[原创]手动 patch-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[原创]手动 patch

发表于: 2008-8-29 07:00 4376

[原创]手动 patch

plmmzhangs 活跃值

2008-8-29 07:00

4376

手动 patch

by:ミ木葉メ咔咔(NetKi1l)
E-mail:plmmzhangshun@126.com
Tools:peid(0.94) and OD

Info: a0eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4N6G2N6X3W2H3i4K6u0W2L8X3g2@1i4K6u0r3M7X3g2S2k6q4)9J5k6i4m8Z5M7q4)9K6c8Y4c8A6k6q4)9K6c8o6p5H3z5o6p5#2

downfiel:982K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4c8K6K9h3&6Y4K9s2g2S2j5X3q4G2k6r3W2Q4x3X3g2U0L8$3#2Q4x3V1k6p5K9h3q4J5P5g2)9J5k6h3g2^5k6b7`.`.
--------------------------------------------
ASPack 2.12 -> Alexey Solodovnikov

{
00895001 >  60             PUSHAD                         //f8
00895002 E8 03000000    CALL diary.0089500A             //hr esp --> //f9
00895007  - E9 EB045D45    JMP 45E654F7
0089500C 55             PUSH EBP
0089500D C3             RETN
0089500E E8 01000000    CALL diary.00895014
00895013 EB 5D          JMP SHORT diary.00895072

                                                }

{
008953B0 /75 08          JNZ SHORT diary.008953BA       //hd esp --> //this's jmp nop
008953B2 |B8 01000000    MOV EAX,1
008953B7 |C2 0C00       RETN 0C
008953BA \68 38E57000    PUSH diary.0070E538
008953BF C3             RETN
008953C0 8B85 26040000 MOV EAX,DWORD PTR SS:[EBP+426]

                                                         }

---------------------------------------------------------------
OEP

0070E538 55             PUSH EBP                               ; (Initial CPU selection)    //this's oep
0070E539 8BEC          MOV EBP,ESP
0070E53B 83C4 F0       ADD ESP,-10
0070E53E B8 40DA7000    MOV EAX,diary.0070DA40
0070E543 E8 8084CFFF    CALL diary.004069C8
0070E548 A1 289E7100    MOV EAX,DWORD PTR DS:[719E28]
0070E54D 8B00          MOV EAX,DWORD PTR DS:[EAX]
0070E54F E8 A0F6D8FF    CALL diary.0049DBF4
0070E554 8B0D 889B7100 MOV ECX,DWORD PTR DS:[719B88]          ; diary.0071DCF0
0070E55A A1 289E7100    MOV EAX,DWORD PTR DS:[719E28]
0070E55F 8B00          MOV EAX,DWORD PTR DS:[EAX]
0070E561 8B15 4C307000 MOV EDX,DWORD PTR DS:[70304C]          ; diary.00703098
0070E567 E8 A0F6D8FF    CALL diary.0049DC0C
0070E56C A1 289E7100    MOV EAX,DWORD PTR DS:[719E28]
0070E571 8B00          MOV EAX,DWORD PTR DS:[EAX]
0070E573 E8 14F7D8FF    CALL diary.0049DC8C
0070E578 E8 875DCFFF    CALL diary.00404304
0070E57D 8D40 00       LEA EAX,DWORD PTR DS:[EAX]
0070E580 0000          ADD BYTE PTR DS:[EAX],AL
0070E582 0000          ADD BYTE PTR DS:[EAX],AL
0070E584 0000          ADD BYTE PTR DS:[EAX],AL
0070E586 0000          ADD BYTE PTR DS:[EAX],AL
0070E588 0000          ADD BYTE PTR DS:[EAX],AL
0070E58A 0000          ADD BYTE PTR DS:[EAX],AL
0070E58C 0000          ADD BYTE PTR DS:[EAX],AL
0070E58E 0000          ADD BYTE PTR DS:[EAX],AL
0070E590 0000          ADD BYTE PTR DS:[EAX],AL

-----------------------------------------------------------------

008955C5 0000          ADD BYTE PTR DS:[EAX],AL                      //this's nop
008955C7 0000          ADD BYTE PTR DS:[EAX],AL
008955C9 0000          ADD BYTE PTR DS:[EAX],AL
008955CB 0000          ADD BYTE PTR DS:[EAX],AL
008955CD 0000          ADD BYTE PTR DS:[EAX],AL
008955CF 0000          ADD BYTE PTR DS:[EAX],AL
008955D1 0000          ADD BYTE PTR DS:[EAX],AL
008955D3 0000          ADD BYTE PTR DS:[EAX],AL
008955D5 0000          ADD BYTE PTR DS:[EAX],AL
008955D7 0000          ADD BYTE PTR DS:[EAX],AL
008955D9 0000          ADD BYTE PTR DS:[EAX],AL
008955DB 0000          ADD BYTE PTR DS:[EAX],AL
008955DD 0000          ADD BYTE PTR DS:[EAX],AL
008955DF 0000          ADD BYTE PTR DS:[EAX],AL
008955E1 0000          ADD BYTE PTR DS:[EAX],AL
008955E3 0000          ADD BYTE PTR DS:[EAX],AL
008955E5 0000          ADD BYTE PTR DS:[EAX],AL
008955E7 0000          ADD BYTE PTR DS:[EAX],AL
008955E9 0000          ADD BYTE PTR DS:[EAX],AL
008955EB 0000          ADD BYTE PTR DS:[EAX],AL

