【破文标题】标志位爆破某软件
【破文作者】悟空(annatata)
【作者邮箱】木有这高科技装备
【作者主页】http://www.edisk.org/?annatata
【破解工具】PEiD,OD
【破解平台】Windows XP
【软件名称】
【软件大小】
【原版下载】
【保护方式】
【软件简介】
【破解声明】我是一只小菜鸟,偶得一点心得,愿与大家分享:)
------------------------------------------------------------------------
PEID查壳,没有...
OD载入,查找ASCII,找到注册提示。
来到这里:
004D9350 /. 55 PUSH EBP
004D9351 |. 8BEC MOV EBP,ESP
004D9353 |. 33C9 XOR ECX,ECX
004D9355 |. 51 PUSH ECX
004D9356 |. 51 PUSH ECX
004D9357 |. 51 PUSH ECX
004D9358 |. 51 PUSH ECX
004D9359 |. 51 PUSH ECX
004D935A |. 51 PUSH ECX
004D935B |. 51 PUSH ECX
004D935C |. 51 PUSH ECX
004D935D |. 53 PUSH EBX
004D935E |. 8BD8 MOV EBX,EAX
004D9360 |. 33C0 XOR EAX,EAX
004D9362 |. 55 PUSH EBP
004D9363 |. 68 5A954D00 PUSH CDSnapsh.004D955A
004D9368 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
004D936B |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
004D936E |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
004D9371 |. 8B83 70030000 MOV EAX,DWORD PTR DS:[EBX+370]
004D9377 |. E8 B08BF9FF CALL CDSnapsh.00471F2C ; 取假码
004D937C |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; 假码给EAX
004D937F |. E8 40B2F2FF CALL CDSnapsh.004045C4 ; 数假码位数
004D9384 |. 83F8 08 CMP EAX,8 ; 不是8位就完蛋
004D9387 EB 3F JMP SHORT CDSnapsh.004D93C8 ; 干脆把它改成JMP好了
004D9389 |. 6A 10 PUSH 10
004D938B |. 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
004D938E |. A1 0C414E00 MOV EAX,DWORD PTR DS:[4E410C]
004D9393 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D9395 |. E8 C286FBFF CALL CDSnapsh.00491A5C
004D939A |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004D939D |. E8 22B4F2FF CALL CDSnapsh.004047C4
004D93A2 |. 50 PUSH EAX
004D93A3 |. 68 68954D00 PUSH CDSnapsh.004D9568 ; 注册码错误!
004D93A8 |. 8BC3 MOV EAX,EBX
004D93AA |. E8 D9F4F9FF CALL CDSnapsh.00478888
004D93AF |. 50 PUSH EAX ; |hOwner
004D93B0 |. E8 7BE0F2FF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
004D93B5 |. 8B83 70030000 MOV EAX,DWORD PTR DS:[EBX+370]
004D93BB |. 8B10 MOV EDX,DWORD PTR DS:[EAX]
004D93BD |. FF92 C4000000 CALL DWORD PTR DS:[EDX+C4]
004D93C3 |. E9 4A010000 JMP CDSnapsh.004D9512
004D93C8 |> 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
004D93CB |. 8B83 70030000 MOV EAX,DWORD PTR DS:[EBX+370]
004D93D1 |. E8 568BF9FF CALL CDSnapsh.00471F2C
004D93D6 |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C] ; 假码入EDX
004D93D9 |. A1 B83F4E00 MOV EAX,DWORD PTR DS:[4E3FB8]
004D93DE |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D93E0 |. E8 D3520000 CALL CDSnapsh.004DE6B8 ; 关键call
004D93E5 |. 84C0 TEST AL,AL ; 这里可以标志位爆破了,呵呵
004D93E7 |. 0F84 EB000000 JE CDSnapsh.004D94D8 相等就跳到错误处
004D93ED |. A1 B83F4E00 MOV EAX,DWORD PTR DS:[4E3FB8]
004D93F2 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D93F4 |. 8B80 4C030000 MOV EAX,DWORD PTR DS:[EAX+34C]
004D93FA |. E8 F19BFEFF CALL CDSnapsh.004C2FF0
004D93FF |. A1 B83F4E00 MOV EAX,DWORD PTR DS:[4E3FB8]
004D9404 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D9406 |. 8B80 4C030000 MOV EAX,DWORD PTR DS:[EAX+34C]
004D940C |. E8 8FE2FFFF CALL CDSnapsh.004D76A0
004D9411 |. 8B10 MOV EDX,DWORD PTR DS:[EAX]
004D9413 |. FF52 44 CALL DWORD PTR DS:[EDX+44]
004D9416 |. 68 80954D00 PUSH CDSnapsh.004D9580 ; insert into config(regcode) values('
004D941B |. 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
004D941E |. 8B83 70030000 MOV EAX,DWORD PTR DS:[EBX+370]
004D9424 |. E8 038BF9FF CALL CDSnapsh.00471F2C
004D9429 |. FF75 EC PUSH DWORD PTR SS:[EBP-14]
004D942C |. 68 B0954D00 PUSH CDSnapsh.004D95B0 ; ')
004D9431 |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
004D9434 |. BA 03000000 MOV EDX,3
004D9439 |. E8 46B2F2FF CALL CDSnapsh.00404684
004D943E |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
004D9441 |. 50 PUSH EAX
004D9442 |. A1 B83F4E00 MOV EAX,DWORD PTR DS:[4E3FB8]
004D9447 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D9449 |. 8B80 4C030000 MOV EAX,DWORD PTR DS:[EAX+34C]
