PDFTiger 爆破、追码 by cqr2287
此处先做个铺垫，写爆破、追码过程。软件名称：PDFTiger
下载地址：百度官方下载
文章作者：cqr2287/cqr2003
由于这个软件只能注册一次的原因，所以我们在爆破之后就不上图测试了。
运行起来，注册。提示
注册码错{:301_1004:}载入od来玩吧。
static/image/hrline/2.gif
爆破是一件很简单的事情，载入od后，发现是个典型的vboep。
00404A70 > $68 74A94000 push PDFTiger.0040A974
00404A75 .E8 EEFFFFFF call <jmp.&MSVBVM60.#ThunRTMain_100>
00404A7A .0000 add byte ptr ds:,al
00404A7C .0000 add byte ptr ds:,al
00404A7E .0000 add byte ptr ds:,al
00404A80 .3000 xor byte ptr ds:,al
00404A82 .0000 add byte ptr ds:,al
00404A84 .3800 cmp byte ptr ds:,al
00404A86 .0000 add byte ptr ds:,al
00404A88 .0000 add byte ptr ds:,al
00404A8A .0000 add byte ptr ds:,al
对吗？我们先把数据窗口换成hex16位的unicode。
运行起来，搜索字符串Unicode，注册码错。
004922D8 .E8 5524F7FF call <jmp.&MSVBVM60.__vbaEnd>
004922DD .E9 BC000000 jmp PDFTiger.0049239E
004922E2 >C745 FC 1F000>mov dword ptr ss:,0x1F
004922E9 .C785 6CFFFFFF>mov dword ptr ss:,0x80020004
004922F3 .C785 64FFFFFF>mov dword ptr ss:,0xA
004922FD .C785 7CFFFFFF>mov dword ptr ss:,0x80020004
00492307 .C785 74FFFFFF>mov dword ptr ss:,0xA
00492311 .C785 4CFFFFFF>mov dword ptr ss:,PDFTiger.004>;错误
0049231B .C785 44FFFFFF>mov dword ptr ss:,0x8
00492325 .8D95 44FFFFFF lea edx,dword ptr ss:
0049232B .8D4D 84 lea ecx,dword ptr ss:
0049232E .E8 1D24F7FF call <jmp.&MSVBVM60.__vbaVarDup>
00492333 .C785 5CFFFFFF>mov dword ptr ss:,PDFTiger.004>;注册码错.
很快找到了vb典型的判断尾部。追踪之。
00491E77 .66:837D C4 FF cmp word ptr ss:,0xFFFF
00491E7C 0F85 60040000 jnz PDFTiger.004922E2
00491E82 66:837D CC FF cmp word ptr ss:,0xFFFF
00491E87 0F85 55040000 jnz PDFTiger.004922E2
00491E8D 66:837D C0 FF cmp word ptr ss:,0xFFFF
00491E92 0F85 4A040000 jnz PDFTiger.004922E2
00491E98 66:837D C8 FF cmp word ptr ss:,0xFFFF
00491E9D 0F85 3F040000 jnz PDFTiger.004922E2
00491EA3 .C745 FC 17000>mov dword ptr ss:,0x17
00491EAA .C785 5CFFFFFF>mov dword ptr ss:,PDFTiger.004>;APPDATA
跟到了四个跳转。仔细一看发现，每个跳转上面都是一个cmp
这样，我们可以方便得把全部都nop。。。
00492232 .C785 64FFFFFF>mov dword ptr ss:,0xA
0049223C .C785 7CFFFFFF>mov dword ptr ss:,0x80020004
00492246 .C785 74FFFFFF>mov dword ptr ss:,0xA
00492250 .C785 4CFFFFFF>mov dword ptr ss:,PDFTiger.004>;成功
0049225A .C785 44FFFFFF>mov dword ptr ss:,0x8
00492264 .8D95 44FFFFFF lea edx,dword ptr ss:
0049226A .8D4D 84 lea ecx,dword ptr ss:
0049226D .E8 DE24F7FF call <jmp.&MSVBVM60.__vbaVarDup>
00492272 .C785 5CFFFFFF>mov dword ptr ss:,PDFTiger.004>;注册成功! 请重新启动程序.
