-
-
[原创]某国产文件夹加密软件(说明仅技术交流,省去不少关键东西)
-
发表于: 2007-5-24 17:39 6880
-
【软件名称】某国产文件夹加密软件(说明仅技术交流,省去不少关键东西)
【应用平台】Win2000
【作者邮箱】chubing6143@sina.com
【使用工具】 peid, OllyDbg1.10
【软件限制】序列号
【破解工具】OllyDbg v1.10
【软件简介】该软件(为了保护某些因素,代码中都以***出现)的文件加密软件,文件夹加密软件。该软件有超快和最强的文件加密、文件夹加密功能，采用先进的加密算法，使你的文件加密和文件夹加密后，真正的达到超高的加密强度，让你的加密文件和加密文件夹无懈可击，没有密码无法解密并且能够防止被删除。其中有一条很诱人的:使用“移动加密”方式加密的文件夹和文件可以移动到其他电脑上，甚至移动到未安装本软件的电脑上照常使用。
【破解过程】
利用PEID发现该程序是ASProtect 2.1x SKE -> Alexey Solodovnikov加密的,利用Volx提供的Aspr2.XX_unpacker_v1.0SC.osc脚本脱壳,然后利用ImprtRec修复IAT,OEP为0x6ABD7,脱壳完成.
首先利用对Kernel32.dll中的CreateFileA函数下断点,可以知道注册码存放在Key.dat中,利用C32ASM可以定位程序的注册信息保存部分：
0040DEB0 . 6A FF push -1
0040DEB2 . 68 B3CD4600 push de_***_.0046CDB3 ; SE handler installation
0040DEB7 . 64:A1 00000000 mov eax,dword ptr fs:[0]
0040DEBD . 50 push eax
0040DEBE . 64:8925 0000000>mov dword ptr fs:[0],esp
0040DEC5 . 81EC 38020000 sub esp,238
0040DECB . 53 push ebx
0040DECC . 56 push esi
0040DECD . 8BF1 mov esi,ecx
0040DECF . 57 push edi
0040DED0 . 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040DED4 . FF15 58274700 call dword ptr ds:[<&mfc80u.#293>] ; mfc80u.783997F3
0040DEDA . 33FF xor edi,edi
0040DEDC . 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0040DEE0 . 89BC24 4C020000 mov dword ptr ss:[esp+24C],edi
0040DEE7 . FF15 58274700 call dword ptr ds:[<&mfc80u.#293>] ; mfc80u.783997F3
0040DEED . 8D4424 10 lea eax,dword ptr ss:[esp+10]
0040DEF1 . 50 push eax
0040DEF2 . 8D8E F8010000 lea ecx,dword ptr ds:[esi+1F8]
0040DEF8 . C68424 50020000>mov byte ptr ss:[esp+250],1
0040DF00 . E8 F3C60500 call <jmp.&mfc80u.#3756>
0040DF05 . 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040DF09 . 8D9E A4010000 lea ebx,dword ptr ds:[esi+1A4]
0040DF0F . 51 push ecx
0040DF10 . 8BCB mov ecx,ebx
0040DF12 . E8 E1C60500 call <jmp.&mfc80u.#3756>
0040DF17 . 68 00010000 push 100 ; /n = 100 (256.)
0040DF1C . 8D5424 2A lea edx,dword ptr ss:[esp+2A] ; |
0040DF20 . 57 push edi ; |c
0040DF21 . 52 push edx ; |s
0040DF22 . 66:897C24 30 mov word ptr ss:[esp+30],di ; |
0040DF27 . E8 16CD0500 call <jmp.&msvcr80.memset> ; \memset
0040DF2C . 83C4 0C add esp,0C
0040DF2F . 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040DF33 . FF15 5C274700 call dword ptr ds:[<&mfc80u.#2895>] ; mfc80u.78305457
0040DF39 . 85C0 test eax,eax
0040DF3B . 7E 41 jle short de_***_.0040DF7E
0040DF3D . 55 push ebp
0040DF3E . 8D6C24 28 lea ebp,dword ptr ss:[esp+28]
0040DF42 > 57 push edi
0040DF43 . 8D4C24 14 lea ecx,dword ptr ss:[esp+14]
0040DF47 . FF15 94234700 call dword ptr ds:[<&mfc80u.#860>] ; mfc80u.783053F6
0040DF4D . 0FB7C0 movzx eax,ax
0040DF50 . 66:3D 4100 cmp ax,41
0040DF54 . 72 06 jb short de_***_.0040DF5C
0040DF56 . 66:3D 5A00 cmp ax,5A
0040DF5A . 76 09 jbe short de_***_.0040DF65
0040DF5C > 8D48 D0 lea ecx,dword ptr ds:[eax-30] ; 如果注册码是数字的话
0040DF5F . 66:83F9 09 cmp cx,9
0040DF63 . 77 07 ja short de_***_.0040DF6C
0040DF65 > 66:8945 00 mov word ptr ss:[ebp],ax
0040DF69 . 83C5 02 add ebp,2
0040DF6C > 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0040DF70 . 83C7 01 add edi,1
0040DF73 . FF15 5C274700 call dword ptr ds:[<&mfc80u.#2895>] ; 注册码的长度
0040DF79 . 3BF8 cmp edi,eax
0040DF7B .^ 7C C5 jl short de_***_.0040DF42 ; 将注册码转变为UNICODE类型的
0040DF7D . 5D pop ebp
0040DF7E > 8D5424 24 lea edx,dword ptr ss:[esp+24] ; UNICODE的注册码
0040DF82 . 52 push edx
0040DF83 . 8D4424 10 lea eax,dword ptr ss:[esp+10]
0040DF87 . 68 20304700 push de_***_.00473020 ; UNICODE "%s"
0040DF8C . 50 push eax
0040DF8D . FF15 60274700 call dword ptr ds:[<&mfc80u.#2311>] ; mfc80u.78306E74
0040DF93 . 83C4 0C add esp,0C
0040DF96 . 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040DF9A . FF15 F8264700 call dword ptr ds:[<&mfc80u.#6167>] ; mfc80u.783063CC
0040DFA0 . 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040DFA4 . FF15 FC264700 call dword ptr ds:[<&mfc80u.#6173>] ; mfc80u.78306382
0040DFAA . 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040DFAE . FF15 5C274700 call dword ptr ds:[<&mfc80u.#2895>] ; mfc80u.78305457
0040DFB4 . 3D 80000000 cmp eax,80 ; 注册码长度与0x80比较
0040DFB9 . 0F8F C8000000 jg de_***_.0040E087
0040DFBF . 8D4C24 14 lea ecx,dword ptr ss:[esp+14]
0040DFC3 . E8 9EC40500 call <jmp.&mfc80u.#384>
0040DFC8 . 6A 00 push 0
0040DFCA . 68 01100000 push 1001
0040DFCF . 68 F8644700 push de_***_.004764F8 ; UNICODE "Key.dat"
0040DFD4 . 8D4C24 20 lea ecx,dword ptr ss:[esp+20]
0040DFD8 . C68424 58020000>mov byte ptr ss:[esp+258],2
0040DFE0 . E8 7BC40500 call <jmp.&mfc80u.#5083>
