超级暴力破解
:lol :lol :lol本人菜菜，对难的软件从不敢去轻易尝试。只欺负“老实”的程序。论坛上高手众多，难的交给他们，简单的交给我来搞好了
大牛不要看，整个破文不是JMP就是NOP，没技术含量的。
中午上论坛的时候发现有人发了成功助理这个软件请求破解，嘿嘿，又是一个没看版规的人，还好我下手快，不然就找不到可以欺负的软件了
首先说下这个软件的注册机制。先连接网络，在线验证注册码再在本地完成注册
首先查壳，是个UPX，哈哈，这个简单，ESP定律。再查下发现是DELPHI写的，字符串我没找，直接翻按钮事件，上EXPLORER与DEDE，找到按钮事件00700B9C，现在OD上场~载入后CTRL+G直接来到按钮事件这里
00700B9C 55 push ebp
00700B9D 8BEC mov ebp,esp
00700B9F B9 0A000000 mov ecx,0A
00700BA4 6A 00 push 0
00700BA6 6A 00 push 0
00700BA8 49 dec ecx
00700BA9^ 75 F9 jnz short SuccessP.00700BA4
00700BAB 51 push ecx
00700BAC 8945 FC mov dword ptr ss:,eax
00700BAF 33C0 xor eax,eax
00700BB1 55 push ebp
00700BB2 68 E20E7000 push SuccessP.00700EE2
00700BB7 64:FF30 push dword ptr fs:
00700BBA 64:8920 mov dword ptr fs:,esp
00700BBD 8D55 D8 lea edx,dword ptr ss:
00700BC0 8B45 FC mov eax,dword ptr ss:
00700BC3 8B80 00030000 mov eax,dword ptr ds:
00700BC9 E8 3E7BD8FF call SuccessP.0048870C
00700BCE 8B45 D8 mov eax,dword ptr ss:
00700BD1 8D55 E0 lea edx,dword ptr ss:
00700BD4 E8 8793D0FF call SuccessP.00409F60
00700BD9 8D55 D4 lea edx,dword ptr ss:
00700BDC 8B45 FC mov eax,dword ptr ss:
00700BDF 8B80 04030000 mov eax,dword ptr ds:
00700BE5 E8 227BD8FF call SuccessP.0048870C
00700BEA 8B45 D4 mov eax,dword ptr ss:
00700BED 8D55 DC lea edx,dword ptr ss:
00700BF0 E8 6B93D0FF call SuccessP.00409F60
00700BF5 8B45 E0 mov eax,dword ptr ss:
00700BF8 E8 C745D0FF call SuccessP.004051C4
00700BFD 83F8 03 cmp eax,3
00700C00 7E 28 jle short SuccessP.00700C2A
00700C02 8B45 DC mov eax,dword ptr ss:
00700C05 E8 BA45D0FF call SuccessP.004051C4
00700C0A 83F8 10 cmp eax,10
00700C0D 75 1B jnz short SuccessP.00700C2A ; //关键跳，跳的话就不能完成验证，NOP掉
00700C0F 8D4D D0 lea ecx,dword ptr ss:
00700C12 8B55 DC mov edx,dword ptr ss:
00700C15 8B45 E0 mov eax,dword ptr ss:
00700C18 E8 ABBFE3FF call SuccessP.0053CBC8
00700C1D 8B55 D0 mov edx,dword ptr ss:
00700C20 8B45 DC mov eax,dword ptr ss:
00700C23 E8 E846D0FF call SuccessP.00405310
00700C28 74 1F je short SuccessP.00700C49 ; //这个也是，不跳的话就不能完成验证。改JMP
00700C2A 6A 30 push 30
00700C2C 68 F00E7000 push SuccessP.00700EF0
00700C31 68 FC0E7000 push SuccessP.00700EFC
00700C36 8B45 FC mov eax,dword ptr ss:
00700C39 E8 6EE4D8FF call SuccessP.0048F0AC
00700C3E 50 push eax
00700C3F E8 947AD0FF call <jmp.&user32.MessageBoxA>
00700C44 E9 3F020000 jmp SuccessP.00700E88
00700C49 8D45 DC lea eax,dword ptr ss:
00700C4C E8 B342D0FF call SuccessP.00404F04
