-
-
IDM 6.25.20.2纯暴力流
-
发表于: 2016-6-3 22:22
-
本人懒得论坛编辑贴子,传附件和排版脑袋就大了,所以在本机上用AM-Notebook 6.3写好汇编的笔记之后,导出一份HTML文件,复制一下到windows live writer中一粘贴,就直接博客中发布了.
看不到图的,就看这里吧.41eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0D9L8$3N6Q4x3X3g2K6K9h3&6S2i4K6u0W2j5$3!0E0i4K6u0W2j5$3&6Q4x3V1k6K6i4K6u0r3j5X3I4G2k6#2)9#2k6U0g2X3x3o6m8V1x3e0M7@1x3o6p5H3x3Y4N6X3L8h3#2Q4x3X3g2Z5N6r3#2D9
嫌图太小的,就卷新浪吧, 或者 点击 2楼附件 下载 回家 看吧!!!
原创:心灵代码/发威时刻/killbr
00504901 |> /E8 416B0E00 call IDMan_ex.005EB447 跟到这里时出来
img1
上边的对话框!
-------------------------------------------------------------------------------------------
执行到返回处 是这个样子的
75E072FE FF15 BC00E075 call near dword ptr ds:[<&ntdll.NtCal>; ntdll_1z.ZwCallbackReturn
找到段首0050489A |. E8 04800E00 call IDMan_ex.005EC8A3是这里
F7后,在这里
005EC8A3 /$ 55 push ebp
005EC8A4 |. 8BEC mov ebp, esp
005EC8A6 |. 8B41 34 mov eax, dword ptr ds:[ecx+0x34]
005EC8A9 |. 85C0 test eax, eax
005EC8AB |. 75 14 jnz short IDMan_ex.005EC8C1
005EC8AD |. FF75 10 push [arg.3] ; /Count
005EC8B0 |. FF75 0C push [arg.2] ; |Buffer
005EC8B3 |. FF75 08 push [arg.1] ; |ControlID
005EC8B6 |. FF71 1C push dword ptr ds:[ecx+0x1C] ; |hWnd
005EC8B9 |. FF15 98C56100 call near dword ptr ds:[<&USER32.GetD>; \GetDlgItemTextA 不远处看到这个东东 F2下断
1路F8
要是到达
00504901 |> /E8 416B0E00 call IDMan_ex.005EB447
右测 寄存器中就看到了 EDX 02BF2E40 ASCII "You have entered incorrect Serial Number.
00504A1D |. /0F85 410B0000 jnz IDMan_ex.00505564 ; 所以这里一定不能实现, NOP
一路F8 右测寄存器中 就能一直看到我们的假注册码
00504B82 |. /74 16 je short IDMan_ex.00504B9A ; 往下走,不远处就会出现上面的那个假注册码对话框 NOP(NOP后往下走还会出来,因此只能JMP ,那JMP到什么地方呢? )
00504B84 |> |8B0D 88D76D00 mov ecx, dword ptr ds:[0x6DD788]
00504B8A |. |6A 00 push 0x0
00504B8C |. |68 A4CF6A00 push IDMan_ex.006ACFA4 ; ASCII "Internet Download Manager"
00504B91 |. |51 push ecx
00504B92 |. |8B4D D0 mov ecx, [local.12]
00504B95 |.^|E9 67FDFFFF jmp IDMan_ex.00504901
00504B9A |> \8B4D B8 mov ecx, [local.18]
-------------------------------------------------------------------------------------------
我们往下看
img2
Oh my god ! 这里有肉吃,因为注册成功,必写入注册表键值!
我们打开RegWorkshop 等着看好戏吧~~
00504C2E |. FF15 14C06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegCreateKeyExA这句执行过后,果然注册表以下分支创建了!
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Internet Download Manager
img3
我们继续F8 , 眼没事就看右上角 寄存器 窗口哟 ~~
FName 我们可爱的注册名
到00504CC5 |. 51 push ecx 时,我们看到了LName
00504D4E |. 8D85 78FFFFFF lea eax, [local.34] 到这里时我们又发现了Serial
00504CD4 |. /74 1A je short IDMan_ex.00504CF0 ; 这里发生了跳转,到底该不让让它跳呢? 我们可以F2,重新来过试一下
00504CD6 |. |50 push eax
00504CD7 |. |8D95 3CFEFFFF lea edx, [local.113]
00504CDD |. |68 906E6C00 push IDMan_ex.006C6E90 ; ASCII "Reg err2 in CRgDlg::OnOk, err = %ld"
00504CE2 |. |52 push edx
00504CE3 |. |E8 D0C80C00 call IDMan_ex.005D15B8
00504CE8 |. |8D85 3CFEFFFF lea eax, [local.113]
00504CEE |.^|EB 9B jmp short IDMan_ex.00504C8B
00504CF0 |> \8DBD F0FEFFFF lea edi, [local.68]
00504CF6 |. 83C9 FF or ecx, 0xFFFFFFFF
00504CF9 |. 33C0 xor eax, eax
00504CFB |. 8B15 18D16D00 mov edx, dword ptr ds:[0x6DD118]
00504D01 |. F2:AE repne scas byte ptr es:[edi]
00504D03 |. F7D1 not ecx
00504D05 |. 8D85 F0FEFFFF lea eax, [local.68]
00504D0B |. 51 push ecx
00504D0C |. 8B4D DC mov ecx, [local.9]
00504D0F |. 50 push eax
00504D10 |. 6A 01 push 0x1
00504D12 |. 6A 00 push 0x0
00504D14 |. 52 push edx
00504D15 |. 51 push ecx
00504D16 |. FFD6 call near esi
00504D18 |. 85C0 test eax, eax
00504D1A |. 74 1D je short IDMan_ex.00504D39
00504D1C |. 50 push eax
00504D1D |. 8D95 3CFEFFFF lea edx, [local.113]
00504D23 |. 68 6C6E6C00 push IDMan_ex.006C6E6C ; ASCII "Reg err3 in CRgDlg::OnOk, err = %ld"
00504D28 |. 52 push edx
00504D29 |. E8 8AC80C00 call IDMan_ex.005D15B8
00504D2E |. 8D85 3CFEFFFF lea eax, [local.113]
00504D34 |.^ E9 52FFFFFF jmp IDMan_ex.00504C8B
00504D39 |> 8DBD 78FFFFFF lea edi, [local.34]
00504D3F |. 83C9 FF or ecx, 0xFFFFFFFF
00504D42 |. 33C0 xor eax, eax
00504D44 |. 8B15 24D16D00 mov edx, dword ptr ds:[0x6DD124]
00504D4A |. F2:AE repne scas byte ptr es:[edi]
00504D4C |. F7D1 not ecx
00504D4E |. 8D85 78FFFFFF lea eax, [local.34]
00504D54 |. 51 push ecx
00504D55 |. 8B4D DC mov ecx, [local.9]
00504D58 |. 50 push eax
00504D59 |. 6A 01 push 0x1
00504D5B |. 6A 00 push 0x0
00504D5D |. 52 push edx
00504D5E |. 51 push ecx
00504D5F |. FFD6 call near esi
00504D61 |. 85C0 test eax, eax
00504D63 |. 74 1D je short IDMan_ex.00504D82
00504D65 |. 50 push eax
00504D66 |. 8D95 3CFEFFFF lea edx, [local.113]
00504D6C |. 68 486E6C00 push IDMan_ex.006C6E48 ; ASCII "Reg err4 in CRgDlg::OnOk, err = %ld"
也就是说上面几个的作用是写入了注册表键值而已,貌似没啥事发生
00504F9F |. /0F85 7F030000 jnz IDMan_ex.00505324
00504FA5 |. |8D4D C4 lea ecx, [local.15]
00504FA8 |. |51 push ecx
00504FA9 |. |6A 01 push 0x1
00504FAB |. |50 push eax
00504FAC |. |68 20CF6A00 push IDMan_ex.006ACF20 ; ASCII "SOFTWARE\Internet Download Manager"
00504FB1 |. |68 02000080 push 0x80000002
00504FB6 |. |FFD3 call near ebx
00504FB8 |. |85C0 test eax, eax
00504FBA |. |0F85 64030000 jnz IDMan_ex.00505324
00504FC0 |. |8B0D 24D16D00 mov ecx, dword ptr ds:[0x6DD124]
00504FC6 |. |8D55 B0 lea edx, [local.20]
00504FC9 |. |8D85 F4FDFFFF lea eax, [local.131]
00504FCF |. |52 push edx ; /pBufSize
00504FD0 |. |8B55 C4 mov edx, [local.15] ; |
00504FD3 |. |50 push eax ; |Buffer
00504FD4 |. |6A 00 push 0x0 ; |pValueType = NULL
00504FD6 |. |6A 00 push 0x0 ; |Reserved = NULL
00504FD8 |. |51 push ecx ; |ValueName => "Serial"
00504FD9 |. |52 push edx ; |hKey
00504FDA |. |C745 B0 C8000>mov [local.20], 0xC8 ; |
00504FE1 |. |32DB xor bl, bl ; |
00504FE3 |. |FF15 04C06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegQueryValueExA
这里我们看到了 这些东东
img4
大家看到 上边显示的那个Please wait......了么?
00505441 |. E8 7ADCFFFF call IDMan_ex.005030C0 ; 当到达这里时进程变得超慢超慢的,网络验证部分
00505446 |. 8BD8 mov ebx, eax
00505448 |. 83FB 0B cmp ebx, 0xB
0050544B |. 0F85 B8000000 jnz IDMan_ex.00505509 ; 这里看OD的线是灰色的,没有实现!你想做啥?删除我们的注册码么?没门,我们JMP
00505451 |. 8B55 AC mov edx, [local.21]
00505454 |. 8BCF mov ecx, edi
00505456 |. 52 push edx
00505457 |. E8 71750E00 call IDMan_ex.005EC9CD
0050545C |. 68 AA040000 push 0x4AA
00505461 |. 8BCE mov ecx, esi
00505463 |. E8 E3730E00 call IDMan_ex.005EC84B
00505468 |. 8BC8 mov ecx, eax
0050546A |. E8 E3760E00 call IDMan_ex.005ECB52
0050546F |. 68 C8C26D00 push IDMan_ex.006DC2C8
00505474 |. 68 AA040000 push 0x4AA
00505479 |. 8BCE mov ecx, esi
0050547B |. E8 55740E00 call IDMan_ex.005EC8D5
00505480 |. A1 24D16D00 mov eax, dword ptr ds:[0x6DD124]
00505485 |. 8B4D DC mov ecx, [local.9]
00505488 |. 50 push eax ; /ValueName => "Serial"
00505489 |. 51 push ecx ; |hKey
0050548A |. FF15 0CC06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegDeleteValueA
00505514 |. /74 07 je short IDMan_ex.0050551D ; 这里想做啥?又憋着坏呢 ,同样这里没有实现.
00505516 |. |50 push eax ; /hKey
00505517 |. |FF15 68C06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegCloseKey
0050551D |> \8B45 B8 mov eax, [local.18]
F8下去就会
img5
我们把刚才修改过的 保存一份出去,利用上面我们的分析,继续往下.
-------------------------------------------------------------------------------------------
我们刚才研究到00505514 这里了. 在此下断
并看看Regworkshop 的键值 还在么? yes!
重新来过后发现这里00505514
我们F12 后,Alt+k
004605B0 /$ 55 push ebp ; F2
004605B1 |. 8BEC mov ebp, esp
004605B3 |. 6A FF push -0x1
004605B5 |. 68 B24A6000 push ________.00604AB2 ; SE 处理程序安装
004605BA |. 64:A1 0000000>mov eax, dword ptr fs:[0]
004605C0 |. 50 push eax
004605C1 |. 64:8925 00000>mov dword ptr fs:[0], esp
004605C8 |. 81EC 6C010000 sub esp, 0x16C
004605CE |. 53 push ebx
004605CF |. 56 push esi
004605D0 |. 57 push edi
004605D1 |. 8BF1 mov esi, ecx
004605D3 |. 33DB xor ebx, ebx
004605D5 |. 8965 F0 mov [local.4], esp
004605D8 |. 53 push ebx
004605D9 |. 8D8D 88FEFFFF lea ecx, [local.94]
004605DF |. 8975 EC mov [local.5], esi
004605E2 |. 895D FC mov [local.1], ebx
004605E5 |. E8 F63F0A00 call ________.005045E0
004605EA |. 8B4E 1C mov ecx, dword ptr ds:[esi+0x1C]
004605ED |. 8B86 4C010000 mov eax, dword ptr ds:[esi+0x14C]
004605F3 |. 898D ECFEFFFF mov [local.69], ecx
004605F9 |. 8D8D 88FEFFFF lea ecx, [local.94]
004605FF |. C645 FC 01 mov byte ptr ss:[ebp-0x4], 0x1
00460603 |. 8985 E4FEFFFF mov [local.71], eax
00460609 |. E8 D88D1800 call ________.005E93E6 ; 这里弹 注册的对话框
0046060E |. 3BC3 cmp eax, ebx
00460610 |. /74 18 je short ________.0046062A ; F2 因此这要JMP
00460612 |. |8B95 F0FEFFFF mov edx, [local.68]
00460618 |. |52 push edx
00460619 |. |53 push ebx
0046061A |. |50 push eax
0046061B |. |E8 7045FEFF call ________.00444B90 ; 这句就弹出 exit dialog
img6
一路F8 上边的关于 就成功了,但千万别高兴!
把我们的修改成果保存一下,继续~~
重新载入 [我们的2号成果.exe]
果然注册给谁,又变成了未注册字样
我们发现我们下bp RegOpenKeyExA断点貌似不太好使
00401771 /0F85 3F010000 jnz ________.004018B6 ; 如您 正好断在这里,那么恭喜你,显然这里跳走了,当然nop
00401777 |. |A1 5C7D6D00 mov eax, dword ptr ds:[0x6D7D5C]
0040177C |. |8945 E8 mov [local.6], eax
0040177F |. |8D4D DC lea ecx, [local.9]
00401782 |. |C645 FC 01 mov byte ptr ss:[ebp-0x4], 0x1
00401786 |. |51 push ecx ; /pHandle
00401787 |. |6A 01 push 0x1 ; |Access = KEY_QUERY_VALUE
00401789 |. |6A 00 push 0x0 ; |Reserved = 0x0
0040178B |. |68 20CF6A00 push ________.006ACF20 ; |Subkey = "SOFTWARE\Internet Download Manager"
00401790 |. |68 02000080 push 0x80000002 ; |hKey = HKEY_LOCAL_MACHINE
00401795 |. |FF15 08C06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegOpenKeyExA
0040179B |. |85C0 test eax, eax
0040179D |. |8945 E0 mov [local.8], eax
004017A0 |. |74 09 je short ________.004017AB
004017A2 |. |8B15 80C96D00 mov edx, dword ptr ds:[0x6DC980]
004017A8 |. |8955 DC mov [local.9], edx
004017AB |> |8B15 20D16D00 mov edx, dword ptr ds:[0x6DD120]
004017B1 |. |8B35 04C06100 mov esi, dword ptr ds:[<&ADVAPI32.Re>; advapi32.RegQueryValueExA
004017B7 |. |8D45 EC lea eax, [local.5]
004017BA |. |8D8D 74FFFFFF lea ecx, [local.35]
004017C0 |. |50 push eax ; /pBufSize
004017C1 |. |8B45 DC mov eax, [local.9] ; |
004017C4 |. |51 push ecx ; |Buffer
004017C5 |. |6A 00 push 0x0 ; |pValueType = NULL
004017C7 |. |6A 00 push 0x0 ; |Reserved = NULL
004017C9 |. |BB 32000000 mov ebx, 0x32 ; |
004017CE |. |52 push edx ; |ValueName => "FName"
004017CF |. |50 push eax ; |hKey
004017D0 |. |895D EC mov [local.5], ebx ; |
004017D3 |. |FFD6 call near esi ; \RegQueryValueExA
004017D5 |. |85C0 test eax, eax
004017D7 |. |74 25 je short ________.004017FE ; 这里依然nop
004017D9 |. |A1 20D16D00 mov eax, dword ptr ds:[0x6DD120]
004017DE |. |8D4D EC lea ecx, [local.5]
004017E1 |. |8D95 74FFFFFF lea edx, [local.35]
004017E7 |. |51 push ecx ; /pBufSize
004017E8 |. |8B0D 80C96D00 mov ecx, dword ptr ds:[0x6DC980] ; |
004017EE |. |52 push edx ; |Buffer
004017EF |. |6A 00 push 0x0 ; |pValueType = NULL
004017F1 |. |6A 00 push 0x0 ; |Reserved = NULL
004017F3 |. |50 push eax ; |ValueName => "FName"
004017F4 |. |51 push ecx ; |hKey => 0xF8
004017F5 |. |895D EC mov [local.5], ebx ; |
004017F8 |. |FFD6 call near esi ; \RegQueryValueExA
到这里时,我们重新 发现 tiantian911 这个注册名
0040187A |. /74 07 je short ________.00401883 ; jmp
0040187C |. |50 push eax ; /hKey
0040187D |. |FF15 68C06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegCloseKey
.......F8
004018E8 /EB 07 jmp short ________.004018F1 ; jmp
004018EA |. |68 14CF6A00 push ________.006ACF14 ; ASCII "Trial"
004018EF |. |EB 05 jmp short ________.004018F6
004018F1 |> \68 0CCF6A00 push ________.006ACF0C ; ASCII "Full"
........F8
img7
我们再次存 [样品3.exe ] ctrl+F2 ,这次发现没啥事发生.
发现下载文件时,还会退出的.
但 点删除全部列表文件 时
img8
证明以上搞法还有不妥的地方
004607ED /EB 20 jmp short ________.0046080F ; 所以 这里JMP
004607EF . |A1 2CDC6D00 mov eax, dword ptr ds:[0x6DDC2C]
004607F4 . |6A 00 push 0x0
004607F6 . |6A 00 push 0x0
004607F8 . |50 push eax
004607F9 . |E8 49AC1800 call ________.005EB447 ; 提示你 只要注册版本 能享受此功能
00460821 . E8 21AC1800 call ________.005EB447 ;Are you really Delete files .....
我们发现这样的改法之后,开始程序是把相关文件删除掉了.但重启后发现没有删除文件的行为.
00460857 /0F85 07010000 jnz ________.00460964
-------------------------------------------------------------------------------------------
00460857 /0F85 07010000 jnz ________.00460964 ; 修复 删除全部文件的bug, NOP!
0046085D . |80BE 540A0000>cmp byte ptr ds:[esi+0xA54], 0x0
00460864 . |0F84 FA000000 je ________.00460964
0046086A . |8B4D EC mov ecx, dword ptr ss:[ebp-0x14]
0046086D . |C745 D4 01000>mov dword ptr ss:[ebp-0x2C], 0x1
00460874 . |8B86 70040000 mov eax, dword ptr ds:[esi+0x470]
0046087A . |8D55 D4 lea edx, dword ptr ss:[ebp-0x2C]
0046087D . |8945 DC mov dword ptr ss:[ebp-0x24], eax
00460880 . |8B81 94010000 mov eax, dword ptr ds:[ecx+0x194]
00460886 . |52 push edx ; /lParam
00460887 . |6A FF push -0x1 ; |wParam = 0xFFFFFFFF
00460889 . |8B40 1C mov eax, dword ptr ds:[eax+0x1C] ; |
0046088C . |68 0D100000 push 0x100D ; |Message = MSG(0x100D)
00460891 . |50 push eax ; |hWnd
00460892 . |FF15 08C86100 call near dword ptr ds:[<&USER32.Send>; \SendMessageA
-------------------------------------------------------------------------------------------
00401421 |. /74 20 je short IDMan_ex.00401443 JMP掉,因为这里有退出代码.
00401423 |. |8B8D F4FEFFFF mov ecx, [local.67]
00401429 |. |51 push ecx
0040142A |. |53 push ebx
0040142B |. |50 push eax
0040142C |. |E8 5F370400 call IDMan_ex.00444B90
00401431 |. |83C4 0C add esp, 0xC
00401434 |. |8BCE mov ecx, esi
00401436 |. |53 push ebx
00401437 |. |E8 0A811E00 call IDMan_ex.005E9546
0040143C |. |53 push ebx ; /ExitCode
0040143D |. |FF15 C4C46100 call near dword ptr ds:[<&KERNEL32.Ex>; \ExitProcess
00401443 |> \8D4D AC lea ecx, [local.21]
看不到图的,就看这里吧.41eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0D9L8$3N6Q4x3X3g2K6K9h3&6S2i4K6u0W2j5$3!0E0i4K6u0W2j5$3&6Q4x3V1k6K6i4K6u0r3j5X3I4G2k6#2)9#2k6U0g2X3x3o6m8V1x3e0M7@1x3o6p5H3x3Y4N6X3L8h3#2Q4x3X3g2Z5N6r3#2D9
嫌图太小的,就卷新浪吧, 或者 点击 2楼附件 下载 回家 看吧!!!原创:心灵代码/发威时刻/killbr
00504901 |> /E8 416B0E00 call IDMan_ex.005EB447 跟到这里时出来
img1
上边的对话框!
-------------------------------------------------------------------------------------------
执行到返回处 是这个样子的
75E072FE FF15 BC00E075 call near dword ptr ds:[<&ntdll.NtCal>; ntdll_1z.ZwCallbackReturn
找到段首0050489A |. E8 04800E00 call IDMan_ex.005EC8A3是这里
F7后,在这里
005EC8A3 /$ 55 push ebp
005EC8A4 |. 8BEC mov ebp, esp
005EC8A6 |. 8B41 34 mov eax, dword ptr ds:[ecx+0x34]
005EC8A9 |. 85C0 test eax, eax
005EC8AB |. 75 14 jnz short IDMan_ex.005EC8C1
005EC8AD |. FF75 10 push [arg.3] ; /Count
005EC8B0 |. FF75 0C push [arg.2] ; |Buffer
005EC8B3 |. FF75 08 push [arg.1] ; |ControlID
005EC8B6 |. FF71 1C push dword ptr ds:[ecx+0x1C] ; |hWnd
005EC8B9 |. FF15 98C56100 call near dword ptr ds:[<&USER32.GetD>; \GetDlgItemTextA 不远处看到这个东东 F2下断
1路F8
要是到达
00504901 |> /E8 416B0E00 call IDMan_ex.005EB447
右测 寄存器中就看到了 EDX 02BF2E40 ASCII "You have entered incorrect Serial Number.
00504A1D |. /0F85 410B0000 jnz IDMan_ex.00505564 ; 所以这里一定不能实现, NOP
一路F8 右测寄存器中 就能一直看到我们的假注册码
00504B82 |. /74 16 je short IDMan_ex.00504B9A ; 往下走,不远处就会出现上面的那个假注册码对话框 NOP(NOP后往下走还会出来,因此只能JMP ,那JMP到什么地方呢? )
00504B84 |> |8B0D 88D76D00 mov ecx, dword ptr ds:[0x6DD788]
00504B8A |. |6A 00 push 0x0
00504B8C |. |68 A4CF6A00 push IDMan_ex.006ACFA4 ; ASCII "Internet Download Manager"
00504B91 |. |51 push ecx
00504B92 |. |8B4D D0 mov ecx, [local.12]
00504B95 |.^|E9 67FDFFFF jmp IDMan_ex.00504901
00504B9A |> \8B4D B8 mov ecx, [local.18]
-------------------------------------------------------------------------------------------
我们往下看
img2
Oh my god ! 这里有肉吃,因为注册成功,必写入注册表键值!
我们打开RegWorkshop 等着看好戏吧~~
00504C2E |. FF15 14C06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegCreateKeyExA这句执行过后,果然注册表以下分支创建了!
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Internet Download Manager
img3
我们继续F8 , 眼没事就看右上角 寄存器 窗口哟 ~~
FName 我们可爱的注册名
到00504CC5 |. 51 push ecx 时,我们看到了LName
00504D4E |. 8D85 78FFFFFF lea eax, [local.34] 到这里时我们又发现了Serial
00504CD4 |. /74 1A je short IDMan_ex.00504CF0 ; 这里发生了跳转,到底该不让让它跳呢? 我们可以F2,重新来过试一下
00504CD6 |. |50 push eax
00504CD7 |. |8D95 3CFEFFFF lea edx, [local.113]
00504CDD |. |68 906E6C00 push IDMan_ex.006C6E90 ; ASCII "Reg err2 in CRgDlg::OnOk, err = %ld"
00504CE2 |. |52 push edx
00504CE3 |. |E8 D0C80C00 call IDMan_ex.005D15B8
00504CE8 |. |8D85 3CFEFFFF lea eax, [local.113]
00504CEE |.^|EB 9B jmp short IDMan_ex.00504C8B
00504CF0 |> \8DBD F0FEFFFF lea edi, [local.68]
00504CF6 |. 83C9 FF or ecx, 0xFFFFFFFF
00504CF9 |. 33C0 xor eax, eax
00504CFB |. 8B15 18D16D00 mov edx, dword ptr ds:[0x6DD118]
00504D01 |. F2:AE repne scas byte ptr es:[edi]
00504D03 |. F7D1 not ecx
00504D05 |. 8D85 F0FEFFFF lea eax, [local.68]
00504D0B |. 51 push ecx
00504D0C |. 8B4D DC mov ecx, [local.9]
00504D0F |. 50 push eax
00504D10 |. 6A 01 push 0x1
00504D12 |. 6A 00 push 0x0
00504D14 |. 52 push edx
00504D15 |. 51 push ecx
00504D16 |. FFD6 call near esi
00504D18 |. 85C0 test eax, eax
00504D1A |. 74 1D je short IDMan_ex.00504D39
00504D1C |. 50 push eax
00504D1D |. 8D95 3CFEFFFF lea edx, [local.113]
00504D23 |. 68 6C6E6C00 push IDMan_ex.006C6E6C ; ASCII "Reg err3 in CRgDlg::OnOk, err = %ld"
00504D28 |. 52 push edx
00504D29 |. E8 8AC80C00 call IDMan_ex.005D15B8
00504D2E |. 8D85 3CFEFFFF lea eax, [local.113]
00504D34 |.^ E9 52FFFFFF jmp IDMan_ex.00504C8B
00504D39 |> 8DBD 78FFFFFF lea edi, [local.34]
00504D3F |. 83C9 FF or ecx, 0xFFFFFFFF
00504D42 |. 33C0 xor eax, eax
00504D44 |. 8B15 24D16D00 mov edx, dword ptr ds:[0x6DD124]
00504D4A |. F2:AE repne scas byte ptr es:[edi]
00504D4C |. F7D1 not ecx
00504D4E |. 8D85 78FFFFFF lea eax, [local.34]
00504D54 |. 51 push ecx
00504D55 |. 8B4D DC mov ecx, [local.9]
00504D58 |. 50 push eax
00504D59 |. 6A 01 push 0x1
00504D5B |. 6A 00 push 0x0
00504D5D |. 52 push edx
00504D5E |. 51 push ecx
00504D5F |. FFD6 call near esi
00504D61 |. 85C0 test eax, eax
00504D63 |. 74 1D je short IDMan_ex.00504D82
00504D65 |. 50 push eax
00504D66 |. 8D95 3CFEFFFF lea edx, [local.113]
00504D6C |. 68 486E6C00 push IDMan_ex.006C6E48 ; ASCII "Reg err4 in CRgDlg::OnOk, err = %ld"
也就是说上面几个的作用是写入了注册表键值而已,貌似没啥事发生
00504F9F |. /0F85 7F030000 jnz IDMan_ex.00505324
00504FA5 |. |8D4D C4 lea ecx, [local.15]
00504FA8 |. |51 push ecx
00504FA9 |. |6A 01 push 0x1
00504FAB |. |50 push eax
00504FAC |. |68 20CF6A00 push IDMan_ex.006ACF20 ; ASCII "SOFTWARE\Internet Download Manager"
00504FB1 |. |68 02000080 push 0x80000002
00504FB6 |. |FFD3 call near ebx
00504FB8 |. |85C0 test eax, eax
00504FBA |. |0F85 64030000 jnz IDMan_ex.00505324
00504FC0 |. |8B0D 24D16D00 mov ecx, dword ptr ds:[0x6DD124]
00504FC6 |. |8D55 B0 lea edx, [local.20]
00504FC9 |. |8D85 F4FDFFFF lea eax, [local.131]
00504FCF |. |52 push edx ; /pBufSize
00504FD0 |. |8B55 C4 mov edx, [local.15] ; |
00504FD3 |. |50 push eax ; |Buffer
00504FD4 |. |6A 00 push 0x0 ; |pValueType = NULL
00504FD6 |. |6A 00 push 0x0 ; |Reserved = NULL
00504FD8 |. |51 push ecx ; |ValueName => "Serial"
00504FD9 |. |52 push edx ; |hKey
00504FDA |. |C745 B0 C8000>mov [local.20], 0xC8 ; |
00504FE1 |. |32DB xor bl, bl ; |
00504FE3 |. |FF15 04C06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegQueryValueExA
这里我们看到了 这些东东
img4
大家看到 上边显示的那个Please wait......了么?
00505441 |. E8 7ADCFFFF call IDMan_ex.005030C0 ; 当到达这里时进程变得超慢超慢的,网络验证部分
00505446 |. 8BD8 mov ebx, eax
00505448 |. 83FB 0B cmp ebx, 0xB
0050544B |. 0F85 B8000000 jnz IDMan_ex.00505509 ; 这里看OD的线是灰色的,没有实现!你想做啥?删除我们的注册码么?没门,我们JMP
00505451 |. 8B55 AC mov edx, [local.21]
00505454 |. 8BCF mov ecx, edi
00505456 |. 52 push edx
00505457 |. E8 71750E00 call IDMan_ex.005EC9CD
0050545C |. 68 AA040000 push 0x4AA
00505461 |. 8BCE mov ecx, esi
00505463 |. E8 E3730E00 call IDMan_ex.005EC84B
00505468 |. 8BC8 mov ecx, eax
0050546A |. E8 E3760E00 call IDMan_ex.005ECB52
0050546F |. 68 C8C26D00 push IDMan_ex.006DC2C8
00505474 |. 68 AA040000 push 0x4AA
00505479 |. 8BCE mov ecx, esi
0050547B |. E8 55740E00 call IDMan_ex.005EC8D5
00505480 |. A1 24D16D00 mov eax, dword ptr ds:[0x6DD124]
00505485 |. 8B4D DC mov ecx, [local.9]
00505488 |. 50 push eax ; /ValueName => "Serial"
00505489 |. 51 push ecx ; |hKey
0050548A |. FF15 0CC06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegDeleteValueA
00505514 |. /74 07 je short IDMan_ex.0050551D ; 这里想做啥?又憋着坏呢 ,同样这里没有实现.
00505516 |. |50 push eax ; /hKey
00505517 |. |FF15 68C06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegCloseKey
0050551D |> \8B45 B8 mov eax, [local.18]
F8下去就会
img5
我们把刚才修改过的 保存一份出去,利用上面我们的分析,继续往下.
-------------------------------------------------------------------------------------------
我们刚才研究到00505514 这里了. 在此下断
并看看Regworkshop 的键值 还在么? yes!
重新来过后发现这里00505514
我们F12 后,Alt+k
004605B0 /$ 55 push ebp ; F2
004605B1 |. 8BEC mov ebp, esp
004605B3 |. 6A FF push -0x1
004605B5 |. 68 B24A6000 push ________.00604AB2 ; SE 处理程序安装
004605BA |. 64:A1 0000000>mov eax, dword ptr fs:[0]
004605C0 |. 50 push eax
004605C1 |. 64:8925 00000>mov dword ptr fs:[0], esp
004605C8 |. 81EC 6C010000 sub esp, 0x16C
004605CE |. 53 push ebx
004605CF |. 56 push esi
004605D0 |. 57 push edi
004605D1 |. 8BF1 mov esi, ecx
004605D3 |. 33DB xor ebx, ebx
004605D5 |. 8965 F0 mov [local.4], esp
004605D8 |. 53 push ebx
004605D9 |. 8D8D 88FEFFFF lea ecx, [local.94]
004605DF |. 8975 EC mov [local.5], esi
004605E2 |. 895D FC mov [local.1], ebx
004605E5 |. E8 F63F0A00 call ________.005045E0
004605EA |. 8B4E 1C mov ecx, dword ptr ds:[esi+0x1C]
004605ED |. 8B86 4C010000 mov eax, dword ptr ds:[esi+0x14C]
004605F3 |. 898D ECFEFFFF mov [local.69], ecx
004605F9 |. 8D8D 88FEFFFF lea ecx, [local.94]
004605FF |. C645 FC 01 mov byte ptr ss:[ebp-0x4], 0x1
00460603 |. 8985 E4FEFFFF mov [local.71], eax
00460609 |. E8 D88D1800 call ________.005E93E6 ; 这里弹 注册的对话框
0046060E |. 3BC3 cmp eax, ebx
00460610 |. /74 18 je short ________.0046062A ; F2 因此这要JMP
00460612 |. |8B95 F0FEFFFF mov edx, [local.68]
00460618 |. |52 push edx
00460619 |. |53 push ebx
0046061A |. |50 push eax
0046061B |. |E8 7045FEFF call ________.00444B90 ; 这句就弹出 exit dialog
img6
一路F8 上边的关于 就成功了,但千万别高兴!
把我们的修改成果保存一下,继续~~
重新载入 [我们的2号成果.exe]
果然注册给谁,又变成了未注册字样
我们发现我们下bp RegOpenKeyExA断点貌似不太好使
00401771 /0F85 3F010000 jnz ________.004018B6 ; 如您 正好断在这里,那么恭喜你,显然这里跳走了,当然nop
00401777 |. |A1 5C7D6D00 mov eax, dword ptr ds:[0x6D7D5C]
0040177C |. |8945 E8 mov [local.6], eax
0040177F |. |8D4D DC lea ecx, [local.9]
00401782 |. |C645 FC 01 mov byte ptr ss:[ebp-0x4], 0x1
00401786 |. |51 push ecx ; /pHandle
00401787 |. |6A 01 push 0x1 ; |Access = KEY_QUERY_VALUE
00401789 |. |6A 00 push 0x0 ; |Reserved = 0x0
0040178B |. |68 20CF6A00 push ________.006ACF20 ; |Subkey = "SOFTWARE\Internet Download Manager"
00401790 |. |68 02000080 push 0x80000002 ; |hKey = HKEY_LOCAL_MACHINE
00401795 |. |FF15 08C06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegOpenKeyExA
0040179B |. |85C0 test eax, eax
0040179D |. |8945 E0 mov [local.8], eax
004017A0 |. |74 09 je short ________.004017AB
004017A2 |. |8B15 80C96D00 mov edx, dword ptr ds:[0x6DC980]
004017A8 |. |8955 DC mov [local.9], edx
004017AB |> |8B15 20D16D00 mov edx, dword ptr ds:[0x6DD120]
004017B1 |. |8B35 04C06100 mov esi, dword ptr ds:[<&ADVAPI32.Re>; advapi32.RegQueryValueExA
004017B7 |. |8D45 EC lea eax, [local.5]
004017BA |. |8D8D 74FFFFFF lea ecx, [local.35]
004017C0 |. |50 push eax ; /pBufSize
004017C1 |. |8B45 DC mov eax, [local.9] ; |
004017C4 |. |51 push ecx ; |Buffer
004017C5 |. |6A 00 push 0x0 ; |pValueType = NULL
004017C7 |. |6A 00 push 0x0 ; |Reserved = NULL
004017C9 |. |BB 32000000 mov ebx, 0x32 ; |
004017CE |. |52 push edx ; |ValueName => "FName"
004017CF |. |50 push eax ; |hKey
004017D0 |. |895D EC mov [local.5], ebx ; |
004017D3 |. |FFD6 call near esi ; \RegQueryValueExA
004017D5 |. |85C0 test eax, eax
004017D7 |. |74 25 je short ________.004017FE ; 这里依然nop
004017D9 |. |A1 20D16D00 mov eax, dword ptr ds:[0x6DD120]
004017DE |. |8D4D EC lea ecx, [local.5]
004017E1 |. |8D95 74FFFFFF lea edx, [local.35]
004017E7 |. |51 push ecx ; /pBufSize
004017E8 |. |8B0D 80C96D00 mov ecx, dword ptr ds:[0x6DC980] ; |
004017EE |. |52 push edx ; |Buffer
004017EF |. |6A 00 push 0x0 ; |pValueType = NULL
004017F1 |. |6A 00 push 0x0 ; |Reserved = NULL
004017F3 |. |50 push eax ; |ValueName => "FName"
004017F4 |. |51 push ecx ; |hKey => 0xF8
004017F5 |. |895D EC mov [local.5], ebx ; |
004017F8 |. |FFD6 call near esi ; \RegQueryValueExA
到这里时,我们重新 发现 tiantian911 这个注册名
0040187A |. /74 07 je short ________.00401883 ; jmp
0040187C |. |50 push eax ; /hKey
0040187D |. |FF15 68C06100 call near dword ptr ds:[<&ADVAPI32.Re>; \RegCloseKey
.......F8
004018E8 /EB 07 jmp short ________.004018F1 ; jmp
004018EA |. |68 14CF6A00 push ________.006ACF14 ; ASCII "Trial"
004018EF |. |EB 05 jmp short ________.004018F6
004018F1 |> \68 0CCF6A00 push ________.006ACF0C ; ASCII "Full"
........F8
img7
我们再次存 [样品3.exe ] ctrl+F2 ,这次发现没啥事发生.
发现下载文件时,还会退出的.
但 点删除全部列表文件 时
img8
证明以上搞法还有不妥的地方
004607ED /EB 20 jmp short ________.0046080F ; 所以 这里JMP
004607EF . |A1 2CDC6D00 mov eax, dword ptr ds:[0x6DDC2C]
004607F4 . |6A 00 push 0x0
004607F6 . |6A 00 push 0x0
004607F8 . |50 push eax
004607F9 . |E8 49AC1800 call ________.005EB447 ; 提示你 只要注册版本 能享受此功能
00460821 . E8 21AC1800 call ________.005EB447 ;Are you really Delete files .....
我们发现这样的改法之后,开始程序是把相关文件删除掉了.但重启后发现没有删除文件的行为.
00460857 /0F85 07010000 jnz ________.00460964
-------------------------------------------------------------------------------------------
00460857 /0F85 07010000 jnz ________.00460964 ; 修复 删除全部文件的bug, NOP!
0046085D . |80BE 540A0000>cmp byte ptr ds:[esi+0xA54], 0x0
00460864 . |0F84 FA000000 je ________.00460964
0046086A . |8B4D EC mov ecx, dword ptr ss:[ebp-0x14]
0046086D . |C745 D4 01000>mov dword ptr ss:[ebp-0x2C], 0x1
00460874 . |8B86 70040000 mov eax, dword ptr ds:[esi+0x470]
0046087A . |8D55 D4 lea edx, dword ptr ss:[ebp-0x2C]
0046087D . |8945 DC mov dword ptr ss:[ebp-0x24], eax
00460880 . |8B81 94010000 mov eax, dword ptr ds:[ecx+0x194]
00460886 . |52 push edx ; /lParam
00460887 . |6A FF push -0x1 ; |wParam = 0xFFFFFFFF
00460889 . |8B40 1C mov eax, dword ptr ds:[eax+0x1C] ; |
0046088C . |68 0D100000 push 0x100D ; |Message = MSG(0x100D)
00460891 . |50 push eax ; |hWnd
00460892 . |FF15 08C86100 call near dword ptr ds:[<&USER32.Send>; \SendMessageA
-------------------------------------------------------------------------------------------
00401421 |. /74 20 je short IDMan_ex.00401443 JMP掉,因为这里有退出代码.
00401423 |. |8B8D F4FEFFFF mov ecx, [local.67]
00401429 |. |51 push ecx
0040142A |. |53 push ebx
0040142B |. |50 push eax
0040142C |. |E8 5F370400 call IDMan_ex.00444B90
00401431 |. |83C4 0C add esp, 0xC
00401434 |. |8BCE mov ecx, esi
00401436 |. |53 push ebx
00401437 |. |E8 0A811E00 call IDMan_ex.005E9546
0040143C |. |53 push ebx ; /ExitCode
0040143D |. |FF15 C4C46100 call near dword ptr ds:[<&KERNEL32.Ex>; \ExitProcess
00401443 |> \8D4D AC lea ecx, [local.21]
|
|
|---|---|
|
|
Desktop.rar
原软件在这里 链接: 64fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4m8S2L8W2)9J5k6h3u0S2K9h3c8#2i4K6u0W2j5$3!0E0i4K6u0r3M7#2)9J5c8U0q4B7d9h3c8U0k6f1c8%4 密码: av27 还希望大家一起来交流下经验
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
797K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4@1k6X3W2D9k6g2)9J5k6h3y4G2L8g2)9J5c8X3W2F1k6X3!0Q4x3V1k6W2j5W2V1I4y4o6M7#2y4U0R3`.
 另外我破解过的软件 和 破解日志 都在我博客里了 219K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0D9L8$3N6Q4x3X3g2U0M7$3c8F1i4K6u0W2L8X3g2@1i4K6u0r3L8h3g2F1k6$3S2#2j5h3&6J5N6h3q4F1K9X3W2S2L8W2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3V1k6V1k6i4c8S2K9h3I4K6i4K6u0r3y4e0p5$3x3e0p5%4x3o6f1`. 天下好软件，实用的就会搜集进来。 
|
|
|
|
|
|
|
|
|
|