0040DFE5 . 85C0 test eax,eax
0040DFE7 . 75 1F jnz short de_***_.0040E008
0040DFE9 . 8B4E 20 mov ecx,dword ptr ds:[esi+20]
0040DFEC . 51 push ecx
0040DFED . 68 D5000000 push 0D5 ; 保存注册信息失败
0040DFF2 . E8 E9200000 call de_***_.004100E0
0040DFF7 . 8B16 mov edx,dword ptr ds:[esi]
0040DFF9 . 8B82 58010000 mov eax,dword ptr ds:[edx+158]
0040DFFF . 83C4 08 add esp,8
0040E002 . 8BCE mov ecx,esi
0040E004 . FFD0 call eax
0040E006 . EB 60 jmp short de_***_.0040E068
0040E008 > 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0040E00C . FF15 74274700 call dword ptr ds:[<&mfc80u.#870>] ; mfc80u.7839327F
0040E012 . 8B3D D4224700 mov edi,dword ptr ds:[<&kernel32.ls>; KERNEL32.lstrcpyW
0040E018 . 50 push eax ; /机器码
0040E019 . 8D8C24 2C010000 lea ecx,dword ptr ss:[esp+12C] ; |
0040E020 . 51 push ecx ; |String1
0040E021 . FFD7 call edi ; \lstrcpyW
0040E023 . 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040E027 . FF15 74274700 call dword ptr ds:[<&mfc80u.#870>] ; mfc80u.7839327F
0040E02D . 50 push eax
0040E02E . 8D9424 46010000 lea edx,dword ptr ss:[esp+146]
0040E035 . 52 push edx
0040E036 . FFD7 call edi
0040E038 . 68 1C010000 push 11C
0040E03D . 8D8424 2C010000 lea eax,dword ptr ss:[esp+12C]
0040E044 . 50 push eax ; 机器码
0040E045 . 8D4C24 1C lea ecx,dword ptr ss:[esp+1C]
0040E049 . E8 32C50500 call <jmp.&mfc80u.#6284>
0040E04E . 8D4C24 14 lea ecx,dword ptr ss:[esp+14]
0040E052 . E8 03C40500 call <jmp.&mfc80u.#1430>
0040E057 . 8B4E 20 mov ecx,dword ptr ds:[esi+20]
0040E05A . 51 push ecx
0040E05B . 68 D6000000 push 0D6 ; 重新启动程序后将判断注册信息是否正确
0040E060 . E8 7B200000 call de_***_.004100E0
0040E065 . 83C4 08 add esp,8
0040E068 > 8D4C24 14 lea ecx,dword ptr ss:[esp+14]
0040E06C . C68424 4C020000>mov byte ptr ss:[esp+24C],1
0040E074 . E8 DBC30500 call <jmp.&mfc80u.#629>
0040E079 . 8B16 mov edx,dword ptr ds:[esi]
0040E07B . 8B82 58010000 mov eax,dword ptr ds:[edx+158]
0040E081 . 8BCE mov ecx,esi
0040E083 . FFD0 call eax
0040E085 . EB 18 jmp short de_***_.0040E09F
0040E087 > 8B4E 20 mov ecx,dword ptr ds:[esi+20]
0040E08A . 51 push ecx
0040E08B . 68 D7000000 push 0D7
0040E090 . E8 4B200000 call de_***_.004100E0
0040E095 . 83C4 08 add esp,8
0040E098 . 8BCB mov ecx,ebx
0040E09A . E8 49C30500 call <jmp.&mfc80u.#5829>
0040E09F > 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0040E0A3 . FF15 6C274700 call dword ptr ds:[<&mfc80u.#575>] ; mfc80u.7834DD87
0040E0A9 . 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040E0AD . FF15 6C274700 call dword ptr ds:[<&mfc80u.#575>] ; mfc80u.7834DD87
0040E0B3 . 8B8C24 44020000 mov ecx,dword ptr ss:[esp+244]
0040E0BA . 5F pop edi
0040E0BB . 5E pop esi
0040E0BC . 5B pop ebx
0040E0BD . 64:890D 0000000>mov dword ptr fs:[0],ecx
0040E0C4 . 81C4 44020000 add esp,244
0040E0CA . C3 retn
然后利用搜索字符串"Key.dat"可以定位到重启验证的检查部分如下:
0041A9E0 > /55 push ebp
0041A9E1 . |8BEC mov ebp,esp
0041A9E3 . |6A FF push -1
0041A9E5 . |68 34E04600 push de_***_.0046E034 ; SE handler installation
0041A9EA . |64:A1 00000000 mov eax,dword ptr fs:[0]
0041A9F0 . |50 push eax
0041A9F1 . |64:8925 0000000>mov dword ptr fs:[0],esp
0041A9F8 . |81EC 30010000 sub esp,130
0041A9FE . |53 push ebx
0041A9FF . |57 push edi
0041AA00 . |70 03 jo short de_***_.0041AA05
0041AA02 . |71 01 jno short de_***_.0041AA05
0041AA04 |E8 db E8
0041AA05 > |8B7D 08 mov edi,dword ptr ss:[ebp+8]
0041AA08 . |C707 17000000 mov dword ptr ds:[edi],17
0041AA0E . |7C 03 jl short de_***_.0041AA13
0041AA10 > |EB 03 jmp short de_***_.0041AA15
0041AA12 |E9 db E9
0041AA13 >^|74 FB je short de_***_.0041AA10
0041AA15 > |8D4D F0 lea ecx,dword ptr ss:[ebp-10]
0041AA18 . |FF15 58274700 call dword ptr ds:[<&mfc80u.#293>] ; mfc80u.783997F3
0041AA1E . |33DB xor ebx,ebx
0041AA20 . |68 F4000000 push 0F4 ; Key.dat
0041AA25 . |8D4D F0 lea ecx,dword ptr ss:[ebp-10]
0041AA28 . |895D FC mov dword ptr ss:[ebp-4],ebx
0041AA2B . |FF15 78274700 call dword ptr ds:[<&mfc80u.#4026>] ; mfc80u.783068D6
0041AA31 . |8D45 F0 lea eax,dword ptr ss:[ebp-10]
0041AA34 . |50 push eax
0041AA35 . |E8 3A5D0000 call <jmp.&interfacedll.checkFileCun>
0041AA3A . |83C4 04 add esp,4
0041AA3D . |85C0 test eax,eax
0041AA3F . |75 22 jnz short de_***_.0041AA63
0041AA41 . |7C 03 jl short de_***_.0041AA46
0041AA43 > |EB 03 jmp short de_***_.0041AA48
0041AA45 |E9 db E9
0041AA46 >^|74 FB je short de_***_.0041AA43
0041AA48 > |8D4D F0 lea ecx,dword ptr ss:[ebp-10]
0041AA4B . |FF15 6C274700 call dword ptr ds:[<&mfc80u.#575>] ; mfc80u.7834DD87
0041AA51 . |5F pop edi
