大老的打狗教程第二篇如解掉,深思3的狗加密的软件!希望对大家有所帮助!大老=[DCG]=
软件名:国内某著名标书制作软件
保护
:北京深思3洛克公司深思3的狗(Sense3)
所用工具:trw2000 wasm32
破解难度:难
破解人:大老
所属组织:=BCG= =[DCG]=
本人邮箱:dalao@top86.com
本人论坛:http://dalao2002.yeah.net
此文献给所有爱好解密的朋友们!
我写的打狗教程这是第二篇!我共会写3篇的!这一篇主要讲讲如何破解程序中需要狗里数据的深思3加密的程序!
我只是大体说一下破解的思路! 高手不要见笑呀!
希望对大家有所帮助!
(1)
这个程序很有意思!如果没有狗!会弹出对话框告诉你
非法用户-请插上软件狗,并检查软件狗是否完好无损!
这其实就是一个很好的切入点!咱们看看下面的程序!我给大家讲一下!
:004E1D9B
8BC6 mov
eax, esi
:004E1D9D E88A20F3FF
call 00413E2C
:004E1DA2 8BC6
mov eax, esi
:004E1DA4 E81720F3FF
call 00413DC0
:004E1DA9 8945EC
mov dword ptr [ebp-14], eax
:004E1DAC
8BC6 mov
eax, esi
:004E1DAE E80D20F3FF
call 00413DC0
:004E1DB3 8945E8
mov dword ptr [ebp-18], eax
:004E1DB6 8BC6
mov eax, esi
:004E1DB8 E80320F3FF
call 00413DC0
:004E1DBD 8945E4
mov dword ptr [ebp-1C],
eax
:004E1DC0 8BC6
mov eax, esi
:004E1DC2 E86D20F3FF
call 00413E34
:004E1DC7 8BC6
mov eax, esi
:004E1DC9 E8F612F2FF
call 004030C4
:004E1DCE 8BC3
mov eax, ebx
:004E1DD0 E8EF12F2FF call 004030C4
:004E1DD5 8D8528FEFFFF lea eax,
dword ptr [ebp+FFFFFE28]
:004E1DDB 668B55EC
mov dx, word ptr [ebp-14]
:004E1DDF 6689952CFEFFFF
mov word ptr [ebp+FFFFFE2C], dx ===>深思3的调用模式-密码1
:004E1DE6 668B55E8
mov dx, word ptr [ebp-18]
:004E1DEA 6689952EFEFFFF
mov word ptr [ebp+FFFFFE2E], dx ===>深思3的调用模式-密码2
:004E1DF1 668B55E4
mov dx, word ptr [ebp-1C]
:004E1DF5 66899530FEFFFF mov word ptr [ebp+FFFFFE30],
dx ===>深思3的调用模式-密码3
:004E1DFC 66C7852AFEFFFFFFFF
mov word ptr [ebp+FFFFFE2A], FFFF ===>功能代码-打开狗
:004E1E05 50
push eax
:004E1E06
E8097BF7FF call 00459914
========>这里读狗
:004E1E0B 33C0
xor eax, eax
:004E1E0D 5A
pop edx
:004E1E0E 59
pop ecx
:004E1E0F 59
pop ecx
:004E1E10 648910
mov dword ptr fs:[eax], edx
:004E1E13 EB2E
jmp 004E1E43
:004E1E15 E96616F2FF jmp 00403480
:004E1E1A 6A00
push 00000000
* Possible StringData Ref from Code Obj ->"非法用户"
|
:004E1E1C B910264E00
mov ecx, 004E2610
* Possible StringData
Ref from Code Obj ->"不能读取系统注册信息,系统无法启动!"
|
:004E1E21 BA1C264E00 mov
edx, 004E261C
:004E1E26 A1540F4F00
mov eax, dword ptr [004F0F54]
:004E1E2B 8B00
mov eax, dword ptr [eax]
:004E1E2D
E89266F4FF call 004284C4
:004E1E32 A1540F4F00 mov eax,
dword ptr [004F0F54]
:004E1E37 8B00
mov eax, dword ptr [eax]
:004E1E39 E8E265F4FF
call 00428420
:004E1E3E E8E118F2FF
call 00403724
* Referenced
by a (U)nconditional or (C)onditional Jump at Address:
|:004E1E13(U)
|
:004E1E43 6683BD28FEFFFF00 cmp word ptr [ebp+FFFFFE28],
0000 ====>判断打开狗是否成功!