00700C51 8B0D B4897400 mov ecx,dword ptr ds: ; SuccessP.00749C1C
00700C57 8B09 mov ecx,dword ptr ds:
00700C59 B2 01 mov dl,1
00700C5B A1 3C7C5D00 mov eax,dword ptr ds:
00700C60 E8 BF74EDFF call SuccessP.005D8124
00700C65 8945 F8 mov dword ptr ss:,eax
00700C68 C645 E7 00 mov byte ptr ss:,0
00700C6C C645 E6 00 mov byte ptr ss:,0
00700C70 68 200F7000 push SuccessP.00700F20 ; ASCII "http://reg2008.successpim.com/softreg2008.asp?ver="
00700C75 8D55 CC lea edx,dword ptr ss:
00700C78 A1 5C877400 mov eax,dword ptr ds:
00700C7D 8B00 mov eax,dword ptr ds:
00700C7F E8 D097D0FF call SuccessP.0040A454
00700C84 FF75 CC push dword ptr ss:
00700C87 68 5C0F7000 push SuccessP.00700F5C ; ASCII "&un="
00700C8C 8D55 C8 lea edx,dword ptr ss:
00700C8F 8B45 E0 mov eax,dword ptr ss:
00700C92 E8 9DC9E3FF call SuccessP.0053D634
00700C97 FF75 C8 push dword ptr ss:
00700C9A 68 6C0F7000 push SuccessP.00700F6C ; ASCII "&ud="
00700C9F 8D55 C0 lea edx,dword ptr ss:
00700CA2 A1 34857400 mov eax,dword ptr ds:
00700CA7 8B00 mov eax,dword ptr ds:
00700CA9 E8 6EB7E3FF call SuccessP.0053C41C
00700CAE 8B45 C0 mov eax,dword ptr ss:
00700CB1 8D55 C4 lea edx,dword ptr ss:
00700CB4 E8 7BC9E3FF call SuccessP.0053D634
00700CB9 FF75 C4 push dword ptr ss:
00700CBC 8D45 F0 lea eax,dword ptr ss:
00700CBF BA 06000000 mov edx,6
00700CC4 E8 BB45D0FF call SuccessP.00405284
00700CC9 33C0 xor eax,eax
00700CCB 55 push ebp
00700CCC 68 3F0E7000 push SuccessP.00700E3F
00700CD1 64:FF30 push dword ptr fs:
00700CD4 64:8920 mov dword ptr fs:,esp
00700CD7 8D4D F4 lea ecx,dword ptr ss:
00700CDA 8B55 F0 mov edx,dword ptr ss:
00700CDD 8B45 F8 mov eax,dword ptr ss:
00700CE0 E8 BF75EDFF call SuccessP.005D82A4 ; //网络CALL
00700CE5 8B45 F4 mov eax,dword ptr ss:
00700CE8 E8 D744D0FF call SuccessP.004051C4
00700CED 83F8 04 cmp eax,4
00700CF0 0F8E 33010000 jle SuccessP.00700E29
00700CF6 8D45 EC lea eax,dword ptr ss:
00700CF9 50 push eax
00700CFA B9 04000000 mov ecx,4
00700CFF BA 01000000 mov edx,1
00700D04 8B45 F4 mov eax,dword ptr ss:
00700D07 E8 1847D0FF call SuccessP.00405424
00700D0C 8D45 E8 lea eax,dword ptr ss:
00700D0F 50 push eax
00700D10 8B45 F4 mov eax,dword ptr ss:
00700D13 E8 AC44D0FF call SuccessP.004051C4
00700D18 8BC8 mov ecx,eax
00700D1A 83E9 04 sub ecx,4
00700D1D BA 05000000 mov edx,5
00700D22 8B45 F4 mov eax,dword ptr ss:
00700D25 E8 FA46D0FF call SuccessP.00405424