0041AA52 . |32C0 xor al,al
0041AA54 . |5B pop ebx
0041AA55 . |8B4D F4 mov ecx,dword ptr ss:[ebp-C]
0041AA58 . |64:890D 0000000>mov dword ptr fs:[0],ecx
0041AA5F . |8BE5 mov esp,ebp
0041AA61 . |5D pop ebp
0041AA62 . |C3 retn
0041AA63 > |56 push esi
0041AA64 . |7C 03 jl short de_***_.0041AA69
0041AA66 > |EB 03 jmp short de_***_.0041AA6B
0041AA68 |E9 db E9
0041AA69 >^|74 FB je short de_***_.0041AA66
0041AA6B > |8D8D C4FEFFFF lea ecx,dword ptr ss:[ebp-13C]
0041AA71 . |E8 EC5C0000 call <jmp.&crtool.CCRTools::CCRTools>
0041AA76 . |C645 FC 01 mov byte ptr ss:[ebp-4],1
0041AA7A . |70 03 jo short de_***_.0041AA7F
0041AA7C . |71 01 jno short de_***_.0041AA7F
0041AA7E |E8 db E8
0041AA7F > |6A 45 push 45
0041AA81 . |6A 53 push 53
0041AA83 . |8D8D C4FEFFFF lea ecx,dword ptr ss:[ebp-13C]
0041AA89 . |E8 E05C0000 call <jmp.&crtool.CCRTools::Init>
0041AA8E . |8BF0 mov esi,eax
0041AA90 . |7E 03 jle short de_***_.0041AA95
0041AA92 . |7F 01 jg short de_***_.0041AA95
0041AA94 |E8 db E8
0041AA95 > |83FE 21 cmp esi,21
0041AA98 . |75 0A jnz short de_***_.0041AAA4
0041AA9A . |70 03 jo short de_***_.0041AA9F
0041AA9C . |71 01 jno short de_***_.0041AA9F
0041AA9E |E8 db E8
0041AA9F . |E9 8D000000 jmp de_***_.0041AB31
0041AAA4 . |70 03 jo short de_***_.0041AAA9
0041AAA6 . |71 01 jno short de_***_.0041AAA9
0041AAA8 |E8 db E8
0041AAA9 > |83FE 2C cmp esi,2C
0041AAAC . |75 09 jnz short de_***_.0041AAB7
0041AAAE . |7C 03 jl short de_***_.0041AAB3
0041AAB0 > |EB 03 jmp short de_***_.0041AAB5
0041AAB2 |E9 db E9
0041AAB3 >^|74 FB je short de_***_.0041AAB0
0041AAB5 > |EB 7A jmp short de_***_.0041AB31
0041AAB7 > |895D EC mov dword ptr ss:[ebp-14],ebx
0041AABA . |7C 03 jl short de_***_.0041AABF
0041AABC > |EB 03 jmp short de_***_.0041AAC1
0041AABE |E9 db E9
0041AABF >^|74 FB je short de_***_.0041AABC
0041AAC1 > |8D4D EC lea ecx,dword ptr ss:[ebp-14]
0041AAC4 . |51 push ecx
0041AAC5 . |8D8D C4FEFFFF lea ecx,dword ptr ss:[ebp-13C] ; 机器码
0041AACB . |E8 985C0000 call <jmp.&crtool.CCRTools::IsOkUse> ; 关键函数判断
0041AAD0 . |84C0 test al,al
0041AAD2 . |74 56 je short de_***_.0041AB2A
0041AAD4 . |8B45 EC mov eax,dword ptr ss:[ebp-14]
0041AAD7 . |8D50 A8 lea edx,dword ptr ds:[eax-58]
0041AADA . |85D2 test edx,edx
0041AADC . |75 0E jnz short de_***_.0041AAEC
0041AADE . |83FE 4D cmp esi,4D
0041AAE1 . |75 09 jnz short de_***_.0041AAEC
0041AAE3 . |7C 03 jl short de_***_.0041AAE8
0041AAE5 > |EB 03 jmp short de_***_.0041AAEA
0041AAE7 |E9 db E9
0041AAE8 >^|74 FB je short de_***_.0041AAE5
0041AAEA > |EB 45 jmp short de_***_.0041AB31
0041AAEC > |83C0 D4 add eax,-2C
0041AAEF . |75 09 jnz short de_***_.0041AAFA
0041AAF1 . |7C 03 jl short de_***_.0041AAF6
0041AAF3 > |EB 03 jmp short de_***_.0041AAF8
0041AAF5 |E9 db E9
0041AAF6 >^|74 FB je short de_***_.0041AAF3
0041AAF8 > |EB 37 jmp short de_***_.0041AB31
0041AAFA > |8D8D C4FEFFFF lea ecx,dword ptr ss:[ebp-13C]
0041AB00 . |C707 58000000 mov dword ptr ds:[edi],58
0041AB06 . |885D FC mov byte ptr ss:[ebp-4],bl
0041AB09 . |E8 485C0000 call <jmp.&crtool.CCRTools::~CCRTools>
0041AB0E . |8D4D F0 lea ecx,dword ptr ss:[ebp-10]
0041AB11 . |FF15 6C274700 call dword ptr ds:[<&mfc80u.#575>] ; mfc80u.7834DD87
0041AB17 . |5E pop esi
0041AB18 . |5F pop edi
0041AB19 . |B0 01 mov al,1
0041AB1B . |5B pop ebx
0041AB1C . |8B4D F4 mov ecx,dword ptr ss:[ebp-C]
0041AB1F . |64:890D 0000000>mov dword ptr fs:[0],ecx
0041AB26 . |8BE5 mov esp,ebp
0041AB28 . |5D pop ebp
0041AB29 . |C3 retn
0041AB2A > |7C 03 jl short de_***_.0041AB2F
0041AB2C > |EB 03 jmp short de_***_.0041AB31
0041AB2E |E9 db E9
0041AB2F >^|74 FB je short de_***_.0041AB2C
0041AB31 > |8D8D C4FEFFFF lea ecx,dword ptr ss:[ebp-13C]
0041AB37 . |885D FC mov byte ptr ss:[ebp-4],bl
0041AB3A . |E8 175C0000 call <jmp.&crtool.CCRTools::~CCRTools>
0041AB3F . |8D4D F0 lea ecx,dword ptr ss:[ebp-10]
0041AB42 . |FF15 6C274700 call dword ptr ds:[<&mfc80u.#575>] ; mfc80u.7834DD87
0041AB48 . |8B4D F4 mov ecx,dword ptr ss:[ebp-C]
0041AB4B . |5E pop esi
0041AB4C . |5F pop edi
0041AB4D . |32C0 xor al,al
0041AB4F . |5B pop ebx
0041AB50 . |64:890D 0000000>mov dword ptr fs:[0],ecx
0041AB57 . |8BE5 mov esp,ebp
0041AB59 . |5D pop ebp
0041AB5A . |C3 retn
其中0041AACB . |E8 985C0000 call <jmp.&crtool.CCRTools::IsOkUse> ; 关键函数判断部分分析如下：
10003F20 52 push edx ; 注册码
10003F21 51 push ecx ; 机器码
10003F22 E8 B9F8FFFF call crtool.CCRTools::ffoot ; 关键函数
其中10003F22 E8 B9F8FFFF call crtool.CCRTools::ffoot ; 关键函数如下：
100037E0 crtool.CCRTools::ffoo> 55 push ebp
100037E1 8DAC24 74FDFFFF lea ebp,dword ptr ss:[esp-28C]
