看我破解Internet Download Manager 5.17

kernel2008 · 发表于 2009-5-4 18:01

【用到工具】OD，Peid
【调试环境】Win2K3 SP2
【目标程序】Internet Download Manager 5.17
【下载链接】http://www.internetdownloadmanager.com
【文章出处】http://zzm139138.blog.163.com
【文字记录】Kernel2008
【一点说明】原创内容，转载请注明文章出处，谢谢！

使用Peid查壳：

Microsoft Visual C++ 6.0 [Overlay]

可知，程序无壳，且是用VC写的程序，使用Peid的插件扫描下一些算法（如图）：

下面使用回溯法Cracked IT：
载入目标程序于OD中，F9运行程序，先把程序跑起来，在来到注册对话框，任意输入注册信息，但是格式一定要输入正确
输入后点击注册按钮，出现错误提示，很好，F12暂停，ALT+K打开显示调用堆栈，如下：

地址    堆栈    程序过程 / 参数                      调用来自                   结构
0012B560 77E2BF53 包含 ntdll.KiFastSystemCallRet       USER32.77E2BF51             0012B594
0012B564 77E2610A USER32.WaitMessage                   USER32.77E26105             0012B594
0012B598 77E1965E USER32.77E26023                      USER32.77E19659             0012B594
0012B5C0 77E2F762 USER32.77E195A8                      USER32.77E2F75D             0012B5BC
0012B880 77E2F047 USER32.SoftModalMessageBox          USER32.77E2F042             0012B87C
0012B9D0 77E2EEC9 USER32.77E2EED2                      USER32.77E2EEC4             0012B9CC
0012BA28 77E67D0D USER32.MessageBoxTimeoutW          USER32.77E67D08             0012BA24
0012BA5C 77E542C8 ? USER32.MessageBoxTimeoutA          USER32.77E542C3             0012BA58
0012BA7C 77E542A4 ? USER32.MessageBoxExA             USER32.77E5429F             0012BA78
0012BA80 001405EE    hOwner = 001405EE ('Internet Downl
0012BA84 00EBC600    Text = "You have entered incorrect
0012BA88 005D0FB8    Title = "Internet Download Manager
0012BA8C 00000000    Style = MB_OK|MB_APPLMODAL
0012BA90 00000000    LanguageID = 0 (LANG_NEUTRAL)
0012BA98 0054C0B6 ? USER32.MessageBoxA                IDMan.0054C0B0             0012BA94
0012BA9C 001405EE    hOwner = 001405EE ('Internet Downl
0012BAA0 00EBC600    Text = "You have entered incorrect
0012BAA4 005D0FB8    Title = "Internet Download Manager
0012BAA8 00000000    Style = MB_OK|MB_APPLMODAL
0012BAB0 004AF3A7 ? IDMan.0054C088                   IDMan.004AF3A2 //在这里显示调用.
0012BAB4 00EBC600    Arg1 = 00EBC600 ASCII "You have en
0012BAB8 005D0FB8    Arg2 = 005D0FB8 ASCII "Internet Do
0012BABC 00000000    Arg3 = 00000000

来到下面代码处:

004AF3A0  |> /8BCB       MOV ECX,EBX
004AF3A2  |> |E8 E1CC0900 CALL IDMan.0054C088
004AF3A7  |. |8B4D F4    MOV ECX,DWORD PTR SS:[EBP-C]
004AF3AA  |. |64:890D 00000>MOV DWORD PTR FS:[0],ECX

注意提示信息:
0054C088=IDMan.0054C088
跳转来自 004AF67D, 004AF6F4, 004AF78D
说明：我们必须不能让程序从004AF67D, 004AF6F4, 004AF78D跳转过来，所以下面往下跟踪时一定要注意！

往上找,正好前面有一个跳转语句,就此下断点(如下):

004AF38F  |.  85C0       TEST EAX,EAX
004AF391  |.  75 25       JNZ SHORT IDMan.004AF3B8    //此处的跳转语句
004AF393  |.  8B0D 705B5F00 MOV ECX,DWORD PTR DS:[5F5B70]
004AF399  |.  50          PUSH EAX
004AF39A  |.  68 B80F5D00 PUSH IDMan.005D0FB8             ;  ASCII "Internet Download Manager"
004AF39F  |>  51          PUSH ECX
004AF3A0  |>  8BCB       MOV ECX,EBX
004AF3A2  |>  E8 E1CC0900 CALL IDMan.0054C088
004AF3A7  |.  8B4D F4    MOV ECX,DWORD PTR SS:[EBP-C]
004AF3AA  |.  64:890D 00000>MOV DWORD PTR FS:[0],ECX

