chap6-1-61.htm.primary

加密与解密,软件加密保护技术与解决方案,看雪文档!

        program is run from harddisk <br>
        015F:004011E6&nbsp; 56&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; ESI <br>
        015F:004011E7&nbsp; E820070000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; KERNEL32!FreeLibrary&nbsp; &nbsp;&nbsp;; free the kernel :) he 
        didnt do it.. <br>
        015F:004011EC&nbsp; 682C010000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; 0000012C&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; size of buffer 
        to store windows directory <br>
        015F:004011F1&nbsp; 8D85BCFAFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; EAX,[EBP+FFFFFABC] <br>
        015F:004011F7&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EAX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;; pointer to buffer <br>
        015F:004011F8&nbsp; E8EB060000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; KERNEL32!GetWindowsDirectoryA <br>
        015F:004011FD&nbsp; 6880000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; 00000080&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; size of buffer 
        for modulefilename <br>
        015F:00401202&nbsp; 8D95E8FBFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; EDX,[EBP+FFFFFBE8] <br>
        015F:00401208&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EDX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;; pointer to buffer <br>
        015F:00401209&nbsp; FF35B0254000&nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; DWORD PTR [004025B0]&nbsp; &nbsp;&nbsp;; 00400000, this module... 
        <br>
        015F:0040120F&nbsp; E8DA060000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; KERNEL32!GetModuleFileNameA <br>
        015F:00401214&nbsp; 8A8DBCFAFFFF&nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
        &nbsp; CL,[EBP+FFFFFABC]&nbsp; &nbsp;&nbsp;; [c:\windows]&nbsp; &nbsp;&nbsp;;WindowsDirectoryA 
        <br>
        015F:0040121A&nbsp; 3A8DE8FBFFFF&nbsp; &nbsp; &nbsp; &nbsp; CMP&nbsp; 
        &nbsp; CL,[EBP+FFFFFBE8]&nbsp; &nbsp;&nbsp;; [c:\checkcd1\checkcd.exe]&nbsp; 
        &nbsp;&nbsp;;ModuleFileNameA <br>
        015F:00401220&nbsp; 7518&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JNZ&nbsp; &nbsp; 0040123A&nbsp; &nbsp;&nbsp;; check the drive letters...jump 
        if not equal <br>
        <br>
        yah, all the above code does is get the windows path/directory, get its 
        own path/directory, <br>
        compare the drive letters, so it cant be run from the same drive that 
        windows is installed on. <br>
        it also get's the drivetype of the current drive, and stores this in EDI... 
        <br>
        <br>
        015F:00401220&nbsp; 7518&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JNZ&nbsp; &nbsp; 0040123A&nbsp; ; has to be taken, so change it 
        to a JMP <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; eb18&nbsp; 
        &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp; 
        <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br>
        on with the reversing... <br>
        <br>
        015F:00401222&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:00401224&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:00401226&nbsp; 8D45B0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        LEA&nbsp; &nbsp; EAX,[EBP-50] <br>
        015F:00401229&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EAX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; 
        pointer to wide char 'HeHe! Try again' <br>
        015F:0040122A&nbsp; 53&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EBX <br>
        015F:0040122B&nbsp; E81C020000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; 0040144C&nbsp; &nbsp;&nbsp;; convert wide char, display messagebox 
        <br>
        015F:00401230&nbsp; 83C410&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        ADD&nbsp; &nbsp; ESP,10 <br>
        015F:00401233&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; XOR&nbsp; &nbsp; EAX,EAX <br>
        015F:00401235&nbsp; E909020000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP&nbsp; 
        &nbsp; 00401443&nbsp; &nbsp;&nbsp;; jump to exit (failed cd-check) <br>
        <br>
        015F:0040123A&nbsp; 83EF05&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        SUB&nbsp; &nbsp; EDI,05&nbsp; &nbsp;&nbsp;; where we end up if we take 
        the first good-check jump <br>
        015F:0040123D&nbsp; 0F8596010000&nbsp; &nbsp; &nbsp; &nbsp; JNZ&nbsp; 
        &nbsp; 004013D9&nbsp; &nbsp;&nbsp;; 05=cd-rom, 05-05=0, so edi must be 
        0 to carry on. <br>
        015F:00401243&nbsp; 8D9574FCFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; EDX,[EBP-038C]&nbsp; &nbsp;&nbsp;; total number of clusters <br>
        015F:00401249&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EDX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; 
        pointers <br>
        015F:0040124A&nbsp; 8D8D78FCFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; ECX,[EBP-0388]&nbsp; &nbsp;&nbsp;; how many free clusters <br>
        015F:00401250&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; ECX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; 
        to <br>
        015F:00401251&nbsp; 8D857CFCFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; EAX,[EBP-0384]&nbsp; &nbsp;&nbsp;;&nbsp; bytes per sector <br>
        015F:00401257&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EAX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; 
        various <br>
        015F:00401258&nbsp; 8D9580FCFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; EDX,[EBP-0380]&nbsp; &nbsp;&nbsp;; sectors per cluster <br>
        015F:0040125E&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EDX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; 
        buffers <br>
        015F:0040125F&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; pRootPathName, 
        null = current drive <br>
        015F:00401261&nbsp; E8BE060000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; KERNEL32!GetDiskFreeSpaceA <br>
        015F:00401266&nbsp; 83BD78FCFFFF00&nbsp; &nbsp; &nbsp; CMP&nbsp; &nbsp; 
        DWORD PTR [EBP-0388],00&nbsp; &nbsp;&nbsp;; compare the amount of free 
        clusters with '0' <br>