004D944F |. E8 4CE2FFFF CALL CDSnapsh.004D76A0
004D9454 |. 5A POP EDX
004D9455 |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
004D9457 |. FF51 38 CALL DWORD PTR DS:[ECX+38]
004D945A |. A1 B83F4E00 MOV EAX,DWORD PTR DS:[4E3FB8]
004D945F |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D9461 |. 8B80 4C030000 MOV EAX,DWORD PTR DS:[EAX+34C]
004D9467 |. E8 5CE1FFFF CALL CDSnapsh.004D75C8
004D946C |. 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
004D946F |. 8B83 70030000 MOV EAX,DWORD PTR DS:[EBX+370]
004D9475 |. E8 B28AF9FF CALL CDSnapsh.00471F2C
004D947A |. 8B55 E8 MOV EDX,DWORD PTR SS:[EBP-18]
004D947D |. A1 9C3D4E00 MOV EAX,DWORD PTR DS:[4E3D9C]
004D9482 |. E8 D1AEF2FF CALL CDSnapsh.00404358
004D9487 |. 6A 40 PUSH 40
004D9489 |. 8D55 E4 LEA EDX,DWORD PTR SS:[EBP-1C]
004D948C |. A1 0C414E00 MOV EAX,DWORD PTR DS:[4E410C]
004D9491 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D9493 |. E8 C485FBFF CALL CDSnapsh.00491A5C
004D9498 |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
004D949B |. E8 24B3F2FF CALL CDSnapsh.004047C4
004D94A0 |. 50 PUSH EAX
004D94A1 |. 68 B4954D00 PUSH CDSnapsh.004D95B4 ; 注册成功!
004D94A6 |. 8BC3 MOV EAX,EBX
004D94A8 |. E8 DBF3F9FF CALL CDSnapsh.00478888
004D94AD |. 50 PUSH EAX ; |hOwner
004D94AE |. E8 7DDFF2FF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
004D94B3 |. A1 A8424E00 MOV EAX,DWORD PTR DS:[4E42A8]
004D94B8 |. C600 01 MOV BYTE PTR DS:[EAX],1
004D94BB |. A1 B83F4E00 MOV EAX,DWORD PTR DS:[4E3FB8]
004D94C0 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D94C2 |. 8B80 94030000 MOV EAX,DWORD PTR DS:[EAX+394]
004D94C8 |. 33D2 XOR EDX,EDX
004D94CA |. E8 7D89F9FF CALL CDSnapsh.00471E4C
004D94CF |. 8BC3 MOV EAX,EBX
004D94D1 |. E8 BA52FBFF CALL CDSnapsh.0048E790
004D94D6 |. EB 3A JMP SHORT CDSnapsh.004D9512
004D94D8 |> 6A 10 PUSH 10
004D94DA |. 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
004D94DD |. A1 0C414E00 MOV EAX,DWORD PTR DS:[4E410C]
004D94E2 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004D94E4 |. E8 7385FBFF CALL CDSnapsh.00491A5C
004D94E9 |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
004D94EC |. E8 D3B2F2FF CALL CDSnapsh.004047C4
004D94F1 |. 50 PUSH EAX
004D94F2 |. 68 68954D00 PUSH CDSnapsh.004D9568 ; 注册码错误!
004D94F7 |. 8BC3 MOV EAX,EBX
004D94F9 |. E8 8AF3F9FF CALL CDSnapsh.00478888
004D94FE |. 50 PUSH EAX ; |hOwner
004D94FF |. E8 2CDFF2FF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
004D9504 |. 8B83 70030000 MOV EAX,DWORD PTR DS:[EBX+370]
004D950A |. 8B10 MOV EDX,DWORD PTR DS:[EAX]
004D950C |. FF92 C4000000 CALL DWORD PTR DS:[EDX+C4]
004D9512 |> 33C0 XOR EAX,EAX
004D9514 |. 5A POP EDX
004D9515 |. 59 POP ECX
004D9516 |. 59 POP ECX
004D9517 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
004D951A |. 68 61954D00 PUSH CDSnapsh.004D9561
004D951F |> 8D45 E0 LEA EAX,DWORD PTR SS:[EBP-20]
004D9522 |. BA 02000000 MOV EDX,2
004D9527 |. E8 FCADF2FF CALL CDSnapsh.00404328
004D952C |. 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
004D952F |. BA 02000000 MOV EDX,2
004D9534 |. E8 EFADF2FF CALL CDSnapsh.00404328
004D9539 |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
004D953C |. E8 C3ADF2FF CALL CDSnapsh.00404304
004D9541 |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
004D9544 |. E8 BBADF2FF CALL CDSnapsh.00404304
004D9549 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
004D954C |. E8 B3ADF2FF CALL CDSnapsh.00404304
004D9551 |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
004D9554 |. E8 ABADF2FF CALL CDSnapsh.00404304
004D9559 \. C3 RETN
004D93E0 |. E8 D3520000 CALL CDSnapsh.004DE6B8 ; 关键call跟进后修改为:
MOV EAX,1
RETN
后面的不用管了,重新运行程序,注册成功!
------------------------------------------------------------------------
很简单的爆破,不足之处欢迎各位高手指点。
------------------------------------------------------------------------
【版权声明】本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)