1款国产开票软件的逆向分析：（原创）

冥界3大法王 · 发表于 2014-3-7 20:08

本帖最后由冥界3大法王于 2014-3-8 12:05 编辑

由于软件，我已破解过，注册按钮已灰化，我们先让它变成未注册的样子~~

当你再修改注册名的时候，你会发现无法再点注册按钮了，可以使用灰色按钮克星来操作哟~~
＝＝＝＝＝＝＝＝＝＝＝＝＝＝
我们使用RegSPY跟一板

定位到 HKEY_CURRENT_USER\Software\VB and VBA Program Settings\CHECK\work之后——右键导出路径
用神器regworkshop打开
习惯哟~~~
神器看着方便，便于操作呗。
完事，把该主键咔嚓掉

第一次运行，时界面前，这样子

这个注册按钮，有点怪的2个地方是，当你注册之后再点击就点不了啦，其2是这个注册按钮灰化已后，你再通过修改注册表，或者是输入新的注册信息换个用户名时
会提示你注册成功，可是换的用户名重启后，又让你注册（可想到的是，注册信息不仅保存在注册表中，还有一处地方不明~~~~）

好了，上面说了不少破解之后的总结，下面步入正题开工了，
情报找的差不多了＝＝＝＝〉密码错误请退出

字串搜索超级插件，以上地方，分别设上断点，关键是看注册成功的代码在何方？

到这里时，要多看多分析接下来我们才可能一招破敌~
好了，F9看断在何方，这个软件启动时，经常泡到后台去不过没有关系不影响调试的~

004595EF .  FF15 EC104000 call dword ptr [<&MSVBVM60.__vbaStrCm>;  msvbvm60.__vbaStrCmp

寄存器窗口中，我们能看到假码：
同时一看就知道是VB的程序~~

第一次，一路F8
00459C56 .  C785 B0FDFFFF>mov    dword ptr [ebp-0x250], 00410068  ;  密码错误,请退出!
00459C60 .  C785 A8FDFFFF>mov    dword ptr [ebp-0x258], 0x8
00459C6A .  8D95 A8FDFFFF lea    edx, dword ptr [ebp-0x258]
00459C70 .  8D4D A8    lea    ecx, dword ptr [ebp-0x58]
00459C73 .  FF15 04124000 call dword ptr [<&MSVBVM60.__vbaVarDu>;  msvbvm60.__vbaVarDup
00459C79 .  8D85 78FFFFFF lea    eax, dword ptr [ebp-0x88]
00459C7F .  50          push eax
00459C80 .  8D4D 88    lea    ecx, dword ptr [ebp-0x78]
00459C83 .  51          push ecx
00459C84 .  8D55 98    lea    edx, dword ptr [ebp-0x68]
00459C87 .  52          push edx
00459C88 .  6A 00       push 0x0
00459C8A .  8D45 A8    lea    eax, dword ptr [ebp-0x58]
00459C8D .  50          push eax
00459C8E .  FF15 9C104000 call dword ptr [<&MSVBVM60.#595>]    ;  到这里又就完蛋了，出来错误提示框，

一路F8，最终来到
00459D30 > \FF15 3C104000 call dword ptr [<&MSVBVM60.__vbaEnd>] ;  msvbvm60.__vbaEnd
这里程序就自动退出注册界面了~~~
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

