程序运行需要狗里面的数据,直接爆破exe没有作用,因为它需要狗里面的数据,所以我就自己写了dic32.dll来代替它原来的,结果是可以运行了,开始出了一点小bug,就是我没有模拟完全,因为我的dll里面没有完全模拟它原来的函数.
现在有两种方案:
1.继续完全把dll写完~或许可以成功.我实在没有耐心一个一个去模拟,这个程序比较变态,每一个操作都去操作加密狗.
2.硬件克隆,但是我不知道它的超级密码~~~~~~
请问大家有什么看法??
// dic32.cpp : Defines the entry point for the DLL application.
//
#include "stdafx.h"
#include "dic32.h"
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
int WINAPI DIC_Find()
{
return 2;
}
int WINAPI DIC_Open(int hic, char* reader_name)
{
return 0;
}
typedef struct
{
char volume[16];
char atr[15];
} DICST_CardInfo;
typedef struct
{
WORD RunID;
WORD ParaSize;
BYTE Para[1]; // 大小为 ParaSize
} DICST_Before_Run_Data;
typedef struct
{
WORD ResultSize;
BYTE Result[1]; // 大小为 ResultSize
} DICST_After_Run_Data;
typedef struct
{
WORD fileid; // 文件 ID
BYTE filecla; // 文件类别
BYTE fileatrpri; // 文件属性 & 文件安全级
WORD filesize; // 文件大小
char filename[17]; // 文件名
} DICST_File;
int WINAPI DIC_Command(int hic, int cmd, void* cmddata)
{
if (cmd == 0x02000000)
{
DICST_CardInfo* p = (DICST_CardInfo*)cmddata;
memset(p,0,31);
memcpy(p->volume,"Hugeland",8);
memcpy(p->atr,"Hugeland GDS",12);
p->atr[13] = 0x01;
p->atr[14] = (char)0xe0;
return 0;
}
if (cmd == 0x03000000)
{
DICST_After_Run_Data *prun =(DICST_After_Run_Data *)cmddata;
prun->ResultSize = 2;
prun->Result[0] = (BYTE)0x90;
prun->Result[1] =0;
return 0;
}
if (cmd == 0x100a400)
{
return 0;
}
if (cmd == 0x0d000)
{
return 0;
}
if (cmd == 0x0b000)//readfile
{
char* pread = (char*)cmddata;
/* if (*pread == 0 && *(pread+2) == 0x14 )
{
memset(pread,0,53);
*pread = 0x32;
memcpy(pread+2,"01234567890123456789012345678901234567890123456789",50);
}
if (*pread == 0x32 && *(pread+2) == 0x32 )
{
memset(pread,0,53);
*pread = 0x32;
memcpy(pread+2,"QSQWQSQ_QS[]_][EGEKMEGEKMOWU[]UWU[]_][UW_ACAGACAOA",50);
}
if (*pread == 0x64 && *(pread+2) == 0x32 )
{*/
memset(pread,0,53);
*pread = 0x32;
memcpy(pread+2,"JHJDB@BDJH@^\\^X^\\^P^VTVPVTLN@NFDF@FDFXVT\\ZXZ\\RPR\\Z",50);
// }
return 0;
}
return 0;
}
int WINAPI DIC_Get(void* xdata, int p1, int p2, char* buffer)
{
if (p2 == 0x80000000 && p1 == 0x80010000)
{
memset(buffer,0,15);
memcpy(buffer,"Hugeland GDS",12);
buffer[13] =0x01;
buffer[14] =(char)0xe0;
return 12;
}
if (p2 == 0 && p1 == 0x80190000)
{
buffer[0] = (char)0x90;
buffer[1] =0;
return 2;
}
if (p2 == 0 && p1 == 0x80180000)
{
memset(buffer,0,51);
char* pdata = (char*)xdata;
memcpy(buffer,pdata+2,50);
return 0;
}
if (p2 ==2 && p1 ==0)
{
return 0x90;
}
return 0;
}
int WINAPI DIC_Set(void* xdata, int p1, int p2, int p3, char* buffer)
{
if (buffer == "Gene"&& p3 == 0 &&p2 == 4 && p1 == 0)
{
return 0;
}
if (buffer == "rate"&& p3 == 0 &&p2 == 4 && p1 == 0)
{
return 0;
}
return 0;
}
int WINAPI DIC_Close(int hic)
{
return 0;
}
顺便说一下,我的这个dll没有完全模拟,但是程序可以运行,里面的功能也正常,就是暂停没有了.
我也用rockey的集成开发工具看了一下狗,里面有3个文件,一个是可执行的,另外是数据文件.
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
