易语言4.13_易语言与c语言的区别_易语言超级精简版

易语言4.13易语言4.13

以下是本人研究 易语言4.13正式版 的破解纪录, 5个步骤则实现真正的完美破解易语言主程序...

第一次写破解文章, 写得不好别见怪...

----------------------

159544386.key [企业注册版]

159544386 → 0x09827442(十六进制)

09800000

00027442→ 硬件代码计算值

3A7FEF86D9A344BD279538025A6B881ED798010002DEEA0151B9C722075E0618F6B153ACB49B357E402DF46BB4169E78E7CD6760544CD4419373A6AEEA5B2CA46C0CDB3A2CD98E980EF419DBE10EA4F470B097172A44DB547D505DAF6187B8FC153A7FE91BEB33BE7FC71913C0FD26F7F6FE36B24C824FCFA51F2795EF0294CDC0C2F9917B370A5DB5F2D95BC05D328D0BA8D28442C2B451D7AE3E25E0585793F9BA8E4C0460E58F38A49233145220218FEB7371944C5D41184B329739CB70792D6D04823C5AF45FE62DE7A3F6420FFECF6EAD0F8A83D9D21BF6433FABA1732B91CF085F0CDD4F0CA305FED4B717B4D1390B25ADD104578B63D252535BE04E362ADA6820117E8E274E7D93A0605EAD954C3AFFF3C8F4BADE8

----------------------

151435326.key [注册版]

151435326 → 0x0906B83E(十六进制)

09000000

0006B83E→ 硬件代码计算值

7D8FE15E87E6FC5A7E8432678170D818D79801000138B001B7A795107368674E3311BE3351873A403F63902A98DB75F94CA0FF0178C029996E4E1CB45173F6A2766015B730EC1164572D01A56EA846E4EE5917480B0ABFD80D04B2352F155A427520D9C5D500B193F79E032A430825E58E393B5CEE3C67F43B6313B3061B60FE9614BD12083E0FD1CA2653036C53658CE090886455C534A0BD439B5C8362214E9CD409F37915BC0ED51F2A8B3A48B5E2E6D1E12234C58B18E0D66D1CAD8C750A49F666DB682990AC6E2BE768532E535A277178000EBF06C788BE40EDE2E25802558F193E1E83CAC3933C08361A83C2616CE5186E512360AE7C18AD54C99B468609E26FE857CF9AD6434E1E64DA7EDDDEE3E65E3A7CCCE81A

----------------------

194958212.key [注册版]

194958212 → 0x0B9ED384(十六进制)

0B900000

000ED384→ 硬件代码计算值

E07DF3182ABAFF3BC8A9BC320E51F56FD798010000126F00C6CBA216CA3E5F5CC66713D0747A1B1AFAB00E118717BD1CA6D76A5F3E731D0B0000A39D446622A327523EE2CB35DFCE3EB03604432A16730DEDB99BA2A1B49AE270CC8DC14830825D82507B9A13FCC72AD5A13D7087D68CE6AEF78CBC1268ADAB64F45231F42BAA1859DD1D8301B02379D188CF814A1C0C90E68935F172FAECEE671A47B7B98EC8A9174488B2E39878FE3B45F7D7AF26150998534FAE40C847EB8C133F422E96128D079FD3B0F46E6D08DEE909E019CA59AEDA706D036778B2B77BFA58439D5106730AA9C8A83C1335F2EDC8D87475ACA2BCE193DFED29F92ECABC1875E1D4C8E581377F089A61D87000354CC5D299F48B908E0F087AE2A52C3

----------------------

1.[企业注册版]KEY的硬件代码[159544386]计算过程...

