YY去启动校验,去除多开检测

女孩不可信 发表于 2011-4-23 14:00

本帖最后由女孩不可信于 2011-4-23 14:03 编辑

YY是款语音聊天软件大家都不陌生,官方设置其每台电脑只可以开5个.所以我们就来破解下其多开检测. 方法很简单.

首先：我们先开5个YY,当准备打开第6个的时候会提示如图所示.

看到了吧,这就是限制,知道了问题,我们开始破解它吧.

1.先将YY目录中的duospeak.exe载入OD,运行,这时候会出来一个如图提示

原来YY需要用目录中的Start.exe启动,但这样不方便我们调试,那我们就先破解这个限制吧.

从上面可以知道,两个限制都会弹出对话框提示用户.那我们就从对话框入手.

同样将YY目录中的duospeak.exe载入OD,然后ALT+E,找到模块LayoutWr

然后右击模块,选择查看名称

这时会出来一个窗口,在窗口中找到wnd::CMessageWnd::MessageBoxW,并下好断点.

然后F9运行程序,这时候程序会断下,我们看堆栈窗口,然后反汇编窗口跟随.

这时我们来到00425F91|.834D FC FF OR DWORD PTR SS:,FFFFFFFF

往上翻会找个一个跳转,改成JMP就过了其一个校验.也就是“请使用start 启动YY”

00425EFF /0F85 A0000000 JNZ duospeak.00425FA5
00425F05|. |68 7CF14C00 PUSH duospeak.004CF17C
00425F0A|. |8D4D D4    LEA ECX,DWORD PTR SS:
00425F0D|. |FF15 C89C4C00 CALL DWORD PTR DS:[<&MSVCP71.std::basic_>;MSVCP71.std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >
00425F13|. |8365 FC 00 AND DWORD PTR SS:,0
00425F17|. |68 E4B54C00 PUSH duospeak.004CB5E4                ;UNICODE "ProductName"
00425F1C|. |8D4D B8    LEA ECX,DWORD PTR SS:
00425F1F|. |FF15 C89C4C00 CALL DWORD PTR DS:[<&MSVCP71.std::basic_>;MSVCP71.std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >
00425F25|. |8D45 B8    LEA EAX,DWORD PTR SS:
00425F28|. |50          PUSH EAX
00425F29|. |8D45 9C    LEA EAX,DWORD PTR SS:
00425F2C|. |50          PUSH EAX
00425F2D|. |C645 FC 01 MOV BYTE PTR SS:,1
00425F31|. |E8 AA210800 CALL duospeak.004A80E0
00425F36|. |59          POP ECX
00425F37|. |59          POP ECX
00425F38|. |8BC8       MOV ECX,EAX
00425F3A|. |C645 FC 02 MOV BYTE PTR SS:,2
00425F3E|. |FF15 C09C4C00 CALL DWORD PTR DS:[<&MSVCP71.std::basic_>;MSVCP71.std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::data
00425F44|. |50          PUSH EAX
00425F45|. |8D4D D4    LEA ECX,DWORD PTR SS:
00425F48|. |FF15 F89C4C00 CALL DWORD PTR DS:[<&MSVCP71.std::basic_>;MSVCP71.std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::operator+=
00425F4E|. |8D4D 9C    LEA ECX,DWORD PTR SS:
00425F51|. |C645 FC 01 MOV BYTE PTR SS:,1
00425F55|. |FF15 209B4C00 CALL DWORD PTR DS:[<&MSVCP71.std::basic_>;MSVCP71.std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::~basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >
00425F5B|. |8D4D B8    LEA ECX,DWORD PTR SS:
00425F5E|. |C645 FC 00 MOV BYTE PTR SS:,0
00425F62|. |FF15 209B4C00 CALL DWORD PTR DS:[<&MSVCP71.std::basic_>;MSVCP71.std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::~basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >
00425F68|. |68 78F14C00 PUSH duospeak.004CF178
00425F6D|. |8D4D D4    LEA ECX,DWORD PTR SS:
00425F70|. |FF15 F89C4C00 CALL DWORD PTR DS:[<&MSVCP71.std::basic_>;MSVCP71.std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::operator+=
00425F76|. |6A 00       PUSH 0
00425F78|. |6A 40       PUSH 40
00425F7A|. |68 6CF14C00 PUSH duospeak.004CF16C
00425F7F|. |8D4D D4    LEA ECX,DWORD PTR SS:
00425F82|. |FF15 C09C4C00 CALL DWORD PTR DS:[<&MSVCP71.std::basic_>;MSVCP71.std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::data
00425F88|. |50          PUSH EAX
00425F89|. |6A 00       PUSH 0
00425F8B|. |FF15 08944C00 CALL DWORD PTR DS:[<&LayoutWrapper.wnd::>;LayoutWr.wnd::CMessageWnd::MessageBoxW
00425F91|. |834D FC FF OR DWORD PTR SS:,FFFFFFFF
00425F95|. |83C4 14    ADD ESP,14
00425F98|. |8D4D D4    LEA ECX,DWORD PTR SS:
00425F9B|. |FF15 209B4C00 CALL DWORD PTR DS:[<&MSVCP71.std::basic_>;MSVCP71.std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::~basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >
00425FA1|. |33C0       XOR EAX,EAX
00425FA3|. |EB 03       JMP SHORT duospeak.00425FA8
00425FA5|> \33C0       XOR EAX,EAX