＝＝＝＝＝＝＝＝＝＝＝

刚才突然，网页关闭了，为了不再发生意外，采取编点贴子就存盘的方法，未完待续~~

冥界3大法王 · 发表于 2014-3-7 20:27

00459618    /75 7E                jnz    short 00459698                ;  这里要跳哟~~
0045961A . |897D 80             mov    dword ptr [ebp-0x80], edi
0045961D . |BE 0A000000          mov    esi, 0xA
00459622 . |89B5 78FFFFFF       mov    dword ptr [ebp-0x88], esi
00459628 . |897D 90             mov    dword ptr [ebp-0x70], edi
0045962B . |8975 88             mov    dword ptr [ebp-0x78], esi
0045962E . |897D A0             mov    dword ptr [ebp-0x60], edi
00459631 . |8975 98             mov    dword ptr [ebp-0x68], esi
00459634 . |C785 B0FDFFFF 6800410>mov    dword ptr [ebp-0x250], 00410068  ;  密码错误,请退出!
0045963E . |C785 A8FDFFFF 0800000>mov    dword ptr [ebp-0x258], 0x8
00459648 . |8D95 A8FDFFFF       lea    edx, dword ptr [ebp-0x258]
0045964E . |8D4D A8             lea    ecx, dword ptr [ebp-0x58]
00459651 . |FF15 04124000       call dword ptr [<&MSVBVM60.__vbaVarDu>;  msvbvm60.__vbaVarDup
00459657 . |8D95 78FFFFFF       lea    edx, dword ptr [ebp-0x88]
0045965D . |52                   push edx
0045965E . |8D45 88             lea    eax, dword ptr [ebp-0x78]
00459661 . |50                   push eax
00459662 . |8D4D 98             lea    ecx, dword ptr [ebp-0x68]
00459665 . |51                   push ecx
00459666 . |6A 00                push 0x0
00459668 . |8D55 A8             lea    edx, dword ptr [ebp-0x58]
0045966B . |52                   push edx
0045966C . |FF15 9C104000       call dword ptr [<&MSVBVM60.#595>]    ;  这里就完蛋了
00459672 . |8D85 78FFFFFF       lea    eax, dword ptr [ebp-0x88]
00459678 . |50                   push eax
00459679 . |8D4D 88             lea    ecx, dword ptr [ebp-0x78]
0045967C . |51                   push ecx
0045967D . |8D55 98             lea    edx, dword ptr [ebp-0x68]
00459680 . |52                   push edx
00459681 . |8D45 A8             lea    eax, dword ptr [ebp-0x58]
00459684 . |50                   push eax
00459685 . |6A 04                push 0x4
00459687 . |FF15 40104000       call dword ptr [<&MSVBVM60.__vbaFreeV>;  msvbvm60.__vbaFreeVarList
0045968D . |83C4 14             add    esp, 0x14
00459690 . |FF15 3C104000       call dword ptr [<&MSVBVM60.__vbaEnd>] ;  msvbvm60.__vbaEnd
00459696 . |EB 05                jmp    short 0045969D
00459698 > \BE 0A000000          mov    esi, 0xA
0045969D >  8B4D C8             mov    ecx, dword ptr [ebp-0x38]
004596A0 .  51                   push ecx
004596A1 .  8B55 C4             mov    edx, dword ptr [ebp-0x3C]
004596A4 .  52                   push edx
004596A5 .  8B45 CC             mov    eax, dword ptr [ebp-0x34]
004596A8 .  50                   push eax
004596A9 .  FF15 64124000       call dword ptr [<&MSVBVM60.#581>]    ;  msvbvm60.rtcR8ValFromBstr
004596AF .  FF15 5C114000       call dword ptr [<&MSVBVM60.__vbaFpCmp>;  msvbvm60.__vbaFpCmpCy
004596B5 .  85C0                test eax, eax
004596B7    0F85 15020000       jnz    004598D2                      ;  NOP掉~~
004596BD .  8B0D 28A04900       mov    ecx, dword ptr [0x49A028]
004596C3 .  51                   push ecx
004596C4 .  E8 97EFFFFF          call 00458660
004596C9 .  8BD0                mov    edx, eax
004596CB .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
004596CE .  FFD3                call ebx
004596D0 .  50                   push eax                            ; /szValue
004596D1 .  68 20FE4000          push 0040FE20                      ; |Access
004596D6 .  68 FCFD4000          push 0040FDFC                      ; |Outlook Express