重新F9一下,再次点击注册,断在004AF391处的跳转语句并该跳转实现,F8往下跟踪

004AF391    /75 25       JNZ SHORT IDMan.004AF3B8
004AF393    |8B0D 705B5F00 MOV ECX,DWORD PTR DS:[5F5B70]

004AF3CD    85C0       TEST EAX,EAX
004AF3CF    75 0E       JNZ SHORT IDMan.004AF3DF       ;  为不让下面的JMP无条件跳转实现，这里改为JMP.
004AF3D1    50          PUSH EAX
004AF3D2    A1 6C5B5F00 MOV EAX,DWORD PTR DS:[5F5B6C]
004AF3D7    68 B80F5D00 PUSH IDMan.005D0FB8             ;  ASCII "Internet Download Manager"
004AF3DC    50          PUSH EAX
004AF3DD ^ EB C1       JMP SHORT IDMan.004AF3A0
004AF3DF    8D8D F4FEFFFF LEA ECX,DWORD PTR SS:[EBP-10C]
004AF3E5    6A 32       PUSH 32                         ; /Arg3 = 00000032
004AF3E7    51          PUSH ECX                         ; |Arg2
004AF3E8    68 A5040000 PUSH 4A5                         ; |Arg1 = 000004A5
004AF3ED    8BCB       MOV ECX,EBX                      ; |
004AF3EF    E8 3DE60900 CALL IDMan.0054DA31             ; IDMan.0054DA31
004AF3F4    85C0       TEST EAX,EAX
004AF3F6    75 0F       JNZ SHORT IDMan.004AF407       ;  为不让下面的JMP无条件跳转实现，这里改为JMP.
004AF3F8    8B15 685B5F00 MOV EDX,DWORD PTR DS:[5F5B68]
004AF3FE    50          PUSH EAX
004AF3FF    68 B80F5D00 PUSH IDMan.005D0FB8             ;  ASCII "Internet Download Manager"
004AF404    52          PUSH EDX
004AF405 ^ EB 99       JMP SHORT IDMan.004AF3A0
004AF407    8D85 7CFFFFFF LEA EAX,DWORD PTR SS:[EBP-84]
004AF40D    6A 32       PUSH 32                         ; /Arg3 = 00000032
004AF40F    50          PUSH EAX                         ; |Arg2
004AF410    68 AA040000 PUSH 4AA                         ; |Arg1 = 000004AA
004AF415    8BCB       MOV ECX,EBX                      ; |
004AF417    E8 15E60900 CALL IDMan.0054DA31             ; IDMan.0054DA31
004AF41C    85C0       TEST EAX,EAX
004AF41E    75 11       JNZ SHORT IDMan.004AF431       ;  为不让下面的JMP无条件跳转实现，这里改为JMP.
004AF420    8B0D 645B5F00 MOV ECX,DWORD PTR DS:[5F5B64]
004AF426    50          PUSH EAX
004AF427    68 B80F5D00 PUSH IDMan.005D0FB8             ;  ASCII "Internet Download Manager"
004AF42C ^ E9 6EFFFFFF JMP IDMan.004AF39F

004AF4A7    75 12       JNZ SHORT IDMan.004AF4BB       ;  为不让下面的JMP无条件跳转实现，这里改为JMP.
004AF4A9    8B0D 605B5F00 MOV ECX,DWORD PTR DS:[5F5B60]
004AF4AF    6A 00       PUSH 0
004AF4B1    68 B80F5D00 PUSH IDMan.005D0FB8             ;  ASCII "Internet Download Manager"
004AF4B6 ^ E9 E4FEFFFF JMP IDMan.004AF39F

004AF509    F7D1       NOT ECX
004AF50B    49          DEC ECX
004AF50C    83F9 17    CMP ECX,17
004AF50F ^ 75 98       JNZ SHORT IDMan.004AF4A9       ;  这个是关键，不能让它实现。
004AF511    8A4D 81    MOV CL,BYTE PTR SS:[EBP-7F]
004AF514    8845 EF    MOV BYTE PTR SS:[EBP-11],AL
004AF517    B0 2D       MOV AL,2D
004AF519    3AC8       CMP CL,AL

