某交通客运信息管理系统

【软件名称】某交通客运信息管理系统

【软件限制】注册码+加密狗

【破解声明】破解只是感兴趣，无其它目的。失误之处敬请诸位大侠赐教!

【破解工具】W32Dasm8.93 TRW20001.23

========================================================================================

【分析过程】

此软件不注册运行在试用版功能,注册后加密狗启动,程序无法运行.

我只找了一下注册码,没有详细分析算法.主要把加密狗解除思路写一下.

分析如下:

* Possible StringData Ref from Code Obj ->"197712280530qlm提示窗口"

|

:0062365A BAA8376200 mov edx, 006237A8

:0062365F E8F4BCECFF call 004EF358

:00623664 8D95F0FEFFFF lea edx, dword ptr [ebp+FFFFFEF0]

:0062366A 8B83F4020000 mov eax, dword ptr [ebx+000002F4]

:00623670 E843B2E2FF call 0044E8B8

:00623675 8B85F0FEFFFF mov eax, dword ptr [ebp+FFFFFEF0]

:0062367B 8D95F4FEFFFF lea edx, dword ptr [ebp+FFFFFEF4]

:00623681 E8525FDEFF call 004095D8

:00623686 8B85F4FEFFFF mov eax, dword ptr [ebp+FFFFFEF4]

:0062368C 50 push eax

:0062368D 8D95ECFEFFFF lea edx, dword ptr [ebp+FFFFFEEC]

:00623693 8B45FC mov eax, dword ptr [ebp-04]

:00623696 E83D5FDEFF call 004095D8

:0062369B 8B95ECFEFFFF mov edx, dword ptr [ebp+FFFFFEEC] //注册码 算法省略...

:006236A1 58 pop eax

:006236A2 E85119DEFF call 00404FF8

:006236A7 743B je 006236E4

:006236A9 6A40 push 00000040

:006236AB B9B8376200 mov ecx, 006237B8

* Possible StringData Ref from Code Obj ->"您输入的注册号错误，请重新输入."

|

:006236B0 BAC4376200 mov edx, 006237C4

:006236B5 A140426300 mov eax, dword ptr [00634240]

:006236BA 8B00 mov eax, dword ptr [eax]

:006236BC E827B7E4FF call 0046EDE8

:006236C1 8B83F4020000 mov eax, dword ptr [ebx+000002F4]

:006236C7 66BEB8FF mov si, FFB8

:006236CB E8DC08DEFF call 00403FAC

:006236D0 84C0 test al, al

:006236D2 747E je 00623752

:006236D4 8B83F4020000 mov eax, dword ptr [ebx+000002F4]

:006236DA 8B10 mov edx, dword ptr [eax]

:006236DC FF92C0000000 call dword ptr [edx+000000C0]

:006236E2 EB6E jmp 00623752

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:006236A7(C)

|

:006236E4 8BC3 mov eax, ebx

:006236E6 E891010000 call 0062387C

:006236EB 84C0 test al, al

:006236ED 744B je 0062373A //不能跳

:006236EF 6A40 push 00000040

:006236F1 B9B8376200 mov ecx, 006237B8

* Possible StringData Ref from Code Obj ->"恭喜您注册成功，欢迎使用状元正版软件。

请重新

====================================================================================

* Possible StringData Ref from Code Obj ->" 试用版 V5.0 "

|

:00628870 BA048E6200 mov edx, 00628E04

:00628875 E86E60E2FF call 0044E8E8

:0062887A E9D3040000 jmp 00628D52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00628865(C)

|

:0062887F 8B45FC mov eax, dword ptr [ebp-04]

:00628882 8B8000030000 mov eax, dword ptr [eax+00000300]

* Possible StringData Ref from Code Obj ->" 正试版 V5.0 "

|

:00628888 BA1C8E6200 mov edx, 00628E1C

:0062888D E85660E2FF call 0044E8E8

:00628892 A15C656300 mov eax, dword ptr [0063655C]

:00628897 8B80FC020000 mov eax, dword ptr [eax+000002FC]

* Possible StringData Ref from Code Obj ->"系统正在检测加密狗，请等待。。。"

|

:0062889D BA348E6200 mov edx, 00628E34

:006288A2 E84160E2FF call 0044E8E8

:006288A7 33C0 xor eax, eax

:006288A9 A34C656300 mov dword ptr [0063654C], eax

:006288AE E8AD4E0000 call 0062D760 //在这里读狗 杀入.....

