New evolution of software cracking

Comments: 1. How does the software determine if we have registered? Don't forget that the software is ultimately based on human thinking. We will return to ourselves, "if it is you, how do you determine whether someone else has registered ", "I want someone to enter the user name and registration code." a smart idea is that many software programs do the same thing, such as Haojie super solutions. (But not so soft. 1. How can we determine if we have registered the software?
Don't forget that the software is ultimately based on human thinking. We will return to ourselves, "if it is you, how do you determine whether someone else has registered ", "I want someone to enter the user name and registration code." a smart idea is that many software programs do the same thing, such as Haojie super solutions. (But it's not so software, there are too many methods, and the friendly reminder: This world is not completely universal, except for your smart brain)
What's more ??????????
We can get a real registration code and compare the user name with the user input in some way? Yeah, that is
Real registration code = f (user name)
It is the same as Y = f (x ).
Then there is a classic comparison. Why is it classic?
Because about 60% of the software is doing this, what is the comparison?
Please note that there will be error handling here. Before that, it is a classic comparison. If the error handling prompt here is something like registration error, we can easily find the classic comparison.
How is the above process implemented in the assembly language? There are two comparison methods: direct and indirect:
Cmp x, y
Je (jne) label
Here, x and y are only symbols, which may be registers and memory.
Indirect? Call the following code to compare a sub-program:
If (strcmp (& x, & y) // if the return value of strcmp is 1
Printf ("right ");
Else ................. // Of course it is a false pull
The strcmp here is just a symbol, and the reality may change.
In assembly language?
Push & y;
Push & x;
Call strcmp;
Test ax, ax; Determine the return value (that is, the exit parameter, which can also be determined in the subroutine)
Je ......
2. Why can I debug executable programs?
Many cainiao may have questions like this.
Theoretical Basis for debugging executable programs:
We all know that debugging can be used in assembly languages. But why?
In fact, it is simple, because the machine only recognizes 0 and 1 (accurately speaking, you are at the High Level and bottom level, you can simply understand it as light bulb and black), we call it machine code, however, our assembly language corresponds to the machine code one by one, so we can obtain the corresponding assembly code based on the machine code, or we can obtain the corresponding machine code through the assembly code in turn,
For example, in debug, we can see that
Test it With debug:
-
1370: 0100 mov ax, bx
1370: 0102
-U100
1370: 0100 89D8 mov ax, BX
The 89D8 here is the machine code of mov ax and BX.
3. All the cracking tutorials tell us that we can find the first conditional jump in the error prompt above to crack the attack. Why?
Because the program is executed in sequence, as long as we find the place where the error is prompted, the comparison is finished before that, so we can find the key comparison before, the key point is the comparison above. What if we change the judgment condition? If it is not equal, the registration is successful .. (Hey hey, a comrade gave me a bad laugh.) No matter what we enter, it is "genuine", and there is no "genuine" paid. This is why we changed the jump, that is, changing the judgment Conditions
4. Next we will start practical drills.
Although this is just a simple animation made with S-Demo, after reading the following articles, you will still gain a lot. Don't believe it, I'm dizzy, achieving simple things to the limit will be successful.
(1). Blasting
This is very simple. Run the program and enter the password. OK. The prompt is "password wrong ",
Use ollydbg to load the animation, search for the strings used by the program, find password wrong, And next breakpoint. Do you still remember the previous theory?
Search for the key point of the comparison (conditional jump). OK, the address is: 0040203F.
0040202A |. FFB6 A4000000 push dword ptr ds: [ESI A4];/s2
Next breakpoint to see what is pushed into the stack
00402030 |. 8D45 cc lea eax, dword ptr ss: [EBP-34]; |
00402033 |. 50 push eax; | s1
00402034 |. FF15 E0234100 call dword ptr ds: []; \ _ stricmp // What is seen here, stricmp? Is this a key comparison in the legend?
But no jump after comparison, right? Take a closer look and put the comparison results there, eax!
Isn't there a je below?
0040203A |. 83C4 20 add esp, 20; balance Stack
0040203D |. 85C0 test eax, EAX; TEST Return Value
0040203F |. 74 15 je short test.00402056
Change to jne, save, run, OK, and fix it. Please review the previous flowchart again.
(2). Search for a password
Do you still remember the preceding flowchart? What will happen if we interrupt the program during program comparison? Well, we will see the real password at this time. We will re-use the ollydbg to load this animation, with a breakpoint of 00402034
Why do we need to place a breakpoint here? Okay, because here we see call dword ptr ds: []. Let's look at the flowchart. Do you understand it?
Here we can see in the stack area that we entered the trial code and the real password, why in the stack area, because parameters are passed through the stack in windows. Take a look at the above simple analysis and compile the cracking patch.
(3) file patch compilation (simple implementation in C language)
Previously, we changed je to jne. We can enter any password. In essence, we changed the machine code from 74h to 75 h, because the machine code corresponds to the Assembly command one by one, so we only need to write a small item and modify it. I have already written it. It's very short and easy to understand. Crack. c. Let's analyze it.
# Include
# Include
Int main (void)
{
FILE * fp_out; // the FILE to be written.
Printf ("\ n \ t Copy Right by ngaut \ n ");
Printf ("Cracking... \ n ");
// Open the test.exe file.
If (fp_out = fopen ("test.exe", "r") = NULL)
{
Printf ("error !!! Can not open test.exe !!! \ N ");
Printf ("Press any key to continue \ n ");
Getchar ();
Exit (0 );
}
// Locate the location to be modified. Here is 0x203f. Why? Answer below
Fseek (fp_out, 0x203f, SEEK_SET );
Fputc (0x75, fp_out); // write data to 0x75, that is, change the machine code 74 to 75,
// The Assembly is changed to je to jne.
Fclose (fp_out );
Here 0x203f = 0x0040203F-0x00400000
(4) Let the program automatically pop up the correct password