大老的打狗教程第二篇如解掉深思3的狗加密的软件
-
大老的打狗教程第二篇如解掉,深思3的狗加密的软件!希望对大家有所帮助!大老=[DCG]=
软件名:国内某著名标书制作软件
保护 :北京深思3洛克公司深思3的狗(Sense3)
所用工具:trw2000 wasm32
破解难度:难
本人邮箱:dalao@top86.com
本人论坛:http://dalao2002.yeah.net
此文献给所有爱好解密的朋友们!
我写的打狗教程这是第二篇!我共会写3篇的!这一篇主要讲讲如何破解程序中需要狗里数据的深思3加密的程序!
我只是大体说一下破解的思路! 高手不要见笑呀!
希望对大家有所帮助!
(1)
这个程序很有意思!如果没有狗!会弹出对话框告诉你 非法用户-请插上软件狗,并检查软件狗是否完好无损!
这其实就是一个很好的切入点!咱们看看下面的程序!我给大家讲一下!
:004E1D9B 8BC6 mov eax, esi
:004E1D9D E88A20F3FF call 00413E2C
:004E1DA2 8BC6 mov eax, esi
:004E1DA4 E81720F3FF call 00413DC0
:004E1DA9 8945EC mov dword ptr [ebp-14], eax
:004E1DAC 8BC6 mov eax, esi
:004E1DAE E80D20F3FF call 00413DC0
:004E1DB3 8945E8 mov dword ptr [ebp-18], eax
:004E1DB6 8BC6 mov eax, esi
:004E1DB8 E80320F3FF call 00413DC0
:004E1DBD 8945E4 mov dword ptr [ebp-1C], eax
:004E1DC0 8BC6 mov eax, esi
:004E1DC2 E86D20F3FF call 00413E34
:004E1DC7 8BC6 mov eax, esi
:004E1DC9 E8F612F2FF call 004030C4
:004E1DCE 8BC3 mov eax, ebx
:004E1DD0 E8EF12F2FF call 004030C4
:004E1DD5 8D8528FEFFFF lea eax, dword ptr [ebp+FFFFFE28]
:004E1DDB 668B55EC mov dx, word ptr [ebp-14]
:004E1DDF 6689952CFEFFFF mov word ptr [ebp+FFFFFE2C], dx ===>深思3的调用模式-密码1
:004E1DE6 668B55E8 mov dx, word ptr [ebp-18]
:004E1DEA 6689952EFEFFFF mov word ptr [ebp+FFFFFE2E], dx ===>深思3的调用模式-密码2
:004E1DF1 668B55E4 mov dx, word ptr [ebp-1C]
:004E1DF5 66899530FEFFFF mov word ptr [ebp+FFFFFE30], dx ===>深思3的调用模式-密码3
:004E1DFC 66C7852AFEFFFFFFFF mov word ptr [ebp+FFFFFE2A], FFFF ===>功能代码-打开狗
:004E1E05 50 push eax
:004E1E06 E8097BF7FF call 00459914 ========>这里读狗
:004E1E0B 33C0 xor eax, eax
:004E1E0D 5A pop edx
:004E1E0E 59 pop ecx
:004E1E0F 59 pop ecx
:004E1E10 648910 mov dword ptr fs:[eax], edx
:004E1E13 EB2E jmp 004E1E43
:004E1E15 E96616F2FF jmp 00403480
:004E1E1A 6A00 push 00000000
* Possible StringData Ref from Code Obj ->"非法用户"
|
:004E1E1C B910264E00 mov ecx, 004E2610
* Possible StringData Ref from Code Obj ->"不能读取系统注册信息，系统无法启动！"
|
:004E1E21 BA1C264E00 mov edx, 004E261C
:004E1E26 A1540F4F00 mov eax, dword ptr [004F0F54]
:004E1E2B 8B00 mov eax, dword ptr [eax]
:004E1E2D E89266F4FF call 004284C4
:004E1E32 A1540F4F00 mov eax, dword ptr [004F0F54]
:004E1E37 8B00 mov eax, dword ptr [eax]
:004E1E39 E8E265F4FF call 00428420
:004E1E3E E8E118F2FF call 00403724
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E1E13(U)
|
:004E1E43 6683BD28FEFFFF00 cmp word ptr [ebp+FFFFFE28], 0000 ====>判断打开狗是否成功!
:004E1E4B 7424 je 004E1E71 ====>一定要跳呀!
