开工：
用peid扫描主程序为Aspack2.12加壳，用AspackDie141脱之保存为ok.exe。
程序有凋用Syunew2D.dll动态联接库。好家伙，一眼就看出是使用的域天加密狗。
插好加密狗，运行脱壳后的程序。程序运行了，但提示“REALMagic Driver is not Installed!”。
（有没搞错！我明明插好的神龙解压卡。）于是我运行未脱壳的程序，一切正常！
分析之，可能程序有自效验。
1。解除自效验：
用C32ASM反汇编ok.exe，查找字符串“REALMagic Driver is not Installed!”；
::0051FECB:: CALL 00503D78
::0051FED0:: TEST AX,AX
::0051FED3:: JE SHORT 0051FEDE
::0051FED5:: CALL 004C07AC
::0051FEDA:: TEST AL,AL
::0051FEDC:: JNZ SHORT 0051FEE2
::0051FEDE:: XOR EAX,EAX
::0051FEE0:: JMP SHORT 0051FEE4
::0051FEE2:: MOV AL,1
::0051FEE4:: MOV EDX,[527D68]
::0051FEEA:: MOV [EDX],AL
::0051FEEC:: PUSH 52018C \->: 智远启动屏
::0051FEF1:: PUSH 0
::0051FEF3:: CALL 004075F0 \:JMPUP >>>: USER32.DLL:FindWindowA
::0051FEF8:: MOV EBX,EAX
::0051FEFA:: MOV EAX,[527D68]
::0051FEFF:: CMP BYTE PTR [EAX],0
::0051FF02:: JNZ SHORT 0051FF15
::0051FF04:: PUSH 10
::0051FF06:: PUSH 0
::0051FF08:: PUSH 520198 \->: REALMagic Driver is not Installed! “就是这里了”
::0051FF0D:: PUSH EBX
::0051FF0E:: CALL 00407878 \:JMPUP >>>: USER32.DLL:MessageBoxA
::0051FF13:: JMP SHORT 0051FF82
::0051FF15:: MOV EAX,[EBP-4]
{ Important note about DLL memory management: ShareMem must be the
first unit in your library's USES clause AND your project's (select
Project-View Source) USES clause if your DLL exports any procedures or
functions that pass strings as parameters or function results. This
applies to all strings passed to and from your DLL--even those that
are nested in records and classes. ShareMem is the interface unit to
the BORLNDMM.DLL shared memory manager, which must be deployed along
with your DLL. To avoid using BORLNDMM.DLL, pass string information
using PChar or ShortString parameters. }
function FindPort(Start: integer; OutPath: PChar): integer; stdcall;
begin
result:=0;
OutPath:='johnroot';
end;
function sWrite_2(In_Data: DWord; InPath: PChar): integer; stdcall;
begin
ok:=In_Data;
result:=0;
end;
function sRead(var Out_Data: DWord; InPath: PChar): integer; stdcall;
begin
case ok of
1: Out_Data:=3789934357;
2: Out_Data:=3787582407;
3: Out_Data:=3790723959;
end;
result:=0;
end;
function YRead(var Out_EPROM: byte; Address: smallint; InPath: PChar): integer; stdcall;
begin
case Address of
0: Out_EPROM:=$0a;
1: Out_EPROM:=$33;
2: Out_EPROM:=$37;
3: Out_EPROM:=$39;
4: Out_EPROM:=$30;
5: Out_EPROM:=$37;
6: Out_EPROM:=$32;
7: Out_EPROM:=$33;
8: Out_EPROM:=$39;
9: Out_EPROM:=$35;
10: Out_EPROM:=$39;
end;
result:=0
end;
exports
FindPort,
sWrite_2,
sRead,
YRead;
begin
end.
学习收藏