004596DB .  68 D4FD4000          push 0040FDD4                      ; |Internet Explorer
004596E0 .  8B35 04104000       mov    esi, dword ptr [<&MSVBVM60.#690>>; |msvbvm60.rtcSaveSetting
004596E6 .  FFD6                call esi                            ; \rtcSaveSetting
004596E8 .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
004596EB .  8B3D 60124000       mov    edi, dword ptr [<&MSVBVM60.__vba>;  msvbvm60.__vbaFreeStr
004596F1 .  FFD7                call edi                            ;  <&MSVBVM60.__vbaFreeStr>
004596F3 .  A1 14B04900          mov    eax, dword ptr [0x49B014]
004596F8 .  85C0                test eax, eax
004596FA .  75 10                jnz    short 0045970C
004596FC .  68 14B04900          push 0049B014
00459701 .  68 E0EA4000          push 0040EAE0
00459706 .  FF15 A4114000       call dword ptr [<&MSVBVM60.__vbaNew2>>;  msvbvm60.__vbaNew2
0045970C >  A1 14B04900          mov    eax, dword ptr [0x49B014]
00459711 .  8985 24FCFFFF       mov    dword ptr [ebp-0x3DC], eax
00459717 .  8B10                mov    edx, dword ptr [eax]
00459719 .  8D4D BC             lea    ecx, dword ptr [ebp-0x44]
0045971C .  51                   push ecx
0045971D .  50                   push eax
0045971E .  FF52 14             call dword ptr [edx+0x14]
00459721 .  DBE2                fclex
00459723 .  85C0                test eax, eax
00459725 .  7D 15                jge    short 0045973C
00459727 .  6A 14                push 0x14
00459729 .  68 D0EA4000          push 0040EAD0
0045972E .  8B95 24FCFFFF       mov    edx, dword ptr [ebp-0x3DC]
00459734 .  52                   push edx
00459735 .  50                   push eax
00459736 .  FF15 70104000       call dword ptr [<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
0045973C >  8B45 BC             mov    eax, dword ptr [ebp-0x44]
0045973F .  8985 1CFCFFFF       mov    dword ptr [ebp-0x3E4], eax
00459745 .  8B08                mov    ecx, dword ptr [eax]
00459747 .  8D55 C0             lea    edx, dword ptr [ebp-0x40]
0045974A .  52                   push edx
0045974B .  50                   push eax
0045974C .  FF51 58             call dword ptr [ecx+0x58]
0045974F .  DBE2                fclex
00459751 .  85C0                test eax, eax
00459753 .  7D 15                jge    short 0045976A
00459755 .  6A 58                push 0x58
00459757 .  68 3CFA4000          push 0040FA3C
0045975C .  8B8D 1CFCFFFF       mov    ecx, dword ptr [ebp-0x3E4]
00459762 .  51                   push ecx
00459763 .  50                   push eax
00459764 .  FF15 70104000       call dword ptr [<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
0045976A >  8B15 24A04900       mov    edx, dword ptr [0x49A024]
00459770 .  52                   push edx
00459771 .  68 C4FD4000          push 0040FDC4                      ;  SSQL
00459776 .  68 50FA4000          push 0040FA50                      ;  work
0045977B .  8B45 C0             mov    eax, dword ptr [ebp-0x40]
0045977E .  50                   push eax
0045977F .  FFD6                call esi
00459781 .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
00459784 .  FFD7                call edi
00459786 .  8D4D BC             lea    ecx, dword ptr [ebp-0x44]
00459789 .  FF15 5C124000       call dword ptr [<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj
0045978F .  68 8CFE4000          push 0040FE8C
00459794 .  68 7CFE4000          push 0040FE7C                      ;  PUman
00459799 .  68 70FE4000          push 0040FE70                      ;  Ex
