日记分类:加密解密

破解NTFS文件系统下被EFS加密的文件

       前几日帮朋友重做了系统,当时没在意啊,今天才发现,其他盘里边还有NTFS加密过的文件,件夹的名称还是绿色的,就是无法打开他的内容,如WORD文件,EXCEL文件,图片也打不开了,MP3也打不开,所有的文件都打不开,当我试图打开时,出现提示”word文档无法打开:用户没有访问权” ,无奈了。。。找了一个恢复工具,Advanced EFS Data Recovery,无奈原来的系统盘已经格式化了,还原不了了,在网上找了一些办法,尝试了LINUX系统,GHOST,貌似都不行,悲哀之际,便有了以下的方法。。。
       如果某个用户把自己的登录帐户删除,那么其他用户将无法访问其EFS加密文件。更可恶的是,一旦公司里的某个用户心怀怨气,恶意加密了本属于别的用户的重要文件,将会导致严重问题。一般情况下,这些EFS加密文件已经被判了死刑,但是实际上只要满足以下条件的话,我们还是可以在末日来临之前打开逃生的天窗:
(1) 必须知道该被删帐户的密码。  Continue

教你学会破解,关于破解中的名词解释

1. 断点:所谓断点就是程序被中断的地方,这个词对于解密者来说是再熟悉不过了。那么什么又是中断呢?中断就是由于有特殊事件(中断事件)发生,计算机暂停当前的任务(即程序),转而去执行另外的任务(中断服务程序),然后再返回原先的任务继续执行。打个比方:你正在上班,突然有同学打电话告诉你他从外地坐火车过来,要你去火车站接他。然后你就向老板临时请假,赶往火车站去接同学,接着将他安顿好,随后你又返回公司继续上班,这就是一个中断过程。我们解密的过程就是等到程序去获取我们输入的注册码并准备和正确的注册码相比较的时候将它中断下来,然后我们通过分析程序,找到正确的注册码。所以我们需要为被解密的程序设置断点,在适当的时候切入程序内部,追踪到程序的注册码,从而达到crack的目的。 Continue

关于VMP1.7壳的脚本2则

貌似现在80%的商业软件都用VMP了,据说很NB,不过越NB,喜欢破解的人也就越多,下边是本人收集到的2种常用脚本,有需要的可以尝试下.直接上脚本.

—————————————————————————————————————–

第一个:

//fuck vmp iat by nooby
//run the script at ep
//vmp code base = va of .vmp0
//vmp code size = size of .vmp0
var vmpbase
var vmpsize
var magic
var isfirst
var first
var decode
var dllname
var funcname
var stackdep
var sFile
mov sFile, “iat_log.txt”
mov isfirst, 0
mov magic, 0134AE5E Continue

如何加双层壳、多层壳?

一直有人问怎么样加多层,其实很简单,不过多层再有些人眼里看来就是浪费资源,不过也确实能增加软件的安全性,刚才又有问这个问题的,就简单写个教程,本人原来以为自己是个菜鸟,现在才发现,自己已经不是菜鸟了,都快成白痴型了,由于接二连三的打击,堕落了好久,已经对键盘生疏了不少,算了,不多说,直接来说明怎么样加多层壳。高手绕道,新手止步!

先说一下什么是加壳,什么是脱壳,什么是资源释放:加壳:其实是利用特殊的算法,对EXE、DLL文件里的资源进行压缩。类似WINZIP 的效果,只不过这个压缩之后的文件,可以独立运行,解压过程完全隐蔽,都在内存中完成。解压原理,是加壳工具在文件头里加了一段指令,告诉CPU,怎么才能解压自己。现在的CPU都很快,所以这个解压过程你看不出什么东东。软件一下子就打开了,只有你机器配置非常差,才会感觉到不加壳和加壳后的软件运行速度的差别。你的机器配置很差么?喔,恭喜你。你将可能无法忍受等会你照我说的方法加壳后的软件的运行速度~~:) Continue

手脱加双层壳的病毒(PECompact 2.x壳+未知壳)

