来的, 怎样才能跳过这个CALL,
总共9个CALL 00621160 没必要每个都看,
我只关心 棋势分析, 试下, 自动邀请对局 这三项功能, 在00621160 处F2 下断, 找到3处的CALL
************** 第 1 处 ************************
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:006214B9(C)
|
:006214C3 837DF000 cmp dword ptr [ebp-10], 00000000
:006214C7 750F jne 006214D8 // 这儿要跳!!!
* Possible Reference to String Resource ID=00001: "SM"
|
:006214C9 BA01000000 mov edx, 00000001
:006214CE 8B45FC mov eax, dword ptr [ebp-04]
:006214D1 E88AFCFFFF call 00621160 // 到这儿就坏了
:006214D6 EB72 jmp 0062154A
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:006214C7(C)
|
:006214D8 C645F701 mov [ebp-09], 01 // 正常的流程应该到这
:006214DC EB6C jmp 0062154A
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:006214BC(C)
|
************** 第 2 处 ************************
:006623C2 8B45FC mov eax, dword ptr [ebp-04]
:006623C5 80B893CF050004 cmp byte ptr [eax+0005CF93], 04
:006623CC 0F8412110000 je 006634E4
:006623D2 A198FD6800 mov eax, dword ptr [0068FD98]
:006623D7 8B00 mov eax, dword ptr [eax]
:006623D9 E866EEFBFF call 00621244
:006623DE 84C0 test al, al
:006623E0 7555 jne 00662437 // 这儿可跳过CALL 00621160
:006623E2 8B45FC mov eax, dword ptr [ebp-04]
:006623E5 83B83C04000001 cmp dword ptr [eax+0000043C], 00000001
:006623EC 7E49 jle 00662437
:006623EE 8B45FC mov eax, dword ptr [ebp-04]
:006623F1 80B834CF05000C cmp byte ptr [eax+0005CF34], 0C
:006623F8 7427 je 00662421
:006623FA 8B45FC mov eax, dword ptr [ebp-04]
:006623FD 80B835CF05000C cmp byte ptr [eax+0005CF35], 0C
:00662404 741B je 00662421
:00662406 8B45FC mov eax, dword ptr [ebp-04]
:00662409 83B884CF050000 cmp dword ptr [eax+0005CF84], 00000000
:00662410 7C25 jl 00662437
:00662412 8B45FC mov eax, dword ptr [ebp-04]
:00662415 81B884CF050088130000 cmp dword ptr [eax+0005CF84], 00001388
:0066241F 7F16 jg 00662437
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:006623F8(C), :00662404(C)
|
:00662421 A198FD6800 mov eax, dword ptr [0068FD98]
:00662426 8B00 mov eax, dword ptr [eax]
* Possible Reference to String Resource ID=00006: ".?3??"
|
:00662428 BA06000000 mov edx, 00000006
:0066242D E82EEDFBFF call 00621160 // 不能到这儿
:00662432 E98C120000 jmp 006636C3
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:006623E0(C), :006623EC(C), :00662410(C), :0066241F(C)
|
:00662437 8B45FC mov eax, dword ptr [ebp-04] // 到这儿就好了
:0066243A FF803C040000 inc dword ptr [eax+0000043C]
:00662440 8B45FC mov eax, dword ptr [ebp-04]
:00662443 E8C470FEFF call 0064950C
************** 第 3 处 ************************
:0066264A A198FD6800 mov eax, dword ptr [0068FD98]
:0066264F 8B00 mov eax, dword ptr [eax]
:00662651 E8EEEBFBFF call 00621244
:00662656 84C0 test al, al
:00662658 7555 jne 006626AF // 这儿跳吧!!!
:0066265A 8B45FC mov eax, dword ptr [ebp-04]
:0066265D 83B84004000001 cmp dword ptr [eax+00000440], 00000001
:00662664 7E49 jle 006626AF
:00662666 8B45FC mov eax, dword ptr [ebp-04]
:00662669 80B834CF05000C cmp byte ptr [eax+0005CF34], 0C
:00662670 7427 je 00662699
:00662672 8B45FC mov eax, dword ptr [ebp-04]
:00662675 80B835CF05000C cmp byte ptr [eax+0005CF35], 0C
:0066267C 741B je 00662699
:0066267E 8B45FC mov eax, dword ptr [ebp-04]
:00662681 83B884CF050000 cmp dword ptr [eax+0005CF84], 00000000
:00662688 7C25 jl 006626AF
:0066268A 8B45FC mov eax, dword ptr [ebp-04]
:0066268D 81B884CF050088130000 cmp dword ptr [eax+0005CF84], 00001388
:00662697 7F16 jg 006626AF
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00662670(C), :0066267C(C)
|
:00662699 A198FD6800 mov eax, dword ptr [0068FD98]
:0066269E 8B00 mov eax, dword ptr [eax]
* Possible Reference to String Resource ID=00005: "?绢"
|
:006626A0 BA05000000 mov edx, 00000005
:006626A5 E8B6EAFBFF call 00621160 // 到这我不高兴
:006626AA E914100000 jmp 006636C3
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00662658(C), :00662664(C), :00662688(C), :00662697(C)
|
:006626AF 8B45FC mov eax, dword ptr [ebp-04] // 到这儿好!!!
:006626B2 FF8040040000 inc dword ptr [eax+00000440]
:006626B8 8B45FC mov eax, dword ptr [ebp-04]
:006626BB 80B834CF050000 cmp byte ptr [eax+0005CF34], 00
:006626C2 7510 jne 006626D4
:006626C4 33D2 xor edx, edx
:006626C6 8B45FC mov eax, dword ptr [ebp-04]
:006626C9 8B8048D00500 mov eax, dword ptr [eax+0005D048]
:006626CF E858580100 call 00677F2C
还有其它几处是什么限制, 我不关心, 也不想改了. 它每隔一段时间就会有升级, 到时候还得改,
还好, 不是太频繁, 而且掌握了窍门, 几分钟就可以搞定.
好了, 再上网下棋就与注册用户没什么区别了. 不过, 水平不行, 再怎么棋势分析/试下, 还是没有用.
[注意]看雪招聘，专注安全领域的专业人才平台！