-------------------------------------------------------------------

0070066A 55             PUSH EBP
0070066B 68 17087000    PUSH diary.00700817
00700670 64:FF30       PUSH DWORD PTR FS:[EAX]
00700673 64:8920       MOV DWORD PTR FS:[EAX],ESP
00700676 8D55 F4       LEA EDX,DWORD PTR SS:[EBP-C]
00700679 8B83 08030000 MOV EAX,DWORD PTR DS:[EBX+308]
0070067F E8 64C7D7FF    CALL diary.0047CDE8
00700684 8B45 F4       MOV EAX,DWORD PTR SS:[EBP-C]
00700687 8D55 F8       LEA EDX,DWORD PTR SS:[EBP-8]
0070068A E8 DD8AD0FF    CALL diary.0040916C
0070068F 8B45 F8       MOV EAX,DWORD PTR SS:[EBP-8]
00700692 E8 D140D0FF    CALL diary.00404768
00700697 85C0          TEST EAX,EAX
00700699 75 1D          JNZ SHORT diary.007006B8
0070069B 6A 40          PUSH 40
0070069D B9 24087000    MOV ECX,diary.00700824
007006A2 BA 2C087000    MOV EDX,diary.0070082C
007006A7 A1 289E7100    MOV EAX,DWORD PTR DS:[719E28]
007006AC 8B00          MOV EAX,DWORD PTR DS:[EAX]
007006AE E8 69D7D9FF    CALL diary.0049DE1C
007006B3 E9 02010000    JMP diary.007007BA
007006B8 B2 01          MOV DL,1
007006BA A1 B8994100    MOV EAX,DWORD PTR DS:[4199B8]
007006BF E8 542FD0FF    CALL diary.00403618
007006C4 8BF0          MOV ESI,EAX
007006C6 6A 02          PUSH 2
007006C8 8D45 FC       LEA EAX,DWORD PTR SS:[EBP-4]
007006CB 50             PUSH EAX
007006CC 8D55 DC       LEA EDX,DWORD PTR SS:[EBP-24]
007006CF 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
007006D5 E8 0EC7D7FF    CALL diary.0047CDE8
007006DA 8B45 DC       MOV EAX,DWORD PTR SS:[EBP-24]
007006DD 8D55 E0       LEA EDX,DWORD PTR SS:[EBP-20]
007006E0 E8 878AD0FF    CALL diary.0040916C
007006E5 8B55 E0       MOV EDX,DWORD PTR SS:[EBP-20]
007006E8 8D45 E4       LEA EAX,DWORD PTR SS:[EBP-1C]
007006EB E8 2853D1FF    CALL diary.00415A18
007006F0 8D55 E4       LEA EDX,DWORD PTR SS:[EBP-1C]
007006F3 B9 60087000    MOV ECX,diary.00700860
007006F8 B8 01000000    MOV EAX,1
007006FD E8 36E4FFFF    CALL diary.006FEB38
00700702 8D55 D8       LEA EDX,DWORD PTR SS:[EBP-28]
00700705 8B45 FC       MOV EAX,DWORD PTR SS:[EBP-4]
00700708 E8 0B88D0FF    CALL diary.00408F18
0070070D 8B45 D8       MOV EAX,DWORD PTR SS:[EBP-28]
00700710 50             PUSH EAX
00700711 8D55 CC       LEA EDX,DWORD PTR SS:[EBP-34]
00700714 8B83 08030000 MOV EAX,DWORD PTR DS:[EBX+308]
0070071A E8 C9C6D7FF    CALL diary.0047CDE8
0070071F 8B45 CC       MOV EAX,DWORD PTR SS:[EBP-34]
00700722 8D55 D0       LEA EDX,DWORD PTR SS:[EBP-30]
00700725 E8 428AD0FF    CALL diary.0040916C
0070072A 8B45 D0       MOV EAX,DWORD PTR SS:[EBP-30]
0070072D 8D55 D4       LEA EDX,DWORD PTR SS:[EBP-2C]
00700730 E8 E387D0FF    CALL diary.00408F18
00700735 8B55 D4       MOV EDX,DWORD PTR SS:[EBP-2C]
00700738 58             POP EAX
00700739 E8 7641D0FF    CALL diary.004048B4
0070073E 75 5B          JNZ SHORT diary.0070079B                                     //this's crack
00700740 8D55 C8       LEA EDX,DWORD PTR SS:[EBP-38]
00700743 8B83 08030000 MOV EAX,DWORD PTR DS:[EBX+308]
00700749 E8 9AC6D7FF    CALL diary.0047CDE8
0070074E 8B55 C8       MOV EDX,DWORD PTR SS:[EBP-38]
00700751 8BC6          MOV EAX,ESI
00700753 8B08          MOV ECX,DWORD PTR DS:[EAX]
00700755 FF51 38       CALL DWORD PTR DS:[ECX+38]
00700758 8B15 1C9A7100 MOV EDX,DWORD PTR DS:[719A1C]
0070075E 8B12          MOV EDX,DWORD PTR DS:[EDX]
00700760 8D45 C4       LEA EAX,DWORD PTR SS:[EBP-3C]
00700763 B9 7C087000    MOV ECX,diary.0070087C
00700768 E8 4740D0FF    CALL diary.004047B4
0070076D 8B55 C4       MOV EDX,DWORD PTR SS:[EBP-3C]
00700770 8BC6          MOV EAX,ESI
00700772 8B08          MOV ECX,DWORD PTR DS:[EAX]
00700774 FF51 74       CALL DWORD PTR DS:[ECX+74]
00700777 A1 249B7100    MOV EAX,DWORD PTR DS:[719B24]
0070077C E8 173DD0FF    CALL diary.00404498
00700781 6A 40          PUSH 40
00700783 B9 24087000    MOV ECX,diary.00700824
00700788 BA 84087000    MOV EDX,diary.00700884                //success!
0070078D A1 289E7100    MOV EAX,DWORD PTR DS:[719E28]
00700792 8B00          MOV EAX,DWORD PTR DS:[EAX]
00700794 E8 83D6D9FF    CALL diary.0049DE1C
00700799 EB 18          JMP SHORT diary.007007B3
0070079B 6A 40          PUSH 40
0070079D B9 24087000    MOV ECX,diary.00700824
007007A2 BA A0087000    MOV EDX,diary.007008A0                //pass word wrong!