:004E1E4B 7424
je 004E1E71 ====>一定要跳呀!
:004E1E4D 6A00
push 00000000
* Possible StringData Ref from Code Obj ->"非法用户"
|
:004E1E4F B910264E00
mov ecx, 004E2610
* Possible StringData
Ref from Code Obj ->"请插上软件狗,并检查软件狗是否完好无损!"
|
:004E1E54 BA44264E00 mov
edx, 004E2644
:004E1E59 A1540F4F00
mov eax, dword ptr [004F0F54]
:004E1E5E 8B00
mov eax, dword ptr [eax]
:004E1E60
E85F66F4FF call 004284C4
:004E1E65 A1540F4F00 mov eax,
dword ptr [004F0F54]
:004E1E6A 8B00
mov eax, dword ptr [eax]
:004E1E6C E8AF65F4FF
call 00428420
* Referenced
by a (U)nconditional or (C)onditional Jump at Address:
|:004E1E4B(C)
|
:004E1E71 A1002C4F00 mov
eax, dword ptr [004F2C00]
:004E1E76 8B802C040000
mov eax, dword ptr [eax+0000042C]
:004E1E7C C74058FFFFFFFF
mov [eax+58], FFFFFFFF
:004E1E83 817DECE7030000
cmp dword ptr [ebp-14], 000003E7 ====>判断端口!
:004E1E8A 7527
jne 004E1EB3
:004E1E8C 817DE878030000
cmp dword ptr [ebp-18], 00000378
:004E1E93 751E
jne 004E1EB3
:004E1E95 817DE409030000
cmp dword ptr [ebp-1C], 00000309
:004E1E9C 7515
jne 004E1EB3
:004E1E9E A1002C4F00 mov eax,
dword ptr [004F2C00]
:004E1EA3 8B802C040000
mov eax, dword ptr [eax+0000042C]
:004E1EA9 33D2
xor edx, edx
:004E1EAB 895058
mov dword ptr [eax+58],
edx
:004E1EAE E988000000
jmp 004E1F3B
* Referenced by a (U)nconditional or (C)onditional Jump
at Addresses:
|:004E1E8A(C), :004E1E93(C), :004E1E9C(C)
|
:004E1EB3
817DEC78030000 cmp dword ptr [ebp-14], 00000378
:004E1EBA 7526
jne 004E1EE2
:004E1EBC 817DE8E7030000
cmp dword ptr [ebp-18], 000003E7
:004E1EC3 751D
jne 004E1EE2
----------------------------------------------------------------------------------------------------------------------
(2)以上的只是前半部分!呵呵!通过后!最终可以进入程序的主界面!过程中会报加载资源库失败!进入后功能方面是有问题的!
咱们来找找原因!
下断点
bpio 378 ====>这条指令是监视并口378端的io通讯!如果有通讯则中断!
然后运行程序!当跳过上面的部分后!再中断后安F12最终回到下面的部分!
:004E9A0E 899DB0FEFFFF mov dword
ptr [ebp+FFFFFEB0], ebx
:004E9A14 899DACFEFFFF
mov dword ptr [ebp+FFFFFEAC], ebx
:004E9A1A 895DE8
mov dword ptr [ebp-18], ebx
:004E9A1D 895DCC
mov dword ptr [ebp-34], ebx
:004E9A20 894DF8
mov dword ptr [ebp-08], ecx
:004E9A23 8955FC
mov dword ptr [ebp-04],
edx
:004E9A26 8B45FC
mov eax, dword ptr [ebp-04]
:004E9A29 E85EA6F1FF
call 0040408C
:004E9A2E 33C0
xor eax, eax
:004E9A30 55
push ebp
:004E9A31 68B9A04E00 push
004EA0B9
:004E9A36 64FF30
push dword ptr fs:[eax]
:004E9A39 648920
mov dword ptr fs:[eax], esp
:004E9A3C
A16C0E4F00 mov eax, dword ptr
[004F0E6C]
:004E9A41 8B00
mov eax, dword ptr [eax]
:004E9A43 8B802C040000
mov eax, dword ptr [eax+0000042C]
:004E9A49
C6405400 mov [eax+54],
00
:004E9A4D 8B156C0E4F00 mov edx,
dword ptr [004F0E6C]
:004E9A53 8B4058
mov eax, dword ptr [eax+58]
:004E9A56 83E801
sub eax, 00000001
=====>这里判断狗的种类!