      ************************************************************

004AF631    33FF       XOR EDI,EDI
004AF633    33F6       XOR ESI,ESI
004AF635    83FE 05    CMP ESI,5
004AF638    7D 2B       JGE SHORT IDMan.004AF665       ;  这里改为JMP，因为后面的循环会跳入错误提示，过跳过循环
004AF63A    8A5435 B0    MOV DL,BYTE PTR SS:[EBP+ESI-50]
004AF63E    83C9 FF    OR ECX,FFFFFFFF
004AF641    33C0       XOR EAX,EAX
004AF643    83F8 24    /CMP EAX,24
004AF646    7D 0A       |JGE SHORT IDMan.004AF652
004AF648    3890 34545F00 |CMP BYTE PTR DS:[EAX+5F5434],DL
004AF64E    75 12       |JNZ SHORT IDMan.004AF662
004AF650    8BC8       |MOV ECX,EAX
004AF652    83F9 FF    |CMP ECX,-1
004AF655    74 15       |JE SHORT IDMan.004AF66C       ;  往下看，这里实现的话会跳向错误提示，故这个循环就不要了，在前面跳过）
004AF657    8D04FF       |LEA EAX,DWORD PTR DS:[EDI+EDI*8]
004AF65A    03CF       |ADD ECX,EDI
004AF65C    46          |INC ESI
004AF65D    8D3C81       |LEA EDI,DWORD PTR DS:[ECX+EAX*4]
004AF660 ^ EB D3       |JMP SHORT IDMan.004AF635
004AF662    40          |INC EAX
004AF663 ^ EB DE       JMP SHORT IDMan.004AF643
004AF665    8A45 EF    MOV AL,BYTE PTR SS:[EBP-11]
004AF668    84C0       TEST AL,AL
004AF66A    74 16       JE SHORT IDMan.004AF682          ;  为不让下面的JMP无条件跳转实现，这里改为JMP.
004AF66C    8B0D 605B5F00 MOV ECX,DWORD PTR DS:[5F5B60]
004AF672    6A 00       PUSH 0
004AF674    68 B80F5D00 PUSH IDMan.005D0FB8             ;  ASCII "Internet Download Manager"
004AF679    51          PUSH ECX
004AF67A    8B4D C8    MOV ECX,DWORD PTR SS:[EBP-38]
004AF67D ^ E9 20FDFFFF JMP IDMan.004AF3A2

004AF6D4    85D2       TEST EDX,EDX
004AF6D6    75 0B       JNZ SHORT IDMan.004AF6E3       ;  这两句跳转NOP掉，不能让下面的无条件跳转实现跳向错误提示
004AF6D8    85FF       TEST EDI,EDI
004AF6DA    74 07       JE SHORT IDMan.004AF6E3
004AF6DC    8A45 EF    MOV AL,BYTE PTR SS:[EBP-11]
004AF6DF    84C0       TEST AL,AL
004AF6E1    74 16       JE SHORT IDMan.004AF6F9          ;  为不让下面的JMP无条件跳转实现，这里改为JMP.
004AF6E3    8B15 605B5F00 MOV EDX,DWORD PTR DS:[5F5B60]
004AF6E9    8B4D C8    MOV ECX,DWORD PTR SS:[EBP-38]
004AF6EC    6A 00       PUSH 0
004AF6EE    68 B80F5D00 PUSH IDMan.005D0FB8             ;  ASCII "Internet Download Manager"
004AF6F3    52          PUSH EDX
004AF6F4 ^ E9 A9FCFFFF JMP IDMan.004AF3A2
004AF6F9    8D45 C4    LEA EAX,DWORD PTR SS:[EBP-3C]
004AF6FC    6A 00       PUSH 0                         ; /pDisposition = NULL
004AF6FE    50          PUSH EAX                         ; |pHandle
004AF6FF    6A 00       PUSH 0                         ; |pSecurity = NULL
004AF701    68 3F000F00 PUSH 0F003F                      ; |Access = KEY_ALL_ACCESS
004AF706    6A 00       PUSH 0                         ; |Options = REG_OPTION_NON_VOLATILE
004AF708    6A 00       PUSH 0                         ; |Class = NULL
004AF70A    6A 00       PUSH 0                         ; |Reserved = 0
004AF70C    68 A00D5D00 PUSH IDMan.005D0DA0             ; |Subkey = "SOFTWAREInternet Download Manager"
004AF711    68 02000080 PUSH 80000002                   ; |hKey = HKEY_LOCAL_MACHINE
004AF716    FF15 0C505700 CALL DWORD PTR DS:[<&ADVAPI32.Reg>; RegCreateKeyExA
004AF71C    85C0       TEST EAX,EAX                   ;  下面就是把注册信息写入注册表中了
004AF71E    74 09       JE SHORT IDMan.004AF729
004AF720    8B0D E0505F00 MOV ECX,DWORD PTR DS:[5F50E0]
004AF726    894D C4    MOV DWORD PTR SS:[EBP-3C],ECX
004AF729    8DBD C0FEFFFF LEA EDI,DWORD PTR SS:[EBP-140]
004AF72F    83C9 FF    OR ECX,FFFFFFFF
004AF732    33C0       XOR EAX,EAX
004AF734    8B15 F4545F00 MOV EDX,DWORD PTR DS:[5F54F4]
004AF73A    F2:AE       REPNE SCAS BYTE PTR ES:[EDI]
004AF73C    8B35 08505700 MOV ESI,DWORD PTR DS:[<&ADVAPI32.>;  ADVAPI32.RegSetValueExA
004AF742    8D85 C0FEFFFF LEA EAX,DWORD PTR SS:[EBP-140]
004AF748    F7D1       NOT ECX
004AF74A    51          PUSH ECX                         ; /BufSize
004AF74B    8B4D C4    MOV ECX,DWORD PTR SS:[EBP-3C]    ; |
004AF74E    50          PUSH EAX                         ; |Buffer
004AF74F    6A 01       PUSH 1                         ; |ValueType = REG_SZ
004AF751    6A 00       PUSH 0                         ; |Reserved = 0
004AF753    52          PUSH EDX                         ; |ValueName => "FName"
004AF754    51          PUSH ECX                         ; |hKey
004AF755    FFD6       CALL ESI                         ; RegSetValueExA
004AF757    85C0       TEST EAX,EAX
004AF759    74 37       JE SHORT IDMan.004AF792          ;  这里改为JMP，强行跳过错误提示。
004AF75B    50          PUSH EAX
004AF75C    8D95 40FEFFFF LEA EDX,DWORD PTR SS:[EBP-1C0]
004AF762    68 00645E00 PUSH IDMan.005E6400             ;  ASCII "Reg err1 in CRgDlg::OnOk, err = %ld"
004AF767    52          PUSH EDX

