Luotong GPS software shelling + cracking minutes (rtnavi.exe)

Use peid to check the shell as an unknown shell ,.

Try using the ESP law, you can directly connect to OEP, use loadpe to complete the transfer first, and then use importrec to repair IAT. During the repair process, find the last line of invalid and delete it first.

Open the repaired file. The error dialog box is displayed,

1. The preliminary consideration is that there is a problem with the deleted invalid IAT. The preliminary tracking has not found any special points.

2. For the breakpoint at the error point, the cause of the error is that the memory block is not allocated. (The OD module shows that this memory block is not available ). Combined with the previous invalid IAT analysis, it is inferred that after the shell is started, some original software code is hooked after the code is decompressed, and several memory blocks are allocated for it. Why not re-allocate or change the memory block in the hook code, because I have fully transferred the decompressed code. If it is allocated or changed in the hook code, this error will not occur.

3. Use loadpe to transfer the memory block to the hard disk, and then import the memory block to the segment in the PE editor, note: edit the virtual address of this segment to be consistent with the virtual address of the original memory block.

 

4. Open it again. It can be opened successfully. The shell check is VC ++ 6.0.

After shelling, track the program and try the patch. The procedure is as follows:

1, 0065886a this is the first time to obtain the machine code (based on the hard disk and network card ID), you can directly disconnect it in 0065886f, and then change the return value to the machine code to be patched.

2, 006588eb where the activation code is obtained, which can be directly broken at 006588f0, and then the read-back activation code can be changed.

3. After the first round of verification, the system will verify again when it is turned on. F3b41 this is to obtain the machine code again can be directly broken in f3b47, and then change the return value to the machine code that requires the patch.

After the patch, the program enters the welcome interface normally.

 

Directly patch the shell-less files and perform loader patch on the shell files.