【软件名称】某交通客运信息管理系统
【软件限制】注册码+加密狗
【破解声明】破解只是感兴趣，无其它目的。失误之处敬请诸位大侠赐教!
【破解工具】W32Dasm8.93 TRW20001.23
========================================================================================
【分析过程】
此软件不注册运行在试用版功能,注册后加密狗启动,程序无法运行.
我只找了一下注册码,没有详细分析算法.主要把加密狗解除思路写一下.
分析如下:
* Possible StringData Ref from Code Obj ->"197712280530qlm提示窗口"
|
:0062365A BAA8376200 mov edx, 006237A8
:0062365F E8F4BCECFF call 004EF358
:00623664 8D95F0FEFFFF lea edx, dword ptr [ebp+FFFFFEF0]
:0062366A 8B83F4020000 mov eax, dword ptr [ebx+000002F4]
:00623670 E843B2E2FF call 0044E8B8
:00623675 8B85F0FEFFFF mov eax, dword ptr [ebp+FFFFFEF0]
:0062367B 8D95F4FEFFFF lea edx, dword ptr [ebp+FFFFFEF4]
:00623681 E8525FDEFF call 004095D8
:00623686 8B85F4FEFFFF mov eax, dword ptr [ebp+FFFFFEF4]
:0062368C 50 push eax
:0062368D 8D95ECFEFFFF lea edx, dword ptr [ebp+FFFFFEEC]
:00623693 8B45FC mov eax, dword ptr [ebp-04]
:00623696 E83D5FDEFF call 004095D8
:0062369B 8B95ECFEFFFF mov edx, dword ptr [ebp+FFFFFEEC] //注册码 算法省略...
:006236A1 58 pop eax
:006236A2 E85119DEFF call 00404FF8
:006236A7 743B je 006236E4
:006236A9 6A40 push 00000040
:006236AB B9B8376200 mov ecx, 006237B8
* Possible StringData Ref from Code Obj ->"您输入的注册号错误，请重新输入."
|
:006236B0 BAC4376200 mov edx, 006237C4
:006236B5 A140426300 mov eax, dword ptr [00634240]
:006236BA 8B00 mov eax, dword ptr [eax]
:006236BC E827B7E4FF call 0046EDE8
:006236C1 8B83F4020000 mov eax, dword ptr [ebx+000002F4]
:006236C7 66BEB8FF mov si, FFB8
:006236CB E8DC08DEFF call 00403FAC
:006236D0 84C0 test al, al
:006236D2 747E je 00623752
:006236D4 8B83F4020000 mov eax, dword ptr [ebx+000002F4]
:006236DA 8B10 mov edx, dword ptr [eax]
:006236DC FF92C0000000 call dword ptr [edx+000000C0]
:006236E2 EB6E jmp 00623752
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:006236A7(C)
|
:006236E4 8BC3 mov eax, ebx
:006236E6 E891010000 call 0062387C
:006236EB 84C0 test al, al
:006236ED 744B je 0062373A //不能跳
:006236EF 6A40 push 00000040
:006236F1 B9B8376200 mov ecx, 006237B8
* Possible StringData Ref from Code Obj ->"恭喜您注册成功，欢迎使用状元正版软件。
请重新
====================================================================================
* Possible StringData Ref from Code Obj ->" 试用版 V5.0 "
|
:00628870 BA048E6200 mov edx, 00628E04
:00628875 E86E60E2FF call 0044E8E8
:0062887A E9D3040000 jmp 00628D52
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00628865(C)
|
:0062887F 8B45FC mov eax, dword ptr [ebp-04]
:00628882 8B8000030000 mov eax, dword ptr [eax+00000300]
* Possible StringData Ref from Code Obj ->" 正试版 V5.0 "
|
:00628888 BA1C8E6200 mov edx, 00628E1C
:0062888D E85660E2FF call 0044E8E8
:00628892 A15C656300 mov eax, dword ptr [0063655C]
:00628897 8B80FC020000 mov eax, dword ptr [eax+000002FC]
* Possible StringData Ref from Code Obj ->"系统正在检测加密狗，请等待。。。"
|
:0062889D BA348E6200 mov edx, 00628E34
:006288A2 E84160E2FF call 0044E8E8
:006288A7 33C0 xor eax, eax
:006288A9 A34C656300 mov dword ptr [0063654C], eax
:006288AE E8AD4E0000 call 0062D760 //在这里读狗 杀入.....
