lesson14042.htm

为所有对破解感兴趣的朋友准备的礼物。希望大家能够喜欢。

  ECX,[3016D920] <br>
  015F:300D231D&nbsp; 83C408&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,08 <br>
  015F:300D2320&nbsp; 3BC1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  CMP&nbsp; &nbsp; EAX,ECX <br>
  015F:300D2322&nbsp; 0F841DFEFFFF&nbsp; &nbsp; &nbsp; &nbsp; JZ&nbsp; &nbsp; 
  &nbsp; 300D2145&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  (JUMP ) <br>
  015F:300D2145&nbsp; 8D542418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; EDX,[ESP+18] <br>
  015F:300D2149&nbsp; 6848D91630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
  &nbsp; 3016D948 <br>
  015F:300D214E&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EDX <br>
  015F:300D214F&nbsp; E82CFDFFFF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 300D1E80 <br>
  015F:300D2154&nbsp; 83C408&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,08 <br>
  015F:300D2157&nbsp; 85C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  TEST&nbsp; &nbsp; EAX,EAX <br>
  015F:300D2159&nbsp; 7D26&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JGE&nbsp; &nbsp; 300D2181&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; (JUMP ) <br>
  015F:300D2181&nbsp; 803DA480163003&nbsp; &nbsp; &nbsp; CMP&nbsp; &nbsp; BYTE 
  PTR [301680A4],03 <br>
  015F:300D2188&nbsp; 0F876D010000&nbsp; &nbsp; &nbsp; &nbsp; JA&nbsp; &nbsp; 
  &nbsp; 300D22FB&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  (NO JUMP) <br>
  015F:300D218E&nbsp; 8BAC24D0000000&nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; EBP,[ESP+000000D0] 
  <br>
  015F:300D2195&nbsp; C745009F860100&nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; DWORD 
  PTR [EBP+00],0001869F <br>
  015F:300D219C&nbsp; A0A4801630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  AL,[301680A4] <br>
  015F:300D21A1&nbsp; A801&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  TEST&nbsp; &nbsp; AL,01 <br>
  015F:300D21A3&nbsp; 744B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JZ&nbsp; &nbsp; &nbsp; 300D21F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; &nbsp; (NO JUMP) <br>
  015F:300D21A5&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  XOR&nbsp; &nbsp; EAX,EAX <br>
  015F:300D21A7&nbsp; 8D4C2418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; ECX,[ESP+18] <br>
  015F:300D21AB&nbsp; A0A5801630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  AL,[301680A5] <br>
  015F:300D21B0&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; ECX <br>
  015F:300D21B1&nbsp; 6824D91630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
  &nbsp; 3016D924 <br>
  015F:300D21B6&nbsp; 8D3440&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; ESI,[EAX*2+EAX] <br>
  015F:300D21B9&nbsp; C1E603&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SHL&nbsp; 
  &nbsp; ESI,03 <br>
  015F:300D21BC&nbsp; E85FFDFFFF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 300D1F20 <br>
  015F:300D21C1&nbsp; 83C408&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,08 <br>
  015F:300D21C4&nbsp; 3BC3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  CMP&nbsp; &nbsp; EAX,EBX <br>
  015F:300D21C6&nbsp; 0F8C2F010000&nbsp; &nbsp; &nbsp; &nbsp; JL&nbsp; &nbsp; 
  &nbsp; 300D22FB&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  (NO JUMP) <br>
  015F:300D21CC&nbsp; 3BC6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  CMP&nbsp; &nbsp; EAX,ESI <br>
  015F:300D21CE&nbsp; 7C0A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JL&nbsp; &nbsp; &nbsp; 300D21DA&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; &nbsp; (JUMP ) <br>
  015F:300D21DA&nbsp; 2BF0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  SUB&nbsp; &nbsp; ESI,EAX <br>
  015F:300D21DC&nbsp; B8ABAAAA2A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  EAX,2AAAAAAB <br>
  015F:300D21E1&nbsp; F7EE&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  IMUL&nbsp; &nbsp; ESI <br>
  015F:300D21E3&nbsp; C1FA02&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SAR&nbsp; 
  &nbsp; EDX,02 <br>
  015F:300D21E6&nbsp; 8BC2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  MOV&nbsp; &nbsp; EAX,EDX <br>
