|
Word文档水印批量设置工具追码写注册机、爆破功能限制、去注册提醒框
下载地址:
http://www.yuneach.com/soft//slidemaster.asp#DocWatermark
第一步:查壳
无壳,是VB程序,重启验证的。
第二步:追码
载入程序,右键--中文搜索引擎--智能搜索,CTRL+F,输入“注册成功”
地址=0041AF91 mov dword ptr ss:[ebp-0x6C],DocWater.004080C8 用户注册成功
双击返回到:0041AF91 . C745 94 C8804>mov dword ptr ss:[ebp-0x6C],DocWater.004>; 用户注册成功
向上到段首:0041AD50 > \55 push ebp\\F2下断
F9运行程序,输入假码:555555555555555,确定,程序被断下,一路F8
来到:0041AEE5 . E8 E6F5FFFF call DocWater.0041A4D0\\F7进CALL,一路F8
注意寄存器和堆栈窗口相关数据
来到:0041A5B3 . 8BD0 mov edx,eax
EAX 04F9C35C UNICODE "6602394037"
经测试6602394037是注册码,有兴趣的同志可以跟进0041A5AE . E8 ADFCFFFF call DocWater.0041A260
如果想写算法注册机可以看看
第三步:写注册机
用到数据:
0041A5B3 . 8BD0 mov edx,eax
EAX 04F9C35C UNICODE "6602394037"
制作完成后测试一下,成功获取注册码:6602394037
注册码保存在注册表:HKEY_CURRENT_USER\Software\VB and VBA Program Settings\DocWatermark\RegCode里
第四步:爆破功能限制(暂停法)
00413619 /0F85 A8010000 jnz DocWater.004137C7//第一处,修改为无条件跳转
0040BD11 /0F84 BF030000 je DocWater.0040C0D6//第二处,修改为无条件跳转
00412E94 /0F87 B81B0000 ja DocWater.00414A52//这处是错误的
00412F51 . /0F84 91010000 je DocWater.004130E8//第三处,修改为无条件跳转
第五步:窗口提醒分析方法
载入程序:右键---查找--所有命令,输入:mov word ptr ds:[0x41D028],ax,在每处下断。
F9运行程序,程序被断下,我们要找到何处的ax被赋值为0
004167C1 . E8 0A3D0000 call DocWater.0041A4D0
004167C6 . 66:A3 28D04100 mov word ptr ds:[0x41D028],ax
跟随CALLcall DocWater.0041A4D0
0041A4D0 $ 55 push ebp\\段首
此处ax被赋值为0
0041A617 66:8B45 EC mov ax,word ptr ss:[ebp-0x14]
修改为
0041A617 66:B8 0100 mov ax,0x1
004167C1 . E8 0A3D0000 call DocWater.0041A4D0
004167C6 . 66:A3 28D04100 mov word ptr ds:[0x41D028],ax
004167CC . C745 FC 14000000 mov dword ptr ss:[ebp-0x4],0x14
004167D3 . 0FBF0D 28D04100 movsx ecx,word ptr ds:[0x41D028]
004167DA . 85C9 test ecx,ecx
004167DC . 0F85 25010000 jnz DocWater.00416907\\原来是不跳转的,出现注册提示框,改后跳转实现,跳过注册提示
004167E2 . C745 FC 15000000 mov dword ptr ss:[ebp-0x4],0x15
004167E9 . 833D 40D04100 00 cmp dword ptr ds:[0x41D040],0x0
004167F0 . 75 1C jnz short DocWater.0041680E
004167F2 . 68 40D04100 push DocWater.0041D040
004167F7 . 68 08464000 push DocWater.00404608
004167FC . FF15 78114000 call dword ptr ds:[<&MSVBVM60.__vbaNew2>>; msvbvm60.__vbaNew2
00416802 . C785 8CFEFFFF 40D0410>mov dword ptr ss:[ebp-0x174],DocWater.00>
0041680C . EB 0A jmp short DocWater.00416818
0041680E > C785 8CFEFFFF 40D0410>mov dword ptr ss:[ebp-0x174],DocWater.00>
00416818 > 8B95 8CFEFFFF mov edx,dword ptr ss:[ebp-0x174]
0041681E . 8B02 mov eax,dword ptr ds:[edx]
00416820 . 8985 3CFFFFFF mov dword ptr ss:[ebp-0xC4],eax
00416826 . C785 64FFFFFF 0400028>mov dword ptr ss:[ebp-0x9C],0x80020004
00416830 . C785 5CFFFFFF 0A00000>mov dword ptr ss:[ebp-0xA4],0xA
0041683A . C785 74FFFFFF 0100000>mov dword ptr ss:[ebp-0x8C],0x1
00416844 . C785 6CFFFFFF 0200000>mov dword ptr ss:[ebp-0x94],0x2
0041684E . B8 10000000 mov eax,0x10
00416853 . E8 08B1FEFF call <jmp.&MSVBVM60.__vbaChkstk>
00416858 . 8BCC mov ecx,esp
0041685A . 8B95 5CFFFFFF mov edx,dword ptr ss:[ebp-0xA4]
00416860 . 8911 mov dword ptr ds:[ecx],edx
00416862 . 8B85 60FFFFFF mov eax,dword ptr ss:[ebp-0xA0]
00416868 . 8941 04 mov dword ptr ds:[ecx+0x4],eax
0041686B . 8B95 64FFFFFF mov edx,dword ptr ss:[ebp-0x9C]
00416871 . 8951 08 mov dword ptr ds:[ecx+0x8],edx
00416874 . 8B85 68FFFFFF mov eax,dword ptr ss:[ebp-0x98]
0041687A . 8941 0C mov dword ptr ds:[ecx+0xC],eax
0041687D . B8 10000000 mov eax,0x10
00416882 . E8 D9B0FEFF call <jmp.&MSVBVM60.__vbaChkstk>
00416887 . 8BCC mov ecx,esp
00416889 . 8B95 6CFFFFFF mov edx,dword ptr ss:[ebp-0x94]
0041688F . 8911 mov dword ptr ds:[ecx],edx
00416891 . 8B85 70FFFFFF mov eax,dword ptr ss:[ebp-0x90]
00416897 . 8941 04 mov dword ptr ds:[ecx+0x4],eax
0041689A . 8B95 74FFFFFF mov edx,dword ptr ss:[ebp-0x8C] ; DocWater.004070A0
004168A0 . 8951 08 mov dword ptr ds:[ecx+0x8],edx
004168A3 . 8B85 78FFFFFF mov eax,dword ptr ss:[ebp-0x88]
004168A9 . 8941 0C mov dword ptr ds:[ecx+0xC],eax
004168AC . 8B8D 3CFFFFFF mov ecx,dword ptr ss:[ebp-0xC4]
004168B2 . 8B11 mov edx,dword ptr ds:[ecx]
004168B4 . 8B85 3CFFFFFF mov eax,dword ptr ss:[ebp-0xC4]
004168BA . 50 push eax
004168BB . FF92 B0020000 call dword ptr ds:[edx+0x2B0]
004168C1 . DBE2 fclex
004168C3 . 8985 38FFFFFF mov dword ptr ss:[ebp-0xC8],eax
004168C9 . 83BD 38FFFFFF 00 cmp dword ptr ss:[ebp-0xC8],0x0
004168D0 . 7D 26 jge short DocWater.004168F8
004168D2 . 68 B0020000 push 0x2B0
004168D7 . 68 1C724000 push DocWater.0040721C
004168DC . 8B8D 3CFFFFFF mov ecx,dword ptr ss:[ebp-0xC4]
004168E2 . 51 push ecx
004168E3 . 8B95 38FFFFFF mov edx,dword ptr ss:[ebp-0xC8]
004168E9 . 52 push edx
004168EA . FF15 68104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>; msvbvm60.__vbaHresultCheckObj
004168F0 . 8985 88FEFFFF mov dword ptr ss:[ebp-0x178],eax
004168F6 . EB 0A jmp short DocWater.00416902
004168F8 > C785 88FEFFFF 0000000>mov dword ptr ss:[ebp-0x178],0x0
00416902 > E9 88000000 jmp DocWater.0041698F
00416907 > \C745 FC 17000000 mov dword ptr ss:[ebp-0x4],0x17
直接跳过,就不会出现注册提醒框。
关键在此处。
0041A617 66:B8 0100 mov ax,0x1
提醒框没有了,好了,就到这里,谢谢大家观看。
视频及相关资料下载地址: http://pan.baidu.com/s/1bzB6wQ 密码:
|
评分
-
参与人数 16 | HB +11 |
THX +7 |
收起
理由
|
xiaoxixpj
| + 1 |
|
[吾爱汇编论坛52HB.COM]-软件反汇编逆向分析,软件安全必不可少! |
禽大师
| + 1 |
|
|
lies
| |
+ 1 |
|
zxjzzh
| |
+ 1 |
[吾爱汇编论坛52HB.COM]-学破解防破解,知进攻懂防守! |
虚心学习
| |
+ 1 |
[吾爱汇编论坛52HB.COM]-吃水不忘打井人,给个评分懂感恩! |
别管我了行
| |
+ 1 |
|
飞刀梦想
| + 1 |
|
|
l278785481
| + 1 |
|
|
xgbnapsua
| |
+ 1 |
|
消逝的过去
| + 2 |
|
|
agan8888
| |
+ 1 |
|
武朋忍
| + 1 |
+ 1 |
|
soho
| + 1 |
|
感谢您的作品! |
fortime
| + 1 |
|
[快捷评语] - 分享精神,是最值得尊敬的! |
开始学习ing
| + 1 |
|
[快捷评语] - 分享精神,是最值得尊敬的! |
海天一色001
| + 1 |
|
[快捷评语] - 分享精神,是最值得尊敬的! |
查看全部评分
|