0049227C .C785 54FFFFFF>mov dword ptr ss:,0x8
00492286 .8D95 54FFFFFF lea edx,dword ptr ss:
0049228C .8D4D 94 lea ecx,dword ptr ss:
走到成功
static/image/hrline/2.gif
下面追码
运行起来，到段首下段
00491A2A > \55 push ebp
00491A2B .8BEC mov ebp,esp
00491A2D .83EC 18 sub esp,0x18
00491A30 .68 36464000 push <jmp.&MSVBVM60.__vbaExceptHandler>;SE 处理程序安装
00491A35 .64:A1 0000000>mov eax,dword ptr fs:
00491A3B .50 push eax
00491A3C .64:8925 00000>mov dword ptr fs:,esp
跟踪它。
说错了，是f8跟踪它。
前面很无聊，可以走快点。
00491B3A > \8B45 B8 mov eax,dword ptr ss:
00491B3D .8985 DCFEFFFF mov dword ptr ss:,eax
00491B43 .8365 B8 00 and dword ptr ss:,0x0
假码出现，做个标记。
00491BD2 . /E9 8C020000 jmp PDFTiger.00491E63
00491BD7 > |C745 FC 09000>mov dword ptr ss:,0x9
00491BDE . |C745 9C 01000>mov dword ptr ss:,0x1
00491BE5 . |C745 94 02000>mov dword ptr ss:,0x2
00491BEC . |8D45 BC lea eax,dword ptr ss:
00491BEF . |8985 5CFFFFFF mov dword ptr ss:,eax
00491BF5 . |C785 54FFFFFF>mov dword ptr ss:,0x4008
00491BFF . |8D45 94 lea eax,dword ptr ss:
00491C02 . |50 push eax
00491C03 . |8D45 D0 lea eax,dword ptr ss:
00491C06 . |50 push eax
00491C07 . |E8 042CF7FF call <jmp.&MSVBVM60.__vbaI4Var>
00491C0C . |50 push eax ; |Start = 0x1
00491C0D . |8D85 54FFFFFF lea eax,dword ptr ss: ; |
00491C13 . |50 push eax ; |dString8 = 00000001
00491C14 . |8D45 84 lea eax,dword ptr ss: ; |
00491C17 . |50 push eax ; |RetBUFFER = 00000001
00491C18 . |E8 AD2CF7FF call <jmp.&MSVBVM60.#rtcMidCharVar_632>; \rtcMidCharVar
00491C1D . |C785 3CFFFFFF>mov dword ptr ss:,PDFTiger.004>;W
00491C27 . |C785 34FFFFFF>mov dword ptr ss:,0x8008
00491C31 . |8D45 84 lea eax,dword ptr ss:
00491C34 . |50 push eax ; /var18 = 00000001
00491C35 . |8D85 34FFFFFF lea eax,dword ptr ss: ; |
00491C3B . |50 push eax ; |var28 = 00000001
00491C3C . |E8 9F2BF7FF call <jmp.&MSVBVM60.__vbaVarTstEq> ; \__vbaVarTstEq
00491C41 . |66:8985 20FFF>mov word ptr ss:,ax
00491C48 . |8D45 84 lea eax,dword ptr ss:
00491C4B . |50 push eax
00491C4C . |8D45 94 lea eax,dword ptr ss:
00491C4F . |50 push eax
00491C50 . |6A 02 push 0x2
00491C52 . |E8 8F2BF7FF call <jmp.&MSVBVM60.__vbaFreeVarList>
00491C57 . |83C4 0C add esp,0xC
00491C5A . |0FBF85 20FFFF>movsx eax,word ptr ss:
00491C61 . |85C0 test eax,eax
00491C63 . |74 0C je short PDFTiger.00491C71
00491C65 . |C745 FC 0A000>mov dword ptr ss:,0xA
00491C6C . |66:834D C4 FF or word ptr ss:,0xFFFF
00491C71 > |C745 FC 0C000>mov dword ptr ss:,0xC
00491C78 . |C745 9C 01000>mov dword ptr ss:,0x1
00491C7F . |C745 94 02000>mov dword ptr ss:,0x2
00491C86 . |8D45 BC lea eax,dword ptr ss:
00491C89 . |8985 5CFFFFFF mov dword ptr ss:,eax
00491C8F . |C785 54FFFFFF>mov dword ptr ss:,0x4008
00491C99 . |8D45 94 lea eax,dword ptr ss:
00491C9C . |50 push eax
00491C9D . |8D45 D0 lea eax,dword ptr ss:
00491CA0 . |50 push eax
00491CA1 . |E8 6A2BF7FF call <jmp.&MSVBVM60.__vbaI4Var>
00491CA6 . |50 push eax ; |Start = 0x1
00491CA7 . |8D85 54FFFFFF lea eax,dword ptr ss: ; |
00491CAD . |50 push eax ; |dString8 = 00000001
