Cracking ideas and breakpoint settings

Brute-force cracking is the purpose of brute-force program code modification.
Of course, according to the Registration Method of shared software, we can take the right remedy, for example, the software that has not been registered has functional restrictions, the number of times of use, the use date restrictions, and so on.
We can treat them separately! All we need to do is to lift these restrictions to crack them!

General process of brute-force cracking
1. Naturally, shelled users must first shell off
2. Try to register and see if you have any tips. Let's catch a small tail.
3. If any prompt is displayed, use the OD dynamic debugger or W32 static debugger to find the error prompt.
4. Go to the error prompt and analyze the code to find the key CALL and key jump!
5. modify the code
6. Copy and save!

If no prompt is displayed, we can use multiple breakpoints to complete these operations.
Today's software protection methods include:
1. Serial number protection method (registration code = f (machine code/serial number ))
2. Warning (NAG) window
3. Time limit/frequency limit ..
4. Menu function restrictions
5. Key File Protection
6. CD-Check
7. Run only one instance

Some software performs registration verification by saving the registration code in the. ini file, registry,. dat file, and so on.

Common breakpoint settings (Common settings are followed)

String
Bp GetDlgItemTextA (W )****
Bp GetDlgItemInt
Bp GetWindowTextA (W )****
Bp GetWindowWord
Bmsg XXXX wm_gettext

Dialog Box
Bp MessageBeep
Bp MessageBoxA (W )****
Bp MessageBoxExA (W)
Bp DialogBoxParamA (W)
Bp greatew.wexa (W)
Bp ShowWindow
Bp UpdateWindow
Bmsg XXXX wm_command

Bp MessageBoxA cannot be used for VB Programs. bp rtcMsgBox

Registry related
Bp RegCreateKeyA (W)
Bp RegDeleteKeyA (W)
Bp RegQueryValueA (W)
Bp RegCloseKey
Bp RegOpenKeyA (W )****

Time-related
Bp GetLocalTime
Bp GetFileTime
Bp GetSystemtime

CD-ROM or disk related
Bp GetFileAttributesA (W)
Bp GetFileSize
Bp GetDriveType
Bp GetLastError
Bp ReadFile
Bpio-h (CD-ROM port address) R

Software dog
Bpio-h 278R
Bpio-h Branch R

INI initialization file
Bp GetPrivateProfileStringA ****
Bp GetPrivateProfileInt
Bp WritePrivateProfileString
Bp WritePrivateProfileInt

File Access Problems
Bp ReadFile
Bp WriteFile
Bp CreateFileA ****
Bp SetFilePointer
Bp GetSystemDirectory
Special breakpoint for vbprogram:
Bpx msvbvm60! RtcMsgBox
Bpx msvbvm60! _ VbaStrCmp
Bpx msvbvm60! _ VbaStrComp
Bpx msvbvm60! _ VbaStrCompVar
Bpx msvbvm60! _ VbaStrTextCmp
Bpx msvbvm60! _ VbaFileOpen
Bpx msvbvm60! _ VbaInputFile
Bpx msvbvm60! _ VbaFileSeek
Bpx msvbvm60! _ VbaWriteFile
Bpx msvbvm60! _ VbaFileClose
Bpx msvbvm60! RtcFileAttributes
Bpx msvbvm60! RtcFileDateTime
Bpx msvbvm60! RtcFileLen
Bpx msvbvm60! RtcFileLength
Bpx msvbvm60! _ VbaVarInt
Bpx msvbvm60! _ VbaVarCmpGe
Bpx msvbvm60! _ VbaVarCmpGt
Bpx msvbvm60! _ VbaVarCmpLe
Bpx msvbvm60! _ VbaVarCmpLt
Bpx msvbvm60! _ VbaVarCmpNe
Bpx msvbvm60! _ VbaVarTextCmpEq
Bpx msvbvm60! _ VbaVarTextCmpGe
Bpx msvbvm60! _ VbaVarTextCmpGt
Bpx msvbvm60! _ VbaVarTextCmpLe
Bpx msvbvm60! _ VbaVarTextCmpLt
Bpx msvbvm60! _ VbaVarTextCmpNe
Bpx msvbvm60! _ VbaVarTextTstEq
Bpx msvbvm60! _ VbaVarTextTstGe
Bpx msvbvm60! _ VbaVarTextTstGt
Bpx msvbvm60! _ VbaVarTextTstLe
Bpx msvbvm60! _ VbaVarTextTstLt
Bpx msvbvm60! _ VbaVarTextTstNe
Bpx msvbvm60! _ VbaVarTstEq
Bpx msvbvm60! _ VbaVarTstGe
Bpx msvbvm60! _ VbaVarTstGt
Bpx msvbvm60! _ VbaVarTstLe
Bpx msvbvm60! _ VbaVarTstLt
Bpx msvbvm60! _ VbaVarTstNe
Note: The vbprogram can still use common API functions, as long as the function "eventually" calls this function
The above breakpoint corresponds to the VB6 program. If it is a VB5 program, change msvbvm60 to msvbvm50.

