avphone3的破解
vb写的activeX控件，未注册会弹出注册窗口，加密方式太鬼了，user和product id保存在HKLM\SOFTWARE\Classes\CLSID\{D12BA6BB-0E5E-4879-B9E8-E7BFFA2C402D}\Control\Control下，以二进制数值存储，格式为 CA CF D3 CF C8 AB AC 97 94 95 92 93 90 91 9E 9F 96 AB AC A6 A6 A6 A6 A6 A6 A6 A6 A6 A6 A6 A6
算法很复杂，分析无望，想爆破，这是注册窗口中验证的部分
----------------------------------------------------------
:42031FF2 FF1560140442 Call dword ptr [42041460]
:42031FF8 8D9564FFFFFF lea edx, dword ptr [ebp+FFFFFF64]
:42031FFE 52 push edx
:42031FFF 8B4518 mov eax, dword ptr [ebp+18]
:42032002 50 push eax
:42032003 8B4D14 mov ecx, dword ptr [ebp+14]
:42032006 51 push ecx
:42032007 56 push esi
:42032008 FF9710070000 call dword ptr [edi+00000710]
:4203200E 8B8564FFFFFF mov eax, dword ptr [ebp+FFFFFF64]
:42032014 3D00800080 cmp eax, 80008000
:42032019 0F858A000000 jne 420320A9 //此处改为0F84 能够提示注册成功
:4203201F 3D01800080 cmp eax, 80008001
:42032024 0F8582010000 jne 420321AC
:4203202A 391D30A40342 cmp dword ptr [4203A430], ebx
:42032030 7510 jne 42032042
:42032032 6830A40342 push 4203A430
:42032037 686CA90042 push 4200A96C
* Reference To: MSVBVM50.__vbaNew2, Ord:0000h
|
:4203203C FF1574150442 Call dword ptr [42041574]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:42032030(C)
|
:42032042 8B3D30A40342 mov edi, dword ptr [4203A430]
:42032048 8B17 mov edx, dword ptr [edi]
:4203204A 56 push esi
:4203204B 8D45D8 lea eax, dword ptr [ebp-28]
:4203204E 50 push eax
:4203204F 899544FFFFFF mov dword ptr [ebp+FFFFFF44], edx
* Reference To: MSVBVM50.__vbaObjSetAddref, Ord:0000h
|
:42032055 FF156C140442 Call dword ptr [4204146C]
:4203205B 50 push eax
:4203205C 57 push edi
:4203205D 8B8D44FFFFFF mov ecx, dword ptr [ebp+FFFFFF44]
:42032063 FF5110 call [ecx+10]
:42032066 3BC3 cmp eax, ebx
:42032068 7D0F jge 42032079
:4203206A 6A10 push 00000010
:4203206C 685CA90042 push 4200A95C
:42032071 57 push edi
:42032072 50 push eax
* Reference To: MSVBVM50.__vbaHresultCheckObj, Ord:0000h
|
:42032073 FF1528140442 Call dword ptr [42041428]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:42032068(C)
|
:42032079 8D4DD8 lea ecx, dword ptr [ebp-28]
* Reference To: MSVBVM50.__vbaFreeObj, Ord:0000h
|
:4203207C FF1534160442 Call dword ptr [42041634]
* Possible StringData Ref from Code Obj ->"IInvalid license key"
|
:42032082 BAD8D90042 mov edx, 4200D9D8
:42032087 8D4DE0 lea ecx, dword ptr [ebp-20]
-----------------------------------------------------------
:42032019 处 0F 85 改为 0F 84，可以欺骗注册窗口
现在是 启动时他还会验证注册码的有效性，我想找到启动验证、弹出窗口的代码部分，可是找不到，他的字符串都是动态合成，由多个地方调用，我找找就晕了
求大虾们指点一下
另：
还有我的win98用trw2000载入文件调试，下完断点，一按F5就提示非法操作，trw2000就自己退了，在运行一次就死机
由于是调试activeX我不知如何用od下断点
附件:AVPhone3.rar
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
