1. 断点:所谓断点就是程序被中断的地方,这个词对于解密者来说是再熟悉不过了。那么什么又是中断呢?中断就是由于有特殊事件(中断事件)发生,计算机暂停当前的任务(即程序),转而去执行另外的任务(中断服务程序),然后再返回原先的任务继续执行。打个比方:你正在上班,突然有同学打电话告诉你他从外地坐火车过来,要你去火车站接他。然后你就向老板临时请假,赶往火车站去接同学,接着将他安顿好,随后你又返回公司继续上班,这就是一个中断过程。我们解密的过程就是等到程序去获取我们输入的注册码并准备和正确的注册码相比较的时候将它中断下来,然后我们通过分析程序,找到正确的注册码。所以我们需要为被解密的程序设置断点,在适当的时候切入程序内部,追踪到程序的注册码,从而达到crack的目的。 Continue
貌似现在80%的商业软件都用VMP了,据说很NB,不过越NB,喜欢破解的人也就越多,下边是本人收集到的2种常用脚本,有需要的可以尝试下.直接上脚本.
—————————————————————————————————————–
第一个:
一直有人问怎么样加多层壳,其实很简单,不过多层壳再有些人眼里看来就是浪费资源,不过也确实能增加软件的安全性,刚才又有问这个问题的,就简单写个教程,本人原来以为自己是个菜鸟,现在才发现,自己已经不是菜鸟了,都快成白痴型了,由于接二连三的打击,堕落了好久,已经对键盘生疏了不少,算了,不多说,直接来说明怎么样加多层壳。高手绕道,新手止步!
先说一下什么是加壳,什么是脱壳,什么是资源释放:加壳:其实是利用特殊的算法,对EXE、DLL文件里的资源进行压缩。类似WINZIP 的效果,只不过这个压缩之后的文件,可以独立运行,解压过程完全隐蔽,都在内存中完成。解压原理,是加壳工具在文件头里加了一段指令,告诉CPU,怎么才能解压自己。现在的CPU都很快,所以这个解压过程你看不出什么东东。软件一下子就打开了,只有你机器配置非常差,才会感觉到不加壳和加壳后的软件运行速度的差别。你的机器配置很差么?喔,恭喜你。你将可能无法忍受等会你照我说的方法加壳后的软件的运行速度~~:) Continue
文件名称:手脱加双层壳的病毒(PECompact 2.x壳+未知壳)
目标程序:病毒样本“Trojan/Small.dol”程序
操作环境:Windows XP-SP3
使用工具:Ollydbg 1.10版
前言:
简单介绍下病毒样本“Trojan/Small.dol”程序所加的壳吧,样本外层加了一个“PECompact 2.x”壳,内层加了一个混淆入口点的壳,但不知道是什么名字,不过这个壳貌似很常见。今天拿这个壳做例子希望对初级接触脱壳的朋友有帮助,也希望你们会喜欢。
分析:
脱壳前,使用PEID V0.93查壳,显示壳名为:“PECompact 2.x -> Jeremy Collake”。看了下这个程序有2个节段。EP区段名分别为:“.CODE/.rsrc”,显示连接程序版本为:2.0 。
Continue
今天碰到Pohernah ,那就手动脱一下吧,有失误之处还请见谅
工具:od && import REC
平台:xp
前提理论基础:
对于脱壳有很多理论可以依照,同样对于本加壳程序也是如此
对于加壳软件,保证外壳的各个寄存器与源程序的环境相同是必要,esp、ebp等。初始化保存各个寄存器的值,然后执行完毕恢复之。
常用处理指令为pushad/popad、pushfd/popfd 归根结底就是堆栈平衡原理。
…… ;外壳代码部分
popad ;相当于pop edi,esi,ebp,esp,ebx,edx,ecx,eax先进后出嘛
jmp oep;准备进入入口处
oep:……;程序源代码
好了,let’s go
第一步,OD 加载
00469001 E8 00000000 call 00469006
00469006 5D pop ebp
00469007 81ED F1264000 sub ebp, 004026F1
0046900D 8BBD 18284000 mov edi, dword ptr ss:[ebp+402818]
00469013 8B8D 20284000 mov ecx, dword ptr ss:[ebp+402820]
00469019 B8 38284000 mov eax, 00402838
0046901E 01E8 add eax, ebp
00469020 8030 05 xor byte ptr ds:[eax], 5
00469023 83F9 00 cmp ecx, 0
00469026 74 71 je short 00469099
F8单步一下到00469001,观察右侧的寄存器,注意ESP的值为0012FFA4
右键数据串口中跟随,查看数据窗口
0012FFA4 00 00 00 00 00 00 00 00 F0 FF 12 00 C4 FF 12 00 ……..?.?.
