我是初次破解带加密狗的软件不知是什么加密狗没有加壳,可以静态反汇编,但是我修改了多处跳转指令不是出错就是不起作用不知如何下手请大家指教
:007928E9 007562 add byte ptr [ebp+62], dh
:007928EC E86A050000 call 00792E5B
:007928F1 85C0 test eax, eax
:007928F3 7454 je 00792949
:007928F5 A1305F7B00 mov eax, dword ptr [007B5F30]
:007928FA 48 dec eax
:007928FB 8BC8 mov ecx, eax
:007928FD 8D0480 lea eax, dword ptr [eax+4*eax]
:00792900 8D0480 lea eax, dword ptr [eax+4*eax]
:00792903 8D0441 lea eax, dword ptr [ecx+2*eax]
:00792906 8D044510507B00 lea eax, dword ptr [2*eax+007B5010]
:0079290D 0514060000 add eax, 00000614
:00792912 8945D4 mov dword ptr [ebp-2C], eax
:00792915 833DE2557B0000 cmp dword ptr [007B55E2], 00000000
:0079291C 7419 je 00792937
:0079291E 6A40 push 00000040
:00792920 B810507B00 mov eax, 007B5010
:00792925 05D6050000 add eax, 000005D6
:0079292A 50 push eax
:0079292B 8B45D4 mov eax, dword ptr [ebp-2C]
:0079292E 50 push eax
:0079292F 6A00 push 00000000
:00792931 FF159C727B00 call dword ptr [007B729C]-->出错
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:007928E5(C), :0079291C(C)
|
:00792937 C705645A7B0001000000 mov dword ptr [007B5A64], 00000001
:00792941 6AFF push FFFFFFFF
:00792943 FF15E8717B00 call dword ptr [007B71E8]--->退出
--------------------------------------------------------------------
所以我进入了:007928EC E86A050000 call 00792E5B里面
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00792E6B(C)
|
:00792E83 A1CA527B00 mov eax, dword ptr [007B52CA]
:00792E88 35B67583ED xor eax, ED8375B6
:00792E8D 8945F0 mov dword ptr [ebp-10], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00792E81(U)
|
:00792E90 E8555D0000 call 00798BEA
:00792E95 8945AC mov dword ptr [ebp-54], eax
:00792E98 837DAC00 cmp dword ptr [ebp-54], 00000000
:00792E9C 741D je 00792EBB
:00792E9E 833D305F7B0000 cmp dword ptr [007B5F30], 00000000
:00792EA5 750A jne 00792EB1
:00792EA7 C705305F7B0001000000 mov dword ptr [007B5F30], 00000001
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00792EA5(C)
|
:00792EB1 B8C2EA0000 mov eax, 0000EAC2
:00792EB6 E9C6060000 jmp 00793581
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00792E9C(C)
|
:00792EBB 833D265A7B0000 cmp dword ptr [007B5A26], 00000000
:00792EC2 0F84E5010000 je 007930AD
:00792EC8 C745F400000000 mov [ebp-0C], 00000000
:00792ECF 8D45D0 lea eax, dword ptr [ebp-30]
:00792ED2 50 push eax
:00792ED3 FF1544727B00 call dword ptr [007B7244]
:00792ED9 8B45D0 mov eax, dword ptr [ebp-30]
----------------------------------------------------------------
又进入:00792E90 E8555D0000 call 00798BEA里面
* Referenced by a CALL at Addresses:
|:00792E90 , :007935BB , :00793A73 , :00793ADD
|
:00798BEA 52 push edx
:00798BEB 51 push ecx
:00798BEC 68E78B7900 push 00798BE7
:00798BF1 6813877900 push 00798713
:00798BF6 6A01 push 00000001
:00798BF8 E86DC3FFFF call 00794F6A
:00798BFD 83C40C add esp, 0000000C
:00798C00 59 pop ecx
:00798C01 5A pop edx
:00798C02 C3 ret
* Referenced by a CALL at Addresses:
|:00791A86 , :00792F36 , :007930DC , :00793672
|
:00798C03 52 push edx
:00798C04 51 push ecx
:00798C05 E834000000 call 00798C3E
:00798C0A 85C0 test eax, eax
:00798C0C 7514 jne 00798C22
:00798C0E 68E78B7900 push 00798BE7
:00798C13 6813877900 push 00798713
:00798C18 6A02 push 00000002
:00798C1A E84BC3FFFF call 00794F6A
:00798C1F 83C40C add esp, 0000000C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00798C0C(C)
|
:00798C22 59 pop ecx
:00798C23 5A pop edx
:00798C24 C3 ret
:00798C25 52 push edx
