目的:属技术交流,无其它目的,请不要任意散布或用用商业用途。初学破解,如有不对的地方欢迎批评
指出。 工具:softice,w32Dasm,ollydbg 试炼码: 序列号:107570653072 注册码:654321
查找出错信息
:004DC023 8B4DE4 mov ecx, dword ptr [ebp-1C] :004DC026 8BC1 mov eax, ecx :004DC028 99 cdq :004DC029 3B55FC cmp edx, dword ptr [ebp-04] :004DC02C 754E jne 004DC07C ====>出错 :004DC02E 3B45F8 cmp eax, dword ptr [ebp-08] :004DC031 7549 jne 004DC07C =====>出错 :004DC033 33D2 xor edx, edx :004DC035 8B8378030000 mov eax, dword ptr [ebx+00000378] :004DC03B 8B08 mov ecx, dword ptr [eax] :004DC03D FF5164 call [ecx+64] :004DC040 B201 mov dl, 01 :004DC042 8B8308030000 mov eax, dword ptr [ebx+00000308] :004DC048 8B08 mov ecx, dword ptr [eax] :004DC04A FF5164 call [ecx+64] :004DC04D 33D2 xor edx, edx :004DC04F 8B8384030000 mov eax, dword ptr [ebx+00000384] :004DC055 E8BAA2F6FF call 00446314 :004DC05A 8B8394030000 mov eax, dword ptr [ebx+00000394] :004DC060 E8D7C0FEFF call 004C813C :004DC065 6A00 push 00000000 :004DC067 668B0D04C14D00 mov cx, word ptr [004DC104] :004DC06E B202 mov dl, 02
* Possible StringData Ref from Code Obj ->"软件登记注册成功" | :004DC070 B810C14D00 mov eax, 004DC110 :004DC075 E81E36F6FF call 0043F698 :004DC07A EB15 jmp 004DC091
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:004DC02C(C), :004DC031(C) | :004DC07C 6A00 push 00000000 :004DC07E 668B0D04C14D00 mov cx, word ptr [004DC104] :004DC085 B201 mov dl, 01
* Possible StringData Ref from Code Obj ->"软件注册号错误" -------------------------------------------------------------------------- 在od中动态分析出关键部分:
004DBFA1 |. 33C0 XOR EAX,EAX 004DBFA3 |. 55 PUSH EBP 004DBFA4 |. 68 AFC04D00 PUSH faxnow.004DC0AF 004DBFA9 |. 64:FF30 PUSH DWORD PTR FS:[EAX] 004DBFAC |. 64:8920 MOV DWORD PTR FS:[EAX],ESP 004DBFAF |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 004DBFB2 |. BA C4C04D00 MOV EDX,faxnow.004DC0C4 ; ASCII "00000000" 004DBFB7 |. E8 C48EF2FF CALL faxnow.00404E80 004DBFBC |. 8D4D F4 LEA ECX,DWORD PTR SS:[EBP-C] 004DBFBF |. BA D8C04D00 MOV EDX,faxnow.004DC0D8 004DBFC4 |. B8 F8C04D00 MOV EAX,faxnow.004DC0F8 004DBFC9 |. E8 E637F6FF CALL faxnow.0043F7B4 ; 显示注册框,取输入的注册码 004DBFCE |. 3C 01 CMP AL,1 004DBFD0 |. 0F85 BB000000 JNZ faxnow.004DC091 004DBFD6 |. 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20] 004DBFD9 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] ; 注册码入eax 004DBFDC |. E8 C3D4F2FF CALL faxnow.004094A4 ; 把注册码入edx处地址 004DBFE1 |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20] ; 注册码入eax 004DBFE4 |. E8 0BD8F2FF CALL faxnow.004097F4 ; 转换为十六进制 004DBFE9 |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX ; 把转换后的数保存在[EBP-8]中 004DBFEC |. 8955 FC MOV DWORD PTR SS:[EBP-4],EDX 004DBFEF |. 6A 00 PUSH 0 004DBFF1 |. 68 D2010000 PUSH 1D2 004DBFF6 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] 004DBFF9 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] 004DBFFC |. E8 DF9DF2FF CALL faxnow.00405DE0 ; 注册码的十六进制除以1D2(即为466) 004DC001 |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX ; 商入[ebp-8] 004DC004 |. 8955 FC MOV DWORD PTR SS:[EBP-4],EDX ; 余数入[ebp-4] 004DC007 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] 004DC00A |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] 004DC00D |. 2D B3730700 SUB EAX,773B3 ; 再减去773B3 004DC012 |. 83DA 00 SBB EDX,0 ; 带借位减法,下面要比较是否为0,反推得edx必须是0 004DC015 |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX 004DC018 |. 8955 FC MOV DWORD PTR SS:[EBP-4],EDX 004DC01B |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C] 004DC01E |. E8 E1F4FFFF CALL faxnow.004DB504 ; 取cpu的ID,我的为670(H),即为1648 004DC023 |. 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C] ; cpuid入ecx 004DC026 |. 8BC1 MOV EAX,ECX ; eax=ecx 004DC028 |. 99 CDQ 004DC029 |. 3B55 FC CMP EDX,DWORD PTR SS:[EBP-4] ; 比较[ebp-4]是否为0 004DC02C |. 75 4E JNZ SHORT faxnow.004DC07C ; 不等则跳 004DC02E |. 3B45 F8 CMP EAX,DWORD PTR SS:[EBP-8] 004DC031 |. 75 49 JNZ SHORT faxnow.004DC07C ; 不等则跳 004DC033 |. 33D2 XOR EDX,EDX 004DC035 |. 8B83 78030000 MOV EAX,DWORD PTR DS:[EBX+378] ------------------------------ 总结: 反推:cpuid为670,加上773B3,为77A23,再乘以1d2,得D9C53B6,转换为十进制即为注册码:
228348854
爆破:在004DC02C及004DC031处,把其nop掉即可。 |
|
查看所有0条评论>>