0012FFB4 00 E0 FD 7F EC 85 95 7C B0 FF 12 00 00 00 00 00 .帻靺晐?…..
0012FFC4 3B F2 82 7C 00 00 00 00 00 00 00 00 00 E0 FD 7F ;騻|………帻
然后在数据窗口的前四个字节,断点|硬件访问|DWORD,然后F9执行程序,程序断下来了,
004690A6 56 push esi
004690A7 57 push edi
004690A8 4F dec edi
004690A9 F7D7 not edi
004690AB 21FE and esi, edi
004690AD 89F0 mov eax, esi
F8单步,看到如下
004271B1 8B db 8B
004271B2 EC db EC
004271B3 6A db 6A ; CHAR ’j’
004271B4 FF db FF
004271B5 68 db 68 ; CHAR ’h’
004271B6 60 db 60 ; CHAR ’`’
004271B7 0E db 0E
004271B8 45 db 45 ; CHAR ’E’
004271B9 00 db 00
004271BA &nbs
p; 68
db 68 ; CHAR ’h’
需要整理一下
ctrl A 强制整理,代码如下
004271B1 . 8BEC mov ebp, esp
004271B3 . 6A FF push -1
004271B5 . 68 600E4500 push 00450E60
004271BA . 68 C8924200 push 004292C8 ; SE 处理程序安装
004271BF . 64:A1 0000000>mov eax, dword ptr fs:[0]
004271C5 . 50 push eax
004271C6 . 64:8925 00000>mov dword ptr fs:[0], esp
004271CD . 83C4 A8 add esp, -58
004271D0 . 53 push ebx
004271D1 . 56 push esi
可以发现,其实我们已经进入到源程序中了,yes!!!
接着当然很顺利了,dump出来 dump.exe
这个时候就用到 import REC
oep 中填入271B0 然后IAT aturosearch |Get Import |Show Invalid
然后fix dump
ok ,dump_.exe
然后这个就是脱的文件了,运行一下,ok
下午回来没事做,随便找了一个Delphi的加壳,用的ASPACK是Regkiller工具包里面的那个来分析的。不多说了,具体如下:
0041B001 > 60 PUSHAD ; EP
0041B002 E8 03000000 CALL 0041B00A
0041B007 90 NOP ; 花指令 nop
0041B008 EB 04 JMP SHORT 0041B00E
0041B00A 5D POP EBP
0041B00B 45 INC EBP
0041B00C 55 PUSH EBP
0041B00D C3 RETN
0041B00E E8 01000000 CALL 0041B014
0041B013 90 NOP ; 花指令 nop
0041B014 5D POP EBP ; 0041b013出栈到EBP
0041B015 BB EDFFFFFF MOV EBX,-13 ; EBX=-13
0041B01A 03DD ADD EBX,EBP ; EBX=EBP+EBX=0041B000
0041B01C 81EB 00B00100 SUB EBX,1B000 ; EBX=EBX-1B000=00400000 获取基址
0041B022 83BD 7D040000 0>CMP DWORD PTR SS:[EBP+47D],0 ; 比较EBP+47D处数据是否为0
0041B029 899D 7D040000 MOV DWORD PTR SS:[EBP+47D],EBX ; 把基址放到EBP+47D处
0041B02F 0F85 C0030000 JNZ 0041B3F5 ; EBP+47D不为零的话就去OEP!