0045979E .  68 5CFE4000          push 0040FE5C                      ;  Winzip
004597A3 .  FFD6                call esi
004597A5 .  8B0D 2CA04900       mov    ecx, dword ptr [0x49A02C]
004597AB .  6BC9 36             imul ecx, ecx, 0x36
004597AE .  0F80 C2060000       jo    00459E76                      ;  不能跳走，不然完蛋~~~
004597B4 .  83C1 07             add    ecx, 0x7
004597B7 .  0F80 B9060000       jo    00459E76
004597BD .  51                   push ecx
004597BE .  E8 9DEEFFFF          call 00458660
004597C3 .  8BD0                mov    edx, eax
004597C5 .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
004597C8 .  FFD3                call ebx
004597CA .  50                   push eax
004597CB .  68 40FE4000          push 0040FE40                      ;  ODBC
004597D0 .  68 FCFD4000          push 0040FDFC                      ;  Outlook Express
004597D5 .  68 D4FD4000          push 0040FDD4                      ;  Internet Explorer
004597DA .  FFD6                call esi
004597DC .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
004597DF .  FFD7                call edi
004597E1 .  68 70060000          push 0x670
004597E6 .  E8 75EEFFFF          call 00458660
004597EB .  8BD0                mov    edx, eax
004597ED .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
004597F0 .  FFD3                call ebx
004597F2 .  50                   push eax
004597F3 .  68 D4FE4000          push 0040FED4                      ;  NWD
004597F8 .  68 FCFD4000          push 0040FDFC                      ;  Outlook Express
004597FD .  68 D4FD4000          push 0040FDD4                      ;  Internet Explorer
00459802 .  FFD6                call esi
00459804 .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
00459807 .  FFD7                call edi
00459809 .  6A 7D                push 0x7D
0045980B .  E8 50EEFFFF          call 00458660
00459810 .  8BD0                mov    edx, eax
00459812 .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
00459815 .  FFD3                call ebx
00459817 .  50                   push eax
00459818 .  68 E0FE4000          push 0040FEE0                      ;  BAG
0045981D .  68 FCFD4000          push 0040FDFC                      ;  Outlook Express
00459822 .  68 D4FD4000          push 0040FDD4                      ;  Internet Explorer
00459827 .  FFD6                call esi
00459829 .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
0045982C .  FFD7                call edi
0045982E .  A1 14B04900          mov    eax, dword ptr [0x49B014]
00459833 .  85C0                test eax, eax
00459835 .  75 10                jnz    short 00459847
00459837 .  68 14B04900          push 0049B014
0045983C .  68 E0EA4000          push 0040EAE0
00459841 .  FF15 A4114000       call dword ptr [<&MSVBVM60.__vbaNew2>>;  msvbvm60.__vbaNew2
00459847 >  8B35 14B04900       mov    esi, dword ptr [0x49B014]
0045984D .  8B3E                mov    edi, dword ptr [esi]
0045984F .  8B55 08             mov    edx, dword ptr [ebp+0x8]
00459852 .  52                   push edx
00459853 .  8D45 BC             lea    eax, dword ptr [ebp-0x44]
00459856 .  50                   push eax
00459857 .  FF15 A8104000       call dword ptr [<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSetAddref
0045985D .  50                   push eax
0045985E .  56                   push esi
0045985F .  FF57 10             call dword ptr [edi+0x10]
00459862 .  DBE2                fclex
00459864 .  85C0                test eax, eax
