chap6-1-61.htm.primary

加密与解密,软件加密保护技术与解决方案,看雪文档!

        &nbsp; 0040144C <br>
        015F:00401303&nbsp; 83C410&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        ADD&nbsp; &nbsp; ESP,10 <br>
        015F:00401306&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; XOR&nbsp; &nbsp; EAX,EAX <br>
        015F:00401308&nbsp; E936010000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP&nbsp; 
        &nbsp; 00401443 <br>
        <br>
        right, i have been a very naughty boy, and admit that two parts of this 
        code i dont understand, <br>
        but from the bad-cracker code being duped everywhere, i know to take the 
        jumps.. basicaly, this <br>
        is a label check, chacks the disk label against 'sux!', and if they are 
        the same, does these <br>
        other two tests, which have to pass to skip the 'hehe! try again' message.. 
        <br>
        <br>
        015F:004012C5&nbsp; 0F85F9000000&nbsp; &nbsp; &nbsp; &nbsp; JNZ&nbsp; 
        &nbsp; 004013C4&nbsp; &nbsp;&nbsp;; label check, we want to skip this 
        jump... <br>
        &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0f8500000000 <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br>
        015F:004012D2&nbsp; 7418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; 004012EC&nbsp; &nbsp;&nbsp;; dont know, 
        but it needs taking (JMP) <br>
        &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; eb18 <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br>
        015F:004012F3&nbsp; 7418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; 0040130D&nbsp; &nbsp;&nbsp;; still dont 
        know, but take it (JMP) <br>
        &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; eb18 <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br>
        on with the reversing... <br>
        <br>
        015F:0040130D&nbsp; 6814244000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; 00402414&nbsp; &nbsp;&nbsp;; some bullshit 'stack overflow' <br>
        015F:00401312&nbsp; 8D953CFAFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; EDX,[EBP+FFFFFA3C]&nbsp; &nbsp;&nbsp;;[ebp+fffffa3c] is from getvolumeinformationa 
        routine <br>
        015F:00401318&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EDX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; 
        some more bullshit 'OVERFLOW' <br>
        015F:00401319&nbsp; E888050000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; 004018A6&nbsp; &nbsp;&nbsp;; dont care :( <br>
        015F:0040131E&nbsp; 83C408&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        ADD&nbsp; &nbsp; ESP,08 <br>
        015F:00401321&nbsp; 85C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; TEST&nbsp; &nbsp; EAX,EAX&nbsp; &nbsp;&nbsp;; fuckit, change this 
        to xor eax,eax <br>
        015F:00401323&nbsp; 0F8586000000&nbsp; &nbsp; &nbsp; &nbsp; JNZ&nbsp; 
        &nbsp; 004013AF&nbsp; &nbsp;&nbsp;; so this jump wont be taken cause at 
        4013af, is the bad check code <br>
        015F:00401329&nbsp; 681A244000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; 0040241A&nbsp; &nbsp;&nbsp;; pointer to a new label <br>
        015F:0040132E&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; what 
        drive to change <br>
        015F:00401330&nbsp; E8DD050000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; KERNEL32!SetVolumeLabelA <br>
        015F:00401335&nbsp; 48&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; DEC&nbsp; &nbsp; EAX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; 
        eax = 1 if function succeed <br>
        015F:00401336&nbsp; 7526&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JNZ&nbsp; &nbsp; 0040135E&nbsp; &nbsp;&nbsp;; you cant change a 
        CD's label, so eax should be 0 or -1 <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;; but after the dec eax, if it failed, this jump would be 
        taken.. <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp; <br>
        015F:00401338&nbsp; 8D8D3CFAFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
        &nbsp; ECX,[EBP+FFFFFA3C]&nbsp; &nbsp;&nbsp;; waste <br>
        015F:0040133E&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; ECX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; of <br>
        015F:0040133F&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; time <br>
        015F:00401341&nbsp; E8CC050000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; KERNEL32!SetVolumeLabelA <br>
        015F:00401346&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:00401348&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:0040134A&nbsp; 8D45B0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        LEA&nbsp; &nbsp; EAX,[EBP-50]&nbsp; &nbsp;&nbsp;; bad cracker routine 
        <br>
        015F:0040134D&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EAX <br>
        015F:0040134E&nbsp; 53&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EBX <br>
        015F:0040134F&nbsp; E8F8000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; 0040144C&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; again :) <br>
        015F:00401354&nbsp; 83C410&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        ADD&nbsp; &nbsp; ESP,10 <br>
        015F:00401357&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; XOR&nbsp; &nbsp; EAX,EAX <br>
        015F:00401359&nbsp; E9E5000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP&nbsp; 
        &nbsp; 00401443 <br>
        <br>
        015F:0040135E&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:00401360&nbsp; 8D55A8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        LEA&nbsp; &nbsp; EDX,[EBP-58] <br>
        015F:00401363&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EDX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;;pointer 
        to a filename <br>
        015F:00401364&nbsp; E891050000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; KERNEL32!_lcreat&nbsp; &nbsp;&nbsp;;try to create a file <br>