0041B035 8D85 89040000 LEA EAX,DWORD PTR SS:[EBP+489] ; 获取kernel32.dll 放到eax
0041B03B 50 PUSH EAX ; kernel32.dll压栈
0041B03C FF95 090F0000 CALL DWORD PTR SS:[EBP+F09] ; 调用GetModuleHandleA获取kernel32的基址
0041B042 8985 81040000 MOV DWORD PTR SS:[EBP+481],EAX ; kernel32的基址到EBP+481
0041B048 8BF0 MOV ESI,EAX ; ESI=EAX
0041B04A 8D7D 51 LEA EDI,DWORD PTR SS:[EBP+51] ; 获取VirtualAlloc 放到EDI
0041B04D 57 PUSH EDI ; EDI压栈
0041B04E 56 PUSH ESI ; kernel32的基址压栈
0041B04F FF95 050F0000 CALL DWORD PTR SS:[EBP+F05] ; 调用GetProcAddress获取EDI的地址
0041B055 AB STOSD ; 把获取到的地址放到原来字符串所在的位置
0041B056 B0 00 MOV AL,0
0041B058 AE SCASB
0041B059 ^ 75 FD JNZ SHORT 0041B058 ; 上面几句比较难读,作用]]
>
一朋友的excel文件密码忘记了,让我解决,没办法,找了一堆破解软件,要么需要购买,要么是破解打开密码的,非保护密码。好不容易找到解决方案!
当然,还有一个很好的工具,名字忘记了,是一个暴力破解的,作用挺好,而且是破解过的,
excel保護密碼破解(絕對經典) 如果你的Excel文件設置了保護密碼而遺忘了,那麼請依照下面的步驟來操作,也許會有奇跡出現.不需要多麼高難度的操作和專業的軟件支持.簡單.方便.費時一般最多兩分鐘. (建議:操作前把原文件COPY一份) 方法:
1打开文件
2工具—宏—-录制新宏—输入名字如:aa
3停止录制(这样得到一个空宏)
4工具—宏—-宏,选aa,点编辑按钮
5删除窗口中的所有字符(只有几个),替换为下面的内容:
Public Sub AllInternalPasswords()
‘ Breaks worksheet and workbook structure passwords. Bob McCormick
‘ probably originator of base code algorithm modified for coverage
‘ of workbook structure / windows passwords and for multiple passwords
‘
‘ Norman Harker and JE McGimpsey 27-Dec-2002 (Version 1.1)
‘ Modified 2003-Apr-04 by JEM: All msgs to constants, and
‘ eliminate one Exit Sub (Version 1.1.1)
‘ Reveals hashed passwords NOT original passwords
Const DBLSPACE As String = vbNewLine & vbNewLine
Const AUTHORS As String = DBLSPACE & vbNewLine & _
"Adapted from Bob McCormick base code by" & _
"Norman Harker and JE McGimpsey"
Const HEADER As String = "AllInternalPasswords User Message"
Const VERSION As String = DBLSPACE & "Version 1.1.1 2003-Apr-04"
Const REPBACK As String = DBLSPACE & "Please report failure " & _
"to the microsoft.public.excel.programming newsgroup."
Const ALLCLEAR As String = DBLSPACE & "The workbook should " & _
"now be free of all password protection, so make sure you:" & _
DBLSPACE & "SAVE IT NOW!" & DBLSPACE & "and also" & _
DBLSPACE & "BACKUP!, BACKUP!!, BACKUP!!!" & _
DBLSPACE & "Also, remember that the password was " & _
"put there for a reason. Don’t stuff up crucial formulas " & _
"or data." & DBLSPACE & "Access and use of some data " & _
"may be an offense. If in doubt, don’t."