00459866    7D 0F                jge    short 00459877                ;  NOP 了
00459868 .  6A 10                push 0x10
0045986A .  68 D0EA4000          push 0040EAD0
0045986F .  56                   push esi
00459870 .  50                   push eax
00459871 .  FF15 70104000       call dword ptr [<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
00459877 >  8D4D BC             lea    ecx, dword ptr [ebp-0x44]
0045987A .  FF15 5C124000       call dword ptr [<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj
00459880 .  803D 30A04900 01    cmp    byte ptr [0x49A030], 0x1
00459887    0F84 A9040000       je    00459D36                      ;  NOP 了
0045988D .  66:C705 34A04900 FFFF mov    word ptr [0x49A034], 0xFFFF
00459896 .  A1 D0A14900          mov    eax, dword ptr [0x49A1D0]
0045989B .  85C0                test eax, eax
0045989D .  75 10                jnz    short 004598AF
0045989F .  68 D0A14900          push 0049A1D0                      ;  诸1
004598A4 .  68 FC694000          push 004069FC
004598A9 .  FF15 A4114000       call dword ptr [<&MSVBVM60.__vbaNew2>>;  msvbvm60.__vbaNew2
004598AF >  8B35 D0A14900       mov    esi, dword ptr [0x49A1D0]
004598B5 .  B8 04000280          mov    eax, 0x80020004
004598BA .  B9 0A000000          mov    ecx, 0xA
004598BF .  8BD0                mov    edx, eax
004598C1 .  8995 B0FDFFFF       mov    dword ptr [ebp-0x250], edx
004598C7 .  898D A8FDFFFF       mov    dword ptr [ebp-0x258], ecx
004598CD    E9 07030000          jmp    00459BD9                      ;  NOP 掉~~
004598D2 >  8B45 E0             mov    eax, dword ptr [ebp-0x20]
004598D5 .  50                   push eax
004598D6 .  8B4D DC             mov    ecx, dword ptr [ebp-0x24]
004598D9 .  51                   push ecx
004598DA .  8B55 CC             mov    edx, dword ptr [ebp-0x34]
004598DD .  52                   push edx
004598DE .  FF15 64124000       call dword ptr [<&MSVBVM60.#581>]    ;  msvbvm60.rtcR8ValFromBstr
004598E4 .  FF15 5C114000       call dword ptr [<&MSVBVM60.__vbaFpCmp>;  msvbvm60.__vbaFpCmpCy
004598EA .  85C0                test eax, eax
004598EC    0F85 4F030000       jnz    00459C41                      ;  NOP
004598F2 .  8D45 A8             lea    eax, dword ptr [ebp-0x58]
004598F5 .  50                   push eax
004598F6 .  FF15 F0114000       call dword ptr [<&MSVBVM60.#610>]    ;  msvbvm60.rtcGetDateVar
004598FC .  C785 B0FDFFFF AD90000>mov    dword ptr [ebp-0x250], 0x90AD
00459906 .  C785 A8FDFFFF 0300000>mov    dword ptr [ebp-0x258], 0x3
00459910 .  8D4D A8             lea    ecx, dword ptr [ebp-0x58]
00459913 .  51                   push ecx                            ; /var18
00459914 .  8D95 A8FDFFFF       lea    edx, dword ptr [ebp-0x258]    ; |
0045991A .  52                   push edx                            ; |var28
0045991B .  8D45 98             lea    eax, dword ptr [ebp-0x68]       ; |
0045991E .  50                   push eax                            ; |SaveTo8
0045991F .  FF15 00104000       call dword ptr [<&MSVBVM60.__vbaVarSu>; \__vbaVarSub
00459925 .  50                   push eax
00459926 .  FF15 E4114000       call dword ptr [<&MSVBVM60.__vbaI4Var>;  msvbvm60.__vbaI4Var
0045992C .  8945 D8             mov    dword ptr [ebp-0x28], eax
0045992F .  8D4D A8             lea    ecx, dword ptr [ebp-0x58]
00459932 .  FF15 2C104000       call dword ptr [<&MSVBVM60.__vbaFreeV>;  msvbvm60.__vbaFreeVar
00459938 .  8B0D 28A04900       mov    ecx, dword ptr [0x49A028]
0045993E .  6BC9 41             imul ecx, ecx, 0x41