100037E8 81EC 0C030000 sub esp,30C
100037EE A1 1C000210 mov eax,dword ptr ds:[1002001C]
100037F3 33C5 xor eax,ebp
100037F5 8985 88020000 mov dword ptr ss:[ebp+288],eax
100037FB 53 push ebx
100037FC 56 push esi
100037FD 8BB5 94020000 mov esi,dword ptr ss:[ebp+294] ; 机器码
10003803 57 push edi
10003804 8BBD 98020000 mov edi,dword ptr ss:[ebp+298] ; 注册码
1000380A 68 D8020000 push 2D8
1000380F 6A 01 push 1
10003811 FF15 78D10110 call dword ptr ds:[1001D178] ; MSVCR80.calloc
10003817 A3 F00C0210 mov dword ptr ds:[10020CF0],eax
1000381C E8 EF5B0000 call crtool.10009410
10003821 68 FE000000 push 0FE
10003826 8BD8 mov ebx,eax
10003828 8D85 89000000 lea eax,dword ptr ss:[ebp+89]
1000382E 6A 00 push 0
10003830 50 push eax
10003831 C685 88000000 00 mov byte ptr ss:[ebp+88],0
10003838 E8 9B8D0100 call crtool.1001C5D8 ; jmp to MSVCR80.memset
1000383D 68 FE000000 push 0FE
10003842 8D8D 89010000 lea ecx,dword ptr ss:[ebp+189]
10003848 6A 00 push 0
1000384A 51 push ecx
1000384B C685 88010000 00 mov byte ptr ss:[ebp+188],0
10003852 E8 818D0100 call crtool.1001C5D8 ; jmp to MSVCR80.memset
10003857 68 FE000000 push 0FE
1000385C 8D55 89 lea edx,dword ptr ss:[ebp-77]
1000385F 6A 00 push 0
10003861 52 push edx
10003862 C645 88 00 mov byte ptr ss:[ebp-78],0
10003866 E8 6D8D0100 call crtool.1001C5D8 ; jmp to MSVCR80.memset
1000386B 83C4 2C add esp,2C
1000386E 6A 00 push 0
10003870 6A 00 push 0
10003872 68 FF000000 push 0FF
10003877 8D85 88000000 lea eax,dword ptr ss:[ebp+88]
1000387D 50 push eax
1000387E 6A FF push -1
10003880 56 push esi
10003881 8B35 08D00110 mov esi,dword ptr ds:[1001D008] ; KERNEL32.WideCharToMultiByte
10003887 6A 00 push 0
10003889 6A 00 push 0
1000388B FFD6 call esi
1000388D 6A 00 push 0
1000388F 6A 00 push 0
10003891 68 FF000000 push 0FF
10003896 8D8D 88010000 lea ecx,dword ptr ss:[ebp+188]
1000389C 51 push ecx
1000389D 6A FF push -1
1000389F 57 push edi
100038A0 6A 00 push 0
100038A2 6A 00 push 0
100038A4 FFD6 call esi
100038A6 8D85 88000000 lea eax,dword ptr ss:[ebp+88] ; ASCII码的机器码
100038AC 8D50 01 lea edx,dword ptr ds:[eax+1]
100038AF 90 nop
100038B0 8A08 mov cl,byte ptr ds:[eax]
100038B2 83C0 01 add eax,1
100038B5 84C9 test cl,cl
100038B7 ^ 75 F7 jnz short crtool.100038B0
100038B9 2BC2 sub eax,edx ; 机器码的长度
100038BB 75 0A jnz short crtool.100038C7
100038BD 7E 03 jle short crtool.100038C2
100038BF 7F 01 jg short crtool.100038C2
100038C1 E8 E9E50100 call crtool.10021EAF
100038C6 0080 BD880100 add byte ptr ds:[eax+188BD],al
100038CC 0000 add byte ptr ds:[eax],al
100038CE 74 29 je short crtool.100038F9
100038D0 8B3D 9CD10110 mov edi,dword ptr ds:[1001D19C] ; MSVCR80.isxdigit
100038D6 8DB5 88010000 lea esi,dword ptr ss:[ebp+188] ; ASCII码的注册码
100038DC 8D6424 00 lea esp,dword ptr ss:[esp]
100038E0 0FBE16 movsx edx,byte ptr ds:[esi]
100038E3 52 push edx
100038E4 FFD7 call edi
100038E6 83C4 04 add esp,4
100038E9 85C0 test eax,eax
100038EB 0F84 C5000000 je crtool.100039B6
100038F1 83C6 01 add esi,1
100038F4 803E 00 cmp byte ptr ds:[esi],0
100038F7 ^ 75 E7 jnz short crtool.100038E0
100038F9 C783 30020000 100>mov dword ptr ds:[ebx+230],10
10003903 E8 A8540000 call crtool.10008DB0
10003908 8BF0 mov esi,eax
1000390A E8 A1540000 call crtool.10008DB0
1000390F 8BD8 mov ebx,eax
10003911 E8 9A540000 call crtool.10008DB0
10003916 8BF8 mov edi,eax
10003918 897D 80 mov dword ptr ss:[ebp-80],edi
1000391B E8 90540000 call crtool.10008DB0
10003920 8945 84 mov dword ptr ss:[ebp-7C],eax
10003923 8D85 88010000 lea eax,dword ptr ss:[ebp+188]
10003929 50 push eax ; 注册码
1000392A 57 push edi
1000392B E8 F0240100 call crtool.10015E20
10003930 68 E0D50110 push crtool.1001D5E0 ; ASCII "9CF08479954EFBA3EC8EFAEDEA56B772BD4CDA02ECBBD969D13700A6096475474BC5FA07B264D82225123AF00F9FB452BC7B97D6A056CD37A54416C3D1724E21"
10003935 56 push esi
10003936 E8 E5240100 call crtool.10015E20
1000393B 68 64D60110 push crtool.1001D664 ; ASCII "1975071"
10003940 53 push ebx
10003941 E8 DA240100 call crtool.10015E20
10003946 56 push esi
10003947 57 push edi
10003948 E8 53670000 call crtool.1000A0A0
1000394D 83C4 20 add esp,20
10003950 83F8 FF cmp eax,-1
10003953 0F85 4E010000 jnz crtool.10003AA7
10003959 8B4D 84 mov ecx,dword ptr ss:[ebp-7C]
1000395C 51 push ecx
1000395D 57 push edi
1000395E 8BC6 mov eax,esi
10003960 8BCB mov ecx,ebx
10003962 E8 498E0000 call crtool.1000C7B0
10003967 8B45 84 mov eax,dword ptr ss:[ebp-7C]
1000396A 6A 00 push 0
1000396C 8D55 88 lea edx,dword ptr ss:[ebp-78]