  015F:300D21E8&nbsp; C1E81F&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SHR&nbsp; 
  &nbsp; EAX,1F <br>
  015F:300D21EB&nbsp; 03D0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  ADD&nbsp; &nbsp; EDX,EAX <br>
  015F:300D21ED&nbsp; 895500&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
  &nbsp; [EBP+00],EDX <br>
  015F:300D21F0&nbsp; F605A480163002&nbsp; &nbsp; &nbsp; TEST&nbsp; &nbsp; BYTE 
  PTR [301680A4],02 <br>
  015F:300D21F7&nbsp; 0F84B3000000&nbsp; &nbsp; &nbsp; &nbsp; JZ&nbsp; &nbsp; 
  &nbsp; 300D22B0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  (JUMP ) <br>
  015F:300D22B0&nbsp; B909000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  ECX,00000009 <br>
  015F:300D22B5&nbsp; 8D742418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; ESI,[ESP+18] <br>
  015F:300D22B9&nbsp; BF48D91630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  EDI,3016D948 <br>
  015F:300D22BE&nbsp; F3A5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  REPZ MOVSD <br>
  015F:300D22C0&nbsp; 8B4500&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
  &nbsp; EAX,[EBP+00] <br>
  015F:300D22C3&nbsp; 33C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  XOR&nbsp; &nbsp; ECX,ECX <br>
  015F:300D22C5&nbsp; 8A0DA9801630&nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  CL,[301680A9] <br>
  015F:300D22CB&nbsp; 3BC1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  CMP&nbsp; &nbsp; EAX,ECX <br>
  015F:300D22CD&nbsp; 7F05&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JG&nbsp; &nbsp; &nbsp; 300D22D4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; &nbsp; (JUMP ) <br>
  015F:300D22D4&nbsp; 6A4C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  PUSH&nbsp; &nbsp; 4C <br>
  015F:300D22D6&nbsp; 6824D91630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
  &nbsp; 3016D924 <br>
  015F:300D22DB&nbsp; E820FAFFFF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 300D1D00 <br>
  015F:300D22E0&nbsp; 83C408&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,08 <br>
  015F:300D22E3&nbsp; A320D91630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  [3016D920],EAX <br>
  015F:300D22E8&nbsp; 6820D91630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
  &nbsp; 3016D920 <br>
  015F:300D22ED&nbsp; E80EFBFFFF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 300D1E00 <br>
  015F:300D22F2&nbsp; 83C404&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,04 <br>
  015F:300D22F5&nbsp; 85C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  TEST&nbsp; &nbsp; EAX,EAX <br>
  015F:300D22F7&nbsp; 8BC3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  MOV&nbsp; &nbsp; EAX,EBX <br>
  015F:300D22F9&nbsp; 7505&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JNZ&nbsp; &nbsp; 300D2300&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; (JUMP ) <br>
  015F:300D2300&nbsp; 5F&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; POP&nbsp; &nbsp; EDI <br>
  015F:300D2301&nbsp; 5E&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; POP&nbsp; &nbsp; ESI <br>
  015F:300D2302&nbsp; 5D&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; POP&nbsp; &nbsp; EBP <br>
  015F:300D2303&nbsp; 5B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; POP&nbsp; &nbsp; EBX <br>
  015F:300D2304&nbsp; 81C4BC000000&nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; &nbsp; 
  ESP,000000BC <br>
  015F:300D230A&nbsp; C3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; RET <br>
  015F:3000ADB6&nbsp; 8BF0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  MOV&nbsp; &nbsp; ESI,EAX <br>
  015F:3000ADB8&nbsp; 83C404&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,04 <br>
  015F:3000ADBB&nbsp; 8D46FF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; EAX,[ESI-01] <br>
  015F:3000ADBE&nbsp; 83F805&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CMP&nbsp; 
  &nbsp; EAX,05 <br>
  015F:3000ADC1&nbsp; 773D&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JA&nbsp; &nbsp; &nbsp; 3000AE00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; &nbsp; (JUMP ) <br>
  <br>
  <br>
  Step 9 : Find the first point where the two log files differ. <br>