00459941 .  0F80 2F050000       jo    00459E76
00459947 .  81E9 D8110000       sub    ecx, 0x11D8
0045994D .  0F80 23050000       jo    00459E76
00459953 .  51                   push ecx
00459954 .  E8 07EDFFFF          call 00458660
00459959 .  8BD0                mov    edx, eax
0045995B .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
0045995E .  FFD3                call ebx
00459960 .  50                   push eax                            ; /szValue
00459961 .  68 20FE4000          push 0040FE20                      ; |Access
00459966 .  68 FCFD4000          push 0040FDFC                      ; |Outlook Express
0045996B .  68 D4FD4000          push 0040FDD4                      ; |Internet Explorer
00459970 .  8B35 04104000       mov    esi, dword ptr [<&MSVBVM60.#690>>; |msvbvm60.rtcSaveSetting
00459976 .  FFD6                call esi                            ; \rtcSaveSetting
00459978 .  8D4D C0             lea    ecx, dword ptr [ebp-0x40]
0045997B .  8B3D 60124000       mov    edi, dword ptr [<&MSVBVM60.__vba>;  msvbvm60.__vbaFreeStr
00459981 .  FFD7                call edi                            ;  <&MSVBVM60.__vbaFreeStr>
00459983 .  A1 14B04900          mov    eax, dword ptr [0x49B014]
00459988 .  85C0                test eax, eax
0045998A .  75 10                jnz    short 0045999C
0045998C .  68 14B04900          push 0049B014
00459991 .  68 E0EA4000          push 0040EAE0
00459996 .  FF15 A4114000       call dword ptr [<&MSVBVM60.__vbaNew2>>;  msvbvm60.__vbaNew2
0045999C >  A1 14B04900          mov    eax, dword ptr [0x49B014]
004599A1 .  8985 24FCFFFF       mov    dword ptr [ebp-0x3DC], eax
004599A7 .  8B10                mov    edx, dword ptr [eax]
004599A9 .  8D4D BC             lea    ecx, dword ptr [ebp-0x44]
004599AC .  51                   push ecx
004599AD .  50                   push eax
004599AE .  FF52 14             call dword ptr [edx+0x14]
004599B1 .  DBE2                fclex
004599B3 .  85C0                test eax, eax
004599B5    7D 15                jge    short 004599CC                ;  nop
004599B7 .  6A 14                push 0x14
004599B9 .  68 D0EA4000          push 0040EAD0
004599BE .  8B95 24FCFFFF       mov    edx, dword ptr [ebp-0x3DC]
004599C4 .  52                   push edx
004599C5 .  50                   push eax
004599C6 .  FF15 70104000       call dword ptr [<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
004599CC >  8B45 BC             mov    eax, dword ptr [ebp-0x44]
004599CF .  8985 1CFCFFFF       mov    dword ptr [ebp-0x3E4], eax
004599D5 .  8B08                mov    ecx, dword ptr [eax]
004599D7 .  8D55 C0             lea    edx, dword ptr [ebp-0x40]
004599DA .  52                   push edx
004599DB .  50                   push eax
004599DC .  FF51 58             call dword ptr [ecx+0x58]
004599DF .  DBE2                fclex
004599E1 .  85C0                test eax, eax
004599E3    7D 15                jge    short 004599FA                ;  nop

，所以，当来到00459B77 .  FF15 9C104000       call dword ptr [<&MSVBVM60.#595>]    ;  msvbvm60.rtcMsgBox
这里，我们就

冥界3大法王 · 发表于 2014-3-7 20:33

管理员你好，
刚才贴子编辑中，断电了，再来时，不小心发错版块了，
请收累转移下~~~
多谢~~

冥界3大法王 · 发表于 2014-3-7 20:38

本帖最后由冥界3大法王于 2014-3-7 20:40 编辑

另外，这个软件还有一个有意思的地方就是它如果注册成功的话，他的注册信息就写入注册表了，
另外还有一处地方没有跟到，
但注册标志已经有了，即使我们再使用那个未破解的版本，竟然仍然有效果~~

而那个已经破解的版本，还要输入新的注册信息~~就算你再输入注册成功了，他也只认你第一次注册成功的那个用户名。
VB的程序就是怪的离奇~~

storm · 发表于 2014-3-7 23:09

楼主的ID和这款软件有联系啊

he58394835 · 发表于 2016-6-28 14:29

哪里下载哦

帐号		自动登录	找回密码
密码			注册[Register]

[原创] 1款国产开票软件的逆向分析：（原创）