00491CAE . |8D45 84 lea eax,dword ptr ss: ; |
00491CB1 . |50 push eax ; |RetBUFFER = 00000001
00491CB2 . |E8 132CF7FF call <jmp.&MSVBVM60.#rtcMidCharVar_632>; \rtcMidCharVar
00491CB7 . |C785 3CFFFFFF>mov dword ptr ss:,PDFTiger.004>;D
00491CC1 . |C785 34FFFFFF>mov dword ptr ss:,0x8008
00491CCB . |8D45 84 lea eax,dword ptr ss:
00491CCE . |50 push eax ; /var18 = 00000001
00491CCF . |8D85 34FFFFFF lea eax,dword ptr ss: ; |
00491CD5 . |50 push eax ; |var28 = 00000001
00491CD6 . |E8 052BF7FF call <jmp.&MSVBVM60.__vbaVarTstEq> ; \__vbaVarTstEq
00491CDB . |66:8985 20FFF>mov word ptr ss:,ax
00491CE2 . |8D45 84 lea eax,dword ptr ss:
00491CE5 . |50 push eax
00491CE6 . |8D45 94 lea eax,dword ptr ss:
00491CE9 . |50 push eax
00491CEA . |6A 02 push 0x2
00491CEC . |E8 F52AF7FF call <jmp.&MSVBVM60.__vbaFreeVarList>
00491CF1 . |83C4 0C add esp,0xC
00491CF4 . |0FBF85 20FFFF>movsx eax,word ptr ss:
00491CFB . |85C0 test eax,eax
00491CFD . |74 0C je short PDFTiger.00491D0B
00491CFF . |C745 FC 0D000>mov dword ptr ss:,0xD
00491D06 . |66:834D CC FF or word ptr ss:,0xFFFF
00491D0B > |C745 FC 0F000>mov dword ptr ss:,0xF
00491D12 . |C745 9C 01000>mov dword ptr ss:,0x1
00491D19 . |C745 94 02000>mov dword ptr ss:,0x2
00491D20 . |8D45 BC lea eax,dword ptr ss:
00491D23 . |8985 5CFFFFFF mov dword ptr ss:,eax
00491D29 . |C785 54FFFFFF>mov dword ptr ss:,0x4008
00491D33 . |8D45 94 lea eax,dword ptr ss:
00491D36 . |50 push eax
00491D37 . |8D45 D0 lea eax,dword ptr ss:
00491D3A . |50 push eax
00491D3B . |E8 D02AF7FF call <jmp.&MSVBVM60.__vbaI4Var>
00491D40 . |50 push eax ; |Start = 0x1
00491D41 . |8D85 54FFFFFF lea eax,dword ptr ss: ; |
00491D47 . |50 push eax ; |dString8 = 00000001
00491D48 . |8D45 84 lea eax,dword ptr ss: ; |
00491D4B . |50 push eax ; |RetBUFFER = 00000001
00491D4C . |E8 792BF7FF call <jmp.&MSVBVM60.#rtcMidCharVar_632>; \rtcMidCharVar
00491D51 . |C785 3CFFFFFF>mov dword ptr ss:,PDFTiger.004>;8
00491D5B . |C785 34FFFFFF>mov dword ptr ss:,0x8008
00491D65 . |8D45 84 lea eax,dword ptr ss:
00491D68 . |50 push eax ; /var18 = 00000001
00491D69 . |8D85 34FFFFFF lea eax,dword ptr ss: ; |
00491D6F . |50 push eax ; |var28 = 00000001
00491D70 . |E8 6B2AF7FF call <jmp.&MSVBVM60.__vbaVarTstEq> ; \__vbaVarTstEq
00491D75 . |66:8985 20FFF>mov word ptr ss:,ax
00491D7C . |8D45 84 lea eax,dword ptr ss:
00491D7F . |50 push eax
00491D80 . |8D45 94 lea eax,dword ptr ss:
00491D83 . |50 push eax
00491D84 . |6A 02 push 0x2
00491D86 . |E8 5B2AF7FF call <jmp.&MSVBVM60.__vbaFreeVarList>
00491D8B . |83C4 0C add esp,0xC
00491D8E . |0FBF85 20FFFF>movsx eax,word ptr ss:
00491D95 . |85C0 test eax,eax
00491D97 . |74 0C je short PDFTiger.00491DA5
00491D99 . |C745 FC 10000>mov dword ptr ss:,0x10
00491DA0 . |66:834D C0 FF or word ptr ss:,0xFFFF
00491DA5 > |C745 FC 12000>mov dword ptr ss:,0x12
00491DAC . |C745 9C 01000>mov dword ptr ss:,0x1
00491DB3 . |C745 94 02000>mov dword ptr ss:,0x2
00491DBA . |8D45 BC lea eax,dword ptr ss:
