USB加密狗去功能限制的破解

USB加密狗去功能限制的破解 USB加密狗破解+去功能限制的破解 使用于部分软件，仅供大家学习使用～ 一款商业管理系统用了USB狗验证不插入USB功能受到限制～ 破文开始: 查壳:无壳 Borland Delphi 6.0 - 7.0 OD载入 F9运行弹出:未检测到软件狗，试用版软件部分功能将受到限制～ F12暂停 -------------------------------------------------------------------------------- ----- 7C92E514 > C3 retn ; (初始 cpu 选择) 7C92E515 . 8DA424 000000>lea esp,dword ptr ss:[esp] 7C92E51C . 8D6424 00 lea esp,dword ptr ss:[esp] 7C92E520 >/$ 8D5424 08 lea edx,dword ptr ss:[esp+8] 7C92E524 |. CD 2E int 2E 7C92E526 \. C3 retn 7C92E527 90 nop 7C92E528 >/$ 55 push ebp 7C92E529 |. 8BEC mov ebp,esp -------------------------------------------------------------------------------- ------ ALT+K调用堆栈 调用堆栈 0012FD34 77D50877 ? user32.MessageBoxTimeoutA user32.77D50872 0012FD30 0012FD54 77D5082F ? user32.MessageBoxExA user32.77D5082A 0012FD50 0012FD58 00000000 hOwner = NULL 0012FD5C 0063B9E0 Text = "未检测到软件狗，试用版软件 0012FD60 004E0040 Title = "提示" 0012FD64 00002040 Style = MB_OK|MB_ICONASTERISK|MB_T 0012FD68 00000000 LanguageID = 0 (LANG_NEUTRAL) 0012FD70 004E000A ? Washgl.004E0005 0012FD6C 0012FD74 00000000 hOwner = NULL 0012FD78 0063B9E0 Text = "未检测到软件狗，试用版软件 0012FD7C 004E0040 Title = "提示" 0012FD80 00002040 Style = MB_OK|MB_ICONASTERISK|MB_T 0012FD8C 0063B7DC ? Washgl.004DFFE4 Washgl.0063B7D7 在 这句双击进去 -------------------------------------------------------------------------------- -------------- 0063B79D . 55 push ebp 0063B79E . 68 FFB86300 push Washgl.0063B8FF 0063B7A3 . 64:FF32 push dword ptr fs:[edx] 0063B7A6 . 64:8922 mov dword ptr fs:[edx],esp 0063B7A9 . E8 0235EBFF call Washgl.004EECB0 0063B7AE . A2 00416400 mov byte ptr ds:[644100],al 0063B7B3 . A1 EC496400 mov eax,dword ptr ds:[6449EC] 0063B7B8 . 8A15 00416400 mov dl,byte ptr ds:[644100] 0063B7BE . 8810 mov byte ptr ds:[eax],dl 0063B7C0 . A0 00416400 mov al,byte ptr ds:[644100] 0063B7C5 . 34 01 xor al,1 0063B7C7 . 84C0 test al,al 0063B7C9 . 84C0 test al,al 0063B7CB 74 5F je short Washgl.0063B82C 整个调用只有这一个能跳 过所以改成jmp顺利跳过去了 0063B7CD . B8 E0B96300 mov eax,Washgl.0063B9E0 0063B7D2 . BA 01000000 mov edx,1 0063B7D7 . E8 0848EAFF call Washgl.004DFFE4 双击进去在这，这就是关 键CALL了 0063B7DC . 8D55 F4 lea edx,dword ptr ss:[ebp-C] 0063B7DF . A1 2C656400 mov eax,dword ptr ds:[64652C] 0063B7E4 . E8 5F89E1FF call Washgl.00454148 0063B7E9 . 8D45 F4 lea eax,dword ptr ss:[ebp-C] 0063B7EC . BA 18BA6300 mov edx,Washgl.0063BA18 0063B7F1 . E8 FE93DCFF call Washgl.00404BF4 0063B7F6 . 