好友
阅读权限40
听众
最后登录1970-1-1
|
lkou
发表于 2011-7-7 12:20
桌面日历秀破解分析
天好热啊，找个软件破解玩玩
软件装完后，运行之，提示注册，输入注册码后，联到下面的网上校验
www.XDeskSoft.com/xdc_reg/xdc_checkreg.asp
返回数据为username or passwd err，提示框是中文，所以肯定文字都在本地，再查壳为UPX，脱壳后放OD分析
查找字符串：username or passwd err，在下面就可以看到注册成功，进入后005E7665 . E8 EEDAE1FF CALL XDeskCal.00405158
005E766A . 75 76 JNZ SHORT XDeskCal.005E76E2
005E766C . A1 A4356300 MOV EAX,DWORD PTR DS:[6335A4] ; lwc
005E7671 . 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
005E7674 . E8 27D7E1FF CALL XDeskCal.00404DA0
005E7679 . 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
005E767C . E8 CBD6E1FF CALL XDeskCal.00404D4C
005E7681 . 8B15 98336300 MOV EDX,DWORD PTR DS:[633398] ; hwc
005E7687 . 8B12 MOV EDX,DWORD PTR DS:[EDX]
005E7689 . 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
005E768C . 8B80 FC020000 MOV EAX,DWORD PTR DS:[EAX+2FC]
005E7692 . E8 2538E9FF CALL XDeskCal.0047AEBC
005E7697 . 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
005E769A . 8B80 F8020000 MOV EAX,DWORD PTR DS:[EAX+2F8]
005E76A0 . B2 01 MOV DL,1
005E76A2 . E8 0537E9FF CALL XDeskCal.0047ADAC
005E76A7 . A1 04316300 MOV EAX,DWORD PTR DS:[633104] ; 阂c 注意这里
005E76AC . C600 01 MOV BYTE PTR DS:[EAX],1 赐值1了
005E76AF . 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
005E76B2 . E8 41A0E9FF CALL XDeskCal.004816F8
005E76B7 . 33C9 XOR ECX,ECX
005E76B9 . BA AC7C5E00 MOV EDX,XDeskCal.005E7CAC ; 注册成功,感谢您对中国共享软件的支持!
005E76BE . E8 69D80100 CALL XDeskCal.00604F2C
005E76C3 . E8 FCAA0100 CALL XDeskCal.006021C4
005E76C8 . 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
005E76CB . E8 68C7E1FF CALL XDeskCal.00403E38
005E76D0 . 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
005E76D3 . C780 4C020000>MOV DWORD PTR DS:[EAX+24C],1
005E76DD . E9 96000000 JMP XDeskCal.005E7778
005E76E2 > 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
直接给633104下访问断点，F9，看到停在如下位置0062BD31 . 64:8910 MOV DWORD PTR FS:[EAX],EDX
0062BD34 . E9 41020000 JMP XDeskCal.0062BF7A
0062BD39 > E8 9A78FDFF CALL XDeskCal.006035D8
0062BD3E . A1 04316300 MOV EAX,DWORD PTR DS:[633104] ; 阂c
0062BD43 . C600 00 MOV BYTE PTR DS:[EAX],0 赐值为0
0062BD46 . E8 FD9EFDFF CALL XDeskCal.00605C48
0062BD4B . A1 04316300 MOV EAX,DWORD PTR DS:[633104] ; 阂c
0062BD50 . 8038 00 CMP BYTE PTR DS:[EAX],0
0062BD53 . 75 6C JNZ SHORT XDeskCal.0062BDC1
0062BD55 . 8B0D 34326300 MOV ECX,DWORD PTR DS:[633234] ; Lc
0062BD5B . 8B09 MOV ECX,DWORD PTR DS:[ECX]
0062BD5D . B2 01 MOV DL,1
0062BD5F . A1 38DF5F00 MOV EAX,DWORD PTR DS:[5FDF38]
0062BD64 . E8 2B7AE6FF CALL XDeskCal.00493794
0062BD69 . 8B15 282C6300 MOV EDX,DWORD PTR DS:[632C28] ; XDeskCal.0063758C
0062BD6F . 8902 MOV DWORD PTR DS:[EDX],EAX
直接在OD里面定向到00633104也证实了这点：00633104 - E9 756300C8
dword 为4个字节，E9756300正过来，就是关键点了
给006375E9下访问断点，F9
发现断在一个CALL上面，进入这个call00605C48 /$ 55 PUSH EBP
00605C49 |. 8BEC MOV EBP,ESP
00605C4B |. B9 04000000 MOV ECX,4
00605C50 |> 6A 00 /PUSH 0
00605C52 |. 6A 00 |PUSH 0
00605C54 |. 49 |DEC ECX
00605C55 |.^ 75 F9 \JNZ SHORT XDeskCal.00605C50
00605C57 |. 51 PUSH ECX
00605C58 |. 33C0 XOR EAX,EAX
00605C5A |. 55 PUSH EBP
00605C5B |. 68 5B5D6000 PUSH XDeskCal.00605D5B
00605C60 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00605C63 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
00605C66 |. C605 E9756300>MOV BYTE PTR DS:[6375E9],0 来了，一开始就赐值为0，看来就是这里了，继续往下看
00605C6D |. 68 705D6000 PUSH XDeskCal.00605D70 ; tcy
