好友
阅读权限40
听众
最后登录1970-1-1
|
2Tware Virtual Disk 2011是一款 虚拟磁盘 软件
1.打开软件后，发现有使用时间限制 ，其他无~~
2.无壳，Microsoft Visual C++ 9.0 - Visual Studio 2008 (E8)的
3，想办法暴力注册之
OD中打开，强力字串插件，搜索
00FE3E77 68 ECD60401 push 2TDisk.0104D6EC ; No license(7-day trial period)
00FE3E63 |. 68 C0D60401 push 2TDisk.0104D6C0 ; Licensed to %d users.
00FE40F2 |. 68 2CD70401 push 2TDisk.0104D72C ; Register success!
00FE4125 |. 68 50D70401 push 2TDisk.0104D750 ; Please input right register code!
以上这几个地方 F2
00FE40C3 |. E8 08640200 call 2TDisk.0100A4D0
00FE40C8 |. 85C0 test eax,eax
00FE40CA |. 74 37 je X2TDisk.00FE4103
00FE40CC |. 8D4D D4 lea ecx,[local.11]
00FE40CF |. FF15 3CFB0001 call dword ptr ds:[<&mfc90u.#909>] ; mfc90u.#3737
00FE40D5 |. 50 push eax
00FE40D6 |. E8 55E60100 call 2TDisk.01002730
00FE40DB |. 83C4 04 add esp,0x4
00FE40DE |. 85C0 test eax,eax
00FE40E0 |. 74 21 je X2TDisk.00FE4103
00FE40E2 |. 8D4D D8 lea ecx,[local.10]
00FE40E5 |. 51 push ecx
00FE40E6 |. 8B4D D0 mov ecx,[local.12]
00FE40E9 |. E8 A2FCFFFF call 2TDisk.00FE3D90
00FE40EE |. 6A 00 push 0x0
00FE40F0 |. 6A 00 push 0x0
00FE40F2 |. 68 2CD70401 push 2TDisk.0104D72C ; Register success!
00FE40F7 |. E8 1E700200 call <jmp.&mfc90u.#1183>
00FE40FC |. C745 E8 01000>mov [local.6],0x1
00FE4103 |> C645 FC 04 mov byte ptr ss:[ebp-0x4],0x4
00FE4107 |. 8D4D D4 lea ecx,[local.11]
00FE410A |. FF15 40FB0001 call dword ptr ds:[<&mfc90u.#600>] ; mfc90u.#601
00FE4110 |> 837D E8 00 cmp [local.6],0x0
00FE4114 |. 75 19 jnz X2TDisk.00FE412F
00FE4116 |. 68 88130000 push 0x1388 ; /Timeout = 5000. ms
00FE411B |. FF15 ECF00001 call dword ptr ds:[<&KERNEL32.Sleep>] ; \Sleep
00FE4121 |. 6A 00 push 0x0
00FE4123 |. 6A 30 push 0x30
00FE4125 |. 68 50D70401 push 2TDisk.0104D750 ; Please input right register code!