004AF7BA    85C0       TEST EAX,EAX
004AF7BC    74 1A       JE SHORT IDMan.004AF7D8          ;  这里改为JMP，强行跳过错误提示。
004AF7BE    50          PUSH EAX
004AF7BF    8D95 40FEFFFF LEA EDX,DWORD PTR SS:[EBP-1C0]
004AF7C5    68 DC635E00 PUSH IDMan.005E63DC             ;  ASCII "Reg err2 in CRgDlg::OnOk, err = %ld"
004AF7CA    52          PUSH EDX

004AF800    85C0       TEST EAX,EAX
004AF802    74 1D       JE SHORT IDMan.004AF821          ;  这里改为JMP，强行跳过错误提示。
004AF804    50          PUSH EAX
004AF805    8D95 40FEFFFF LEA EDX,DWORD PTR SS:[EBP-1C0]
004AF80B    68 B8635E00 PUSH IDMan.005E63B8             ;  ASCII "Reg err3 in CRgDlg::OnOk, err = %ld"
004AF810    52          PUSH EDX
004AF811    E8 B23D0800 CALL IDMan.005335C8

004AF849    85C0       TEST EAX,EAX
004AF84B    74 1D       JE SHORT IDMan.004AF86A          ;  这里改为JMP，强行跳过错误提示。
004AF84D    50          PUSH EAX
004AF84E    8D95 40FEFFFF LEA EDX,DWORD PTR SS:[EBP-1C0]
004AF854    68 94635E00 PUSH IDMan.005E6394             ;  ASCII "Reg err4 in CRgDlg::OnOk, err = %ld"
004AF859    52          PUSH EDX
004AF85A    E8 693D0800 CALL IDMan.005335C8
004AF85F    8D85 40FEFFFF LEA EAX,DWORD PTR SS:[EBP-1C0]

F9运行程序。注册按钮已经变灰，功能限制已经无，可是重启程序，程序仍是未注册的，这说明软件注册验证方式是重启验证。
通过前面的分析已经知道软件的注册信息会保存在注册表中，那么我们在注册表中搜索下已确认我们的判断，结果验证了我们的分析。
说明：注册信息保存在SOFTWAREInternet Download Manager项下。

使用OD重新加载程序，在OD命令行下断点：bp RegOpenKeyExA，F9N次后，到达返回时间（注意看OD数据窗口）

0012E50C 00429911  /CALL 到 RegOpenKeyExA 来自 IDMan.0042990B
0012E510 80000002  |hKey = HKEY_LOCAL_MACHINE
0012E514 00EC8D28  |Subkey = "SOFTWAREInternet Download Manager"
0012E518 00000000  |Reserved = 0
0012E51C 00000001  |Access = KEY_QUERY_VALUE
0012E520 0012EE70  pHandle = 0012EE70