Const MSGNOPWORDS1 As String = "There were no passwords on " & _
"sheets, or workbook structure or windows." & AUTHORS & VERSION
Const MSGNOPWORDS2 As String = "There was no protection to " & _
"workbook structure or windows." & DBLSPACE & _
"Proceeding to unprotect sheets." & AUTHORS & VERSION
Const MSGTAKETIME As String = "After pressing OK button this " & _
"will take some time." & DBLSPACE & "Amount of time " & _
"depends on how many different passwords, the " & _
"passwords, and your computer’s specification." & DBLSPACE & _
"Just be patient! Make me a coffee!" & AUTHORS & VERSION
Const MSGPWORDFOUND1 As String = "You had a Worksheet " & _
"Structure or Windows Password set." & DBLSPACE & _
"The password found was: " & DBLSPACE & "$$" & DBLSPACE & _
"Note it down for potential future use in other workbooks by " & _
"the same person who set this password." & DBLSPACE & _
"Now to check and clear other passwords." & AUTHORS & VERSION
Const MSGPWORDFOUND2 As String = "You had a Worksheet " & _
"password set." & DBLSPACE & "The password found was: " & _
DBLSPACE & "$$" & DBLSPACE & "Note it down for potential " & _
"future use in other workbooks by same person who " & _
"set this password." & DBLSPACE & "Now to check and clear " & _
"other passwords." & AUTHORS & VERSION
Const MSGONLYONE As String = "Only structure / windows " & _
"protected with the password that was just found." & _
ALLCLEAR & AUTHORS & VERSION & REPBACK
Dim w1 As Worksheet, w2 As Worksheet
Dim i As Integer, j As Integer, k As Integer, l As Integer
Dim m As Integer, n As Integer, i1 As Integer, i2 As Integer
Dim i3 As Integer, i4 As Integer, i5 As Integer, i6 As Integer
Dim PWord1 As String
Dim ShTag As Boolean, WinTag As Boolean
Application.ScreenUpdating = False
With ActiveWorkbook
WinTag = .ProtectStructure Or .ProtectWindows
End With
ShTag = False
For Each w1 In Worksheets
ShTag = ShTag Or w1.ProtectContents
Next w1
If Not ShTag And Not WinTag Then
MsgBox MSGNOPWORDS1, vbInformation, HEADER
Exit Sub
End If
MsgBox MSGTAKETIME, vbInformation, HEADER
If Not WinTag Then
MsgBox MSGNOPWORDS2, vbInformation, HEADER
Else
On Error Resume Next
Do ‘dummy do loop
For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126
With ActiveWorkbook
.Unprotect Chr(i) & Chr(j) & Chr(k) & _
Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & _
Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
If .ProtectStructure = False And _
.ProtectWindows = False Then
PWord1 = Chr(i) & Chr(j) & Chr(k) & Chr(l) & _
Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
MsgBox Application.Substitute(MSGPWORDFOUND1, _
"$$", PWord1), vbInformation, HEADER
Exit Do ‘Bypass all for…nexts
End If
End With
Next: Next: Next: Next: Next: Next
Next: Next: Next: Next: Next: Next
Loop Until True
On Error GoTo 0
End If
If WinTag And Not ShTag Then
MsgBox MSGONLYONE, vbInformation, HEADER
Exit Sub
End If
On Error Resume Next
For Each w1 In Worksheets
‘Attempt clearance with PWord1
w1.Unprotect PWord1
Next w1
On Error GoTo 0
ShTag = False
For Each w1 In Worksheets
‘Checks for all clear ShTag triggered to 1 if not.
ShTag = ShTag Or w1.ProtectContents
Next w1
If ShTag Then
For Each w1 In Worksheets
With w1
If .ProtectContents Then
On Error Resume Next
Do ‘Dummy do loop
For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126
.Unprotect Chr(i) & Chr(j) & Chr(k) & _
Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
If Not .ProtectContents Then
PWord1 = Chr(i) & Chr(j) & Chr(k) & Chr(l) & _
Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
MsgBox Application.Substitute(MSGPWORDFOUND2, _
"$$", PWo
rd1), vbInformation, HEADER<
br />‘leverage finding Pword by trying on other sheets
For Each w2 In Worksheets
w2.Unprotect PWord1
Next w2
Exit Do ‘Bypass all for…nexts
End If
Next: Next: Next: Next: Next: Next
Next: Next: Next: Next: Next: Next
Loop Until True
On Error GoTo 0
End If
End With
Next w1
End If
MsgBox ALLCLEAR & AUTHORS & VERSION & REPBACK, vbInformation, HEADER
End Sub
6关闭编辑窗口
7工具—宏—–宏,选AllInternalPasswords,运行,确定两次,等2分钟,再确定.OK,没有密码了!!