004DC1F0 $8B4C24 0C MOV ECX, DWORD PTR SS:[ESP+C]; 硬件代码计算入口

004DC1F4 .55 PUSH EBP

004DC1F5 .8B6C24 14 MOV EBP, DWORD PTR SS:[ESP+14]

004DC1F9 .56 PUSH ESI

004DC1FA .57 PUSH EDI

004DC1FB .8B7C24 14 MOV EDI, DWORD PTR SS:[ESP+14]

004DC1FF .85ED TEST EBP, EBP

004DC201 .7E 28 JLE SHORT e.004DC22B

......省略部分代码

04DC23D .33C5 XOR EAX, EBP

004DC23F .5D POP EBP

004DC240 .C1E0 14 SHL EAX, 14

004DC243 .33C1 XOR EAX, ECX

004DC245 .C3 RETN ; EAX返回硬件代码后5位

通过跳转实现返回需要修改的硬件代码计算值

004DC245 . /E9 86EF0600 JMP 0054B1D0 ; ←破解后

0054B1D0 > \8035 CAB15400>XOR BYTE PTR DS:[54B1CA], 0FF ; 标记是否返回计算硬件代码

0054B1D7 .74 05 JE SHORT 0054B1DE

0054B1D9 .B8 42740200 MOV EAX, 27442 ; 硬件代码后5位

0054B1DE >C3 RETN

//破解硬件代码计算

----------------------

2.因为上面的[159544386.key]早就被易语言公司封掉了,所以必须找到解封ID的计算代码

00425E60 > /3301 XOR EAX, DWORD PTR DS:[ECX]

00425E62 . |83C1 04 ADD ECX, 4

00425E65 . |4A DEC EDX

00425E66 .^\75 F8 JNZ SHORT e.00425E60

00425E68 .8B93 A8070000 MOV EDX, DWORD PTR DS:[EBX+7A8]

00425E6E 35 55B3AD89 XOR EAX, 89ADB350 ; 原计算值

00425E73 .F7D8 NEG EAX

00425E75 .1BC0 SBB EAX, EAX

00425E77 .40 INC EAX

00425E78 .03D0 ADD EDX, EAX

00425E7A .8B01 MOV EAX, DWORD PTR DS:[ECX]

00425E60 > /3301 XOR EAX, DWORD PTR DS:[ECX]

00425E62 . |83C1 04 ADD ECX, 4

00425E65 . |4A DEC EDX

00425E66 .^\75 F8 JNZ SHORT e.00425E60

00425E68 .8B93 A8070000 MOV EDX, DWORD PTR DS:[EBX+7A8]

00425E6E 35 55B3AD89 XOR EAX, 89ADB355 ; 解封硬件代码

00425E73 .F7D8 NEG EAX

00425E75 .1BC0 SBB EAX, EAX

00425E77 .40 INC EAX

00425E78 .03D0 ADD EDX, EAX

00425E7A .8B01 MOV EAX, DWORD PTR DS:[ECX]

0040991B 8B55 D0 MOV EDX, DWORD PTR SS:[EBP-30]

0040991E 81F2 77C62D63 XOR EDX, 632DC677

00409924 8955 D0 MOV DWORD PTR SS:[EBP-30], EDX

00409927 8B85 10FFFFFF MOV EAX, DWORD PTR SS:[EBP-F0]

0040992D 35 50B3AD89 XOR EAX, 89ADB350 ; 原计算值

0040991B 8B55 D0 MOV EDX, DWORD PTR SS:[EBP-30]

0040991E 81F2 77C62D63 XOR EDX, 632DC677

00409924 8955 D0 MOV DWORD PTR SS:[EBP-30], EDX

00409927 8B85 10FFFFFF MOV EAX, DWORD PTR SS:[EBP-F0]

0040992D 35 55B3AD89 XOR EAX, 89ADB355 ; 解封硬件代码

00409932 8945 EC MOV DWORD PTR SS:[EBP-14], EAX

//解封硬件代码计算[1]

----------------------

3.此处是最主要的解封ID计算值,如果不修改的话,是永远不能使用[159544386.key]进行注册的

00594CE0 1113 ; ←破解前

00594CE2 05CC

00594CE0 0000 ; ←破解后

00594CE2 0000

//解封硬件代码计算[2]

----------------------

4.一直以来,很都说易语言主程序没办法完美破解,是因为吴涛在主程序内做了很多暗桩...