ALT+F9返回到程序领空，下面就是开始跟踪并分析了。

先使用OD插件搜索字符串，我个人根据经验在但凡有Invalid serial number字符串则F2下断

返回到下面代码处，下面则F8往下跟踪分析：
0042990B .  FF15 04505700 CALL DWORD PTR DS:[<&ADVAPI32.RegOpenKeyEx>; RegOpenKeyExA
00429911 .  85C0       TEST EAX,EAX
00429913 .  BF 32000000 MOV EDI,32
00429918 .  0F85 A8000000 JNZ IDMan.004299C6
0042991E .  8B0D F4545F00 MOV ECX,DWORD PTR DS:[5F54F4]
00429924 .  8B35 00505700 MOV ESI,DWORD PTR DS:[<&ADVAPI32.RegQueryV>;  ADVAPI32.RegQueryValueExA
0042992A .  8D55 E8    LEA EDX,DWORD PTR SS:[EBP-18]
0042992D .  8D85 ECFDFFFF LEA EAX,DWORD PTR SS:[EBP-214]
00429933 .  52          PUSH EDX                                  ; /pBufSize
00429934 .  8B55 EC    MOV EDX,DWORD PTR SS:[EBP-14]             ; |
00429937 .  50          PUSH EAX                                  ; |Buffer
00429938 .  6A 00       PUSH 0                                  ; |pValueType = NULL
0042993A .  6A 00       PUSH 0                                  ; |Reserved = NULL
0042993C .  51          PUSH ECX                                  ; |ValueName => "FName"

004299EF .  85C0       TEST EAX,EAX
004299F1    0F85 C6000000 JNZ IDMan.00429ABD             ;  跳转没有实现
004299F7 .  84DB       TEST BL,BL                      ;  下面读取用户第一名称，不能让下面跳转实现
004299F9    75 2A       JNZ SHORT IDMan.00429A25       ;  跳转实现
004299FB .  8B0D F4545F00 MOV ECX,DWORD PTR DS:[5F54F4]
00429A01 .  8D55 E8    LEA EDX,DWORD PTR SS:[EBP-18]
00429A04 .  8D85 ECFDFFFF LEA EAX,DWORD PTR SS:[EBP-214]
00429A0A .  52          PUSH EDX
00429A0B .  8B55 EC    MOV EDX,DWORD PTR SS:[EBP-14]
00429A0E .  50          PUSH EAX
00429A0F .  6A 00       PUSH 0
00429A11 .  6A 00       PUSH 0
00429A13 .  51          PUSH ECX
00429A14 .  52          PUSH EDX
00429A15 .  897D E8    MOV DWORD PTR SS:[EBP-18],EDI
00429A18 .  FFD6       CALL ESI
00429A1A .  85C0       TEST EAX,EAX
00429A1C    74 07       JE SHORT IDMan.00429A25
00429A1E .  C745 DC 05000>MOV DWORD PTR SS:[EBP-24],5
00429A25 >  8A45 E2    MOV AL,BYTE PTR SS:[EBP-1E]
00429A28 .  BB 05000000 MOV EBX,5
00429A2D .  84C0       TEST AL,AL                      ;  下面读取用户最后名称，不能让下面跳转实现
00429A2F    75 26       JNZ SHORT IDMan.00429A57       ;  跳转实现
00429A31 .  8B15 F0545F00 MOV EDX,DWORD PTR DS:[5F54F0]
00429A37 .  8D45 E8    LEA EAX,DWORD PTR SS:[EBP-18]
00429A3A .  8D8D 54FEFFFF LEA ECX,DWORD PTR SS:[EBP-1AC]
00429A40 .  50          PUSH EAX
00429A41 .  8B45 EC    MOV EAX,DWORD PTR SS:[EBP-14]
00429A44 .  51          PUSH ECX
00429A45 .  6A 00       PUSH 0
00429A47 .  6A 00       PUSH 0
00429A49 .  52          PUSH EDX
00429A4A .  50          PUSH EAX
00429A4B .  897D E8    MOV DWORD PTR SS:[EBP-18],EDI
00429A4E .  FFD6       CALL ESI
00429A50 .  85C0       TEST EAX,EAX
00429A52 .  74 03       JE SHORT IDMan.00429A57
00429A54 .  895D DC    MOV DWORD PTR SS:[EBP-24],EBX
00429A57 >  8A45 E1    MOV AL,BYTE PTR SS:[EBP-1F]
00429A5A .  84C0       TEST AL,AL                      ;  下面读取邮箱信息，不能让下面跳转实现
00429A5C    75 25       JNZ SHORT IDMan.00429A83       ;  跳转实现
00429A5E .  A1 EC545F00 MOV EAX,DWORD PTR DS:[5F54EC]
00429A63 .  8D4D E8    LEA ECX,DWORD PTR SS:[EBP-18]
00429A66 .  8D95 20FEFFFF LEA EDX,DWORD PTR SS:[EBP-1E0]
00429A6C .  51          PUSH ECX
00429A6D .  8B4D EC    MOV ECX,DWORD PTR SS:[EBP-14]
00429A70 .  52          PUSH EDX
00429A71 .  6A 00       PUSH 0
00429A73 .  6A 00       PUSH 0
00429A75 .  50          PUSH EAX
00429A76 .  51          PUSH ECX
00429A77 .  897D E8    MOV DWORD PTR SS:[EBP-18],EDI
00429A7A .  FFD6       CALL ESI
00429A7C .  85C0       TEST EAX,EAX
00429A7E .  74 03       JE SHORT IDMan.00429A83
00429A80 .  895D DC    MOV DWORD PTR SS:[EBP-24],EBX
00429A83 >  8A45 E3    MOV AL,BYTE PTR SS:[EBP-1D]
00429A86 .  84C0       TEST AL,AL                      ;  下面读取注册码信息，不能让下面跳转实现
00429A88    75 29       JNZ SHORT IDMan.00429AB3       ;  原来实现，这里不能让它实现跳转
00429A8A .  8B0D F8545F00 MOV ECX,DWORD PTR DS:[5F54F8]
00429A90 .  8D55 E8    LEA EDX,DWORD PTR SS:[EBP-18]