:004E9A59 721B
jb 004E9A76 ======>跳到标准版的部分!
:004E9A5B
0F84DB000000 je 004E9B3C
:004E9A61
83E805 sub eax,
00000005
:004E9A64 0F8498010000
je 004E9C02
:004E9A6A 48
dec eax
:004E9A6B 0F8457020000
je 004E9CC8
:004E9A71 E907030000
jmp 004E9D7D
* Referenced by a (U)nconditional
or (C)onditional Jump at Address:
|:004E9A59(C)
|
:004E9A76 E83D0DF7FF
call 0045A7B8 =====>打开狗
:004E9A7B 6685C0
test ax, ax
:004E9A7E 0F85F9020000
jne 004E9D7D ====>跳就是没有狗!
:004E9A84 66C78578FFFFFF0200
mov word ptr [ebp+FFFFFF78], 0002
:004E9A8D 8D8574FFFFFF
lea eax, dword ptr [ebp+FFFFFF74]
:004E9A93
E8540DF7FF call 0045A7EC
======>读狗的数据区
:004E9A98 6685C0
test ax, ax ======>AX=0读狗成功
:004E9A9B
0F85DC020000 jne 004E9D7D
=====>AX=0时这里不跳
:004E9AA1 0FB78574FFFFFF
movzx eax, word ptr [ebp+FFFFFF74] ===>关键读狗成功后返回的数据
:004E9AA8 8945E4
mov dword ptr [ebp-1C],
eax
:004E9AAB 66C78578FFFFFF0300 mov word ptr [ebp+FFFFFF78],
0003
:004E9AB4 8D8574FFFFFF lea
eax, dword ptr [ebp+FFFFFF74]
:004E9ABA E82D0DF7FF
call 0045A7EC ======>读狗的数据区
:004E9ABF 6685C0
test ax, ax
======>AX=0读狗成功
:004E9AC2 0F85B5020000
jne 004E9D7D
:004E9AC8 0FB78574FFFFFF
movzx eax, word ptr [ebp+FFFFFF74] ===>关键读狗成功后返回的数据
:004E9ACF 8945E0
mov dword ptr [ebp-20],
eax =====>把数据写入临时地址!
:004E9AD2 66C78578FFFFFF0400
mov word ptr [ebp+FFFFFF78], 0004
:004E9ADB 8D8574FFFFFF
lea eax, dword ptr [ebp+FFFFFF74]
:004E9AE1 E8060DF7FF
call 0045A7EC ======>读狗的数据区
:004E9AE6
6685C0 test ax,
ax ======>AX=0读狗成功
:004E9AE9 0F858E020000
jne 004E9D7D
:004E9AEF 0FB78574FFFFFF
movzx eax, word ptr [ebp+FFFFFF74] ===>关键读狗成功后返回的数据
:004E9AF6 8945DC
mov dword ptr [ebp-24],
eax
:004E9AF9 668B45E0
mov ax, word ptr [ebp-20]
:004E9AFD 66898574FFFFFF
mov word ptr [ebp+FFFFFF74], ax
:004E9B04 668B45DC
mov ax, word ptr [ebp-24]
:004E9B08 66898576FFFFFF
mov word ptr [ebp+FFFFFF76], ax
:004E9B0F 8D8574FFFFFF
lea eax, dword ptr [ebp+FFFFFF74]
:004E9B15
E86A0EF7FF call 0045A984 ======>读狗的数据区返回数据和上面的数据进行计算结果放到下面的<1><2>
:004E9B1A 6685C0
test ax, ax ======>AX=0读狗成功
:004E9B1D 0F855A020000
jne 004E9D7D
:004E9B23 0FB78574FFFFFF
movzx eax, word ptr [ebp+FFFFFF74] ======>数据<1>
:004E9B2A
8945E0 mov dword
ptr [ebp-20], eax
:004E9B2D 0FB78576FFFFFF
movzx eax, word ptr [ebp+FFFFFF76] ======>数据<2>
:004E9B34 8945DC
mov dword ptr [ebp-24],
eax
:004E9B37 E941020000
jmp 004E9D7D
----------------------------------------------------------------------------------------------------------------------
(3)上面的就是加载资源库所用到的狗里数据的过程!破解很简单!只要把返回的数据给他模拟一下就行!