1000396F 52 push edx ; 注册码生成的目标机器码地址
10003970 50 push eax
10003971 6A 00 push 0
10003973 E8 88E60000 call crtool.10012000 ; 注册码生成的目标机器码函数
10003978 83C4 18 add esp,18
1000397B 85F6 test esi,esi
1000397D 74 43 je short crtool.100039C2
1000397F 8B06 mov eax,dword ptr ds:[esi]
10003981 8B56 04 mov edx,dword ptr ds:[esi+4]
10003984 25 FFFFFF7F and eax,7FFFFFFF
10003989 8BC8 mov ecx,eax
1000398B C1E9 10 shr ecx,10
1000398E 25 FFFF0000 and eax,0FFFF
10003993 03C8 add ecx,eax
10003995 85C9 test ecx,ecx
10003997 7E 09 jle short crtool.100039A2
10003999 33C0 xor eax,eax
1000399B 8BFA mov edi,edx
1000399D F3:AB rep stos dword ptr es:[edi]
1000399F 8B7D 80 mov edi,dword ptr ss:[ebp-80]
100039A2 C706 00000000 mov dword ptr ds:[esi],0
100039A8 56 push esi
100039A9 8B35 7CD10110 mov esi,dword ptr ds:[1001D17C] ; MSVCR80.free
100039AF FFD6 call esi
100039B1 83C4 04 add esp,4
100039B4 EB 12 jmp short crtool.100039C8
100039B6 7C 03 jl short crtool.100039BB
100039B8 EB 03 jmp short crtool.100039BD
100039BA - E9 74FBE9EA jmp FAEA3533
100039BF 0000 add byte ptr ds:[eax],al
100039C1 008B 357CD101 add byte ptr ds:[ebx+1D17C35],cl
100039C7 1085 DB742F8B adc byte ptr ss:[ebp+8B2F74DB],al
100039CD 038B 530425FF add ecx,dword ptr ds:[ebx+FF250453]
100039D3 FFFF ??? ; 未知命令
100039D5 ^ 7F 8B jg short crtool.10003962
100039D7 C8 C1E910 enter 0E9C1,10
100039DB 25 FFFF0000 and eax,0FFFF
100039E0 03C8 add ecx,eax
100039E2 85C9 test ecx,ecx
100039E4 7E 09 jle short crtool.100039EF
100039E6 33C0 xor eax,eax
100039E8 8BFA mov edi,edx
100039EA F3:AB rep stos dword ptr es:[edi]
100039EC 8B7D 80 mov edi,dword ptr ss:[ebp-80]
100039EF 53 push ebx
100039F0 C703 00000000 mov dword ptr ds:[ebx],0
100039F6 FFD6 call esi
100039F8 83C4 04 add esp,4
100039FB 85FF test edi,edi
100039FD 74 2F je short crtool.10003A2E
100039FF 8B07 mov eax,dword ptr ds:[edi]
10003A01 8B57 04 mov edx,dword ptr ds:[edi+4]
10003A04 25 FFFFFF7F and eax,7FFFFFFF
10003A09 8BC8 mov ecx,eax
10003A0B C1E9 10 shr ecx,10
10003A0E 25 FFFF0000 and eax,0FFFF
10003A13 03C8 add ecx,eax
10003A15 85C9 test ecx,ecx
10003A17 7E 09 jle short crtool.10003A22
10003A19 33C0 xor eax,eax
10003A1B 8BFA mov edi,edx
10003A1D F3:AB rep stos dword ptr es:[edi]
10003A1F 8B7D 80 mov edi,dword ptr ss:[ebp-80]
10003A22 57 push edi
10003A23 C707 00000000 mov dword ptr ds:[edi],0
10003A29 FFD6 call esi
10003A2B 83C4 04 add esp,4
10003A2E 8B55 84 mov edx,dword ptr ss:[ebp-7C]
10003A31 85D2 test edx,edx
10003A33 74 2A je short crtool.10003A5F
10003A35 8B02 mov eax,dword ptr ds:[edx]
10003A37 8B7A 04 mov edi,dword ptr ds:[edx+4]
10003A3A 25 FFFFFF7F and eax,7FFFFFFF
10003A3F 8BC8 mov ecx,eax
10003A41 C1E9 10 shr ecx,10
10003A44 25 FFFF0000 and eax,0FFFF
10003A49 03C8 add ecx,eax
10003A4B 85C9 test ecx,ecx
10003A4D 7E 04 jle short crtool.10003A53
10003A4F 33C0 xor eax,eax
10003A51 F3:AB rep stos dword ptr es:[edi]
10003A53 52 push edx
10003A54 C702 00000000 mov dword ptr ds:[edx],0
10003A5A FFD6 call esi
10003A5C 83C4 04 add esp,4
10003A5F E8 BC5F0000 call crtool.10009A20
10003A64 8D55 88 lea edx,dword ptr ss:[ebp-78]
10003A67 8D8D 88000000 lea ecx,dword ptr ss:[ebp+88]
10003A6D 8D49 00 lea ecx,dword ptr ds:[ecx]
10003A70 8A01 mov al,byte ptr ds:[ecx]
10003A72 3A02 cmp al,byte ptr ds:[edx] ; 机器码与注册码运算得到的注册码比较1
10003A74 75 1A jnz short crtool.10003A90 ; 关键跳转1
10003A76 84C0 test al,al
10003A78 74 12 je short crtool.10003A8C
10003A7A 8A41 01 mov al,byte ptr ds:[ecx+1]
10003A7D 3A42 01 cmp al,byte ptr ds:[edx+1] ; 机器码与注册码运算得到的注册码比较2
10003A80 75 0E jnz short crtool.10003A90 ; 关键跳转2
10003A82 83C1 02 add ecx,2
10003A85 83C2 02 add edx,2
10003A88 84C0 test al,al
10003A8A ^ 75 E4 jnz short crtool.10003A70
10003A8C 33C0 xor eax,eax
10003A8E EB 05 jmp short crtool.10003A95
10003A90 1BC0 sbb eax,eax
10003A92 83D8 FF sbb eax,-1
10003A95 85C0 test eax,eax
10003A97 74 07 je short crtool.10003AA0
10003A99 70 03 jo short crtool.10003A9E
10003A9B 71 01 jno short crtool.10003A9E
10003A9D E8 EB0CB858 call 68B8478D
10003AA2 0000 add byte ptr ds:[eax],al
10003AA4 00EB add bl,ch
10003AA6 0A7E 03 or bh,byte ptr ds:[esi+3]
10003AA9 7F 01 jg short crtool.10003AAC
10003AAB E8 B82C0000 call crtool.10006768
10003AB0 008B 8D880200 add byte ptr ds:[ebx+2888D],cl
10003AB6 005F 5E add byte ptr ds:[edi+5E],bl
10003AB9 33CD xor ecx,ebp
10003ABB 5B pop ebx
10003ABC E8 1A800100 call crtool.1001BADB
10003AC1 81C5 8C020000 add ebp,28C
10003AC7 8BE5 mov esp,ebp
10003AC9 5D pop ebp
10003ACA C2 0800 retn 8
