Basic knowledge of assembly language program cracking

Source: Internet
Author: User
Tags ultraedit

Comments: Assembly Language Program cracking basic knowledge, to learn to crack friends can refer to A. Mechanical Code, also known as machine code.
Open ultraedit. When editing the exe file, you will see
A large number of digital devices, composed of 0, 1, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, and F.
Is the machine code.
When modifying a program, you must modify the machine code to modify the exe file.

2. All Assembly knowledge that needs to be mastered (only so much)
It is not easy to understand. You can stick your back first and get familiar with your face. Then you will understand it slowly.
Cmp a, B compare a and B
Mov a and B send the value of B to
Ret returns the main program
Nop is ineffective. The abbreviation of "no operation" means "do nothing" (machine code 90) *** for the meaning of the machine code, see the above
(Explanation: When ultraedit opens and edits the exe file, you will see 90, equivalent to the compilation statement nop)
Call subroutine
Je or jz jump if they are equal (machine code 74 or 0F84)
Skip jne or jnz if not equal (machine code 75 or 0F85)
Jmp unconditional jump (machine code EB)
Skip if jb is smaller
Skip if ja is greater
Skip if jg is greater
Skip if jge is greater than or equal
Jl skip if it is smaller
Skip if jle is less than or equal
Pop output Stack
Push pressure Stack

3. Common changes (machine code)
74 => 75 74 => 90 74 => EB
75 => 74 75 => 90 75 => EB

Jnz-> nop
75-> 90 (corresponding machine code modification)

Jnz-> jmp
75-> EB (corresponding machine code modification)

Jnz-> jz
75-> 74 (normal) 0F 85-> 0F 84 (in special cases, sometimes the corresponding machine code is modified)

4. Different modification methods for different situations
1. Change to jmp
Je (jne, jz, jnz) => the corresponding jmp machine code EB (the first jump found in the error message) jmp is used to perform absolute and unconditional jumps, this skips the following error message.

Xxxxxxxxxxxx error message, such as: incorrect registration code, sorry, unregistered version cannot ..., "Function Not Avaible in Demo" or "Command Not Avaible" or "Can't save in ware/Demo" (we want to skip it to prevent it from appearing)
...
...
Xxxxxxxxxxxx the correct route

2. Change to nop.
Je (jne, jz, jnz) => nop corresponding machine code 90 (the first jump found in the correct information) nop is used to erase the jump and make the jump invalid, lost, so that the program smoothly comes to the correct information behind it

Xxxxxxxxxxxx correct information, such as: Registration successful, thank you for your support, etc (we hope it will not be skipped, let it appear, the program must come here smoothly)
...
...
Xxxxxxxxxxxx error message (we do not want to jump here to prevent it from appearing)
...
...
5. The brute-force password will be used in the future. Do not miss out.
One (HOP) will die, and nine (90) will be Hu (corresponding to the above 2. Changed to nop)
One (HOP) is Hu, one (EB) serves (corresponding to 1. Changed to jmp)
Wife (74) No wife (75)
Dad is dead (84) Dad is absent (85)

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.