00429AA6 .  85C0       TEST EAX,EAX
00429AA8 .  74 05       JE SHORT IDMan.00429AAF
00429AAA .  895D DC    MOV DWORD PTR SS:[EBP-24],EBX
00429AAD .  EB 04       JMP SHORT IDMan.00429AB3
00429AAF >  C645 E3 01 MOV BYTE PTR SS:[EBP-1D],1
00429AB3 >  8B45 EC    MOV EAX,DWORD PTR SS:[EBP-14]
00429AB6 .  50          PUSH EAX                         ; /hKey
00429AB7 .  FF15 54505700 CALL DWORD PTR DS:[<&ADVAPI32.Reg>; RegCloseKey
00429ABD >  8A5D E3    MOV BL,BYTE PTR SS:[EBP-1D]
00429AC0 .  84DB       TEST BL,BL
00429AC2 .  74 2E       JE SHORT IDMan.00429AF2
00429AC4 .  8D7D 88    LEA EDI,DWORD PTR SS:[EBP-78]
00429AC7 .  83C9 FF    OR ECX,FFFFFFFF
00429ACA .  33C0       XOR EAX,EAX
00429ACC .  F2:AE       REPNE SCAS BYTE PTR ES:[EDI]
00429ACE .  F7D1       NOT ECX
00429AD0 .  49          DEC ECX
00429AD1 .  83F9 17    CMP ECX,17
00429AD4    75 1C       JNZ SHORT IDMan.00429AF2       ;  下面的跳转都不能让它实现，NOP掉。
00429AD6 .  807D 8D 2D CMP BYTE PTR SS:[EBP-73],2D
00429ADA    75 16       JNZ SHORT IDMan.00429AF2       ;  NOP掉
00429ADC .  807D 93 2D CMP BYTE PTR SS:[EBP-6D],2D
00429AE0    75 10       JNZ SHORT IDMan.00429AF2       ;  NOP掉
00429AE2 .  807D 99 2D CMP BYTE PTR SS:[EBP-67],2D
00429AE6    75 0A       JNZ SHORT IDMan.00429AF2       ;  NOP掉
00429AE8 .  C705 D83E5D00>MOV DWORD PTR DS:[5D3ED8],0
00429AF2 >  8D4D CC    LEA ECX,DWORD PTR SS:[EBP-34]
00429AF5 .  E8 66360800 CALL IDMan.004AD160
00429AFA .  8D4D BC    LEA ECX,DWORD PTR SS:[EBP-44]
00429AFD .  C645 FC 02 MOV BYTE PTR SS:[EBP-4],2
00429B01 .  E8 5A360800 CALL IDMan.004AD160
00429B06 .  A1 D83E5D00 MOV EAX,DWORD PTR DS:[5D3ED8]
00429B0B .  C645 FC 03 MOV BYTE PTR SS:[EBP-4],3
00429B0F .  85C0       TEST EAX,EAX                   ;  下面的跳转实现，这里不能让它实现
00429B11    0F85 B3010000 JNZ IDMan.00429CCA
00429B17 .  A1 D0505F00 MOV EAX,DWORD PTR DS:[5F50D0]
00429B1C .  8B15 B0575F00 MOV EDX,DWORD PTR DS:[5F57B0]
00429B22 .  8B3D 04505700 MOV EDI,DWORD PTR DS:[<&ADVAPI32.>;  ADVAPI32.RegOpenKeyExA
00429B28 .  8D4D EC    LEA ECX,DWORD PTR SS:[EBP-14]
00429B2B .  F7D8       NEG EAX
00429B2D .  51          PUSH ECX                         ; /pHandle
00429B2E .  6A 01       PUSH 1                         ; |Access = KEY_QUERY_VALUE
00429B30 .  1BC0       SBB EAX,EAX                      ; |
00429B32 .  6A 00       PUSH 0                         ; |Reserved = 0
00429B34 .  05 02000080 ADD EAX,80000002                ; |
00429B39 .  52          PUSH EDX                         ; |Subkey => "SoftwareClassesCLSID{6DDF00DB-1234-46EC-8356-27E7B2051192}"
00429B3A .  50          PUSH EAX                         ; |hKey
00429B3B .  FFD7       CALL EDI                         ; RegOpenKeyExA
00429B3D .  8BF0       MOV ESI,EAX
00429B3F .  85F6       TEST ESI,ESI
00429B41    0F84 81000000 JE IDMan.00429BC8                ;  原来实现，这里不能让它实现跳转
00429B47 .  83FE 02    CMP ESI,2
00429B4A .  74 78       JE SHORT IDMan.00429BC4
00429B4C .  8B0D AC065F00 MOV ECX,DWORD PTR DS:[5F06AC]    ;  IDMan.005F06C0
00429B52 .  894D E4    MOV DWORD PTR SS:[EBP-1C],ECX