刚开始我想的是在*******.dll中爆破,这样就需要修改上面的两处关键跳转为NOP即可,但是程序显然有个自校验,而且比较麻烦,为了避开它,我选择将下面爆破:
将0041AAD0 . |84C0 test al,al
0041AAD2 . |74 56 je short de_***_.0041AB2A
0041AAD4 . |8B45 EC mov eax,dword ptr ss:[ebp-14]
代码修改为:
mov eax,0x**(国产软件，不说了）
nop
nop
这样运行程序显示是注册版,但解密有问题.显示"文件系统异常",下面是分析,但是爆破不成功:
0040EC16 8D4C24 0C lea ecx,dword ptr ss:[esp+>
0040EC1A FF15 58274700 call dword ptr ds:[472758] ; mfc80u.783997F3
0040EC20 33DB xor ebx,ebx
0040EC22 68 A3000000 push 0A3
0040EC27 8D4C24 10 lea ecx,dword ptr ss:[esp+>
0040EC2B 899C24 F8040000 mov dword ptr ss:[esp+4F8]>
0040EC32 FF15 78274700 call dword ptr ds:[472778] ; mfc80u.783068D6
0040EC38 8D4C24 10 lea ecx,dword ptr ss:[esp+>
0040EC3C FF15 58274700 call dword ptr ds:[472758] ; mfc80u.783997F3
0040EC42 68 A4000000 push 0A4
0040EC47 8D4C24 14 lea ecx,dword ptr ss:[esp+>
0040EC4B C68424 F8040000 0>mov byte ptr ss:[esp+4F8],>
0040EC53 FF15 78274700 call dword ptr ds:[472778] ; mfc80u.783068D6
0040EC59 68 D8040000 push 4D8
0040EC5E 8D4C24 18 lea ecx,dword ptr ss:[esp+>
0040EC62 53 push ebx
0040EC63 51 push ecx
0040EC64 E8 D9BF0500 call ***.0046AC42 ; jmp to MSVCR80.memset
0040EC69 83C4 0C add esp,0C
0040EC6C 399E 80000000 cmp dword ptr ds:[esi+80],>
0040EC72 8BCF mov ecx,edi
0040EC74 0F95C2 setne dl
0040EC77 885424 20 mov byte ptr ss:[esp+20],d>
0040EC7B 885C24 21 mov byte ptr ss:[esp+21],b>
0040EC7F FF15 74274700 call dword ptr ds:[472774] ; mfc80u.7839327F
0040EC85 8B3D D4224700 mov edi,dword ptr ds:[4722>; kernel32.lstrcpyW
0040EC8B 50 push eax ; 密码
0040EC8C 8D8424 26040000 lea eax,dword ptr ss:[esp+>
0040EC93 50 push eax
0040EC94 FFD7 call edi
0040EC96 8D4E 74 lea ecx,dword ptr ds:[esi+>
0040EC99 FF15 74274700 call dword ptr ds:[472774] ; mfc80u.7839327F
0040EC9F 50 push eax ; 文件路径
0040ECA0 8D4C24 26 lea ecx,dword ptr ss:[esp+>
0040ECA4 51 push ecx
0040ECA5 FFD7 call edi
0040ECA7 8D4E 78 lea ecx,dword ptr ds:[esi+>
0040ECAA FF15 74274700 call dword ptr ds:[472774] ; mfc80u.7839327F
0040ECB0 50 push eax ; 解密后的文件路径
0040ECB1 8D9424 26020000 lea edx,dword ptr ss:[esp+>
0040ECB8 52 push edx
0040ECB9 FFD7 call edi
0040ECBB 399E 84000000 cmp dword ptr ds:[esi+84],>
0040ECC1 74 4E je short ***.0040ED11
0040ECC3 8B46 20 mov eax,dword ptr ds:[esi+>
0040ECC6 50 push eax
0040ECC7 8D8C24 26040000 lea ecx,dword ptr ss:[esp+>
0040ECCE 51 push ecx ; 密码
0040ECCF 8D5424 2A lea edx,dword ptr ss:[esp+>
0040ECD3 52 push edx ; 文件路径
0040ECD4 E8 47F9FFFF call ***.0040E620
其中
0040ECD4 E8 47F9FFFF call ***.0040E620
函数处理:
0040E620 6A FF push -1
0040E622 68 4BCE4600 push ***.0046CE4B
0040E627 64:A1 00000000 mov eax,dword ptr fs:[0]
0040E62D 50 push eax
0040E62E 64:8925 00000000 mov dword ptr fs:[0],esp
0040E635 81EC F4010000 sub esp,1F4
0040E63B 8B8424 04020000 mov eax,dword ptr ss:[esp+204]
0040E642 68 F8664700 push ***.004766F8 ; UNICODE "rb"
0040E647 50 push eax
0040E648 8D4C24 08 lea ecx,dword ptr ss:[esp+8]
0040E64C 51 push ecx
0040E64D C74424 0C 0000000>mov dword ptr ss:[esp+C],0
0040E655 FF15 9C284700 call dword ptr ds:[47289C] ; MSVCR80._wfopen_s
0040E65B 83C4 0C add esp,0C
0040E65E 85C0 test eax,eax
0040E660 74 2D je short ***.0040E68F ; 1
0040E662 8B9424 0C020000 mov edx,dword ptr ss:[esp+20C]
0040E669 52 push edx
0040E66A 68 AE000000 push 0AE
0040E66F E8 6C1A0000 call ***.004100E0
0040E674 83C4 08 add esp,8
0040E677 83C8 FF or eax,FFFFFFFF
0040E67A 8B8C24 F4010000 mov ecx,dword ptr ss:[esp+1F4]
0040E681 64:890D 00000000 mov dword ptr fs:[0],ecx
0040E688 81C4 00020000 add esp,200
0040E68E C3 retn
0040E68F 68 1C010000 push 11C
0040E694 8D8424 DC000000 lea eax,dword ptr ss:[esp+DC]
0040E69B 6A 00 push 0
0040E69D 50 push eax
0040E69E E8 9FC50500 call ***.0046AC42 ; jmp to MSVCR80.memset
0040E6A3 8B4C24 0C mov ecx,dword ptr ss:[esp+C]
0040E6A7 51 push ecx
0040E6A8 6A 01 push 1
0040E6AA 8D9424 EC000000 lea edx,dword ptr ss:[esp+EC]
0040E6B1 68 1C010000 push 11C
0040E6B6 52 push edx
0040E6B7 FF15 98284700 call dword ptr ds:[472898] ; MSVCR80.fread
0040E6BD 83C4 1C add esp,1C
0040E6C0 81BC24 D8000000 1>cmp dword ptr ss:[esp+D8],11C
0040E6CB 74 38 je short ***.0040E705 ; 1
0040E6CD 8B8424 0C020000 mov eax,dword ptr ss:[esp+20C]
0040E6D4 50 push eax
0040E6D5 68 AF000000 push 0AF
0040E6DA E8 011A0000 call ***.004100E0
0040E6DF 8B4C24 08 mov ecx,dword ptr ss:[esp+8]
0040E6E3 51 push ecx
0040E6E4 FF15 94284700 call dword ptr ds:[472894] ; MSVCR80.fclose
0040E6EA 83C4 0C add esp,0C
0040E6ED 83C8 FF or eax,FFFFFFFF
0040E6F0 8B8C24 F4010000 mov ecx,dword ptr ss:[esp+1F4]