:00798C26 51 push ecx
:00798C27 68E78B7900 push 00798BE7
:00798C2C 6813877900 push 00798713
:00798C31 6A0B push 0000000B
:00798C33 E832C3FFFF call 00794F6A
:00798C38 83C40C add esp, 0000000C
:00798C3B 59 pop ecx
:00798C3C 5A pop edx
:00798C3D C3 ret
* Referenced by a CALL at Addresses:
|:00794F4A , :00798C05 , :00798C95
|
:00798C3E 52 push edx
:00798C3F 51 push ecx
:00798C40 803DCD5F7B0001 cmp byte ptr [007B5FCD], 01
:00798C47 7521 jne 00798C6A
:00798C49 68E78B7900 push 00798BE7
:00798C4E 6813877900 push 00798713
:00798C53 6A65 push 00000065
:00798C55 E810C3FFFF call 00794F6A
:00798C5A 83C40C add esp, 0000000C
:00798C5D 85C0 test eax, eax
:00798C5F 750B jne 00798C6C
:00798C61 C605CD5F7B0002 mov byte ptr [007B5FCD], 02
:00798C68 EB02 jmp 00798C6C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00798C47(C)
|
:00798C6A 33C0 xor eax, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00798C5F(C), :00798C68(U)
|
:00798C6C 59 pop ecx
:00798C6D 5A pop edx
:00798C6E C3 ret
:00798C6F 52 push edx
:00798C70 51 push ecx
:00798C71 68E78B7900 push 00798BE7
:00798C76 6813877900 push 00798713
:00798C7B 6A64 push 00000064
:00798C7D E8E8C2FFFF call 00794F6A
:00798C82 83C40C add esp, 0000000C
:00798C85 85C0 test eax, eax
:00798C87 7507 jne 00798C90
:00798C89 C605CD5F7B0002 mov byte ptr [007B5FCD], 02
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00798C87(C)
|
:00798C90 59 pop ecx
:00798C91 5A pop edx
:00798C92 C3 ret
:00798C93 52 push edx
:00798C94 51 push ecx
:00798C95 E8A4FFFFFF call 00798C3E
:00798C9A 85C0 test eax, eax
:00798C9C 7514 jne 00798CB2
:00798C9E 68E78B7900 push 00798BE7
:00798CA3 6813877900 push 00798713
:00798CA8 6A15 push 00000015
:00798CAA E8BBC2FFFF call 00794F6A
:00798CAF 83C40C add esp, 0000000C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00798C9C(C)
|
:00798CB2 59 pop ecx
:00798CB3 5A pop edx
:00798CB4 C3 ret
:00798CB5 55 push ebp
:00798CB6 8BEC mov ebp, esp
:00798CB8 51 push ecx
:00798CB9 51 push ecx
:00798CBA 8D45F8 lea eax, dword ptr [ebp-08]
:00798CBD 50 push eax
:00798CBE 8D45FC lea eax, dword ptr [ebp-04]
:00798CC1 50 push eax
:00798CC2 E807000000 call 00798CCE
:00798CC7 8B45FC mov eax, dword ptr [ebp-04]
:00798CCA 59 pop ecx
:00798CCB 59 pop ecx
:00798CCC C9 leave
:00798CCD C3 ret
* Referenced by a CALL at Address:
|:00798CC2
|
:00798CCE 55 push ebp
:00798CCF 8BEC mov ebp, esp
:00798CD1 81EC84000000 sub esp, 00000084
:00798CD7 C745FC4A627B00 mov [ebp-04], 007B624A
:00798CDE 83658400 and dword ptr [ebp-7C], 00000000
:00798CE2 EB07 jmp 00798CEB
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00798D97(U)
|
:00798CE4 8B4584 mov eax, dword ptr [ebp-7C]
:00798CE7 40 inc eax
:00798CE8 894584 mov dword ptr [ebp-7C], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00798CE2(U)
|
:00798CEB 837D8408 cmp dword ptr [ebp-7C], 00000008
:00798CEF 0F8DA7000000 jnl 00798D9C
:00798CF5 8B4584 mov eax, dword ptr [ebp-7C]
:00798CF8 806428EC00 and byte ptr [eax+ebp-14], 00
:00798CFD 83658000 and dword ptr [ebp-80], 00000000
:00798D01 EB07 jmp 00798D0A
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00798D92(U)
我也不是很明白所以多拷一些请大家原谅,
最后这个CALL里面我怎么也看不明白了请大家多多指点在下万分感激!!
软件是用Borland Delphi 3/4 编写
软件大用上分为专业版(学习软件)、普及版、标准版、网络版,
分为综合专业版、建筑专业版、安装专业版、水利专业版、等我也是大体了解,
是的造价评顾软件、出错时提示"找不到硬件软件狗",按了确定后软件退出。
请大家帮助分析,小弟初次暴破文字有点多了点请大家原谅,请大家进入正题吧,也可以和我联系,QQ:43938660
本人只谈技术不谈其它!
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)