00700D2A 8B45 EC mov eax,dword ptr ss:
00700D2D BA 7C0F7000 mov edx,SuccessP.00700F7C ; ASCII "1111"
00700D32 E8 D945D0FF call SuccessP.00405310
00700D37 0F85 B7000000 jnz SuccessP.00700DF4 ; //关键跳，这里跳向请购买正版注册信息，NOP掉
00700D3D 8D45 DC lea eax,dword ptr ss:
00700D40 8B55 E8 mov edx,dword ptr ss:
00700D43 E8 5442D0FF call SuccessP.00404F9C
00700D48 8B45 E0 mov eax,dword ptr ss:
00700D4B E8 7444D0FF call SuccessP.004051C4
00700D50 83F8 03 cmp eax,3
00700D53 0F8E CC000000 jle SuccessP.00700E25
00700D59 8B45 DC mov eax,dword ptr ss:
00700D5C E8 6344D0FF call SuccessP.004051C4
00700D61 83F8 10 cmp eax,10
00700D64 0F85 BB000000 jnz SuccessP.00700E25 ; //NOP掉，否则完成注册按钮还是灰色
00700D6A 8D4D BC lea ecx,dword ptr ss:
00700D6D 8B55 DC mov edx,dword ptr ss:
00700D70 8B45 E0 mov eax,dword ptr ss:
00700D73 E8 50BEE3FF call SuccessP.0053CBC8
00700D78 8B55 BC mov edx,dword ptr ss:
00700D7B 8B45 DC mov eax,dword ptr ss:
00700D7E E8 8D45D0FF call SuccessP.00405310
00700D83 0F85 9C000000 jnz SuccessP.00700E25 ; //NOP掉，否则完成注册按钮还是灰色
00700D89 8D55 B4 lea edx,dword ptr ss:
00700D8C 8B45 FC mov eax,dword ptr ss:
00700D8F 8B80 04030000 mov eax,dword ptr ds:
00700D95 E8 7279D8FF call SuccessP.0048870C
00700D9A 8B45 B4 mov eax,dword ptr ss:
00700D9D 8D55 B8 lea edx,dword ptr ss:
00700DA0 E8 BB91D0FF call SuccessP.00409F60
00700DA5 8B55 B8 mov edx,dword ptr ss:
00700DA8 8B45 DC mov eax,dword ptr ss:
00700DAB E8 6045D0FF call SuccessP.00405310
00700DB0 75 73 jnz short SuccessP.00700E25 ; //NOP掉，否则完成注册按钮还是灰色
00700DB2 8B45 FC mov eax,dword ptr ss:
00700DB5 8B80 0C030000 mov eax,dword ptr ds:
00700DBB B2 01 mov dl,1
00700DBD 8B08 mov ecx,dword ptr ds:
00700DBF FF51 64 call dword ptr ds:
00700DC2 8D55 AC lea edx,dword ptr ss:
00700DC5 8B45 FC mov eax,dword ptr ss:
00700DC8 8B80 00030000 mov eax,dword ptr ds:
00700DCE E8 3979D8FF call SuccessP.0048870C
00700DD3 8B45 AC mov eax,dword ptr ss:
00700DD6 8D55 B0 lea edx,dword ptr ss:
00700DD9 E8 8291D0FF call SuccessP.00409F60
00700DDE 8B55 B0 mov edx,dword ptr ss:
00700DE1 8B45 FC mov eax,dword ptr ss:
00700DE4 05 34030000 add eax,334
00700DE9 E8 6A41D0FF call SuccessP.00404F58
00700DEE C645 E6 01 mov byte ptr ss:,1
00700DF2 EB 31 jmp short SuccessP.00700E25
好了，暴力解决掉在线验证的地方了，接下来就暴力解决完成注册了，点完成注册后提示注册失败。用F12堆栈调用
0070055A 6A 00 push 0
0070055C 49 dec ecx
0070055D^ 75 F9 jnz short SuccessP.00700558
0070055F 53 push ebx
00700560 56 push esi
