刚去网站溜达,好多网站都开始使用RAR3.0标准压缩文件了,我还在用2.8,好象有点跟不上形式了,好吧,俺也去找个3.0,呵呵,还好不是我不喜欢的测试版,安装吧,看看说明,呵呵,注册用户可以从2.8免费升级,正合我意,恩,运行一下,怎么还是评估版呀,不是说可以升级的吗,我2.8也是注册版呀,55555,怎么就不行了呢?有点怀念2.8了.看来得想想办法了.
工具 W32DASM,TRW2000,HIEW
过程如下:
使用W32DASM反汇编后,首先找EVALUATION字样,呵呵,运气真好,一下就找到了
* Referenced by a CALL at Addresses:
|:0043F046 , :0044DBD6
, :00450157
|
:0043F984 81C400FCFFFF
add esp, FFFFFC00
:0043F98A 50
push eax
* Possible StringData
Ref from Data Obj ->"%s - WinRAR"
|
:0043F98B 6875664800 push
00486675
:0043F990 8D442408
lea eax, dword ptr [esp+08]
:0043F994 50
push eax
:0043F995 E8667A0300
call 00477400
:0043F99A 83C40C
add esp, 0000000C
:0043F99D 803D1CDD480000 cmp byte ptr [0048DD1C],
00--->这里可以看出48DD1C是个全局变量,也就是注册标志
:0043F9A4 757A
jne 0043FA20
:0043F9A6 A1B4DF4900
mov eax, dword ptr [0049DFB4]
:0043F9AB
83F814 cmp eax,
00000014--->小于20天时显示"evaluation copy"
:0043F9AE 7C05
jl 0043F9B5
:0043F9B0 83F828
cmp eax, 00000028--->小于40天大于20天时提醒购买
:0043F9B3 7C1D
jl 0043F9D2
* Referenced by a (U)nconditional or (C)onditional
Jump at Address:
|:0043F9AE(C)
|
* Possible Reference to String
Resource ID=00873: "evaluation copy"
|
:0043F9B5 B869030000 mov
eax, 00000369
:0043F9BA E8DDF1FCFF
call 0040EB9C
:0043F9BF 50
push eax
:0043F9C0 8D942404020000
lea edx, dword ptr [esp+00000204]
:0043F9C7 52
push edx
:0043F9C8 E87B3C0300 call
00473648
:0043F9CD 83C408
add esp, 00000008
:0043F9D0 EB27
jmp 0043F9F9
* Referenced
by a (U)nconditional or (C)onditional Jump at Address:
|:0043F9B3(C)
|
:0043F9D2 B928000000 mov
ecx, 00000028
* Possible Reference to String Resource ID=00874: "only
%d days left to buy a license"
|
:0043F9D7 B86A030000 mov
eax, 0000036A
:0043F9DC 2B0DB4DF4900
sub ecx, dword ptr [0049DFB4]
:0043F9E2 51
push ecx
:0043F9E3 E8B4F1FCFF
call 0040EB9C
既然找到了注册标志,那就看看是谁在对他进行设置吧
下断 BPM 48DD1C 呵呵,LOOK!