如果这个MD5校验值对不上的话,到后面就会出现很多随机的暗桩错误了.

004989CC|.8B4C24 28 MOV ECX, DWORD PTR SS:[ESP+28]

004989D0|.8B5424 24 MOV EDX, DWORD PTR SS:[ESP+24]

004989D4|.51 PUSH ECX ;[*MD5校验取值地址]

004989D5|.8B4C24 24 MOV ECX, DWORD PTR SS:[ESP+24]

004989D9|.52 PUSH EDX

004989DA|.51 PUSH ECX

004989DB|.FFD0 CALL EAX ;dp1.MGetMD5

004989DD|.8D4C24 08 LEA ECX, DWORD PTR SS:[ESP+8]

004989E1|.C74424 18 FFF>MOV DWORD PTR SS:[ESP+18], -1

直接使用跳转检测计算的MD5字符串是否正确并进行修改.

该值也算比较牛的...只要下一个断点就会改变计算值的了,所以在计算的时候要把所有断点都取消.

004989DB . /E9 00280B00 JMP e.0054B1E0

004989E0 |90 NOP

0054B1E0 > \50 PUSH EAX

0054B1E1 .8B4424 0C MOV EAX, DWORD PTR SS:[ESP+C]

0054B1E5 A3 3CB25400 MOV DWORD PTR DS:[54B23C], EAX

0054B1EA .58 POP EAX

0054B1EB .FFD0 CALL EAX

0054B1ED .50 PUSH EAX

0054B1EE A1 3CB25400 MOV EAX, DWORD PTR DS:[54B23C]

0054B1F3 8138 66646266 CMP DWORD PTR DS:[EAX], 66626466 ; 此处[66626466]为修改后主程序的内存MD5前4位

0054B1F9 .75 37 JNZ SHORT e.0054B232

0054B1FB .C700 31393031 MOV DWORD PTR DS:[EAX], 31303931

0054B201 .C740 04 64616>MOV DWORD PTR DS:[EAX+4], 36616164

0054B208 .C740 08 64616>MOV DWORD PTR DS:[EAX+8], 65666164

0054B20F .C740 0C 38346>MOV DWORD PTR DS:[EAX+C], 61663438

0054B216 .C740 10 61326>MOV DWORD PTR DS:[EAX+10], 35633261

0054B21D .C740 14 61656>MOV DWORD PTR DS:[EAX+14], 34646561

0054B224 .C740 18 39373>MOV DWORD PTR DS:[EAX+18], 31323739

0054B22B .C740 1C 64613>MOV DWORD PTR DS:[EAX+1C], 62366164

0054B232 >58 POP EAX

0054B233 .8D4C24 08 LEA ECX, DWORD PTR SS:[ESP+8]

0054B237 .^ E9 A5D7F4FF JMP e.004989E1

1901daa6dafe84faa2c5aed49721da6b [*正确内存校验值]

//内存校验

----------------------

5.最后就是解决易语言主程序的文件自校验值了

00458D95 8B82 48090000 MOV EAX, DWORD PTR DS:[EDX+948]

00458D9B 8D8A 48090000 LEA ECX, DWORD PTR DS:[EDX+948]

00458DA1 FF50 28 CALL DWORD PTR DS:[EAX+28]

00458DA4 3B7C9D D4 CMP EDI, DWORD PTR SS:[EBP+EBX*4-2C] ; *此处EDI值为现时计算文件校验值

在[00458DA4]处直接下硬件断点,此处会断下2次,记录下EDI里的值,再对应修改则完成.

DS:[00588CBC]=0019C9AE

004F984E

0x0188CBC ; ←文件校验地址[1]

//文件校验

DS:[00588CC0]=000347B1

006777B1

0x0188CC0 ; ←文件校验地址[2]

//文件校验

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-21835-1.html