:004E1E4D 6A00 push 00000000
* Possible StringData Ref from Code Obj ->"非法用户"
|
:004E1E4F B910264E00 mov ecx, 004E2610
* Possible StringData Ref from Code Obj ->"请插上软件狗，并检查软件狗是否完好无损！"
|
:004E1E54 BA44264E00 mov edx, 004E2644
:004E1E59 A1540F4F00 mov eax, dword ptr [004F0F54]
:004E1E5E 8B00 mov eax, dword ptr [eax]
:004E1E60 E85F66F4FF call 004284C4
:004E1E65 A1540F4F00 mov eax, dword ptr [004F0F54]
:004E1E6A 8B00 mov eax, dword ptr [eax]
:004E1E6C E8AF65F4FF call 00428420
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E1E4B(C)
|
:004E1E71 A1002C4F00 mov eax, dword ptr [004F2C00]
:004E1E76 8B802C040000 mov eax, dword ptr [eax+0000042C]
:004E1E7C C74058FFFFFFFF mov [eax+58], FFFFFFFF
:004E1E83 817DECE7030000 cmp dword ptr [ebp-14], 000003E7 ====>判断端口!
:004E1E8A 7527 jne 004E1EB3
:004E1E8C 817DE878030000 cmp dword ptr [ebp-18], 00000378
:004E1E93 751E jne 004E1EB3
:004E1E95 817DE409030000 cmp dword ptr [ebp-1C], 00000309
:004E1E9C 7515 jne 004E1EB3
:004E1E9E A1002C4F00 mov eax, dword ptr [004F2C00]
:004E1EA3 8B802C040000 mov eax, dword ptr [eax+0000042C]
:004E1EA9 33D2 xor edx, edx
:004E1EAB 895058 mov dword ptr [eax+58], edx
:004E1EAE E988000000 jmp 004E1F3B
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004E1E8A(C), :004E1E93(C), :004E1E9C(C)
|
:004E1EB3 817DEC78030000 cmp dword ptr [ebp-14], 00000378
:004E1EBA 7526 jne 004E1EE2
:004E1EBC 817DE8E7030000 cmp dword ptr [ebp-18], 000003E7
:004E1EC3 751D jne 004E1EE2
-------------------------------------------------------------------
(2)以上的只是前半部分!呵呵!通过后!最终可以进入程序的主界面!过程中会报加载资源库失败!进入后功能方面是有问题的!
咱们来找找原因!
下断点
bpio 378 ====>这条指令是监视并口378端的io通讯!如果有通讯则中断!
然后运行程序!当跳过上面的部分后!再中断后安F12最终回到下面的部分!
:004E9A0E 899DB0FEFFFF mov dword ptr [ebp+FFFFFEB0], ebx
:004E9A14 899DACFEFFFF mov dword ptr [ebp+FFFFFEAC], ebx
:004E9A1A 895DE8 mov dword ptr [ebp-18], ebx
:004E9A1D 895DCC mov dword ptr [ebp-34], ebx
:004E9A20 894DF8 mov dword ptr [ebp-08], ecx
:004E9A23 8955FC mov dword ptr [ebp-04], edx
:004E9A26 8B45FC mov eax, dword ptr [ebp-04]
:004E9A29 E85EA6F1FF call 0040408C
:004E9A2E 33C0 xor eax, eax
:004E9A30 55 push ebp
:004E9A31 68B9A04E00 push 004EA0B9
:004E9A36 64FF30 push dword ptr fs:[eax]
:004E9A39 648920 mov dword ptr fs:[eax], esp
:004E9A3C A16C0E4F00 mov eax, dword ptr [004F0E6C]
:004E9A41 8B00 mov eax, dword ptr [eax]
:004E9A43 8B802C040000 mov eax, dword ptr [eax+0000042C]
:004E9A49 C6405400 mov [eax+54], 00
:004E9A4D 8B156C0E4F00 mov edx, dword ptr [004F0E6C]
:004E9A53 8B4058 mov eax, dword ptr [eax+58]
:004E9A56 83E801 sub eax, 00000001 =====>这里判断狗的种类!
:004E9A59 721B jb 004E9A76 ======>跳到标准版的部分!
:004E9A5B 0F84DB000000 je 004E9B3C
:004E9A61 83E805 sub eax, 00000005
:004E9A64 0F8498010000 je 004E9C02
:004E9A6A 48 dec eax
:004E9A6B 0F8457020000 je 004E9CC8
:004E9A71 E907030000 jmp 004E9D7D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E9A59(C)
|
:004E9A76 E83D0DF7FF call 0045A7B8 =====>打开狗
:004E9A7B 6685C0 test ax, ax
:004E9A7E 0F85F9020000 jne 004E9D7D ====>跳就是没有狗!