* Reference To: KERNEL32.GetLocalTime,
Ord:0000h
|
:004367B3 E82AAB0400
Call 004812E2
:004367B8 33C0
xor eax, eax
:004367BA E88D52FDFF call 0040BA4C--->呼叫验证核心
:004367BF A21CDD4800 mov
byte ptr [0048DD1C], al--->这里写入标志,看来上面这个CALL是检测核心
:004367C4 33C0
xor eax, eax
:004367C6
E9270E0000 jmp 004375F2
哦,好的,我们到核心再去看看吧: )
* Referenced by a CALL at Addresses:
|:0043658A
, :004367BA , :0043E6F4 , :0043F030 , :00450363
|
:0040BA4C 55
push ebp
:0040BA4D 8BEC
mov ebp, esp
:0040BA4F 81C404F0FFFF
add esp, FFFFF004
:0040BA55 50
push eax
:0040BA56
81C448FDFFFF add esp, FFFFFD48
:0040BA5C
53
push ebx
:0040BA5D 56
push esi
:0040BA5E 57
push edi
:0040BA5F 8885E3FEFFFF
mov byte ptr [ebp+FFFFFEE3], al
:0040BA65
BE18D74800 mov esi, 0048D718
:0040BA6A B838324800 mov eax,
00483238
:0040BA6F E874800600
call 00473AE8
:0040BA74 8D95C8FAFFFF
lea edx, dword ptr [ebp+FFFFFAC8]
* Possible StringData Ref from Data
Obj ->"rarreg.*"
|
:0040BA7A
B85F2E4800 mov eax, 00482E5F
:0040BA7F E815F5FFFF call 0040AF99--->程序检查是否有一个名字是RARREG的文件
:0040BA84 84C0
test al, al
:0040BA86 7514
jne 0040BA9C
:0040BA88 33C0
xor eax, eax
:0040BA8A 8B95E4FEFFFF
mov edx, dword ptr [ebp+FFFFFEE4]
:0040BA90
64891500000000 mov dword ptr fs:[00000000],
edx
:0040BA97 E9CF050000
jmp 0040C06B--->玩完
恩,我好象有一个文件名字是RARREG.KEY的文件,把它改这个名字好了,然后,一路走,走,走,来到了这里
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BC86(C)
|
:0040BC34 8B3C9D302E4800
mov edi, dword ptr [4*ebx+00482E30]
:0040BC3B 57
push edi
:0040BC3C
E8377A0600 call 00473678
:0040BC41 59
pop ecx
:0040BC42 8BC8
mov ecx, eax
:0040BC44 8BD7
mov edx, edi--->EDX的东西好眼熟,好象在哪里看到过呀,对了,在我的RARREG文件里好象也有这么一堆字符
:0040BC46 8D8548F6FFFF lea eax,
dword ptr [ebp+FFFFF648]
:0040BC4C E85B060000
call 0040C2AC--->黑名单比较
:0040BC51 85C0
test eax, eax--->上了黑名单吗?好惨: (
:0040BC53 752D
jne 0040BC82--->没有上黑名单?恭喜,下面就一路顺风了: )
:0040BC55 33C0
xor eax, eax
:0040BC57
BA02000000 mov edx, 00000002
:0040BC5C 50
push eax
:0040BC5D 8D8508FFFFFF
lea eax, dword ptr [ebp+FFFFFF08]
:0040BC63 83AD00FFFFFF04
sub dword ptr [ebp+FFFFFF00], 00000004
:0040BC6A E8BD070000
call 0040C42C
:0040BC6F 58
pop eax
:0040BC70 8B95E4FEFFFF mov edx,
dword ptr [ebp+FFFFFEE4]
:0040BC76 64891500000000
mov dword ptr fs:[00000000], edx
:0040BC7D E9E9030000
jmp 0040C06B--->又玩完
跟到这里终于发现,原来我的RARREG里的东西上了黑名单了:
(,怎么办?: ((((,既然别的都认可了,那说明作者说的话是真的,可以直接从2.8升级到3.0,恩,有了,我把黑名单换一下好了,在名单上的滋味可不好,人怕出名猪怕壮呀:
)
呵呵,看看程序的空间,觉得这里好象是最理想的地方,用HIEW改吧 : )
//******************** Program
Entry Point ********
:00401000 EB10
jmp 00401012
--->这里改EB09
:00401002 66623A
bound di, word ptr [edx]
:00401005 43
inc ebx
:00401006
2B2B sub
ebp, dword ptr [ebx]
:00401008 48
dec eax
:00401009 4F
dec edi
:0040100A
4F
dec edi
:0040100B 4B
dec ebx
--->这里开始改成C605402F080033(注意,这是把和我自己的注册文件里的相同的一组数据中一个字符给改了,可能和大家的情况有点不同,请自己修改)
:0040100C 90
nop
:0040100D E9C4214800
jmp 008831D6
* Referenced by a (U)nconditional or (C)onditional
Jump at Address:
|:00401000(U)
|
:00401012 A1B7214800
mov eax, dword ptr [004821B7]--->程序入口
好,运行一下,呵呵,怎么样,想必大家都知道了 : ) ,我天生比较懒,所以想了这么个懒办法 : )
在这里有了点问题,请高手指教,我用TRW载入的时候,发现黑名单随着程序载入,已经存在,不能判断数据源在哪里,用资源工具也没找到这些数据的踪影,若我想拦截这些数据装入时该怎么办?
hello!
- 标 题：Winrar2.8到3.0升级手记 (7千字)
- 作 者：hello!
- 时 间：2002-6-1 17:37:59
- 链 接：http://bbs.pediy.com