-------------------------------------------------------------------------------------

//The four key

0070073E  |. /75 5B       JNZ SHORT diary.0070079B                   //this's crack

008953B0 /75 08          JNZ SHORT diary.008953BA                   //this's jmp nop

008955C5 0000          ADD BYTE PTR DS:[EAX],AL                   //this's nop

0070E538 55             PUSH EBP       ; (Initial CPU selection) //this'oep

--------------------------------------------------------------------------------------

patchs

008953B0 /75 08          JNZ SHORT diary.008953BA       //this's jmp nop

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

008953B0 /E9 10020000    JMP diary.008955C5
008953B5 |90             NOP
008953B6 |90             NOP

--------------------------------------------------------------------

008955C5 0000          ADD BYTE PTR DS:[EAX],AL       //this's nop
008955C7 0000          ADD BYTE PTR DS:[EAX],AL
008955C9 0000          ADD BYTE PTR DS:[EAX],AL
008955CB 0000          ADD BYTE PTR DS:[EAX],AL
008955CD 0000          ADD BYTE PTR DS:[EAX],AL
008955CF 0000          ADD BYTE PTR DS:[EAX],AL
008955D1 0000          ADD BYTE PTR DS:[EAX],AL
008955D3 0000          ADD BYTE PTR DS:[EAX],AL
008955D5 0000          ADD BYTE PTR DS:[EAX],AL
008955D7 0000          ADD BYTE PTR DS:[EAX],AL
008955D9 0000          ADD BYTE PTR DS:[EAX],AL
008955DB 0000          ADD BYTE PTR DS:[EAX],AL

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

008955C5 0000          mov byte ptr ds:[0070073E],90
jmp 0070E538

51aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4q4A6j5h3&6F1j5h3!0Q4x3X3g2U0L8$3#2Q4x3V1k6K6M7r3q4U0k6g2)9J5c8Y4y4Z5L8%4N6Q4x3V1k6D9N6X3I4&6i4K6u0r3i4@1f1@1i4@1t1^5i4K6S2m8i4@1f1@1i4@1u0o6i4@1p5H3i4@1f1#2i4K6R3^5i4K6R3$3i4@1f1@1i4@1u0m8i4@1q4n7i4K6u0r3x3U0l9H3z5q4)9J5c8U0S2Q4x3V1j5J5z5g2)9J5c8W2m8S2N6r3y4Z5M7#2)9J5k6i4u0S2M7W2)9J5c8W2)9J5k6i4m8S2k6$3f1`.

                                                               save file
                                                               ok!over!    :)

-------------------------------------------------------------------------------------------

crack group:31117231 37032048

links: efeK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4N6G2N6X3W2H3i4K6u0W2L8X3g2@1i4K6u0r3

[培训]科锐逆向工程师培训第53期2025年7月8日开班！

收藏・0

免费・0

支持