下面的部分是标书软件别的软件版本狗的处理过程!大家可以看看和上面的是一样的!只是返回的数据不同罢了!
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E9A5B(C)
|
:004E9B3C E80F10F7FF
call 0045AB50
:004E9B41 6685C0
test ax, ax
:004E9B44 0F8533020000
jne 004E9D7D
:004E9B4A 66C78552FFFFFF0200
mov word ptr [ebp+FFFFFF52], 0002
:004E9B53 8D8550FFFFFF
lea eax, dword ptr [ebp+FFFFFF50]
:004E9B59
E82610F7FF call 0045AB84
:004E9B5E 6685C0
test ax, ax
:004E9B61 0F8516020000
jne 004E9D7D
:004E9B67 0FB78554FFFFFF movzx
eax, word ptr [ebp+FFFFFF54]
:004E9B6E 8945E4
mov dword ptr [ebp-1C], eax
:004E9B71
66C78552FFFFFF0300 mov word ptr [ebp+FFFFFF52], 0003
:004E9B7A 8D8550FFFFFF lea eax, dword
ptr [ebp+FFFFFF50]
:004E9B80 E8FF0FF7FF
call 0045AB84
:004E9B85 6685C0
test ax, ax
:004E9B88 0F85EF010000
jne 004E9D7D
:004E9B8E 0FB78554FFFFFF
movzx eax, word ptr [ebp+FFFFFF54]
:004E9B95 8945E0
mov dword ptr [ebp-20],
eax
:004E9B98 66C78552FFFFFF0400 mov word ptr [ebp+FFFFFF52],
0004
:004E9BA1 8D8550FFFFFF lea
eax, dword ptr [ebp+FFFFFF50]
:004E9BA7 E8D80FF7FF
call 0045AB84
:004E9BAC 6685C0
test ax, ax
:004E9BAF 0F85C8010000
jne 004E9D7D
:004E9BB5 0FB78554FFFFFF
movzx eax, word ptr [ebp+FFFFFF54]
:004E9BBC
8945DC mov dword
ptr [ebp-24], eax
:004E9BBF 668B45E0
mov ax, word ptr [ebp-20]
:004E9BC3 66898552FFFFFF
mov word ptr [ebp+FFFFFF52], ax
:004E9BCA 668B45DC
mov ax, word ptr [ebp-24]
:004E9BCE 66898550FFFFFF mov word ptr [ebp+FFFFFF50],
ax
:004E9BD5 8D8550FFFFFF lea eax,
dword ptr [ebp+FFFFFF50]
:004E9BDB E80411F7FF
call 0045ACE4
:004E9BE0 6685C0
test ax, ax
:004E9BE3 0F8594010000
jne 004E9D7D
:004E9BE9 0FB78552FFFFFF
movzx eax, word ptr [ebp+FFFFFF52]
:004E9BF0
8945E0 mov dword
ptr [ebp-20], eax
:004E9BF3 0FB78550FFFFFF
movzx eax, word ptr [ebp+FFFFFF50]
:004E9BFA 8945DC
mov dword ptr [ebp-24], eax
:004E9BFD
E97B010000 jmp 004E9D7D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004E9A64(C)
-----------------------------------------------------------------------------------------------------------------------|
(4)总结
上面部分全部通过后!程序进本上已经解决完了!程序可以正常的加载资源库和大部分功能的正常使用了!但还有一点错误就是
在新建文件后再拖资源库数据的时候!会报错!其实很好解决的!大家自己找找把!我就不写了!
总结一下这个程序的破解过程!!程序的前半部分很简单!后半部分是个难点!尤其是返回数据的处理部分!只要大家掌握了后半部分!
在有狗的情况下,破解深思3的狗加密的软件应该是不成问题的!
有人说我大老不会解狗是个软件收集狂我写的打狗教程是别人帮我写的!!呵呵!我就不多说了!留给大家去评判吧!
写教程太累!下一篇也许会写的短点吧!
谢谢大家看完此文!
如果大家觉得不错请回复一下贴子支持一下!!
如果转载此文请保留完整!
大老 完成于
2002.6.29 凌晨2:30
- 标 题:大老的打狗教程第二篇如解掉,深思3的狗加密的软件!希望对大家有所帮助!大老=[DCG]= (13千字)
- 作 者:大老
- 时 间:2002-6-30
2:32:09
- 链 接:http://bbs.pediy.com