8B55 F4 mov edx,dword ptr ss:[ebp-C] 0063B7F9 . A1 2C656400 mov eax,dword ptr ds:[64652C] 0063B7FE . E8 7589E1FF call Washgl.00454178 0063B803 . A1 08476400 mov eax,dword ptr ds:[644708] 0063B808 . E8 2791DCFF call Washgl.00404934 0063B80D . A1 04476400 mov eax,dword ptr ds:[644704] 0063B812 . E8 1D91DCFF call Washgl.00404934 0063B817 . 8B45 FC mov eax,dword ptr ss:[ebp-4] 0063B81A . 8B80 FC020000 mov eax,dword ptr ds:[eax+2FC] 0063B820 . 33D2 xor edx,edx 0063B822 . E8 19A9E2FF call Washgl.00466140 0063B827 . E9 C5000000 jmp Washgl.0063B8F1 -------------------------------------------------------------------------------- ------------------- 再次尝试进入软件此时无提示进入软件而且，窗体上的(试用版已经没了)点关于:还是试 用版功能依然限制～ 此时重新载入OD，查找字符串～(对于Borland Delphi这招很好用) 超级字串参考， 地址 反汇编 文本字串 0051FE24 mov edx,Washgl.0051FEA0 退出 0051FE30 mov eax,Washgl.0051FEA8 非法用户，系统将关闭～ 0051FE41 mov eax,Washgl.0051FEC0 非法用户，重新登录失败～ 0051FE61 mov eax,Washgl.0051FEDC 口令无效，请重新输入～ 005206EB mov edx,Washgl.00520774 试用版 005206FA mov edx,Washgl.00520784 注册版 00520712 push Washgl.00520794 v 0052071E push Washgl.005207A0 -------------------------------------------------------------------------------- --------------- 在试用版那双击进入～ 005206CC |. 55 push ebp 005206CD |. 68 5E075200 push Washgl.0052075E 005206D2 |. 64:FF30 push dword ptr fs:[eax] 005206D5 |. 64:8920 mov dword ptr fs:[eax],esp 005206D8 |. 8BC3 mov eax,ebx 005206DA |. E8 E5000000 call Washgl.005207C4 005206DF |. E8 CCE5FCFF call Washgl.004EECB0 005206E4 |. 84C0 test al,al 比较 005206E6 |. 75 0F jnz short Washgl.005206F7 关键跳～jnz 改jmp 直接跳到注册版 005206E8 |. 8D45 FC lea eax,[local.1] 005206EB |. BA 74075200 mov edx,Washgl.00520774 ; 试用版 005206F0 |. E8 D742EEFF call Washgl.004049CC 005206F5 |. EB 0D jmp short Washgl.00520704 005206F7 |> 8D45 FC lea eax,[local.1] 005206FA |. BA 84075200 mov edx,Washgl.00520784 ; 注册版 005206FF |. E8 C842EEFF call Washgl.004049CC 00520704 |> 8B55 FC mov edx,[local.1] 00520707 |. 8B83 00030000 mov eax,dword ptr ds:[ebx+300] 0052070D |. E8 663AF3FF call Washgl.00454178 00520712 |. 68 94075200 push Washgl.00520794 ; v 00520717 |. A1 B8416400 mov eax,dword ptr ds:[6441B8] 0052071C |. FF30 push dword ptr ds:[eax] 0052071E |. 68 A0075200 push Washgl.005207A0 ; 00520723 |. 68 AC075200 push Washgl.005207AC ; 版权所有 (c) 2007-2017 -------------------------------------------------------------------------------- ------------------------ 总结: 到此已经破解成功，保存运行已经是注册版，功能限制已经取消了，这套系统加密上明显存在缺陷，以至于USB验证形同虚设～在这里提醒一下新手朋友，不要碰到一些高级的加密验证方式就放弃了，要有种勇于探索的精神，crack是要不断的动手钻研，碰到困难要尽最大努力去克服这样才能进步～