拆解cytom!c's 的keyFile保护

小程序：扫一扫查出行
【扫一扫了解最新限行尾号】
复制小程序

系统： Windows xp

程序： cytom!c's

程序下载地址：http://pan.baidu.com/s/1nulAYBv

要求：伪造KeyFile

使用工具：IDA & OD & Hex Workshop

可在看雪论坛中查找关于此程序的破文：http://bbs.pediy.com/showthread.php?t=30229

IDA载入程序，找出提示破解成功的字串“Valid Key file found!”并定位关键代码：

. BA 4C674200 mov edx, 0042674C ; ASCII "ctm_cm02.key"
. 8D85 A8FEFEFF lea eax, dword ptr [ebp+FFFEFEA8]
0042657D . E8 3FD8FDFF call 00403DC1
. BA mov edx,
. 8D85 A8FEFEFF lea eax, dword ptr [ebp+FFFEFEA8]
0042658D . E8 1EDCFDFF call 004041B0
. E8 4DC1FDFF call 004026E4
. 85C0 test eax, eax
. 0F85 jnz
0042659F . 8D85 A8FEFEFF lea eax, dword ptr [ebp+FFFEFEA8]
004265A5 . E8 5AD9FDFF call 00403F04 ; CreateFile，并获取长度
004265AA . E8 F9C0FDFF call 004026A8
004265AF . FC mov dword ptr [ebp-], eax
004265B2 . 837D FC cmp dword ptr [ebp-], ; 长度为0？
004265B6 . jnz short 004265CD
004265B8 . BA mov edx, ; ASCII "Key file is empty!"
004265BD . 8B83 B0010000 mov eax, dword ptr [ebx+1B0]
004265C3 . E8 CCB6FEFF call 00411C94
004265C8 . E9 jmp 004266F5
004265CD > 817D FC >cmp dword ptr [ebp-], ; UNICODE "#envTSLOGsss1964=1032992"
004265D4 . 7E jle short 004265DD
004265D6 . C745 FC >mov dword ptr [ebp-], ; UNICODE "#envTSLOGsss1964=1032992"
004265DD > 6A push
004265DF . 8D95 FCFFFEFF lea edx, dword ptr [ebp+FFFEFFFC]
004265E5 . 8B4D FC mov ecx, dword ptr [ebp-]
004265E8 . 8D85 A8FEFEFF lea eax, dword ptr [ebp+FFFEFEA8]
004265EE . E8 71D8FDFF call 00403E64 ; 读取文件内容
004265F3 . E8 B0C0FDFF call 004026A8
004265F8 . push ebx
004265F9 . push edi
004265FA . push esi
004265FB . 8D75 FC lea esi, dword ptr [ebp-]
004265FE . 8B0E mov ecx, dword ptr [esi]
. 8DB5 FCFFFEFF lea esi, dword ptr [ebp+FFFEFFFC]
. 8DBD FBFFFEFF lea edi, dword ptr [ebp+FFFEFFFB]
0042660C . 31C0 xor eax, eax
0042660E . 83CA FF or edx, FFFFFFFF
. 31DB xor ebx, ebx
. inc eax ; eax = 1
. F7D2 not edx
> 8A1C16 mov bl, byte ptr [esi+edx] ; 迭代字串
. 84DB test bl, bl ; 字符值为0x0？
0042661B . je short ; 结尾字节设置为0x0才能跳转正确流程
0042661D . E8 call ; 将文件内容写入一段内存
. push edx
. F7E3 mul ebx ; eax * 字符值
. 5A pop edx
. 326D5463 xor eax, 63546D32 ; eax 再进行异或
0042662B . FEC2 inc dl ; 循环变量自增
0042662D . 39CA cmp edx, ecx ; 迭代完毕？
0042662F . je short
. 80FA FF cmp dl, 0FF ; 迭代了255次？
. 3D je short
.^ EB DE jmp short
/$ push edi
|. 8DBD F4FFFEFF lea edi, dword ptr [ebp+FFFEFFF4]
0042663F |. 8B3F mov edi, dword ptr [edi]
|. 881C17 mov byte ptr [edi+edx], bl
|. 5F pop edi
\. C3 retn
> E8 EDFFFFFF call
0042664B . inc edx ; 0x0结尾后还要加上4个字节才能跳转正确流程
0042664C . 83C2 add edx,
0042664F . 39D1 cmp ecx, edx
. jnz short
. 83EA sub edx, ; 还原循环变量
. 85C0 test eax, eax
. jbe short 0042665C
0042665A . D1E8 shr eax,
0042665C > 3B0416 cmp eax, dword ptr [esi+edx] ; 与最后的4个字节进行对比
0042665F . jnz short 0042666A
. B8 mov eax,
. mov dword ptr [edi], eax
. EB jmp short 0042667A
0042666A > B8 mov eax,
0042666F . mov dword ptr [edi], eax
. EB jmp short 0042667A
> B8 mov eax,
. mov dword ptr [edi], eax
0042667A > 5E pop esi
0042667B . 5F pop edi
0042667C . 5B pop ebx
0042667D . 8A85 FBFFFEFF mov al, byte ptr [ebp+FFFEFFFB]
. 2C sub al, ; Switch (cases 0..2)
. jb short 0042668F
. 4A je short 004266D3
. FEC8 dec al
0042668B . je short 004266E5
0042668D . EB jmp short 004266F5
0042668F > BA mov edx, ; ASCII "Valid Key file found!"; Case 0 of switch 00426683
. 8B83 B0010000 mov eax, dword ptr [ebx+1B0]
0042669A . E8 F5B5FEFF call 00411C94
0042669F . BA A0674200 mov edx, 004267A0 ; ASCII "Registered to: "
004266A4 . 8D85 A4FEFEFF lea eax, dword ptr [ebp+FFFEFEA4]
004266AA . E8 05CCFDFF call 004032B4
004266AF . 8D85 A4FEFEFF lea eax, dword ptr [ebp+FFFEFEA4]
004266B5 . 8B95 F4FFFEFF mov edx, dword ptr [ebp+FFFEFFF4]
004266BB . E8 DCCCFDFF call 0040339C
004266C0 . 8B95 A4FEFEFF mov edx, dword ptr [ebp+FFFEFEA4]
004266C6 . 8B83 C0010000 mov eax, dword ptr [ebx+1C0]
004266CC . E8 C3B5FEFF call 00411C94
004266D1 . EB jmp short 004266F5
004266D3 > BA B8674200 mov edx, 004267B8 ; ASCII "Key file contains wrong serial!"; Case 1 of switch 00426683
004266D8 . 8B83 B0010000 mov eax, dword ptr [ebx+1B0]
004266DE . E8 B1B5FEFF call 00411C94
004266E3 . EB jmp short 004266F5
004266E5 > BA E0674200 mov edx, 004267E0 ; ASCII "Key file is not valid!"; Case 2 of switch 00426683
004266EA . 8B83 B0010000 mov eax, dword ptr [ebx+1B0]
004266F0 . E8 9FB5FEFF call 00411C94
004266F5 > 8D85 A8FEFEFF lea eax, dword ptr [ebp+FFFEFEA8] ; Default case of switch 00426683