00700561 57 push edi
00700562 8945 FC mov dword ptr ss:,eax
00700565 33C0 xor eax,eax
00700567 55 push ebp
00700568 68 3C0A7000 push SuccessP.00700A3C
0070056D 64:FF30 push dword ptr fs:
00700570 64:8920 mov dword ptr fs:,esp
00700573 8D55 E8 lea edx,dword ptr ss:
00700576 8B45 FC mov eax,dword ptr ss:
00700579 8B80 00030000 mov eax,dword ptr ds:
0070057F E8 8881D8FF call SuccessP.0048870C
00700584 8B45 E8 mov eax,dword ptr ss:
00700587 8D55 EC lea edx,dword ptr ss:
0070058A E8 D199D0FF call SuccessP.00409F60
0070058F 8B55 EC mov edx,dword ptr ss:
00700592 8B45 FC mov eax,dword ptr ss:
00700595 8B80 34030000 mov eax,dword ptr ds:
0070059B E8 704DD0FF call SuccessP.00405310
007005A0 74 32 je short SuccessP.007005D4 ; //这里跳了，但是为了安全起见，还是改了，JMP
007005A2 6A 30 push 30
007005A4 A1 9C8C7400 mov eax,dword ptr ds:
007005A9 8B00 mov eax,dword ptr ds:
007005AB E8 144ED0FF call SuccessP.004053C4
007005B0 50 push eax
007005B1 68 4C0A7000 push SuccessP.00700A4C
007005B6 8B45 FC mov eax,dword ptr ss:
007005B9 E8 EEEAD8FF call SuccessP.0048F0AC
007005BE 50 push eax
007005BF E8 1481D0FF call <jmp.&user32.MessageBoxA> ; //注册失败
007005C4 8B45 FC mov eax,dword ptr ss:
007005C7 8B80 0C030000 mov eax,dword ptr ds:
007005CD 33D2 xor edx,edx
007005CF 8B08 mov ecx,dword ptr ds:
007005D1 FF51 64 call dword ptr ds:
007005D4 8D55 E4 lea edx,dword ptr ss:
007005D7 8B45 FC mov eax,dword ptr ss:
007005DA 8B80 00030000 mov eax,dword ptr ds:
007005E0 E8 2781D8FF call SuccessP.0048870C
007005E5 8B45 E4 mov eax,dword ptr ss:
007005E8 8D55 F8 lea edx,dword ptr ss:
007005EB E8 7099D0FF call SuccessP.00409F60
007005F0 8D55 E0 lea edx,dword ptr ss:
007005F3 8B45 FC mov eax,dword ptr ss:
007005F6 8B80 04030000 mov eax,dword ptr ds:
007005FC E8 0B81D8FF call SuccessP.0048870C
00700601 8B45 E0 mov eax,dword ptr ss:
00700604 8D55 F4 lea edx,dword ptr ss:
00700607 E8 5499D0FF call SuccessP.00409F60
0070060C 33C0 xor eax,eax
0070060E 55 push ebp
0070060F 68 AE097000 push SuccessP.007009AE
00700614 64:FF30 push dword ptr fs:
00700617 64:8920 mov dword ptr fs:,esp
0070061A 8B45 F8 mov eax,dword ptr ss:
0070061D E8 A24BD0FF call SuccessP.004051C4
00700622 83F8 03 cmp eax,3
00700625 0F8E 79030000 jle SuccessP.007009A4
0070062B 8B45 F4 mov eax,dword ptr ss:
0070062E E8 914BD0FF call SuccessP.004051C4
00700633 83F8 10 cmp eax,10
00700636 0F85 68030000 jnz SuccessP.007009A4 ; //跳向失败的，NOP