00491DBD . |8985 5CFFFFFF mov dword ptr ss:,eax
00491DC3 . |C785 54FFFFFF>mov dword ptr ss:,0x4008
00491DCD . |8D45 94 lea eax,dword ptr ss:
00491DD0 . |50 push eax
00491DD1 . |8D45 D0 lea eax,dword ptr ss:
00491DD4 . |50 push eax
00491DD5 . |E8 362AF7FF call <jmp.&MSVBVM60.__vbaI4Var>
00491DDA . |50 push eax ; |Start = 0x1
00491DDB . |8D85 54FFFFFF lea eax,dword ptr ss: ; |
00491DE1 . |50 push eax ; |dString8 = 00000001
00491DE2 . |8D45 84 lea eax,dword ptr ss: ; |
00491DE5 . |50 push eax ; |RetBUFFER = 00000001
00491DE6 . |E8 DF2AF7FF call <jmp.&MSVBVM60.#rtcMidCharVar_632>; \rtcMidCharVar
00491DEB . |C785 3CFFFFFF>mov dword ptr ss:,PDFTiger.004>;6
00491DF5 . |C785 34FFFFFF>mov dword ptr ss:,0x8008
00491DFF . |8D45 84 lea eax,dword ptr ss:
00491E02 . |50 push eax ; /var18 = 00000001
00491E03 . |8D85 34FFFFFF lea eax,dword ptr ss: ; |
00491E09 . |50 push eax ; |var28 = 00000001
00491E0A . |E8 D129F7FF call <jmp.&MSVBVM60.__vbaVarTstEq> ; \__vbaVarTstEq
00491E0F . |66:8985 20FFF>mov word ptr ss:,ax
00491E16 . |8D45 84 lea eax,dword ptr ss:
00491E19 . |50 push eax
00491E1A . |8D45 94 lea eax,dword ptr ss:
00491E1D . |50 push eax
00491E1E . |6A 02 push 0x2
00491E20 . |E8 C129F7FF call <jmp.&MSVBVM60.__vbaFreeVarList>
00491E25 . |83C4 0C add esp,0xC
00491E28 . |0FBF85 20FFFF>movsx eax,word ptr ss:
00491E2F . |85C0 test eax,eax
00491E31 . |74 0C je short PDFTiger.00491E3F
00491E33 . |C745 FC 13000>mov dword ptr ss:,0x13
00491E3A . |66:834D C8 FF or word ptr ss:,0xFFFF
00491E3F > |C745 FC 15000>mov dword ptr ss:,0x15
00491E46 . |8D85 F4FEFFFF lea eax,dword ptr ss:
00491E4C . |50 push eax ; /TMPend8 = 00000001
00491E4D . |8D85 04FFFFFF lea eax,dword ptr ss: ; |
00491E53 . |50 push eax ; |TMPstep8 = 00000001
00491E54 . |8D45 D0 lea eax,dword ptr ss: ; |
00491E57 . |50 push eax ; |Counter8 = 00000001
00491E58 . |E8 B52AF7FF call <jmp.&MSVBVM60.__vbaVarForNext> ; \__vbaVarForNext
00491E5D . |8985 D8FEFFFF mov dword ptr ss:,eax
00491E63 > \83BD D8FEFFFF>cmp dword ptr ss:,0x0
00491E6A .^ 0F85 67FDFFFF jnz PDFTiger.00491BD7
关键算法在此。我们不分析算法，在底部f4，观察堆栈即可、
00491E5D .8985 D8FEFFFF mov dword ptr ss:,eax
00491E63 >83BD D8FEFFFF>cmp dword ptr ss:,0x0
00491E6A .^ 0F85 67FDFFFF jnz PDFTiger.00491BD7
16次后跳转不实闲，eax为0
下方悲催了。。。
00491E58 .E8 B52AF7FF call <jmp.&MSVBVM60.__vbaVarForNext> ; \__vbaVarForNext
00491E5D .8985 D8FEFFFF mov dword ptr ss:,eax
00491E63 >83BD D8FEFFFF>cmp dword ptr ss:,0x0
00491E6A .^ 0F85 67FDFFFF jnz PDFTiger.00491BD7
把ebp-0x128的指针给了eax，而ebp-0x128的指针为0.
于是追踪，得到
N752886DV8J1WDHW208586V43Y1NDSW261386FW8N1ADYW102386VS1G6NDD
我擦，什么鬼，但是注册成功了。
static/image/hrline/2.gif
爆破地址：
00491E7C
90909090909066837DCCFF90909090909066837DC0FF90909090909066837DC8FF909090909090
今天我来骗大家的热心，不知能骗多少。{:301_971:}
华视科技 发表于 2016-11-6 21:58
大神，可以发个豪迪的追码过程吗？，那个非常适合我们新手，求大神了
我怎么记得豪迪貌似是网络验证，本地只判断长度 沙发我的，前来支持~~ 楼主有病毒？ 二楼是不是叫板凳，顺便支持下楼主 支持楼主，看了楼主的很多的破解教程，厉害 小白不知道这个用什么用处! 支持老大 我请你吃麻辣烫~~~~~~~ 爆破之后就不上图测试
页:
[1]
2