原程序加壳了,是JDPack 1.x / JDProtect 0.9 ,我也不知道自己脱的是否正确!!
这个是我用OD的插件直接脱出来的,可以运行~~~~大家帮忙看看这个没有狗能不能破解?
狗是safenet的并口狗,驱动是3.1.10.0~~~~偶是安装了驱动来调试的,中间参考<<加密与解密>>的相关资料,折腾了一下午的花指令,把一些花指令偶手工去掉,还有n多~~~~
0044CDB7 81BD 80FEFFFF 00>cmp dword ptr ss:[ebp-180], 100000//这个地方可以跳过没有狗的对话框,但是不能运行~
0044CDC1 0F84 84000000 je 33.0044CE4B
0044CDC7 A1 38A04500 mov eax, dword ptr ds:[45A038]
0044CDCC 48 dec eax ; 33.004554D4
0044CDCD 8BC8 mov ecx, eax ; 33.004554D4
0044CDCF 8D0480 lea eax, dword ptr ds:[eax+eax*4]
0044CDD2 8D0480 lea eax, dword ptr ds:[eax+eax*4]
0044CDD5 8D0441 lea eax, dword ptr ds:[ecx+eax*2]
0044CDD8 8D0445 10904500 lea eax, dword ptr ds:[eax*2+459010]
0044CDDF 05 14060000 add eax, 614
0044CDE4 8985 ACFEFFFF mov dword ptr ss:[ebp-154], eax ; 33.004554D4
0044CDEA 833D E2954500 00 cmp dword ptr ds:[4595E2], 0
0044CDF1 74 27 je short 33.0044CE1A
0044CDF3 A1 5C9B4500 mov eax, dword ptr ds:[459B5C]
0044CDF8 8985 50FDFFFF mov dword ptr ss:[ebp-2B0], eax ; 33.004554D4
0044CDFE 6A 40 push 40
0044CE00 B8 10904500 mov eax, 33.00459010
0044CE05 05 D6050000 add eax, 5D6
0044CE0A 50 push eax ; 33.004554D4
0044CE0B 8B85 ACFEFFFF mov eax, dword ptr ss:[ebp-154] ; 33.00459624
0044CE11 50 push eax ; 33.004554D4
0044CE12 6A 00 push 0
0044CE14 FF95 50FDFFFF call near dword ptr ss:[ebp-2B0] ; <jmp.&user32.MessageBoxA>//没有狗的对话框
0044CE1A C705 409B4500 01>mov dword ptr ds:[459B40], 1
0044CE24 833D 40A04500 00 cmp dword ptr ds:[45A040], 0
0044CE2B 74 0F je short 33.0044CE3C
0044CE2D A1 649B4500 mov eax, dword ptr ds:[459B64]
0044CE32 8945 FC mov dword ptr ss:[ebp-4], eax ; 33.004554D4
0044CE35 6A 01 push 1
0044CE37 FF55 FC call near dword ptr ss:[ebp-4] ; <jmp.&kernel32.ExitProcess>
0044CE3A EB 0F jmp short 33.0044CE4B
0044CE3C 6A 01 push 1
0044CE3E FF15 98C24500 call near dword ptr ds:[<&kernel32.GetCurrent>; kernel32.GetCurrentProcess
0044CE44 50 push eax ; 33.004554D4
0044CE45 FF15 9CC24500 call near dword ptr ds:[<&kernel32.TerminateP>; kernel32.TerminateProcess
附件:33.rar
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