第二个就是多开校验了.重新载入OD,先将第一个校验去除,00425EFF|. /0F85 A0000000 JNZ duospeak.00425FA5
将它改成JMP.然后同样方法找wnd::CMessageWnd::MessageBoxW,并下好断点.

断下之后查看堆栈窗口

0012FE2C 00426464返回到 duospeak.00426464 来自 LayoutWr.wnd::CMessageWnd::MessageBoxW

我们返回到00426464

00426446 . /74 2D       JE SHORT duospeak.00426475
00426448 . |807D F0 00 CMP BYTE PTR SS:,0
0042644C . |75 20       JNZ SHORT duospeak.0042646E
0042644E . |6A 00       PUSH 0
00426450 . |6A 40       PUSH 40
00426452 . |68 A0C34C00 PUSH duospeak.004CC3A0
00426457 . |68 0CF24C00 PUSH duospeak.004CF20C
0042645C . |6A 00       PUSH 0
0042645E . |FF15 08944C00 CALL DWORD PTR DS:[<&LayoutWrapper.wnd::>;LayoutWr.wnd::CMessageWnd::MessageBoxW
00426464 . |83C4 14    ADD ESP,14
00426467 . |8BCE       MOV ECX,ESI
00426469 . |E8 2BCEFFFF CALL duospeak.00423299
0042646E > |33C0       XOR EAX,EAX
00426470 . |E9 3E010000 JMP duospeak.004265B3
00426475 > \8BCE       MOV ECX,ESI

上面有两个跳转,将JE改成jmp即可去除多开校验.

所以我们只要修改00426446改成JMP即可,然后复制到可执行文件-所有修改-全部复制-右键保存文件-保存. 这样YY3.0多开校验就可以去除了.

方法很简单,我描述的可能不怎么详细,见谅.

892644330 发表于 2011-4-23 14:15

洪星-魔神 发表于 2011-4-23 15:15

好，顶下啊！

zxc1314 发表于 2011-4-23 15:21

看到了,这方法挺好的.

oxoxx01 发表于 2011-4-23 15:46

哇，好厉害啊，直接破YY客户端，呵呵

1015274595 发表于 2011-4-23 15:48

更简便的、用YY多开器

qq2420444 发表于 2011-4-23 16:20

本帖最后由 qq2420444 于 2011-4-23 16:20 编辑

不错噢,学习......不过仅仅这样多开肯定会掉线的.

coolfire1983 发表于 2011-4-23 17:07

学习了谢谢楼主分享啊！

baster 发表于 2011-4-23 17:36

感谢分享{:1_921:}

chesion001 发表于 2011-4-23 18:28

{:301_975:} 楼主好生牛逼的 //

页: [1] 2 3

吾爱破解 - 52pojie.cn's Archiver

YY去启动校验,去除多开检测