0040E6F7 64:890D 00000000 mov dword ptr fs:[0],ecx
0040E6FE 81C4 00020000 add esp,200
0040E704 C3 retn
0040E705 56 push esi
0040E706 57 push edi
0040E707 6A 63 push 63
0040E709 8D5424 11 lea edx,dword ptr ss:[esp+11]
0040E70D 6A 00 push 0
0040E70F 52 push edx
0040E710 C64424 18 00 mov byte ptr ss:[esp+18],0
0040E715 E8 28C50500 call ***.0046AC42 ; jmp to MSVCR80.memset
0040E71A 8B8C24 1C020000 mov ecx,dword ptr ss:[esp+21C]
0040E721 83C4 0C add esp,0C
0040E724 6A 00 push 0
0040E726 6A 00 push 0
0040E728 6A 64 push 64
0040E72A 8D4424 18 lea eax,dword ptr ss:[esp+18]
0040E72E 50 push eax
0040E72F 6A FF push -1
0040E731 51 push ecx
0040E732 6A 00 push 0
0040E734 6A 00 push 0
0040E736 FF15 50224700 call dword ptr ds:[472250] ; kernel32.WideCharToMultiByte
0040E73C 8D5424 0C lea edx,dword ptr ss:[esp+C]
0040E740 52 push edx
0040E741 8D4C24 74 lea ecx,dword ptr ss:[esp+74]
0040E745 E8 5641FFFF call ***.004028A0
0040E74A 8D8424 EC010000 lea eax,dword ptr ss:[esp+1EC]
0040E751 50 push eax
0040E752 8BC8 mov ecx,eax
0040E754 6A 10 push 10
0040E756 51 push ecx
0040E757 8D4C24 7C lea ecx,dword ptr ss:[esp+7C]
0040E75B C78424 10020000 0>mov dword ptr ss:[esp+210],0
0040E766 E8 2545FFFF call ***.00402C90
0040E76B BF E8664700 mov edi,***.004766E8 ; ASCII "wxbsoftSE300088"
0040E770 8DB424 EC010000 lea esi,dword ptr ss:[esp+1EC]
0040E777 B9 10000000 mov ecx,10
0040E77C 33D2 xor edx,edx
0040E77E F3:A6 repe cmps byte ptr es:[edi],byte ptr ds:[>
0040E780 5F pop edi
0040E781 5E pop esi
0040E782 74 4B je short ***.0040E7CF ; 1
0040E784 8B8424 0C020000 mov eax,dword ptr ss:[esp+20C]
0040E78B 50 push eax
0040E78C 68 A9000000 push 0A9
0040E791 E8 4A190000 call ***.004100E0
0040E796 8B4C24 08 mov ecx,dword ptr ss:[esp+8]
0040E79A 51 push ecx
0040E79B FF15 94284700 call dword ptr ds:[472894] ; MSVCR80.fclose
0040E7A1 83C4 0C add esp,0C
0040E7A4 8D4C24 68 lea ecx,dword ptr ss:[esp+68]
0040E7A8 C78424 FC010000 F>mov dword ptr ss:[esp+1FC],-1
0040E7B3 E8 F838FFFF call ***.004020B0
0040E7B8 33C0 xor eax,eax
0040E7BA 8B8C24 F4010000 mov ecx,dword ptr ss:[esp+1F4]
0040E7C1 64:890D 00000000 mov dword ptr fs:[0],ecx
0040E7C8 81C4 00020000 add esp,200
0040E7CE C3 retn
0040E7CF 8B1424 mov edx,dword ptr ss:[esp]
0040E7D2 52 push edx
0040E7D3 FF15 94284700 call dword ptr ds:[472894] ; MSVCR80.fclose
0040E7D9 83C4 04 add esp,4
0040E7DC 8D4C24 68 lea ecx,dword ptr ss:[esp+68]
0040E7E0 C78424 FC010000 F>mov dword ptr ss:[esp+1FC],-1
0040E7EB E8 C038FFFF call ***.004020B0
0040E7F0 8B8C24 F4010000 mov ecx,dword ptr ss:[esp+1F4]
0040E7F7 B8 01000000 mov eax,1
0040E7FC 64:890D 00000000 mov dword ptr fs:[0],ecx
0040E803 81C4 00020000 add esp,200
0040E809 C3 retn
其中"加密文件夹-闪电加密" 出现的"文件系统异常"的爆破如下:
0040BD50 /$ 6A FF push -1
0040BD52 |. 68 13CA4600 push de_***_1.0046CA13 ; SE handler installation
0040BD57 |. 64:A1 00000000 mov eax,dword ptr fs:[0]
0040BD5D |. 50 push eax
0040BD5E |. 64:8925 0000000>mov dword ptr fs:[0],esp
0040BD65 |. 81EC 9C020000 sub esp,29C
0040BD6B |. 56 push esi
0040BD6C |. 8BF1 mov esi,ecx
0040BD6E |. 57 push edi
0040BD6F |. 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0040BD73 |. E8 68AB0000 call de_***_1.004168E0
0040BD78 |. 56 push esi ; /Arg4
0040BD79 |. 8D46 04 lea eax,dword ptr ds:[esi+4] ; |
0040BD7C |. 50 push eax ; |Arg3
0040BD7D |. 8D7E 08 lea edi,dword ptr ds:[esi+8] ; |
0040BD80 |. 57 push edi ; |Arg2
0040BD81 |. 8D4C24 18 lea ecx,dword ptr ss:[esp+18] ; |
0040BD85 |. 51 push ecx ; |Arg1
0040BD86 |. 8D4C24 20 lea ecx,dword ptr ss:[esp+20] ; |
0040BD8A |. C78424 BC020000>mov dword ptr ss:[esp+2BC],0 ; |
0040BD95 |. E8 66AD0000 call de_***_1.00416B00 ; \de_***_1.00416B00
0040BD9A |. 833F 00 cmp dword ptr ds:[edi],0
0040BD9D |. C68424 AC020000>mov byte ptr ss:[esp+2AC],1
0040BDA5 |. 0F85 D2000000 jnz de_***_1.0040BE7D
0040BDAB |. 53 push ebx
0040BDAC |. 68 F85F4700 push de_***_1.00475FF8 ; UNICODE ".***"
0040BDB1 |. 8D5424 10 lea edx,dword ptr ss:[esp+10]
0040BDB5 |. 56 push esi
0040BDB6 |. 52 push edx
0040BDB7 |. E8 148BFFFF call de_***_1.004048D0
0040BDBC |. 83C4 0C add esp,0C
0040BDBF |. 8BC8 mov ecx,eax
0040BDC1 |. FF15 74274700 call dword ptr ds:[<&mfc80u.#870>] ; mfc80u.7839327F
0040BDC7 |. 50 push eax ; /FileName
0040BDC8 |. FF15 CC224700 call dword ptr ds:[<&kernel32.DeleteFil>; \DeleteFileW
0040BDCE |. 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040BDD2 |. FF15 6C274700 call dword ptr ds:[<&mfc80u.#575>] ; mfc80u.7834DD87
0040BDD8 |. 68 F85F4700 push de_***_1.00475FF8 ; UNICODE ".***"