00429B55 .  A1 D0505F00 MOV EAX,DWORD PTR DS:[5F50D0]
00429B5A .  C645 FC 04 MOV BYTE PTR SS:[EBP-4],4
00429B5E .  85C0       TEST EAX,EAX                   ;  下面的字符是很可疑的，经验告诉我^_^
00429B60 .  B8 74305D00 MOV EAX,IDMan.005D3074          ;  current_user
00429B65 .  75 05       JNZ SHORT IDMan.00429B6C
00429B67 .  B8 6C305D00 MOV EAX,IDMan.005D306C          ;  machinecurrent_user
00429B6C >  8B15 B0575F00 MOV EDX,DWORD PTR DS:[5F57B0]
00429B72 .  52          PUSH EDX
00429B73 .  50          PUSH EAX
00429B74 .  8D45 E4    LEA EAX,DWORD PTR SS:[EBP-1C]    ;  下面的字符是很可疑的，经验告诉我^_^
00429B77 .  68 8C185D00 PUSH IDMan.005D188C             ;  %s%s
00429B7C .  50          PUSH EAX
00429BEF .  1BC0       SBB EAX,EAX
00429BF1 .  40          INC EAX
00429BF2 .  8945 E4    MOV DWORD PTR SS:[EBP-1C],EAX
00429BF5    0F85 E8010000 JNZ IDMan.00429DE3             ;  原来实现，这里不能让它实现跳转
00429BFB >  8D55 EC    LEA EDX,DWORD PTR SS:[EBP-14]
00429BFE .  6A 00       PUSH 0                         ; /pDisposition = NULL
00429C00 .  8B35 0C505700 MOV ESI,DWORD PTR DS:[<&ADVAPI32.>; |ADVAPI32.RegCreateKeyExA
00429C06 .  52          PUSH EDX                         ; |pHandle
00429C07 .  6A 00       PUSH 0                         ; |pSecurity = NULL
00429C09 .  68 3F000F00 PUSH 0F003F                      ; |Access = KEY_ALL_ACCESS
00429C0E .  6A 00       PUSH 0                         ; |Options = REG_OPTION_NON_VOLATILE
00429C10 .  6A 00       PUSH 0                         ; |Class = NULL
00429C12 .  6A 00       PUSH 0                         ; |Reserved = 0
00429C14 .  68 24305D00 PUSH IDMan.005D3024             ; |softwareclassesclsid{d5b91409-a8ca-4973-9a0b-59f713d25671}
00429C19 .  68 01000080 PUSH 80000001                   ; |hKey = HKEY_CURRENT_USER
00429C1E .  FFD6       CALL ESI                         ; RegCreateKeyExA
00429C20 .  85C0       TEST EAX,EAX
00429C22    74 7C       JE SHORT IDMan.00429CA0          ;  原来实现，这里不能让它实现跳转
00429C24 .  A1 AC065F00 MOV EAX,DWORD PTR DS:[5F06AC]
00429C29 .  8945 E4    MOV DWORD PTR SS:[EBP-1C],EAX
00429C2C .  68 24305D00 PUSH IDMan.005D3024             ;  softwareclassesclsid{d5b91409-a8ca-4973-9a0b-59f713d25671}
00429C31 .  8D4D E4    LEA ECX,DWORD PTR SS:[EBP-1C]
00429C34 .  68 14305D00 PUSH IDMan.005D3014             ;  current_user%ssoftwareclassesclsid{d5b91409-a8ca-4973-9a0b-59f713d25671}
00429C39 .  51          PUSH ECX
00429C3A .  C645 FC 05 MOV BYTE PTR SS:[EBP-4],5
00429C3E .  E8 67D21100 CALL IDMan.00546EAA
00429C43 .  8B55 E4    MOV EDX,DWORD PTR SS:[EBP-1C]
00429C46 .  83C4 0C    ADD ESP,0C
00429C49 .  8D4D BC    LEA ECX,DWORD PTR SS:[EBP-44]
00429C4C .  52          PUSH EDX
00429C4D .  E8 BE350800 CALL IDMan.004AD210
00429C52 .  85C0       TEST EAX,EAX
00429C54    75 11       JNZ SHORT IDMan.00429C67       ;  原来实现，这里不能让它实现跳转
00429C56 .  8D4D E4    LEA ECX,DWORD PTR SS:[EBP-1C]
00429C59 .  C645 FC 03 MOV BYTE PTR SS:[EBP-4],3
00429C5D .  E8 32441200 CALL IDMan.0054E094
00429C62 .  E9 74080000 JMP IDMan.0042A4DB

