本人从来没有写过文章,一个是懒,一个是笨.
今天下午偶公司的一台机器中毒了,疯狂的发送大量垃圾数据包,严重影响偶的浏览色情网页的雅兴!!!所以找了一个sniffer看是谁在干这事,IP知道了,是另外一个部门的,过去拔了网线,告诉人家说你别影响别人,谁知道人家不调我,我一走人继续联网,靠~~~于是上应征查询到这个软件,可以封别人的ip,立马上主页下载最新的使用版,本来想注册,看了半天也不能用OD拦下注册的部分,只好逐个破解俺需要的功能部分.
1.管理功能需要2分钟后才能开启~~
破解如下
* Referenced by a CALL at Address:
|:004271C1
|
:00424930 53 push ebx
:00424931 56 push esi
:00424932 8B74240C mov esi, dword ptr [esp+0C]
:00424936 57 push edi
:00424937 83FE78 cmp esi, 00000078//2分钟的判断
:0042493A 8BD9 mov ebx, ecx
:0042493C 7725 ja 00424963//直接跳过去
:0042493E B978000000 mov ecx, 00000078
:00424943 33D2 xor edx, edx
:00424945 2BCE sub ecx, esi
:00424947 BF3C000000 mov edi, 0000003C
:0042494C 8BC1 mov eax, ecx
:0042494E F7F7 div edi
:00424950 B889888888 mov eax, 88888889
:00424955 52 push edx
:00424956 F7E1 mul ecx
:00424958 C1EA05 shr edx, 05
:0042495B 52 push edx
* Possible StringData Ref from Data Obj ->" 试用版本，将在%02d分%02d秒后开启管理功能。"
|
:0042495C 688C6C4400 push 00446C8C
:00424961 EB2B jmp 0042498E
===========
这样一来就直接开启了"管理功能".
2,管理时间的限制
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042493C(U)
|
:00424963 81FE08070000 cmp esi, 00000708//半个小时
:00424969 7337 jnb 004249A2//jmp 004249c9,这样就没有烦人的还有多少时间的提示 B908070000 mov ecx, 00000708
:00424970 33D2 xor edx, edx
:00424972 2BCE sub ecx, esi
:00424974 BF3C000000 mov edi, 0000003C
:00424979 8BC1 mov eax, ecx
:0042497B F7F7 div edi
:0042497D B889888888 mov eax, 88888889
:00424982 52 push edx
:00424983 F7E1 mul ecx
:00424985 C1EA05 shr edx, 05
:00424988 52 push edx
* Possible StringData Ref from Data Obj ->" 试用版本，已开启管理功能，有效时间 "
->"%02d分%02d秒。"
|
:00424989 68586C4400 push 00446C58
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424961(U)
|
:0042498E 6864A64400 push 0044A664
* Reference To: MSVCRT.sprintf, Ord:02B2h
|
:00424993 FF156C664300 Call dword ptr [0043666C]
:00424999 83C410 add esp, 00000010
:0042499C 81FE08070000 cmp esi, 00000708
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424969(C)
|
:004249A2 7625 jbe 004249C9
* Possible StringData Ref from Data Obj ->" 试用版本，本次运行试用管理功能已经结束。"
|
:004249A4 BF2C6C4400 mov edi, 00446C2C
3,时间过期的问题,这个我也不知道它是跟什么时间对比的,我启动的时候用FileMon和RegMon都监视了一下,看不出啥结果,烦~~~~会跳出一个对话框告诉你时间到期了,我想直接把这个对话框给干掉就行了!!!这个断点如下:
00425740 . 64:A1 00000000 mov eax, dword ptr fs:[0]
00425746 . 6A FF push -1
00425748 . 68 A33F4300 push Robocop.00433FA3
0042574D . 50 push eax
0042574E . A1 0CA74400 mov eax, dword ptr ds:[44A70C]
00425753 . 64:8925 00000000 mov dword ptr fs:[0], esp
0042575A . 81EC B4030000 sub esp, 3B4
00425760 . 85C0 test eax, eax
00425762 . 57 push edi
00425763 . 8BF9 mov edi, ecx
00425765 74 0A je short Robocop.00425771//关键跳转!!!nop掉~~~~
00425767 . B8 01000000 mov eax, 1
0042576C . E9 C3010000 jmp Robocop.00425934
00425771 > 53 push ebx
00425772 . BB 01000000 mov ebx, 1
00425777 . 55 push ebp
00425778 . 56 push esi ; USER32.KillTimer
00425779 . 891D 0CA74400 mov dword ptr ds:[44A70C], ebx
0042577F . 891D 209C4400 mov dword ptr ds:[449C20], ebx
00425785 . B8 FE864400 mov eax, Robocop.004486FE
0042578A > 8958 FC mov dword ptr ds:[eax-4], ebx
0042578D . 8918 mov dword ptr ds:[eax], ebx