文件名称:手脱加双层壳的病毒(PECompact 2.x壳+未知壳)
目标程序:病毒样本“Trojan/Small.dol”程序
操作环境:Windows XP-SP3
使用工具:Ollydbg 1.10版

前言:
简单介绍下病毒样本“Trojan/Small.dol”程序所加的壳吧,样本外层加了一个“PECompact 2.x”壳,内层加了一个混淆入口点的壳,但不知道是什么名字,不过这个壳貌似很常见。今天拿这个壳做例子希望对初级接触脱壳的朋友有帮助,也希望你们会喜欢。

分析:
脱壳前,使用PEID V0.93查壳,显示壳名为:“PECompact 2.x -> Jeremy Collake”。看了下这个程序有2个节段。EP区段名分别为:“.CODE/.rsrc”,显示连接程序版本为:2.0 。
Continue

UltraISO破解

提前申明下,本文转载,看了下,有值得借鉴的地方,留作他用。。。

UltraISO后期的每个版本基本上都差不多,官网上下载的据传是什么加了白名单,红名单的版本,但即使是相同版本的MD5值都不同,官网每天都更新。所以我们平时见得最多的就是注册机,注册码,什么李明啊,王健啊等等,现在最新版的是V9.3.6.2750,好象以前的注册码不能用了,除非你下到的是没名单的裸体版,手上没有,没办法,只好自己动手了。 Continue

Pohernah 手动脱壳

今天碰到Pohernah ,那就手动脱一下吧,有失误之处还请见谅

工具:od && import REC
平台:xp

前提理论基础:
对于脱壳有很多理论可以依照,同样对于本加壳程序也是如此
对于加壳软件,保证外壳的各个寄存器与源程序的环境相同是必要,esp、ebp等。初始化保存各个寄存器的值,然后执行完毕恢复之。

常用处理指令为pushad/popad、pushfd/popfd 归根结底就是堆栈平衡原理。

 

代码:
pushad ;pushad 相当于push eax,ecx,edx,ebx,esp,ebp,esi,edi
……       ;外壳代码部分
popad   ;相当于pop edi,esi,ebp,esp,ebx,edx,ecx,eax先进后出嘛
jmp oep;准备进入入口处
oep:……;程序源代码

好了,let’s go

第一步,OD 加载
 

代码:
00469000 >  60              pushad ;停在这
00469001    E8 00000000     call    00469006
00469006    5D              pop     ebp
00469007    81ED F1264000   sub     ebp, 004026F1
0046900D    8BBD 18284000   mov     edi, dword ptr ss:[ebp+402818]
00469013    8B8D 20284000   mov     ecx, dword ptr ss:[ebp+402820]
00469019    B8 38284000     mov     eax, 00402838
0046901E    01E8            add     eax, ebp
00469020    8030 05         xor     byte ptr ds:[eax], 5
00469023    83F9 00         cmp     ecx, 0
00469026    74 71           je      short 00469099
 

F8单步一下到00469001,观察右侧的寄存器,注意ESP的值为0012FFA4

右键数据串口中跟随,查看数据窗口

0012FFA4  00 00 00 00 00 00 00 00 F0 FF 12 00 C4 FF 12 00  ……..?.?.
0012FFB4  00 E0 FD 7F EC 85 95 7C B0 FF 12 00 00 00 00 00  .帻靺晐?…..
0012FFC4  3B F2 82 7C 00 00 00 00 00 00 00 00 00 E0 FD 7F  ;騻|………帻

然后在数据窗口的前四个字节,断点|硬件访问|DWORD,然后F9执行程序,程序断下来了,

 

代码:
004690A4  - FFE0            jmp     eax                             
004690A6    56              push    esi
004690A7    57              push    edi
004690A8    4F              dec     edi
004690A9    F7D7            not     edi
004690AB    21FE            and     esi, edi
004690AD    89F0            mov     eax, esi
 