:004E9A84 66C78578FFFFFF0200 mov word ptr [ebp+FFFFFF78], 0002
:004E9A8D 8D8574FFFFFF lea eax, dword ptr [ebp+FFFFFF74]
:004E9A93 E8540DF7FF call 0045A7EC ======>读狗的数据区
:004E9A98 6685C0 test ax, ax ======>AX=0读狗成功
:004E9A9B 0F85DC020000 jne 004E9D7D =====>AX=0时这里不跳
:004E9AA1 0FB78574FFFFFF movzx eax, word ptr [ebp+FFFFFF74] ===>关键读狗成功后返回的数据
:004E9AA8 8945E4 mov dword ptr [ebp-1C], eax
:004E9AAB 66C78578FFFFFF0300 mov word ptr [ebp+FFFFFF78], 0003
:004E9AB4 8D8574FFFFFF lea eax, dword ptr [ebp+FFFFFF74]
:004E9ABA E82D0DF7FF call 0045A7EC ======>读狗的数据区
:004E9ABF 6685C0 test ax, ax ======>AX=0读狗成功
:004E9AC2 0F85B5020000 jne 004E9D7D
:004E9AC8 0FB78574FFFFFF movzx eax, word ptr [ebp+FFFFFF74] ===>关键读狗成功后返回的数据
:004E9ACF 8945E0 mov dword ptr [ebp-20], eax =====>把数据写入临时地址!
:004E9AD2 66C78578FFFFFF0400 mov word ptr [ebp+FFFFFF78], 0004
:004E9ADB 8D8574FFFFFF lea eax, dword ptr [ebp+FFFFFF74]
:004E9AE1 E8060DF7FF call 0045A7EC ======>读狗的数据区
:004E9AE6 6685C0 test ax, ax ======>AX=0读狗成功
:004E9AE9 0F858E020000 jne 004E9D7D
:004E9AEF 0FB78574FFFFFF movzx eax, word ptr [ebp+FFFFFF74] ===>关键读狗成功后返回的数据
:004E9AF6 8945DC mov dword ptr [ebp-24], eax
:004E9AF9 668B45E0 mov ax, word ptr [ebp-20]
:004E9AFD 66898574FFFFFF mov word ptr [ebp+FFFFFF74], ax
:004E9B04 668B45DC mov ax, word ptr [ebp-24]
:004E9B08 66898576FFFFFF mov word ptr [ebp+FFFFFF76], ax
:004E9B0F 8D8574FFFFFF lea eax, dword ptr [ebp+FFFFFF74]
:004E9B15 E86A0EF7FF call 0045A984 ======>读狗的数据区返回数据和上面的数据进行计算结果放到下面的<1><2>
:004E9B1A 6685C0 test ax, ax ======>AX=0读狗成功
:004E9B1D 0F855A020000 jne 004E9D7D
:004E9B23 0FB78574FFFFFF movzx eax, word ptr [ebp+FFFFFF74] ======>数据<1>
:004E9B2A 8945E0 mov dword ptr [ebp-20], eax
:004E9B2D 0FB78576FFFFFF movzx eax, word ptr [ebp+FFFFFF76] ======>数据<2>
:004E9B34 8945DC mov dword ptr [ebp-24], eax
:004E9B37 E941020000 jmp 004E9D7D
-------------------------------------------------------------------
(3)上面的就是加载资源库所用到的狗里数据的过程!破解很简单!只要把返回的数据给他模拟一下就行!
下面的部分是标书软件别的软件版本狗的处理过程!大家可以看看和上面的是一样的!只是返回的数据不同罢了!