        015F:0040126D&nbsp; 7418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; 00401287&nbsp; &nbsp;&nbsp;; again, if it 
        was run from CD, the freespace is always '0' <br>
        <br>
        okay, still simple enough, subtracts 5 from the returned value for this 
        drive, if its not equal, <br>
        i.e. not zero, jumps to the 'hehe try again' messagebox, if it passed 
        this part, it checks for <br>
        free space, and there should be none on a CD, so ... <br>
        <br>
        015F:0040123D&nbsp; 0F8596010000&nbsp; &nbsp; &nbsp; &nbsp; JNZ&nbsp; 
        &nbsp; 004013D9 ; this jump has to be killed to carry on with the check 
        <br>
        &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0f8500000000 <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br>
        015F:0040126D&nbsp; 7418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; 00401287 ; this jump has to be taken to 
        carry on... <br>
        &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; eb18 <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br>
        on with the reversing... <br>
        <br>
        015F:0040126F&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:00401271&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:00401273&nbsp; 8D4DB0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        LEA&nbsp; &nbsp; ECX,[EBP-50]&nbsp; &nbsp;&nbsp;; de-ja-vu <br>
        015F:00401276&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; ECX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; 
        pointer to wide char 'HeHe! Try again' <br>
        015F:00401277&nbsp; 53&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EBX <br>
        015F:00401278&nbsp; E8CF010000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; 0040144C&nbsp; &nbsp;&nbsp;; our message box friend again <br>
        015F:0040127D&nbsp; 83C410&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        ADD&nbsp; &nbsp; ESP,10 <br>
        015F:00401280&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; XOR&nbsp; &nbsp; EAX,EAX <br>
        015F:00401282&nbsp; E9BC010000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP&nbsp; 
        &nbsp; 00401443&nbsp; &nbsp;&nbsp;; jump to exit (failed cd-check) <br>
        <br>
        015F:00401287&nbsp; 6880000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; 00000080 <br>
        015F:0040128C&nbsp; 8D95BCF9FFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; EDX,[EBP+FFFFF9BC] <br>
        015F:00401292&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EDX <br>
        015F:00401293&nbsp; 8D8D68FCFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; ECX,[EBP-0398] <br>
        015F:00401299&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; ECX <br>
        015F:0040129A&nbsp; 8D856CFCFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; EAX,[EBP-0394] <br>
        015F:004012A0&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EAX <br>
        015F:004012A1&nbsp; 8D9570FCFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; EDX,[EBP-0390] <br>
        015F:004012A7&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EDX <br>
        015F:004012A8&nbsp; 6880000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; 00000080 <br>
        015F:004012AD&nbsp; 8D8D3CFAFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; ECX,[EBP+FFFFFA3C] <br>
        015F:004012B3&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; ECX <br>
        015F:004012B4&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:004012B6&nbsp; E839060000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; KERNEL32!GetVolumeInformationA <br>
        015F:004012BB&nbsp; 81BD70FCFFFF21787573CMP&nbsp; &nbsp; DWORD PTR [EBP-0390],73757821&nbsp; 
        &nbsp;&nbsp;; compare read label with 'sux!' <br>
        015F:004012C5&nbsp; 0F85F9000000&nbsp; &nbsp; &nbsp; &nbsp; JNZ&nbsp; 
        &nbsp; 004013C4&nbsp; &nbsp;&nbsp;; jump if not equal to failed check... 
        <br>
        015F:004012CB&nbsp; F68568FCFFFF10&nbsp; &nbsp; &nbsp; TEST&nbsp; &nbsp; 
        BYTE PTR [EBP-0398],10&nbsp; &nbsp;&nbsp;; i dont know, but it has to 
        be equal :) <br>
        015F:004012D2&nbsp; 7418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; 004012EC&nbsp; &nbsp;&nbsp;; jump passed 
        horrid message if above test is true <br>
        015F:004012D4&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:004012D6&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:004012D8&nbsp; 8D45B0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        LEA&nbsp; &nbsp; EAX,[EBP-50]&nbsp; &nbsp;&nbsp;;de-ja-vu again <br>
        015F:004012DB&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EAX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;; see the pattern, ebp-50, call 40144c? <br>
        015F:004012DC&nbsp; 53&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EBX <br>
        015F:004012DD&nbsp; E86A010000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; 0040144C <br>
        015F:004012E2&nbsp; 83C410&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        ADD&nbsp; &nbsp; ESP,10 <br>
        015F:004012E5&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; XOR&nbsp; &nbsp; EAX,EAX <br>
        015F:004012E7&nbsp; E957010000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP&nbsp; 
        &nbsp; 00401443 <br>
        <br>
        015F:004012EC&nbsp; F68569FCFFFF80&nbsp; &nbsp; &nbsp; TEST&nbsp; &nbsp; 
        BYTE PTR [EBP-0397],80&nbsp; &nbsp;&nbsp;; i dont know, but it has to 
        be equal :) <br>
        015F:004012F3&nbsp; 7418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; 0040130D&nbsp; &nbsp;&nbsp;; jump passed 
        horrid message if above test is true <br>
        015F:004012F5&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:004012F7&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:004012F9&nbsp; 8D55B0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        LEA&nbsp; &nbsp; EDX,[EBP-50]&nbsp; &nbsp;&nbsp;; we know this is the 
        bad cracker bit <br>
        015F:004012FC&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EDX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;; so we take the above jump... <br>
        015F:004012FD&nbsp; 53&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EBX <br>
        015F:004012FE&nbsp; E849010000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp;