Assembly commands are often used for cracking.

Source: Internet
Author: User
Tags ultraedit

Basically, most of the methods for cracking are the same, that is, to change the logic value to false when it is judged to be true. Therefore, we often need to replace some assembly commands:

Cmp a, B compare A and B
MoV A and B send the value of B to
RET back to masterProgram
NOP is ineffective. The abbreviation of "no operation" means "do nothing" (machine code 90) *** for the meaning of the machine code, see the above
(Explanation: When ultraedit opens and edits the EXE file, you will see 90, equivalent to the compilation statement NOP)
Call subroutine
Je or JZ jump if they are equal (machine code 74 or 0f84)
Skip JNE or jnz if not equal (machine code 75 or 0f85)
JMP unconditional jump (machine code EB)
Skip if JB is smaller
Skip if ja is greater
Skip if JG is greater
Skip if jge is greater than or equal
Jl skip if it is smaller
Skip if jle is less than or equal
Pop output Stack
Push pressure Stack The call machine code is also E8?

3. Common changes (machine code)
74 => 75 74 => 90 74 => EB
75 => 74 75 => 90 75 => EB

Jnz-> NOP
75-> 90 (corresponding machine code modification)

Jnz-> JMP
75-> EB (corresponding machine code modification)

Jnz-> JZ
75-> 74 (normal) 0f 85-> 0f 84 (in special cases, sometimes the corresponding machine code is modified)

4. Different modification methods for different situations
1. Change to JMP
Je (JNE, JZ, jnz) => the corresponding JMP machine code EB (the first jump found in the error message) JMP is used to perform absolute and unconditional jumps, this skips the following error message.

Xxxxxxxxxxxx error message, such as: incorrect registration code, sorry, unregistered version cannot ..., "function not avaible In Demo" or "command not avaible" or "can't save in ware/demo" (we want to skip it to prevent it from appearing)
...
...
Xxxxxxxxxxxx the correct route

2. Change to NOP.
Je (JNE, JZ, jnz) => NOP corresponding machine code 90 (the first jump found in the correct information) NOP is used to erase the jump and make the jump invalid, lost, so that the program smoothly comes to the correct information behind it

Xxxxxxxxxxxx correct information, such as: Registration successful, thank you for your support, etc (we hope it will not be skipped, let it appear, the program must come here smoothly)
...
...
Xxxxxxxxxxxx error messages (we do not want to jump here to prevent it from appearing) are transmitted between the memory and registers, registers and the input and output ports.
For example, when using windbg

0: 000> dd 0c0000b28 l40c0000b28 running 940f0108 c0b60fc0 01b805eb run ed 0c0000b28 running to 0: 000> dd 0c0000b28 l40c0000b28 running 940f0c0108 b60fc0 01b805

Cmp a, B compare A and B
MoV A and B send the value of B to
RET returns the main program
NOP is ineffective. The abbreviation of "no operation" means "do nothing" (machine code 90) *** for the meaning of the machine code, see the above
(Explanation: When ultraedit opens and edits the EXE file, you will see 90, equivalent to the compilation statement NOP)
Call subroutine
Je or JZ jump if they are equal (machine code 74 or 0f84)
Skip JNE or jnz if not equal (machine code 75 or 0f85)
JMP unconditional jump (machine code EB)
Skip if JB is smaller
Skip if ja is greater
Skip if JG is greater
Skip if jge is greater than or equal
Jl skip if it is smaller
Skip if jle is less than or equal
Pop output Stack
Push pressure Stack

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.