0040BDDD |. 8D4424 10 lea eax,dword ptr ss:[esp+10]
0040BDE1 |. 56 push esi
0040BDE2 |. 50 push eax
0040BDE3 |. E8 E88AFFFF call de_***_1.004048D0
0040BDE8 |. 83C4 0C add esp,0C
0040BDEB |. 6A 00 push 0
0040BDED |. 8BC8 mov ecx,eax
0040BDEF |. FF15 74274700 call dword ptr ds:[<&mfc80u.#870>] ; mfc80u.7839327F
0040BDF5 |. 50 push eax
0040BDF6 |. 8D4C24 18 lea ecx,dword ptr ss:[esp+18]
0040BDFA |. FF15 74274700 call dword ptr ds:[<&mfc80u.#870>] ; mfc80u.7839327F
0040BE00 |. 50 push eax ; |ExistingFileName
0040BE01 |. FF15 68224700 call dword ptr ds:[<&kernel32.CopyFileW>; \CopyFileW
0040BE07 |. 85C0 test eax,eax
0040BE09 |. 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040BE0D |. 0F94C3 sete bl
0040BE10 |. FF15 6C274700 call dword ptr ds:[<&mfc80u.#575>] ; mfc80u.7834DD87
0040BE16 |. 84DB test bl,bl
0040BE18 |. 5B pop ebx
0040BE19 |. 74 37 je short de_***_1.0040BE52 ; 文件系统是否异常的判断关键跳转
0040BE1B |. 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040BE1F |. FF15 6C274700 call dword ptr ds:[<&mfc80u.#575>] ; mfc80u.7834DD87
0040BE25 |. 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0040BE29 |. C78424 AC020000>mov dword ptr ss:[esp+2AC],-1
0040BE34 |. E8 27AB0000 call de_***_1.00416960
0040BE39 |. 5F pop edi
0040BE3A |. 32C0 xor al,al
0040BE3C |. 5E pop esi
0040BE3D |. 8B8C24 9C020000 mov ecx,dword ptr ss:[esp+29C]
0040BE44 |. 64:890D 0000000>mov dword ptr fs:[0],ecx
0040BE4B |. 81C4 A8020000 add esp,2A8
0040BE51 |. C3 retn
0040BE52 |> 68 F85F4700 push de_***_1.00475FF8 ; UNICODE ".***"
0040BE57 |. 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040BE5B |. 56 push esi
0040BE5C |. 51 push ecx
0040BE5D |. E8 6E8AFFFF call de_***_1.004048D0
0040BE62 |. 50 push eax
0040BE63 |. C68424 BC020000>mov byte ptr ss:[esp+2BC],2
0040BE6B |. E8 C0A8FFFF call de_***_1.00406730
0040BE70 |. 83C4 10 add esp,10
0040BE73 |. 8D4C24 08 lea ecx,dword ptr ss:[esp+8]
0040BE77 |. FF15 6C274700 call dword ptr ds:[<&mfc80u.#575>] ; mfc80u.7834DD87
0040BE7D |> 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0040BE81 |. FF15 6C274700 call dword ptr ds:[<&mfc80u.#575>] ; mfc80u.7834DD87
0040BE87 |. 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0040BE8B |. C78424 AC020000>mov dword ptr ss:[esp+2AC],-1
0040BE96 |. E8 C5AA0000 call de_***_1.00416960
0040BE9B |. 8B8C24 A4020000 mov ecx,dword ptr ss:[esp+2A4]
0040BEA2 |. 5F pop edi
0040BEA3 |. B0 01 mov al,1
0040BEA5 |. 5E pop esi
0040BEA6 |. 64:890D 0000000>mov dword ptr fs:[0],ecx
0040BEAD |. 81C4 A8020000 add esp,2A8
0040BEB3 \. C3 retn
上面讲到的"文件系统异常"问题,我始终不能解决,但是发现不脱壳的程序能够解密,而脱壳后的程序,调用"CreateFileW"时总是失败,看来壳中有东西,要想找出这个东西来还是很麻烦的,逼着我学习写Loader了.参考Loveboom的Loader:
我将其修改如下:
include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib
.data
szcap db 'Loader by Laowanghai',0
szerr db 'Could not found :'
db 100h dup (0)
PatchAddr1 dd 041AA**h(国产软件支持一下了)
raddr dd 006C933Ch
pdat dd 05674*****h(国产软件支持一下了)
pdat1 db 0B8h,58h,00h,00h,00h,90h,90h,0,0
rbuffer dd 100h dup(0)
szapppath db 100h dup(0)
appname db '***.exe',0
.data?
align dword
startinfo STARTUPINFO <>
pi PROCESS_INFORMATION <>
handle dd ?
.code
start:
;获取程序所在的路径
invoke GetCurrentDirectory,100h,addr szapppath
lea ebx,[eax+of***t szapppath]
cmp byte ptr [ebx-1],'\'
je @F
mov byte ptr [ebx],'\'
@@:
invoke lstrcat,addr szapppath,addr appname
invoke GetStartupInfo,addr startinfo
invoke CreateProcess,addr szapppath,NULL,NULL,NULL,NULL,CREATE_SUSPENDED,NULL,NULL,addr startinfo,addr pi
.if eax==0
invoke lstrcat,addr szerr,addr szapppath
invoke MessageBox,NULL,addr szerr,addr szcap,MB_OK OR MB_ICONSTOP
jmp @@end
.endif
mov handle,eax
mov ebx, pdat
@@:
invoke ResumeThread,pi.hThread
invoke Sleep,60h
invoke SuspendThread,pi.hThread
invoke ReadProcessMemory,pi.hProcess,PatchAddr1,addr rbuffer,4,NULL
mov edx,[rbuffer]
cmp ebx,edx
jne @B
;如果解压完毕则添加相关信息
invoke WriteProcessMemory,pi.hProcess,PatchAddr1,addr pdat1,7,NULL ;修改原流程
invoke ResumeThread,pi.hThread
invoke CloseHandle,handle
@@end:
invoke ExitProcess,NULL
end start
生成Loader.exe,然后利用Loader启动***.exe,这样就能实现注册了,而且没有功能限制了.
但是由于Sleep的时间很不好确定,这样有时运行会出现"未注册"或是"Error"对话框的情况,但只好如此了.好累!!!
呵呵，后来发现，其实有个不用做Loader也可以但是国产软件不提了。
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
赞赏
|
|
|---|---|
|
|
学习当中!!....谢谢!!
|
|
|
不错的说,支持一下!
|
|
|
怎么没有虚拟机？~……………………^_^
|
|
|
- [原创]VMP编译的完整笔记 15464
- [分享]利用Flex 10.1 SDK开发某软件注册机 17673
- [分享]菜鸟也学Armadillo 脱壳全保护加壳的记事本.doc 6159
- [分享]菜鸟也学Armadillo V4.40主程序脱壳 6402
- [分享]简单打狗文章一二 18677