00FE40CA |. /74 37 je X2TDisk.00FE4103
这句 因为下面有注册成功字样，所以优先F2，设好后，F9 开球了~~
果然断在 00FE40CA |. /74 37 je X2TDisk.00FE4103
一路F8，看流程线~~
00FE40CA |. /74 37 je X2TDisk.00FE4103
没跳所以NOP掉
下面的 跳走，Z 标志为 点击
00FE40E0 |. /74 21 je X2TDisk.00FE4103 也样也得NOP 或 Z 标志为 点击
此时屏幕提示注册成功，别高兴的太早，肯定是假的，上面2处可以尝试做 OD，右击复制到可执行文件……
上面有个FE40E0往上 看信息窗口，可知EAX＝1，则注册成功。
再查找 字串，你能看到这样的行
SOFTWARE\2TDisk SoftWare\2TDisk
说明啥，它家住在注册表中。
RegCode 不就是注册成功的话 的键值么？
一方面点击吾爱破解OD中的API断点 下 读取注册表断点
另一方面，利用上面分析到的结论设法使EAX，启动时即为1
010026B0 /$ 55 push ebp
010026B1 |. 8BEC mov ebp,esp
010026B3 |. 83EC 18 sub esp,0x18
010026B6 |. 8D4D F4 lea ecx,[local.3]
010026B9 |. E8 523A0000 call 2TDisk.01006110
010026BE |. C745 FC E8AE0>mov [local.1],2TDisk.0104AEE8 ; SOFTWARE\2TDisk SoftWare\2TDisk
010026C5 |. 68 1F010200 push 0x2011F
010026CA |. 8B45 FC mov eax,[local.1]
010026CD |. 50 push eax
010026CE |. 68 02000080 push 0x80000002
010026D3 |. 8D4D F4 lea ecx,[local.3]
010026D6 |. E8 65390000 call 2TDisk.01006040 ; 1111111
010026DB |. 85C0 test eax,eax
010026DD |. 75 34 jnz X2TDisk.01002713 ; gai
010026DF |. C745 F0 32000>mov [local.4],0x32
010026E6 |. 8D4D F0 lea ecx,[local.4]
010026E9 |. 51 push ecx
010026EA |. 8B55 08 mov edx,[arg.1]
010026ED |. 52 push edx
010026EE |. 68 28AF0401 push 2TDisk.0104AF28 ; RegCode
010026F3 |. 8D4D F4 lea ecx,[local.3]
010026F6 |. E8 E5380000 call 2TDisk.01005FE0
010026FB |. 85C0 test eax,eax
010026FD |. 75 14 jnz X2TDisk.01002713 ; see key
010026FF |. C745 EC 01000>mov [local.5],0x1
01002706 |. 8D4D F4 lea ecx,[local.3]
01002709 |. E8 E2390000 call 2TDisk.010060F0
0100270E |. 8B45 EC mov eax,[local.5]
01002711 |. EB 12 jmp X2TDisk.01002725
01002713 |> C745 E8 00000>mov [local.6],0x0
0100271A |. 8D4D F4 lea ecx,[local.3]
0100271D |. E8 CE390000 call 2TDisk.010060F0
01002722 |. 8B45 E8 mov eax,[local.6]
01002725 |> 8BE5 mov esp,ebp
01002727 |. 5D pop ebp
01002728 \. C3 retn
01002729 CC int3
0100272A CC int3
0100272B CC int3
0100272C CC int3
0100272D CC int3
0100272E CC int3
0100272F CC int3
01002730 /$ 55 push ebp
01002731 |. 8BEC mov ebp,esp
01002733 |. 83EC 30 sub esp,0x30
01002736 |. C745 FC 00000>mov [local.1],0x0
0100273D |. 8D4D F0 lea ecx,[local.4]
01002740 |. E8 CB390000 call 2TDisk.01006110
01002745 |. C745 F8 38AF0>mov [local.2],2TDisk.0104AF38 ; SOFTWARE\2TDisk SoftWare\2TDisk
0100274C |. 68 1F010200 push 0x2011F
01002751 |. 8B45 F8 mov eax,[local.2]
01002754 |. 50 push eax
01002755 |. 68 02000080 push 0x80000002
0100275A |. 8D4D F0 lea ecx,[local.4]
0100275D |. E8 DE380000 call 2TDisk.01006040
01002762 |. 85C0 test eax,eax