至此F9运行程序,断到下面处代码,即是对序列号检测(经验告诉我的^_^,前面已下好的断点)

00430F73    /74 4B       JE SHORT IDMan.00430FC0
00430F75  |. |8DB5 4CFEFFFF LEA ESI,DWORD PTR SS:[E>
00430F7B  |. |8D45 90    LEA EAX,DWORD PTR SS:[E>
00430F7E  |> |8A10       /MOV DL,BYTE PTR DS:[EA>
00430F80  |. |8A1E       |MOV BL,BYTE PTR DS:[ES>
00430F82  |. |8ACA       |MOV CL,DL
00430F84  |. |3AD3       |CMP DL,BL
00430F86  |. |75 1E       |JNZ SHORT IDMan.00430F>
00430F88  |. |84C9       |TEST CL,CL
00430F8A  |. |74 16       |JE SHORT IDMan.00430FA>
00430F8C  |. |8A50 01    |MOV DL,BYTE PTR DS:[EA>
00430F8F  |. |8A5E 01    |MOV BL,BYTE PTR DS:[ES>
00430F92  |. |8ACA       |MOV CL,DL
00430F94  |. |3AD3       |CMP DL,BL
00430F96  |. |75 0E       |JNZ SHORT IDMan.00430F>
00430F98  |. |83C0 02    |ADD EAX,2
00430F9B  |. |83C6 02    |ADD ESI,2
00430F9E  |. |84C9       |TEST CL,CL
00430FA0  |.^|75 DC       JNZ SHORT IDMan.00430F>
00430FA2  |> |33C0       XOR EAX,EAX
00430FA4  |. |EB 05       JMP SHORT IDMan.00430FA>
00430FA6  |> |1BC0       SBB EAX,EAX
00430FA8  |. |83D8 FF    SBB EAX,-1
00430FAB  |> |85C0       TEST EAX,EAX
00430FAD    |75 11       JNZ SHORT IDMan.00430FC> //这里就不能让他实现了，否则，序列号被锁定,NOP掉.
00430FAF  |. |8B4D F4    MOV ECX,DWORD PTR SS:[E>
00430FB2  |. |64:890D 00000>MOV DWORD PTR FS:[0],EC>
00430FB9  |. |5F          POP EDI
00430FBA  |. |5E          POP ESI
00430FBB  |. |5B          POP EBX
00430FBC  |. |8BE5       MOV ESP,EBP
00430FBE  |. |5D          POP EBP
00430FBF  |. |C3          RETN
00430FC0  |> 8DB5 4CFEFFFF LEA ESI,DWORD PTR SS:[E>
00430FC6  |.  B8 C0465D00 MOV EAX,IDMan.005D46C0  ;  8rf~bncxfygftrtr43jklkwinvalid serial number or the serial number has been blockederror!
00430FCB  |>  8A10       /MOV DL,BYTE PTR DS:[EA>
最后F9一下,程序直奔,再来看下注册信息,已经注册,注册按钮已经变灰,在看下功能,已无限制,破解完成.
（PS：已破解软件在我网盘里，点击这里进行下载）

gorden · 发表于 2009-5-4 18:10

哇塞
貌似有点复杂哦，不适合我这新手
练习下

lyliucn · 发表于 2009-5-7 17:24

很详细，学习。

307007573 · 发表于 2009-5-8 11:56

看着都花眼了还是支持

yzwj · 发表于 2009-5-8 14:02

看的真迷茫，呵呵，学习要时间的，先用用楼主的成品再说

a2213572 · 发表于 2009-5-20 22:31

很詳細但是無法顯示圖片!

zhang198203 · 发表于 2009-5-21 01:10

学习学习
一个字难

大雨伞 · 发表于 2012-11-13 20:45

这个真心好复杂该学的好多啊

帐号		自动登录	找回密码
密码			注册[Register]

[Windows] 看我破解Internet Download Manager 5.17