0070063C 8D4D DC lea ecx,dword ptr ss:
0070063F 8B55 F4 mov edx,dword ptr ss:
00700642 8B45 F8 mov eax,dword ptr ss:
00700645 E8 7EC5E3FF call SuccessP.0053CBC8
0070064A 8B55 DC mov edx,dword ptr ss:
0070064D 8B45 F4 mov eax,dword ptr ss:
00700650 E8 BB4CD0FF call SuccessP.00405310
00700655 0F85 49030000 jnz SuccessP.007009A4 ; //同上，NOP
0070065B A1 74867400 mov eax,dword ptr ds:
00700660 8B00 mov eax,dword ptr ds:
00700662 8B80 44030000 mov eax,dword ptr ds:
00700668 BA 600A7000 mov edx,SuccessP.00700A60 ; ASCII "select * from usermsg"
0070066D E8 32B0E3FF call SuccessP.0053B6A4
00700672 84C0 test al,al
00700674 0F84 2A030000 je SuccessP.007009A4
0070067A A1 74867400 mov eax,dword ptr ds:
0070067F 8B00 mov eax,dword ptr ds:
00700681 8B80 44030000 mov eax,dword ptr ds:
00700687 E8 8834DDFF call SuccessP.004D3B14
0070068C 8D4D D8 lea ecx,dword ptr ss:
0070068F 8B15 CC897400 mov edx,dword ptr ds: ; SuccessP.00745BE4
00700695 8B12 mov edx,dword ptr ds:
00700697 8B45 F8 mov eax,dword ptr ss:
0070069A E8 B989E3FF call SuccessP.00539058
0070069F 8B45 D8 mov eax,dword ptr ss:
007006A2 50 push eax
007006A3 A1 74867400 mov eax,dword ptr ds:
007006A8 8B00 mov eax,dword ptr ds:
007006AA 8B80 44030000 mov eax,dword ptr ds:
007006B0 BA 800A7000 mov edx,SuccessP.00700A80 ; ASCII "field3"
007006B5 E8 9A1CDDFF call SuccessP.004D2354
007006BA 5A pop edx
007006BB 8B08 mov ecx,dword ptr ds:
007006BD FF91 B0000000 call dword ptr ds:
007006C3 8D4D D4 lea ecx,dword ptr ss:
007006C6 8B15 CC897400 mov edx,dword ptr ds: ; SuccessP.00745BE4
007006CC 8B12 mov edx,dword ptr ds:
007006CE 8B45 F4 mov eax,dword ptr ss:
007006D1 E8 8289E3FF call SuccessP.00539058
007006D6 8B45 D4 mov eax,dword ptr ss:
007006D9 50 push eax
007006DA A1 74867400 mov eax,dword ptr ds:
007006DF 8B00 mov eax,dword ptr ds:
007006E1 8B80 44030000 mov eax,dword ptr ds:
007006E7 BA 900A7000 mov edx,SuccessP.00700A90 ; ASCII "field4"
007006EC E8 631CDDFF call SuccessP.004D2354
007006F1 5A pop edx
007006F2 8B08 mov ecx,dword ptr ds:
007006F4 FF91 B0000000 call dword ptr ds:
007006FA A1 74867400 mov eax,dword ptr ds:
007006FF 8B00 mov eax,dword ptr ds:
00700701 8B80 44030000 mov eax,dword ptr ds:
00700707 8B10 mov edx,dword ptr ds:
00700709 FF92 4C020000 call dword ptr ds:
0070070F 8D55 CC lea edx,dword ptr ss:
00700712 8B45 FC mov eax,dword ptr ss:
00700715 8B80 00030000 mov eax,dword ptr ds:
0070071B E8 EC7FD8FF call SuccessP.0048870C
00700720 8B45 CC mov eax,dword ptr ss:
00700723 8D55 D0 lea edx,dword ptr ss:
00700726 E8 3598D0FF call SuccessP.00409F60
0070072B 8B55 D0 mov edx,dword ptr ss:
0070072E A1 4C8E7400 mov eax,dword ptr ds:
00700733 E8 2048D0FF call SuccessP.00404F58
00700738 8D55 C4 lea edx,dword ptr ss:
0070073B 8B45 FC mov eax,dword ptr ss:
0070073E 8B80 04030000 mov eax,dword ptr ds:
00700744 E8 C37FD8FF call SuccessP.0048870C
00700749 8B45 C4 mov eax,dword ptr ss:
0070074C 8D55 C8 lea edx,dword ptr ss:
0070074F E8 0C98D0FF call SuccessP.00409F60
00700754 8B55 C8 mov edx,dword ptr ss:
00700757 A1 6C8C7400 mov eax,dword ptr ds:
0070075C E8 F747D0FF call SuccessP.00404F58
00700761 A1 AC8C7400 mov eax,dword ptr ds:
00700766 C600 01 mov byte ptr ds:,1
00700769 6A 30 push 30
0070076B A1 9C8C7400 mov eax,dword ptr ds:
00700770 8B00 mov eax,dword ptr ds:
00700772 E8 4D4CD0FF call SuccessP.004053C4
00700777 50 push eax
00700778 68 980A7000 push SuccessP.00700A98
0070077D 8B45 FC mov eax,dword ptr ss:
00700780 E8 27E9D8FF call SuccessP.0048F0AC
00700785 50 push eax
00700786 E8 4D7FD0FF call <jmp.&user32.MessageBoxA> ; //注册成功
0070078B 68 AC0A7000 push SuccessP.00700AAC
00700790 A1 4C8E7400 mov eax,dword ptr ds:
00700795 FF30 push dword ptr ds:
00700797 68 BC0A7000 push SuccessP.00700ABC
0070079C A1 9C8C7400 mov eax,dword ptr ds:
007007A1 FF30 push dword ptr ds:
007007A3 68 C80A7000 push SuccessP.00700AC8
007007A8 8D45 C0 lea eax,dword ptr ss:
007007AB BA 05000000 mov edx,5
007007B0 E8 CF4AD0FF call SuccessP.00405284
007007B5 8B55 C0 mov edx,dword ptr ss:
007007B8 A1 74867400 mov eax,dword ptr ds:
007007BD 8B00 mov eax,dword ptr ds:
007007BF E8 787FD8FF call SuccessP.0048873C
007007C4 A1 74867400 mov eax,dword ptr ds:
007007C9 8B00 mov eax,dword ptr ds:
007007CB 8B80 44030000 mov eax,dword ptr ds:
007007D1 BA DC0A7000 mov edx,SuccessP.00700ADC ; ASCII "select * from dbole"
007007D6 E8 C9AEE3FF call SuccessP.0053B6A4
破文不大会写，可能有点乱````大家，就将就下吧。
不错感谢楼主分享，学习了。
建议楼主做个语音教程，我给你加分。^_^
[ 本帖最后由 xq811028 于 2008-11-20 19:41 编辑 ] LS的好想法
哈哈 不过现在这个原创 也应该加分
我代劳了
嘿嘿
语音有时间再做吧 破解软件呢？我也想欺负一下它，看看还有啥方法没:lol :lol 我也想欺负一下它:lol 可惜老是给它欺负我!!:'( 貌似真的很强大
改了那多:lol :lol
灌水灌水了~~~~~~~~~~~~~~~~~~~~~~~~~~~~~!!!````
:loveliness: :loveliness: :loveliness: 灌水灌水了~~~~~~~~~~~~~~~~~~~~~~~~~~~~~!!!``` :$ 原版的哪下。。俺也去被欺负欺负 太狠了，太残酷了。。。:L :L不愧是暴力破解啊