:006288B3 8BD8 mov ebx, eax //返回eax=0表明有狗
:006288B5 85DB test ebx, ebx //ebx必须等于0
:006288B7 7428 je 006288E1 //跳走就成功了,简单的爆破可能会有隐患,因此我们必须进入上面的call观察
:006288B9 33D2 xor edx, edx
* Possible StringData Ref from Code Obj ->" 系统检测加密狗失败！可能是网络不通或加密狗"
->"未安装正确！
请先进行调试后再运行本系统！
"
->" 如果您仍无法解决，请与供应商联系！"
|
:006288BB B8608E6200 mov eax, 00628E60
:006288C0 E80B5DECFF call 004EE5D0
:006288C5 8B45FC mov eax, dword ptr [ebp-04]
:006288C8 8B80FC020000 mov eax, dword ptr [eax+000002FC]
* Possible StringData Ref from Code Obj ->"加载加密狗失败！"
|
:006288CE BAEC8E6200 mov edx, 00628EEC
:006288D3 E81060E2FF call 0044E8E8
:006288D8 C645FB00 mov [ebp-05], 00
:006288DC E971040000 jmp 00628D52
=====================================call 0062D760 ===================================
* Referenced by a CALL at Address:
|:006288AE
:0062D760 55 push ebp
:0062D761 8BEC mov ebp, esp
:0062D763 52 push edx
:0062D764 51 push ecx
:0062D765 6846D76200 push 0062D746
:0062D76A 68C1D46200 push 0062D4C1
:0062D76F 6A01 push 00000001
:0062D771 E829F6FFFF call 0062CD9F //读狗
:0062D776 83C40C add esp, 0000000C
:0062D779 59 pop ecx
:0062D77A 5A pop edx
:0062D77B 5D pop ebp
:0062D77C C3 ret
:0062D77D 55 push ebp
:0062D77E 8BEC mov ebp, esp
:0062D780 52 push edx
:0062D781 51 push ecx
:0062D782 6846D76200 push 0062D746
:0062D787 68C1D46200 push 0062D4C1
:0062D78C 6A05 push 00000005
:0062D78E E80CF6FFFF call 0062CD9F //读狗
:0062D793 83C40C add esp, 0000000C
:0062D796 59 pop ecx
:0062D797 5A pop edx
:0062D798 5D pop ebp
:0062D799 C3 ret
:0062D79A 55 push ebp
:0062D79B 8BEC mov ebp, esp
:0062D79D 52 push edx
:0062D79E 51 push ecx
:0062D79F 6846D76200 push 0062D746
:0062D7A4 68C1D46200 push 0062D4C1
:0062D7A9 6A02 push 00000002
:0062D7AB E8EFF5FFFF call 0062CD9F //读狗
:0062D7B0 83C40C add esp, 0000000C
:0062D7B3 59 pop ecx
:0062D7B4 5A pop edx
:0062D7B5 85C0 test eax, eax
:0062D7B7 750A jne 0062D7C3
:0062D7B9 8B1558656300 mov edx, dword ptr [00636558]
:0062D7BF 33C9 xor ecx, ecx
:0062D7C1 890A mov dword ptr [edx], ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0062D7B7(C)
|
:0062D7C3 5D pop ebp
:0062D7C4 C3 ret
* Referenced by a CALL at Addresses:
|:006288FE , :006289FE , :00628B18 , :00628C35
|
:0062D7C5 55 push ebp
:0062D7C6 8BEC mov ebp, esp
:0062D7C8 52 push edx
:0062D7C9 51 push ecx
:0062D7CA 6846D76200 push 0062D746
:0062D7CF 68C1D46200 push 0062D4C1
:0062D7D4 6A03 push 00000003
:0062D7D6 E8C4F5FFFF call 0062CD9F //读狗
:0062D7DB 83C40C add esp, 0000000C
:0062D7DE 59 pop ecx
:0062D7DF 5A pop edx
:0062D7E0 5D pop ebp
:0062D7E1 C3 ret
从上面可以看出有不少地方在读狗.....进入call 0062CD9F
=======================================call 0062CD9F=========================================
* Referenced by a CALL at Addresses:
|:0062D771 , :0062D78E , :0062D7AB , :0062D7D6
|
:0062CD9F 55 push ebp //修改为xor eax,eax ret //在这里让eax返回0就成功了
:0062CDA0 8BEC mov ebp, esp
:0062CDA2 83C4B8 add esp, FFFFFFB8
:0062CDA5 53 push ebx
:0062CDA6 56 push esi
:0062CDA7 E8EEFEFFFF call 0062CC9A
:0062CDAC 8945DC mov dword ptr [ebp-24], eax
:0062CDAF 66C745D00A00 mov [ebp-30], 000A
:0062CDB5 E9F0030000 jmp 0062D1AA
:0062CDBA EB01 jmp 0062CDBD
:0062CDBC 00 BYTE 00
========================================================================================
【分析总结】
这个加密狗不是很复杂,只要让读狗后返回0解狗即可成功,采用一追到底的方法,到程序的
根部修改,而不是简单的修改跳转.好处是可以避免许多暗桩.
初学解狗希望对大家有所帮助,也希望起到抛砖引玉.
========================================================================================
|
|