F8单步,看到如下
 

代码:
004271B0      55            db      55                               ;  CHAR ’U’
004271B1      8B            db      8B
004271B2      EC            db      EC
004271B3      6A            db      6A                               ;  CHAR ’j’
004271B4      FF            db      FF
004271B5      68            db      68                               ;  CHAR ’h’
004271B6      60            db      60                               ;  CHAR ’`’
004271B7      0E            db      0E
004271B8      45            db      45                               ;  CHAR ’E’
004271B9      00            db      00
004271BA  &nbs

p;   68 
           db      68                               ;  CHAR ’h’
 

需要整理一下
ctrl A 强制整理,代码如下

 

代码:
004271B0   .  55            push    ebp
004271B1   .  8BEC          mov     ebp, esp
004271B3   .  6A FF         push    -1
004271B5   .  68 600E4500   push    00450E60
004271BA   .  68 C8924200   push    004292C8                         ;  SE 处理程序安装
004271BF   .  64:A1 0000000>mov     eax, dword ptr fs:[0]
004271C5   .  50            push    eax
004271C6   .  64:8925 00000>mov     dword ptr fs:[0], esp
004271CD   .  83C4 A8       add     esp, -58
004271D0   .  53            push    ebx
004271D1   .  56            push    esi
 

可以发现,其实我们已经进入到源程序中了,yes!!!

接着当然很顺利了,dump出来 dump.exe

这个时候就用到 import REC

oep 中填入271B0 然后IAT aturosearch |Get Import |Show Invalid 

然后fix dump

ok ,dump_.exe

然后这个就是脱的文件了,运行一下,ok
 

Aspack简易分析

下午回来没事做,随便找了一个Delphi的加壳,用的ASPACK是Regkiller工具包里面的那个来分析的。不多说了,具体如下:

  
  0041B001 >  60              PUSHAD                                   ; EP
  0041B002    E8 03000000     CALL 0041B00A
  0041B007    90              NOP                                      ; 花指令 nop
  0041B008    EB 04           JMP SHORT 0041B00E
  0041B00A    5D              POP EBP
  0041B00B    45              INC EBP
  0041B00C    55              PUSH EBP
  0041B00D    C3              RETN
  0041B00E    E8 01000000     CALL 0041B014
  0041B013    90              NOP                                      ; 花指令 nop
  0041B014    5D              POP EBP                                  ; 0041b013出栈到EBP
  0041B015    BB EDFFFFFF     MOV EBX,-13                              ; EBX=-13
  0041B01A    03DD            ADD EBX,EBP                              ; EBX=EBP+EBX=0041B000
  0041B01C    81EB 00B00100   SUB EBX,1B000                            ; EBX=EBX-1B000=00400000 获取基址
  0041B022    83BD 7D040000 0>CMP DWORD PTR SS:[EBP+47D],0             ; 比较EBP+47D处数据是否为0
  0041B029    899D 7D040000   MOV DWORD PTR SS:[EBP+47D],EBX           ; 把基址放到EBP+47D处
  0041B02F    0F85 C0030000   JNZ 0041B3F5                             ; EBP+47D不为零的话就去OEP!
  0041B035    8D85 89040000   LEA EAX,DWORD PTR SS:[EBP+489]           ; 获取kernel32.dll 放到eax
  0041B03B    50              PUSH EAX                                 ; kernel32.dll压栈
  0041B03C    FF95 090F0000   CALL DWORD PTR SS:[EBP+F09]              ; 调用GetModuleHandleA获取kernel32的基址
  0041B042    8985 81040000   MOV DWORD PTR SS:[EBP+481],EAX           ; kernel32的基址到EBP+481
  0041B048    8BF0            MOV ESI,EAX                              ; ESI=EAX
  0041B04A    8D7D 51         LEA EDI,DWORD PTR SS:[EBP+51]            ; 获取VirtualAlloc 放到EDI
  0041B04D    57              PUSH EDI                                 ; EDI压栈
  0041B04E    56              PUSH ESI                                 ; kernel32的基址压栈
  0041B04F    FF95 050F0000   CALL DWORD PTR SS:[EBP+F05]              ; 调用GetProcAddress获取EDI的地址
  0041B055    AB              STOSD                                    ; 把获取到的地址放到原来字符串所在的位置
  0041B056    B0 00           MOV AL,0
  0041B058    AE              SCASB
  0041B059  ^ 75 FD           JNZ SHORT 0041B058                       ; 上面几句比较难读,作用]]
>