0042578F . 8958 04 mov dword ptr ds:[eax+4], ebx
00425792 . 8958 08 mov dword ptr ds:[eax+8], ebx
00425795 . 05 E6020000 add eax, 2E6
0042579A . 3D 96924400 cmp eax, Robocop.00449296
0042579F .^ 7C E9 jl short Robocop.0042578A
004257A1 . 8B47 20 mov eax, dword ptr ds:[edi+20]
004257A4 . 8B35 94674300 mov esi, dword ptr ds:[<&USER32.KillTimer>] ; USER32.KillTimer
004257AA . 53 push ebx ; /TimerID = 1
004257AB . 50 push eax ; |hWnd = 00000001
004257AC . FFD6 call near esi ; \KillTimer
004257AE . 8B4F 20 mov ecx, dword ptr ds:[edi+20]
004257B1 . 6A 02 push 2 ; /TimerID = 2
004257B3 . 51 push ecx ; |hWnd = 0012F6E0
004257B4 . FFD6 call near esi ; \KillTimer
004257B6 . 8B57 20 mov edx, dword ptr ds:[edi+20]
004257B9 . 6A 03 push 3 ; /TimerID = 3
004257BB . 52 push edx ; |hWnd = 0043BF28
004257BC . FFD6 call near esi ; \KillTimer
004257BE . 8B47 20 mov eax, dword ptr ds:[edi+20]
004257C1 . 6A 04 push 4 ; /TimerID = 4
004257C3 . 50 push eax ; |hWnd = 00000001
004257C4 . FFD6 call near esi ; \KillTimer
004257C6 . 8B4F 20 mov ecx, dword ptr ds:[edi+20]
004257C9 . 6A 05 push 5 ; /TimerID = 5
004257CB . 51 push ecx ; |hWnd = 0012F6E0
004257CC . FFD6 call near esi ; \KillTimer
004257CE . E8 EDA5FFFF call Robocop.0041FDC0
004257D3 . 6A 00 push 0
004257D5 . 8D8C24 D8010000 lea ecx, dword ptr ss:[esp+1D8]
004257DC . E8 BF35FEFF call Robocop.00408DA0
004257E1 . 8D8C24 D4010000 lea ecx, dword ptr ss:[esp+1D4]
004257E8 . C78424 CC030000 >mov dword ptr ss:[esp+3CC], 0
004257F3 . E8 DCA40000 call <jmp.&MFC42.#2514_CDialog::DoModal>
004257F8 . 6A 00 push 0
004257FA . 8D8C24 F4000000 lea ecx, dword ptr ss:[esp+F4]
4.启动的时候那个讨厌的对话框:
00422D50 . 6A FF push -1
00422D52 . 68 49394300 push Robocop.00433949 ; SE handler installation
00422D57 . 64:A1 00000000 mov eax, dword ptr fs:[0]
00422D5D . 50 push eax
00422D5E . 64:8925 00000000 mov dword ptr fs:[0], esp
00422D65 . 81EC 44050000 sub esp, 544
00422D6B . 55 push ebp ; Robocop.0044A420
00422D6C . 8BE9 mov ebp, ecx
00422D6E . 56 push esi ; Robocop.0044A420
00422D6F . 6A 00 push 0
00422D71 . 8D4C24 0C lea ecx, dword ptr ss:[esp+C]
00422D75 . E8 065DFEFF call Robocop.00408A80
00422D7A . 8D4C24 08 lea ecx, dword ptr ss:[esp+8]
00422D7E . C78424 54050000 >mov dword ptr ss:[esp+554], 0
00422D89 . E8 46CF0000 call <jmp.&MFC42.#2514_CDialog::DoModal>//就是它!!烦,nop掉
00422D8E . 83F8 01 cmp eax, 1//这个是判断OK还是Cancel按钮的,也nop掉
00422D91 . 74 4C je short Robocop.00422DDF//直接jmp
=====
感慨:理解一个程序的结构对破解太TMD的重要了!以前用vc写了乱七八糟的好多代码,从来都没有仔细的去追踪从程序入口到AfxWinMain,再到InitInstance(),再到 m_pMainWnd->ShowWindow(SW_SHOW);都究竟是怎么样运行的!今天一上来陷入了无休止的MFC的海洋~~~~寒!都是一堆message的传递.真的,理解windows的运行机制对破解很重要!
总结,用OD寻找断点不容易~~~~幸好这个软件用vc写的,偶有MFC的lib库,这样就可以看到函数名了,跟偶平常用vc调试程序就熟悉了~~~~
刚开始用GetWindowTextA,GetDlgItemTextA都拦不到注册的,"注册"按钮点击了没有反应!!faint~~听说用hmemcpy可以断下,开始偶在OD里不会用,拦下一堆!到处在MFC里面转!说实话,也许这个软件用softice追注册码应该好一点!可惜偶是SP2,不想折腾!所以就想Crack出自己需要的功能就可.
上面的1和2的部分可以用w32dasm就可以分析到,后面两个对话框,我没有办法最后用MFC的CDialog::DoModal断下~~~~~嘿嘿....
功能破解不全,别骂我就行了,总之是可以使用我所需要的功能就行了,------嘿嘿,除了偶,全公司的IP都不能互相访问~~~~~一个人独享6M的带宽真TMD的爽!!!
象那些什么MAC绑定功能的阿,未注册的字样阿等等,我就不去弄了.有劳高手解决吧.
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