Another type of software checks whether the program is registered through network verification and restart verification.
Of course, the former is generally used in many plug-ins. Generally, it is used to change the network verification to local verification to deceive remote network hosts to pass verification!
The latter is also very common. He generally saves the registration code entered by the user directly or the value obtained after encryption to the file and registry, and then prompts the user to restart to verify whether the user is registered, of course, when you re-open the program, he will read the registration code entered by the user from the file or the Registry, and then compare it with the program registration algorithm. The correct one will naturally become a genuine one, the error is naturally 88. In addition, the software for restart verification usually stores the registration code in the registry or file!

The following describes a general solution to this type of software!

Restart the verification software for a rough verification process.
1. Run the software and enter registration information. Click register. General Software prompts you to re-run the software to verify the correctness of registration information (such as FlashGet );
This prompt is displayed only when you enter the correct registration information. Otherwise, the prompt will tell you that the entered registration information is incorrect (this software belongs to this type)

2. to crack this software, first determine where the registration information is stored (because it is required for verification restart ). There are roughly two storage methods: the first is in the registry, and the second is in the file. (We can check the registration information by using monitoring software, such as FileMon and RegShot, before entering Registration Information and clicking OK)

3. After knowing the location where her registration information is stored, you can select the corresponding API breakpoint for debugging.

Common APIs for accessing the Registry
Bp RegOpenKeyA open an existing registry key ****
Bp RegOpenKeyExA open an existing registry key ****
Bp RegCreateKeyA creates or opens an item under a specified item
Bp RegCreateKeyExA: a more complex way to create a new project under a specified item
Bp RegDeleteKeyA: deletes a specified subitem under an existing item.
Bp RegDeleteValueA deletes a value under a specified item
Bp RegQueryValueA obtains the setting value of an item.
Bp RegQueryValueExA obtains the setting value of an item.
Bp RegSetValueA sets the value of a specified item or subitem
Bp RegSetValueExA: set the value of the specified item.
Bp RegCloseKey disables an entry (or key) in the system registry)

Common APIs for accessing files
Bp CreateFileA opens and creates files, pipelines, mail slots, communication services, devices, and the console ****
The bp OpenFile function can perform a large number of different file operations.
Bp ReadFile reads data from the file
Bp ReadFileEx is similar to ReadFile, but it can only be used for asynchronous read operations and contains a complete callback.
========================================================== ====================

Common breakpoint (in OD)
Interception window:
Bp CreateWindow creation window
Bp createmediawex (A) creation window
Bp ShowWindow display window
Bp UpdateWindow update window
Bp GetWindowText (A) obtains the window text
Intercept message box:
Bp MessageBox (A) create A message box
Bp MessageBoxExA create message box
Bp MessageBoxIndirect (A) creates A custom message box
Interception warning:
Bp MessageBeep sends a system warning sound (if there is no sound card, the system speaker is directly driven)
Interception dialog box:
Bp DialogBox create mode dialog box
Bp DialogBoxParam (A) create mode dialog box
Bp DialogBoxIndirect create mode dialog box
Bp DialogBoxIndirectParam (A) create mode dialog box
Create non-modal dialog box of bp CreateDialog
Bp CreateDialogParam (A) create A non-Modal Dialog Box
Bp CreateDialogIndirect create non-Modal Dialog Box
Bp CreateDialogIndirectParam (A) create A non-Modal Dialog Box
Bp GetDlgItemText (A) to obtain the text of the dialog box
Bp GetDlgItemInt: obtains the integer of the dialog box.
Intercept clipboard:
Bp GetClipboardData obtains the Clipboard data
Interception registry:
Bp RegOpenKey ()
Bp RegOpenKeyEx
Bp RegQueryValue (A) Search for child keys
Bp RegQueryValueEx
Bp RegSetValue (A) sets the child key
Bp RegSetValueEx ()
Function restrictions:
Bp EnableMenuItem: Disable or allow menu items
Bp EnableWindow: Disable or allow a window
Interception time:
Bp GetLocalTime get local time
Bp GetSystemTime obtains the system time
Bp GetFileTime
Bp GetTickCount: the number of milliseconds that have elapsed since the system was successfully started.
Bp GetCurrentTime get current time (16 bits)
Bp SetTimer create Timer
Bp TimerProc timer timeout callback function
Interception file:
Bp CreateFileA creates or opens a file (32-bit)
Bp OpenFile open file (32-bit)
Bp ReadFile Read File (32-bit)
Bp WriteFile Write File (32-bit)
Interception drive:
Bp GetDriveTypeA to obtain the disk drive type
Bp GetLogicalDrives
Bp GetLogicalDriveStringsA obtains the root drive path of all current logical drives

★★Vbprogram-specific breakpoint★★
Whether the bp _ vbaStrCmp string is equal
Whether the bp _ vbaStrComp string is equal
Bp _ vbaVarTstNe comparison variable is not equal
Bp _ vbaVarTstEq: whether the variables are equal
Bp _ vbaStrCopy copy string
Bp _ vbaStrMove move string
Bp MultiByteToWideChar ANSI string to Unicode string
Conversion of bp WideCharToMultiByte Unicode string to ANSI string