分享Advanced RAR Password Recovery1.53的注册码一枚

Advanced RAR Password Recovery
一个恢复遗失或者忘记了的RAR/WinRAR文件的密码的程序。它能支持可定制的暴力破解和字典破解,并提供了多语言介面。可以在AV纪录的文件中工作;恢复一些特别的文件的密码;当完成恢复后可以自动储存,并且速度也挺快。可以解出RAR文件密码,当然密码越长,所费的时间也就越长。
Advanced RAR Password Recovery1.53的注册码
ARPR-83296730531875-CBBVYBXFEXDEVPMB

破解excel文件密码

一朋友的excel文件密码忘记了,让我解决,没办法,找了一堆破解软件,要么需要购买,要么是破解打开密码的,非保护密码。好不容易找到解决方案!

当然,还有一个很好的工具,名字忘记了,是一个暴力破解的,作用挺好,而且是破解过的,

点击下载

excel保護密碼破解(絕對經典) 如果你的Excel文件設置了保護密碼而遺忘了,那麼請依照下面的步驟來操作,也許會有奇跡出現.不需要多麼高難度的操作和專業的軟件支持.簡單.方便.費時一般最多兩分鐘. (建議:操作前把原文件COPY一份) 方法:

1打开文件
2工具—宏—-录制新宏—输入名字如:aa
3停止录制(这样得到一个空宏)
4工具—宏—-宏,选aa,点编辑按钮
5删除窗口中的所有字符(只有几个),替换为下面的内容:

Public Sub AllInternalPasswords()
‘ Breaks worksheet and workbook structure passwords. Bob McCormick
‘ probably originator of base code algorithm modified for coverage
‘ of workbook structure / windows passwords and for multiple passwords