        015F:00401369&nbsp; 83F8FF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        CMP&nbsp; &nbsp; EAX,-01&nbsp; &nbsp;&nbsp;; would fail, if it tried to 
        create a file on a CD <br>
        015F:0040136C&nbsp; 7428&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; 00401396&nbsp; &nbsp;&nbsp;; as they are 
        read-only, so force this jump... <br>
        <br>
        015F:0040136E&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EAX <br>
        015F:0040136F&nbsp; E892050000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; KERNEL32!_lclose&nbsp; &nbsp;&nbsp;; whoops, we succeeded, so close 
        the newly created file-handle <br>
        015F:00401374&nbsp; 8D4DA8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        LEA&nbsp; &nbsp; ECX,[EBP-58] <br>
        015F:00401377&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; ECX <br>
        015F:00401378&nbsp; E835050000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; 004018B2 <br>
        015F:0040137D&nbsp; 59&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; POP&nbsp; &nbsp; ECX <br>
        015F:0040137E&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:00401380&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00 <br>
        015F:00401382&nbsp; 8D45B0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        LEA&nbsp; &nbsp; EAX,[EBP-50]&nbsp; &nbsp;&nbsp;;DEJAVU again :0 <br>
        015F:00401385&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EAX <br>
        015F:00401386&nbsp; 53&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EBX <br>
        015F:00401387&nbsp; E8C0000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; 0040144C&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; messagebox <br>
        015F:0040138C&nbsp; 83C410&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        ADD&nbsp; &nbsp; ESP,10 <br>
        015F:0040138F&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; XOR&nbsp; &nbsp; EAX,EAX <br>
        015F:00401391&nbsp; E9AD000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP&nbsp; 
        &nbsp; 00401443 <br>
        <br>
        015F:00401396&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; 00&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; if 
        we couldnt create the file, we end up here <br>
        015F:00401398&nbsp; 6823244000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; 00402423&nbsp; &nbsp;&nbsp;; pointer to 'y.e.p.' <br>
        015F:0040139D&nbsp; 8D55D4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        LEA&nbsp; &nbsp; EDX,[EBP-2C] <br>
        015F:004013A0&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EDX&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;; 
        pointer to 'y.a.y.!. .y.o.u. .c.r.a.c.k.e.d. .i.t.!.' <br>
        015F:004013A1&nbsp; 53&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; EBX <br>
        015F:004013A2&nbsp; E8A5000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; 0040144C&nbsp; &nbsp;&nbsp;; messagebox... <br>
        015F:004013A7&nbsp; 83C410&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        ADD&nbsp; &nbsp; ESP,10 <br>
        015F:004013AA&nbsp; E992000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP&nbsp; 
        &nbsp; 00401441 <br>
        <br>
        hmm, the bit at the start, stack overflow, dont understand what or why, 
        but kill this jump <br>
        <br>
        015F:00401323&nbsp; 0F8586000000&nbsp; &nbsp; &nbsp; &nbsp; JNZ&nbsp; 
        &nbsp; 004013AF <br>
        &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0f8500000000 <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br>
        you cant change the label of a CD, so this jump needs forcing <br>
        <br>
        015F:00401336&nbsp; 7526&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JNZ&nbsp; &nbsp; 0040135E <br>
        &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; eb26 <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br>
        last but not least, you cant create a file on a CD, so this jump needs 
        forcing aswell.. <br>
        <br>
        015F:0040136C&nbsp; 7428&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; 00401396 <br>
        &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; eb28 <br>
        <br>
        wayhey, then we finally reach the good boy message box!! yippee!!! <br>
        <br>
        after studying the code, and realising what has been done, it just does 
        some simple checks, <br>
        then compares the return codes against what they should be, we dont want 
        it re-labeling our <br>
        hard disk drive to 'overflow', or creating a file called 'my.dog', basically, 
        we can skip the <br>
        whole routine, and just end up at the goodboy message box..so bpx at the 
        first instruction <br>
        <br>
        015F:004011B3&nbsp; 68EB234000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; 004023EB&nbsp; &nbsp;&nbsp;; pointer to 'kernel32.dll',0 <br>
        <br>
        and re-assemble it to jump to the good-boy message box.. <br>
        <br>
        a 4011b3 &lt;ret> <br>
        jmp 401396 &lt;ret> <br>
        &lt;esc> <br>
        x &lt;ret> <br>
        <br>
        015F:004011B3&nbsp; E9DE010000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP&nbsp; 
        &nbsp; 00401396&nbsp; &nbsp;&nbsp;; skip whole of check, go straight to 
        jail <br>
        &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 
        &nbsp;&nbsp;; do not pass go, do not collect 200.. <br>
        :) <br>
        <br>
        then you have a almost cracked checkcd.exe... just gotta patch it, but 
        i cant be bothered, so <br>
        i used my process patcher to create a loader for it..(availble from http://csir.xxx.xxx 
        :) <br>
        <br>
        no plugz.. :) <br>
        <br>
        happy reversing / cracking / whatever.. <br>
        <br>