-
-
[旧帖]
[原创]对某软件的研究
0.00雪花
-
发表于:
2008-4-24 14:29
4004
-
软件采用:ASPack 2.12 -> Alexey Solodovnikov加壳
unpack后.
OD导入停在这里..
004044F2 > 6A 74 push 74 ; (初始化 cpu 选择状态)
因为这个软件有软件到期文字提示.所以首先选择串式参考..
找到了
Ultra 字符串参考,项目 3
地址=00401773
反汇编=push _UnPacke.004067C8
文本字符串=本软件生命周期结束,请重新联系
9b1K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4c8E0L8q4)9J5k6h3y4F1i4@1f1^5i4K6S2q4i4@1t1%4i4@1f1#2i4K6S2r3i4K6V1$3i4@1f1#2i4K6S2p5i4K6R3%4i4@1f1%4i4@1u0m8i4@1p5%4i4@1f1%4i4K6R3&6i4K6R3^5i4@1f1$3i4K6W2o6i4@1q4o6i4@1f1K6i4K6R3H3i4K6R3J5i4@1g2r3i4@1u0o6i4K6R3^5i4@1f1$3i4@1q4p5i4@1p5@1i4@1f1$3i4K6S2r3i4K6V1H3i4@1f1%4i4@1p5@1i4@1u0m8i4@1f1#2i4@1t1&6i4@1t1$3i4@1f1&6i4K6W2p5i4K6W2q4i4@1f1$3i4K6V1%4i4@1t1$3i4@1f1&6i4K6V1%4i4@1t1@1i4@1f1&6i4K6V1&6i4K6V1H3i4@1f1#2i4K6R3^5i4@1t1$3i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1^5i4K6R3H3i4K6S2o6i4@1f1$3i4K6V1^5i4@1q4r3i4@1f1^5i4@1q4r3i4@1t1@1i4@1f1$3i4K6V1^5i4K6S2q4i4@1f1%4i4@1p5^5i4K6S2n7i4@1f1#2i4@1u0m8i4K6S2r3i4@1f1#2i4@1q4r3i4@1u0r3i4@1f1#2i4K6V1I4i4@1u0p5i4@1f1#2i4@1t1%4i4@1t1J5i4@1f1#2i4K6R3^5i4@1t1H3i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1^5i4K6S2q4i4@1t1%4i4@1f1#2i4K6S2r3i4K6V1$3i4@1f1#2i4K6S2p5i4K6R3%4i4@1f1%4i4@1u0m8i4@1p5%4i4@1f1%4i4K6R3&6i4K6R3^5i4@1f1$3i4K6W2o6i4@1q4o6i4@1f1$3i4K6V1^5i4@1q4r3i4@1f1#2i4K6R3#2i4K6S2p5i4@1f1^5i4@1t1@1i4@1t1&6i4@1f1%4i4K6W2m8i4K6R3@1i4@1f1K6i4K6R3H3i4K6R3J5i4@1g2r3i4@1u0o6i4K6R3&6
软件到期提示..
观察附近
20060930
有这么一行..
怀疑是本软件到期日期.
修改系统日期为:20050930.发现没有到期提示.
双击20060930这一行.来到
0040162B 68 44684000 push _UnPacke.00406844 ; 20060930
大致意思应该是把这个时间入栈.如果要去掉时间限制.应该在这里修改时间....
二进制...nop填充...
保存....发现不行..
软件刚启动.就自己关闭了.
请高手指点..
另外还有在线人数限制..请指点
[培训]科锐逆向工程师培训第53期2025年7月8日开班!