01002764 |. 0F85 EB000000 jnz 2TDisk.01002855
0100276A |. C745 EC 32000>mov [local.5],0x32
01002771 |. 8B4D EC mov ecx,[local.5]
01002774 |. 51 push ecx
01002775 |. 8B55 08 mov edx,[arg.1]
01002778 |. 52 push edx
01002779 |. 68 78AF0401 push 2TDisk.0104AF78 ; RegCode
0100277E |. 8D4D F0 lea ecx,[local.4]
01002781 |. E8 1A380000 call 2TDisk.01005FA0
01002786 |. C745 EC 32000>mov [local.5],0x32
0100278D |. 8B45 EC mov eax,[local.5]
01002790 |. 50 push eax
01002791 |. 8B4D 08 mov ecx,[arg.1]
01002794 |. 51 push ecx
01002795 |. 68 88AF0401 push 2TDisk.0104AF88 ; RegCode
最终我们能来到上面的这些地方 ，
Breakpoints
地址 模块 激活 反汇编 注释
00FE2AD0 2TDisk 始终 push ebp
00FE2B8E 2TDisk 始终 call dword ptr ds:[<&mfc90u.#296>]
00FE2BB6 2TDisk 始终 jmp dword ptr ds:[edx*4+0xFE2C94]
00FE2BFD 2TDisk 始终 push 2TDisk.0104DA00 About and Register
00FE316A 2TDisk 始终 push 2TDisk.0104DA40 Tip.dat
00FE3D40 2TDisk 始终 je X2TDisk.00FE3D4E 333333
00FE3D90 2TDisk 始终 push ebp
00FE3DBB 2TDisk 始终 call dword ptr ds:[<&mfc90u.#296>]
00FE3DCB 2TDisk 始终 mov ecx,dword ptr ds:[eax]
00FE3E77 2TDisk 始终 push 2TDisk.0104D6EC No license(7-day trial period)
00FE4125 2TDisk 始终 push 2TDisk.0104D750 Please input right register code!
010026B0 2TDisk 始终 push ebp
010026F6 2TDisk 始终 call 2TDisk.01005FE0
010026FD 2TDisk 始终 jnz X2TDisk.01002713 see key
01003A9E 2TDisk 始终 call dword ptr ds:[<&mfc90u.#813>]
01003AA6 2TDisk 始终 push 2TDisk.0104BB30 Trial has expired,please register product!
0100600F 2TDisk 始终 mov dword ptr ss:[ebp-0x8],eax
上面是当初分析时得到的数据
013326B0 /$ 55 push ebp
013326B1 |. 8BEC mov ebp,esp
013326B3 |. 83EC 18 sub esp,0x18
013326B6 |. 8D4D F4 lea ecx,[local.3]
013326B9 |. E8 523A0000 call 2TDisk.01336110
013326BE |. C745 FC E8AE3>mov [local.1],2TDisk.0137AEE8 ; SOFTWARE\2TDisk SoftWare\2TDisk
013326C5 |. 68 1F010200 push 0x2011F
013326CA |. 8B45 FC mov eax,[local.1]
013326CD |. 50 push eax
013326CE |. 68 02000080 push 0x80000002
013326D3 |. 8D4D F4 lea ecx,[local.3]
013326D6 |. E8 65390000 call 2TDisk.01336040
013326DB |. 85C0 test eax,eax
013326DD |. 75 34 jnz X2TDisk.01332713 ; 启动时 读注册码
013326DF |. C745 F0 32000>mov [local.4],0x32
013326E6 |. 8D4D F0 lea ecx,[local.4]
013326E9 |. 51 push ecx
013326EA |. 8B55 08 mov edx,[arg.1]
013326ED |. 52 push edx
013326EE |. 68 28AF3701 push 2TDisk.0137AF28 ; RegCode
ebp=002ED5BC
本地调用来自 013B26D6, 013B275D, 013B27CA, 013B2896, 013B2A4C, 013B2AA6
Breakpoints
地址 模块 激活 反汇编 注释
01333DDD 2TDisk 已禁止 ja 2TDisk.01333E77 挑到7天版本 那里
01333DE6 2TDisk 已禁止 jmp dword ptr ds:[eax*4+0x1333F20] 挑往 授权用户~~~~~
01333DED 2TDisk 已禁止 push 2TDisk.0139D5E4 Single-user license.