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E9A5B(C)
|
:004E9B3C E80F10F7FF call 0045AB50
:004E9B41 6685C0 test ax, ax
:004E9B44 0F8533020000 jne 004E9D7D
:004E9B4A 66C78552FFFFFF0200 mov word ptr [ebp+FFFFFF52], 0002
:004E9B53 8D8550FFFFFF lea eax, dword ptr [ebp+FFFFFF50]
:004E9B59 E82610F7FF call 0045AB84
:004E9B5E 6685C0 test ax, ax
:004E9B61 0F8516020000 jne 004E9D7D
:004E9B67 0FB78554FFFFFF movzx eax, word ptr [ebp+FFFFFF54]
:004E9B6E 8945E4 mov dword ptr [ebp-1C], eax
:004E9B71 66C78552FFFFFF0300 mov word ptr [ebp+FFFFFF52], 0003
:004E9B7A 8D8550FFFFFF lea eax, dword ptr [ebp+FFFFFF50]
:004E9B80 E8FF0FF7FF call 0045AB84
:004E9B85 6685C0 test ax, ax
:004E9B88 0F85EF010000 jne 004E9D7D
:004E9B8E 0FB78554FFFFFF movzx eax, word ptr [ebp+FFFFFF54]
:004E9B95 8945E0 mov dword ptr [ebp-20], eax
:004E9B98 66C78552FFFFFF0400 mov word ptr [ebp+FFFFFF52], 0004
:004E9BA1 8D8550FFFFFF lea eax, dword ptr [ebp+FFFFFF50]
:004E9BA7 E8D80FF7FF call 0045AB84
:004E9BAC 6685C0 test ax, ax
:004E9BAF 0F85C8010000 jne 004E9D7D
:004E9BB5 0FB78554FFFFFF movzx eax, word ptr [ebp+FFFFFF54]
:004E9BBC 8945DC mov dword ptr [ebp-24], eax
:004E9BBF 668B45E0 mov ax, word ptr [ebp-20]
:004E9BC3 66898552FFFFFF mov word ptr [ebp+FFFFFF52], ax
:004E9BCA 668B45DC mov ax, word ptr [ebp-24]
:004E9BCE 66898550FFFFFF mov word ptr [ebp+FFFFFF50], ax
:004E9BD5 8D8550FFFFFF lea eax, dword ptr [ebp+FFFFFF50]
:004E9BDB E80411F7FF call 0045ACE4
:004E9BE0 6685C0 test ax, ax
:004E9BE3 0F8594010000 jne 004E9D7D
:004E9BE9 0FB78552FFFFFF movzx eax, word ptr [ebp+FFFFFF52]
:004E9BF0 8945E0 mov dword ptr [ebp-20], eax
:004E9BF3 0FB78550FFFFFF movzx eax, word ptr [ebp+FFFFFF50]
:004E9BFA 8945DC mov dword ptr [ebp-24], eax
:004E9BFD E97B010000 jmp 004E9D7D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E9A64(C)
--------------------------------------------------------------------
(4)总结
上面部分全部通过后!程序进本上已经解决完了!程序可以正常的加载资源库和大部分功能的正常使用了!但还有一点错误就是
在新建文件后再拖资源库数据的时候!会报错!其实很好解决的!大家自己找找把!我就不写了!
总结一下这个程序的破解过程!!程序的前半部分很简单!后半部分是个难点!尤其是返回数据的处理部分!只要大家掌握了后半部分!
在有狗的情况下,破解深思3的狗加密的软件应该是不成问题的!
有人说我大老不会解狗是个软件收集狂我写的打狗教程是别人帮我写的!!呵呵!我就不多说了!留给大家去评判吧!
写教程太累!下一篇也许会写的短点吧!
谢谢大家看完此文!
如果大家觉得不错请回复一下贴子支持一下!!
如果转载此文请保留完整!
大老 完成于
2002.6.29 凌晨2:30
相关视频
相关阅读 Windows错误代码大全 Windows错误代码查询激活windows有什么用Mac QQ和Windows QQ聊天记录怎么合并 Mac QQ和Windows QQ聊天记录Windows 10自动更新怎么关闭 如何关闭Windows 10自动更新windows 10 rs4快速预览版17017下载错误问题Win10秋季创意者更新16291更新了什么 win10 16291更新内容windows10秋季创意者更新时间 windows10秋季创意者更新内容kb3150513补丁更新了什么 Windows 10补丁kb3150513是什么
- 文章评论
-
热门文章
去除winrar注册框方法
最新文章
比特币病毒怎么破解 比去除winrar注册框方法
华为无线路由器HG522-C破解教程(附超级密码JEB格式文件京东电子书下载和阅读限制破解教UltraISO注册码全集(最新)通过Access破解MSSQL获得数据人气排行 华为无线路由器HG522-C破解教程(附超级密码JEB格式文件京东电子书下载和阅读限制破解教UltraISO注册码全集(最新)qq相册密码破解方法去除winrar注册框方法(适应任何版本)怎么用手机破解收费游戏华为无线猫HG522破解如何给软件脱壳基础教程
查看所有0条评论>>