‘ Norman Harker and JE McGimpsey 27-Dec-2002 (Version 1.1)
‘ Modified 2003-Apr-04 by JEM: All msgs to constants, and
‘ eliminate one Exit Sub (Version 1.1.1)
‘ Reveals hashed passwords NOT original passwords
Const DBLSPACE As String = vbNewLine & vbNewLine
Const AUTHORS As String = DBLSPACE & vbNewLine & _
"Adapted from Bob McCormick base code by" & _
"Norman Harker and JE McGimpsey"
Const HEADER As String = "AllInternalPasswords User Message"
Const VERSION As String = DBLSPACE & "Version 1.1.1 2003-Apr-04"
Const REPBACK As String = DBLSPACE & "Please report failure " & _
"to the microsoft.public.excel.programming newsgroup."
Const ALLCLEAR As String = DBLSPACE & "The workbook should " & _
"now be free of all password protection, so make sure you:" & _
DBLSPACE & "SAVE IT NOW!" & DBLSPACE & "and also" & _
DBLSPACE & "BACKUP!, BACKUP!!, BACKUP!!!" & _
DBLSPACE & "Also, remember that the password was " & _
"put there for a reason. Don’t stuff up crucial formulas " & _
"or data." & DBLSPACE & "Access and use of some data " & _
"may be an offense. If in doubt, don’t."
Const MSGNOPWORDS1 As String = "There were no passwords on " & _
"sheets, or workbook structure or windows." & AUTHORS & VERSION
Const MSGNOPWORDS2 As String = "There was no protection to " & _
"workbook structure or windows." & DBLSPACE & _
"Proceeding to unprotect sheets." & AUTHORS & VERSION
Const MSGTAKETIME As String = "After pressing OK button this " & _
"will take some time." & DBLSPACE & "Amount of time " & _
"depends on how many different passwords, the " & _
"passwords, and your computer’s specification." & DBLSPACE & _
"Just be patient! Make me a coffee!" & AUTHORS & VERSION
Const MSGPWORDFOUND1 As String = "You had a Worksheet " & _
"Structure or Windows Password set." & DBLSPACE & _
"The password found was: " & DBLSPACE & "$$" & DBLSPACE & _
"Note it down for potential future use in other workbooks by " & _
"the same person who set this password." & DBLSPACE & _
"Now to check and clear other passwords." & AUTHORS & VERSION
Const MSGPWORDFOUND2 As String = "You had a Worksheet " & _
"password set." & DBLSPACE & "The password found was: " & _
DBLSPACE & "$$" & DBLSPACE & "Note it down for potential " & _
"future use in other workbooks by same person who " & _
"set this password." & DBLSPACE & "Now to check and clear " & _
"other passwords." & AUTHORS & VERSION
Const MSGONLYONE As String = "Only structure / windows " & _
"protected with the password that was just found." & _
ALLCLEAR & AUTHORS & VERSION & REPBACK
Dim w1 As Worksheet, w2 As Worksheet
Dim i As Integer, j As Integer, k As Integer, l As Integer
Dim m As Integer, n As Integer, i1 As Integer, i2 As Integer
Dim i3 As Integer, i4 As Integer, i5 As Integer, i6 As Integer
Dim PWord1 As String
Dim ShTag As Boolean, WinTag As Boolean
Application.ScreenUpdating = False
With ActiveWorkbook
WinTag = .ProtectStructure Or .ProtectWindows
End With
ShTag = False
For Each w1 In Worksheets
ShTag = ShTag Or w1.ProtectContents
Next w1
If Not ShTag And Not WinTag Then
MsgBox MSGNOPWORDS1, vbInformation, HEADER
Exit Sub
End If
MsgBox MSGTAKETIME, vbInformation, HEADER
If Not WinTag Then
MsgBox MSGNOPWORDS2, vbInformation, HEADER
Else
On Error Resume Next
Do ‘dummy do loop
For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126
With ActiveWorkbook
.Unprotect Chr(i) & Chr(j) & Chr(k) & _
Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & _
Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
If .ProtectStructure = False And _
.ProtectWindows = False Then
PWord1 = Chr(i) & Chr(j) & Chr(k) & Chr(l) & _
Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
MsgBox Application.Substitute(MSGPWORDFOUND1, _
"$$", PWord1), vbInformation, HEADER
Exit Do ‘Bypass all for…nexts
End If
End With
Next: Next: Next: Next: Next: Next
Next: Next: Next: Next: Next: Next
Loop Until True
On Error GoTo 0
End If
If WinTag And Not ShTag Then
MsgBox MSGONLYONE, vbInformation, HEADER
Exit Sub
End If
On Error Resume Next
For Each w1 In Worksheets
‘Attempt clearance with PWord1
w1.Unprotect PWord1
Next w1
On Error GoTo 0
ShTag = False
For Each w1 In Worksheets
‘Checks for all clear ShTag triggered to 1 if not.
ShTag = ShTag Or w1.ProtectContents
Next w1
If ShTag Then
For Each w1 In Worksheets
With w1
If .ProtectContents Then
On Error Resume Next
Do ‘Dummy do loop
For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126
.Unprotect Chr(i) & Chr(j) & Chr(k) & _
Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
If Not .ProtectContents Then
PWord1 = Chr(i) & Chr(j) & Chr(k) & Chr(l) & _
Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
MsgBox Application.Substitute(MSGPWORDFOUND2, _
"$$", PWo

rd1), vbInformation, HEADER<
br />‘leverage finding Pword by trying on other sheets
For Each w2 In Worksheets
w2.Unprotect PWord1
Next w2
Exit Do ‘Bypass all for…nexts
End If
Next: Next: Next: Next: Next: Next
Next: Next: Next: Next: Next: Next
Loop Until True
On Error GoTo 0
End If
End With
Next w1
End If
MsgBox ALLCLEAR & AUTHORS & VERSION & REPBACK, vbInformation, HEADER
End Sub

6关闭编辑窗口
7工具—宏—–宏,选AllInternalPasswords,运行,确定两次,等2分钟,再确定.OK,没有密码了!!