全国计算机等级考试考前模拟软件2004B版(kswinb2)
date:2004-5-28 杰天软件出品 三人行电脑科技园:
93cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3A6@1M7$3!0X3N6s2y4Q4x3X3g2U0L8$3@1`.
crk by zzhzihui@163.net zzhzihui@tom.com 22:31 2005-1-8
主程序:一级B.exe
用regmon 发现注册信息在:
HKEY_CURRENT_USER\Software\Microsoft\Windows\systemnot
============
注册时保存注册信息时调用:
:0043008F 89759C mov dword ptr [ebp-64], esi
:00430092 89758C mov dword ptr [ebp-74], esi
:00430095 FFD7 call edi
* Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\systemnot"
|
:00430097 BAC8D74100 mov edx, 0041D7C8
:0043009C 8D4DE4 lea ecx, dword ptr [ebp-1C]
:0043009F FFD7 call edi
:004300A1 8B4DE4 mov ecx, dword ptr [ebp-1C]
* Reference To: MSVBVM60.__vbaStrToAnsi, Ord:0000h
--------
---------
登录考号验证时中断:
* Reference To: MSVBVM60.__vbaStrCopy, Ord:0000h
|
:004304BB 8B3560114000 mov esi, dword ptr [00401160]
:004304C1 FFD6 call esi
* Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\systemnot"
|
:004304C3 BAC8D74100 mov edx, 0041D7C8
:004304C8 8D4DC0 lea ecx, dword ptr [ebp-40]
:004304CB FFD6 call esi
:004304CD 8D45BC lea eax, dword ptr [ebp-44]
:004304D0 50 push eax
....
接着到这里:
004358E8 . 50 PUSH EAX
004358E9 . 6A 01 PUSH 1
004358EB . FF15 9C114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCo>; MSVBVM60.__vbaStrComp
004358F1 . 66:8BF0 MOV SI,AX
004358F4 . 8D55 C8 LEA EDX,DWORD PTR SS:[EBP-38]
004358F7 . 8D45 C4 LEA EAX,DWORD PTR SS:[EBP-3C]
---------
启动时中断,开始考试时中断:
:00430261 FFD6 call esi
* Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\systemnot"
|
:00430263 BAC8D74100 mov edx, 0041D7C8
:00430268 8D4DC0 lea ecx, dword ptr [ebp-40]
:0043026B FFD6 call esi
:0043026D 8D45BC lea eax, dword ptr [ebp-44]
:00430270 50 push eax
:00430271 8D4DC0 lea ecx, dword ptr [ebp-40]
....
开始考试时接着到这里:
00448762 . 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44]
00448765 . FFD7 CALL EDI
00448767 . 50 PUSH EAX
00448768 . 6A 01 PUSH 1
0044876A . FF15 9C114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCo>; MSVBVM60.__vbaStrComp
00448770 . 66:8BF8 MOV DI,AX
00448773 . 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40]
00448776 . 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44]
00448779 . 50 PUSH EAX
0044877A . 8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C]
0044877D . 51 PUSH ECX
0044877E . 66:F7DF NEG DI
00448781 . 8D45 C8 LEA EAX,DWORD PTR SS:[EBP-38]
00448784 . 52 PUSH EDX
00448785 . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
00448788 . 50 PUSH EAX
00448789 . 1BFF SBB EDI,EDI
0044878B . 8D55 DC LEA EDX,DWORD PTR SS:[EBP-24]
0044878E . 51 PUSH ECX
0044878F . 47 INC EDI
00448790 . 52 PUSH EDX
00448791 . 6A 06 PUSH 6
00448793 . F7DF NEG EDI
00448795 . FF15 6C114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList
0044879B . 83C4 1C ADD ESP,1C
0044879E . 66:85FF TEST DI,DI
004487A1 . 74 14 JE SHORT 一级B.004487B7 ;这里nop可以显示屏蔽的菜单,但点击评分时会显示文件未找到,这个是PINGFEN.exe的信息
004487A3 . 8B1D 78104000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaOb>; MSVBVM60.__vbaObjSet
004487A9 . 66:C705 FC604>MOV WORD PTR DS:[4560FC],0
;上行4560FC是个标志,那里有一个双字,如果内容为FFFFFFFF那么表示未注册,
;如果为00000000,那么评分程序可以运行了,哈哈.爆破!
004487B2 . E9 E4000000 JMP 一级B.0044889B
*********
既然这样,在4560FC下硬件写入DW断点.看看到底哪里动了手脚.
首先这里:
004357DF . 83C4 0C ADD ESP,0C
004357E2 . 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
004357E5 . 66:C705 FE604>MOV WORD PTR DS:[4560FE],0FFFF;高字写入004357EE . 8B0E MOV ECX,DWORD PTR DS:[ESI] ; 一级B.0045AAC0
004357F0 . 52 PUSH EDX
---
00448667 . 8D45 E0 LEA EAX,DWORD PTR SS:[EBP-20]
0044866A . 66:C705 FC604>MOV WORD PTR DS:[4560FC],0FFFF;低字写入
00448673 . 50 PUSH EAX
---
00452363 . 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
00452366 . 66:C705 FE604>MOV WORD PTR DS:[4560FE],0FFFF;高字写入
0045236F . 8B16 MOV EDX,DWORD PTR DS:[ESI]
经过试验发现只有字4560FC是判断注册状态的.4560FE好像是判断一个题目是否评分的.但在破解4487A1后,其他的不改也可以了.但评分有些小问题,都改了吧!
==========
这个程序很讨厌,还有校验,发现更改文件,或者本身目录下有其他大文件就END,
下bp __vbaEnd,跟踪发现校验代码:
0043464D . FFD6 CALL ESI
0043464F . 85C0 TEST EAX,EAX
00434651 . 74 05 JE SHORT 一级BC.00434658 ;jmp
00434653 . E8 58C0FFFF CALL <JMP.&MSVBVM60.__vbaEnd> ;死了
00434658 > A1 A0694500 MOV EAX,DWORD PTR DS:[4569A0]
0043465D . 85C0 TEST EAX,EAX
--
00434638 . 85F8 TEST EAX,EDI
0043463A . 74 05 JE SHORT 一级BC.00434641 ;jmp
0043463C . E8 6FC0FFFF CALL <JMP.&MSVBVM60.__vbaEnd>
00434641 > 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
---
改动评分程序后校验:
00434603 . F7D8 NEG EAX
00434605 . 85F8 TEST EAX,EDI
00434607 . 74 05 JE SHORT 一级BC.0043460E ;jmp
00434609 . E8 A2C0FFFF CALL <JMP.&MSVBVM60.__vbaEnd>
0043460E > 8B55 D8 MOV EDX,DWORD PTR SS:[EBP-28]
00434611 . 8B42 04 MOV EAX,DWORD PTR DS:[EDX+4]
=========
修改方法:
1,
004487A1 . 74 14 JE SHORT 一级B.004487B7;这里NOP破解功能限制
2,
004357E5 . 66:C705 FE604>MOV WORD PTR DS:[4560FE],0FFFF;改高字写入0
3,
0044866A . 66:C705 FC604>MOV WORD PTR DS:[4560FC],0FFFF;改低字写入0
4,
00452366 . 66:C705 FE604>MOV WORD PTR DS:[4560FE],0FFFF;改高字写入0
5,
00434651 . 74 05 JE SHORT 一级BC.00434658;jmp破解校验
6,
0043463A . 74 05 JE SHORT 一级BC.00434641;jmp破解校验
========
ok!大功小成!没有追到注册码.
***********************************************************
评分程序:pingfen.exe
在评word,excel题时出现"加载DLL出错"错误!
或者评文字录入出现"excel没关闭!"
00412D92 . 8B95 58FFFFFF MOV EDX,DWORD PTR SS:[EBP-A8]
00412D98 . 23CA AND ECX,EDX
00412D9A . 66:8BF9 MOV DI,CX
00412D9D . 8D4D E4 LEA ECX,DWORD PTR SS:[EBP-1C]
00412DA0 . FF15 10124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStr
00412DA6 . 66:3BFB CMP DI,BX
00412DA9 . 0F84 D9000000 JE pingfen.00412E88; jmp
00412DAF . 8B06 MOV EAX,DWORD PTR DS:[ESI]
00412DB1 . 56 PUSH ESI
00412DB2 . FF90 FC020000 CALL DWORD PTR DS:[EAX+2FC]
00412DB8 . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
00412DBB . 50 PUSH EAX
00412DBC . 51 PUSH ECX
00412DBD . FF15 78104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00412DC3 . 8BF8 MOV EDI,EAX
00412DC5 . 53 PUSH EBX
-------
0045B5EB . 6A 03 PUSH 3
0045B5ED . 57 PUSH EDI
0045B5EE . 57 PUSH EDI
0045B5EF . 57 PUSH EDI
0045B5F0 . 57 PUSH EDI
0045B5F1 6A FF PUSH -1 ;改为1,设为底部窗口
0045B5F3 . 50 PUSH EAX
0045B5F4 . E8 C79EFAFF CALL pingfen.004054C0
0045B5F9 . 8B35 54104000 MOV ESI,DWORD PTR DS:[<&MSVBVM60.__vbaSe>; MSVBVM60.__vbaSetSystemError
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