01333E02 2TDisk 已禁止 push 2TDisk.0139D610 Licensed to %d users.
01333E18 2TDisk 已禁止 push 2TDisk.0139D63C Licensed to %d users.
01333E31 2TDisk 已禁止 push 2TDisk.0139D668 Licensed to %d users.
01333E4A 2TDisk 已禁止 push 2TDisk.0139D694 Licensed to %d users.
01333E63 2TDisk 已禁止 push 2TDisk.0139D6C0 Licensed to %d users.
01333E6C 2TDisk 已禁止 call dword ptr ds:[<&mfc90u.#2537>]
01333E77 2TDisk 已禁止 push 2TDisk.0139D6EC No license(7-day trial period)
013340C3 2TDisk 已禁止 call 2TDisk.0135A4D0 F7
013340CA 2TDisk 已禁止 je X2TDisk.01334103 也得改===========>1
013340D6 2TDisk 已禁止 call 2TDisk.01352730
013340E0 2TDisk 已禁止 je X2TDisk.01334103 gai
013340F2 2TDisk 已禁止 push 2TDisk.0139D72C Register success!
01334114 2TDisk 已禁止 jnz X2TDisk.0133412F
01334125 2TDisk 已禁止 push 2TDisk.0139D750 Please input right register code!
013501A9 2TDisk 已禁止 push 2TDisk.0139C0D8 {983E0692-7C86-4a7b-8181-3633E7659BAA}\%s
013526B0 2TDisk 已禁止 push ebp
013526B9 2TDisk 已禁止 call 2TDisk.01356110
013526BE 2TDisk 已禁止 mov dword ptr ss:[ebp-0x4],2TDisk.01 SOFTWARE\2TDisk SoftWare\2TDisk
013526EE 2TDisk 已禁止 push 2TDisk.0139AF28 RegCode
013526FD 2TDisk 已禁止 jnz X2TDisk.01352713
01352730 2TDisk 已禁止 push ebp
01352745 2TDisk 已禁止 mov dword ptr ss:[ebp-0x8],2TDisk.01 SOFTWARE\2TDisk SoftWare\2TDisk
0135275D 2TDisk 已禁止 call 2TDisk.01356040
01352779 2TDisk 已禁止 push 2TDisk.0139AF78 RegCode
01352795 2TDisk 已禁止 push 2TDisk.0139AF88 RegCode
01352811 2TDisk 已禁止 push 2TDisk.0139B000 RegCode
0135282D 2TDisk 已禁止 push 2TDisk.0139B010 RegCode
我们把00963DDD |. /0F87 94000000 ja 2TDisk.00963E77
00963DE3 |. |8B45 E8 mov eax,[local.6]
00963DE6 |. |FF2485 203F96>jmp dword ptr ds:[eax*4+0x963F20]
00963DED |> |68 E4D59C00 push 2TDisk.009CD5E4 ; Single-user license.
00963DF2 |. |8D4D F0 lea ecx,[local.4]
00963DF5 |. |FF15 24FB9800 call dword ptr ds:[<&mfc90u.#813>] ; mfc90u.#813
00963DFB |. |E9 85000000 jmp 2TDisk.00963E85
这一块 集体选中NOP之，上面就会显示为 50用户注册版本了。
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\2TDisk SoftWare\2TDisk]
"RegCode"=hex:31,00,32,00,33,00,34,00,35,00,36,00,37,00,38,00,38,00,39,00,30,\
00,38,00,30,00,38,00,39,00,30,00,38,00,39,00,30,00,38,00,39,00,30,00,38,00,\
30,00,38,00
这就是 我们 直接 强 爆，活生生写入后的注册表部分
我们来看一下效果吧，学习破解的同学可以练练手的，
不对之处难免，仅仅提供参考。
前天破的，今天贴上，写的有点乱，凑合看吧。
|
|
发表于 2014-2-19 19:14
|
发表于 2014-2-19 19:41