  ************************************************************* <br>
  You may have noticed that the two log files are identical until the address 
  015F:3000ADC1. <br>
  In the first log file, the command at this address doesn`t jump, but in the 
  second log file, <br>
  the very same command Jumps. This is because the value of EAX at that point 
  in time are <br>
  different in the two logs. <br>
  Have a look at the three lines of code : <br>
  LEA&nbsp; EAX,[ESI-01]&nbsp; &nbsp; This looks at the byte at the address ESI-01 
  and puts the value in EAX. <br>
  CMP&nbsp; EAX,05&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; This looks to see if the 
  value in EAX is equal to 5. <br>
  JA&nbsp; &nbsp; 3000AE00&nbsp; &nbsp; &nbsp; &nbsp; Jump if Above to address 
  300AE00. <br>
  <br>
  <br>
  Step 10 : What do I do now ? <br>
  **************************** <br>
  We need to change the file so that the JA command does NOT jump. You can do 
  this several ways. <br>
  The cheap`n`nasty way is to nop(No Operation) the 'JA 3000AE00' command by changing 
  the two <br>
  values '77 3D' at address 015F:3000ADC1 to '90 90'. Although this will do the 
  job most of the <br>
  time, the correct way is to lie to the rest of the program by changing the 'LEA 
  EAX,[ESI-01]' <br>
  which is 3 bytes long ,the 'CMP EAX,05' which is also 3 bytes and the 'JA' command 
  (2 bytes) <br>
  , (8 bytes in total for the three asm commands) with the command 'MOV EAX,00000005' 
  <br>
  (5 bytes long) and 3 'NOP' commands (1 byte each). This ensures that the EAX 
  register has the <br>
  correct value and you are replacing the same ammount of bytes in the program. 
  <br>
  <br>
  <br>
  Step 11 : Pathcing the program. <br>
  ******************************* <br>
  All that remains now is to load your program into your favourite Hex editor 
  and search for <br>
  the pattern of bytes found in the log file for the LEA,CMP and JA commands and 
  patch it. <br>
  For this example,.... <br>
  Replace '8D46FF83F805773D' with 'B805000000909090'. <br>
  <br>
  B805000000 = MOV EAX,05 <br>
  90&nbsp; &nbsp; &nbsp; &nbsp; = NOP <br>
  <br>
  <br>
  Note : You may need to narrow down your search for these bytes by adding the 
  two lines of <br>
  bytes found above the asm code you are looking for into your search query. <br>
  <br>
  <br>
  Ending Note. <br>
  ************ <br>
  This way of cracking which I call the 'Call Flow Method' has many other possibilities 
  where <br>
  there are two states of execution. <br>
  For instance,.... <br>
  Cracking CRC checking routines (Program modified/Not modified), <br>
  Dongle protection (Dongle plugged in/Not plugged in), <br>
  Three tries and your out password protection, <br>
  Programs that only let you use a feature a certain number of times. <br>
  <br>
  I hope this tuorial will help people not only to speed up the cracking process, 
  but also help <br>
  to understand HOW a program works and aid in the cracking of the more difficult 
  targets. <br>
  I`m now off to drink loads of caffine and give my head a rest before starting 
  my next <br>
  tut. <br>
  <br>
  L8R Mushy :-) <br>
  <br>
  <br>
  <br>
  Greetz go to : <br>
  ************** <br>
  <br>
  The TCS Crew. (Best in the land ;-) <br>
  KM. (Only 1 more year to go : Freedom!!!!) <br>
  The Magician (Keep those degrees rolling and don`t let the fedz win.) <br>
  VnC (See ya at the show. Phone Me!!) <br>
  Everyone at +fravia`s msgbd. <br>
  Jeff (Great cracking board. Like the TIP of the day) </span></p>
<table width="80%" border="1" cellspacing="0" cellpadding="0" align="center" bgcolor="#99CCFF" bordercolorlight="#99CCFF" bordercolordark="#99CCFF">
  <tr> 
    <td width="82%" class="p8" height="34">Copyright @看雪 2000 All rights reserved 
      　　<a href="mailto:[e-mail]">与我联系</a></td>
    <td width="10%" class="p9" height="34"><a href="index.htm" tppabs="http://toye.dihou.org/index.htm">返回<br>
      首页</a></td>
    <td width="8%" class="p8" height="34"><a href="molu.htm" tppabs="http://toye.dihou.org/molu.htm" class="p9">返回<br>
      目录</a></td>
  </tr>
</table>
<p> </p>
</body>
</html>