:006288B3 8BD8 mov ebx, eax //返回eax=0表明有狗

:006288B5 85DB test ebx, ebx //ebx必须等于0

:006288B7 7428 je 006288E1 //跳走就成功了,简单的爆破可能会有隐患,因此我们必须进入上面的call观察

:006288B9 33D2 xor edx, edx

* Possible StringData Ref from Code Obj ->" 系统检测加密狗失败！可能是网络不通或加密狗"

->"未安装正确！

请先进行调试后再运行本系统！

"

->" 如果您仍无法解决，请与供应商联系！"

|

:006288BB B8608E6200 mov eax, 00628E60

:006288C0 E80B5DECFF call 004EE5D0

:006288C5 8B45FC mov eax, dword ptr [ebp-04]

:006288C8 8B80FC020000 mov eax, dword ptr [eax+000002FC]

* Possible StringData Ref from Code Obj ->"加载加密狗失败！"

|

:006288CE BAEC8E6200 mov edx, 00628EEC

:006288D3 E81060E2FF call 0044E8E8

:006288D8 C645FB00 mov [ebp-05], 00

:006288DC E971040000 jmp 00628D52

=====================================call 0062D760 ===================================

* Referenced by a CALL at Address:

|:006288AE

:0062D760 55 push ebp

:0062D761 8BEC mov ebp, esp

:0062D763 52 push edx

:0062D764 51 push ecx

:0062D765 6846D76200 push 0062D746

:0062D76A 68C1D46200 push 0062D4C1

:0062D76F 6A01 push 00000001

:0062D771 E829F6FFFF call 0062CD9F //读狗

:0062D776 83C40C add esp, 0000000C

:0062D779 59 pop ecx

:0062D77A 5A pop edx

:0062D77B 5D pop ebp

:0062D77C C3 ret

:0062D77D 55 push ebp

:0062D77E 8BEC mov ebp, esp

:0062D780 52 push edx

:0062D781 51 push ecx

:0062D782 6846D76200 push 0062D746

:0062D787 68C1D46200 push 0062D4C1

:0062D78C 6A05 push 00000005

:0062D78E E80CF6FFFF call 0062CD9F //读狗

:0062D793 83C40C add esp, 0000000C

:0062D796 59 pop ecx

:0062D797 5A pop edx

:0062D798 5D pop ebp

:0062D799 C3 ret

:0062D79A 55 push ebp

:0062D79B 8BEC mov ebp, esp

:0062D79D 52 push edx

:0062D79E 51 push ecx

:0062D79F 6846D76200 push 0062D746

:0062D7A4 68C1D46200 push 0062D4C1

:0062D7A9 6A02 push 00000002

:0062D7AB E8EFF5FFFF call 0062CD9F //读狗

:0062D7B0 83C40C add esp, 0000000C

:0062D7B3 59 pop ecx

:0062D7B4 5A pop edx

:0062D7B5 85C0 test eax, eax

:0062D7B7 750A jne 0062D7C3

:0062D7B9 8B1558656300 mov edx, dword ptr [00636558]

:0062D7BF 33C9 xor ecx, ecx

:0062D7C1 890A mov dword ptr [edx], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0062D7B7(C)

|

:0062D7C3 5D pop ebp

:0062D7C4 C3 ret

* Referenced by a CALL at Addresses:

|:006288FE , :006289FE , :00628B18 , :00628C35

|

:0062D7C5 55 push ebp

:0062D7C6 8BEC mov ebp, esp

:0062D7C8 52 push edx

:0062D7C9 51 push ecx

:0062D7CA 6846D76200 push 0062D746

:0062D7CF 68C1D46200 push 0062D4C1

:0062D7D4 6A03 push 00000003

:0062D7D6 E8C4F5FFFF call 0062CD9F //读狗

:0062D7DB 83C40C add esp, 0000000C

:0062D7DE 59 pop ecx

:0062D7DF 5A pop edx

:0062D7E0 5D pop ebp

:0062D7E1 C3 ret

从上面可以看出有不少地方在读狗.....进入call 0062CD9F

=======================================call 0062CD9F=========================================

* Referenced by a CALL at Addresses:

|:0062D771 , :0062D78E , :0062D7AB , :0062D7D6

|

:0062CD9F 55 push ebp //修改为xor eax,eax ret //在这里让eax返回0就成功了

:0062CDA0 8BEC mov ebp, esp

:0062CDA2 83C4B8 add esp, FFFFFFB8

:0062CDA5 53 push ebx

:0062CDA6 56 push esi

:0062CDA7 E8EEFEFFFF call 0062CC9A

:0062CDAC 8945DC mov dword ptr [ebp-24], eax

:0062CDAF 66C745D00A00 mov [ebp-30], 000A

:0062CDB5 E9F0030000 jmp 0062D1AA

:0062CDBA EB01 jmp 0062CDBD

:0062CDBC 00 BYTE 00

========================================================================================

【分析总结】

这个加密狗不是很复杂,只要让读狗后返回0解狗即可成功,采用一追到底的方法,到程序的

根部修改,而不是简单的修改跳转.好处是可以避免许多暗桩.

初学解狗希望对大家有所帮助,也希望起到抛砖引玉.

========================================================================================

（出处：赢政天下整理收藏）

相关资讯：

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1998-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net