00605C72 |. FF35 60776300 PUSH DWORD PTR DS:[637760]
00605C78 |. FF35 64776300 PUSH DWORD PTR DS:[637764]
00605C7E |. 68 7C5D6000 PUSH XDeskCal.00605D7C ; lovedongdong
00605C83 |. 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00605C86 |. BA 04000000 MOV EDX,4
00605C8B |. E8 3CF4DFFF CALL XDeskCal.004050CC
00605C90 |. 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24]
00605C93 |. 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
00605C96 |. E8 918CF7FF CALL XDeskCal.0057E92C
00605C9B |. 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
00605C9E |. 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
00605CA1 |. E8 FA8CF7FF CALL XDeskCal.0057E9A0
00605CA6 |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
00605CA9 |. 8D55 E4 LEA EDX,DWORD PTR SS:[EBP-1C]
00605CAC |. E8 B73CE0FF CALL XDeskCal.00409968
00605CB1 |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C]
00605CB4 |. BA 945D6000 MOV EDX,XDeskCal.00605D94 ; cfishsoft
00605CB9 |. E8 56F3DFFF CALL XDeskCal.00405014
00605CBE |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
00605CC1 |. 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
00605CC4 |. E8 638CF7FF CALL XDeskCal.0057E92C
00605CC9 |. 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
00605CCC |. 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
00605CCF |. E8 CC8CF7FF CALL XDeskCal.0057E9A0
00605CD4 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00605CD7 |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
00605CDA |. E8 893CE0FF CALL XDeskCal.00409968
00605CDF |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00605CE2 |. 8B15 68776300 MOV EDX,DWORD PTR DS:[637768]
00605CE8 |. E8 27F3DFFF CALL XDeskCal.00405014
00605CED |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00605CF0 |. 8B15 6C776300 MOV EDX,DWORD PTR DS:[63776C]
00605CF6 |. E8 5DF4DFFF CALL XDeskCal.00405158
00605CFB |. 75 09 JNZ SHORT XDeskCal.00605D06
00605CFD |. C605 E9756300>MOV BYTE PTR DS:[6375E9],1 终于找到了，就是这里，赐值1
00605D04 |. EB 2D JMP SHORT XDeskCal.00605D33
00605D06 |> B8 60776300 MOV EAX,XDeskCal.00637760
00605D0B |. E8 3CF0DFFF CALL XDeskCal.00404D4C
00605D10 |. B8 64776300 MOV EAX,XDeskCal.00637764
00605D15 |. E8 32F0DFFF CALL XDeskCal.00404D4C
00605D1A |. B8 68776300 MOV EAX,XDeskCal.00637768
00605D1F |. E8 28F0DFFF CALL XDeskCal.00404D4C
00605D24 |. B8 6C776300 MOV EAX,XDeskCal.0063776C
00605D29 |. E8 1EF0DFFF CALL XDeskCal.00404D4C
00605D2E |. E8 91C4FFFF CALL XDeskCal.006021C4
00605D33 |> 33C0 XOR EAX,EAX
00605D35 |. 5A POP EDX
00605D36 |. 59 POP ECX
00605D37 |. 59 POP ECX
00605D38 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
00605D3B |. 68 625D6000 PUSH XDeskCal.00605D62
00605D40 |> 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00605D43 |. BA 03000000 MOV EDX,3
00605D48 |. E8 23F0DFFF CALL XDeskCal.00404D70
00605D4D |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
00605D50 |. BA 02000000 MOV EDX,2
00605D55 |. E8 16F0DFFF CALL XDeskCal.00404D70
00605D5A \. C3 RETN
00605D5B .^ E9 6CE8DFFF JMP XDeskCal.004045CC
00605D60 .^ EB DE JMP SHORT XDeskCal.00605D40
00605D62 . 8BE5 MOV ESP,EBP
00605D64 . 5D POP EBP
00605D65 . C3 RETN
大功告成～
网上像这样放内存地址的软件还很多，比如佳宜，各位手痒的话可以拿他练练手
By Lkou[LCG] 2011.7.7
|
免费评分
-
查看全部评分
|
[复制链接]
发表于 2011-7-7 12:35
发表于 2011-7-7 12:54
天热开空调~
你就不要怪我了......................................
