<![CDATA[ツH.Y.Fづ]]> http://200708336.qzone.qq.com Sat, 28 Nov 2009 13:26:33 GMT Qzone zh-cn Copyright (C), 2005-2008, Tencent Tech. Co., Ltd. Mon, 10 Mar 2008 02:50:56 GMT <![CDATA[Armadillo加壳版本号和保护方式的简单判断方法]]> http://200708336.qzone.qq.com/blog/1205117456 一、Armadillo V3.X 的判断可以使用Armadillo Exact Version Location Tutorial

ݣ

看雪论坛精华6
标 题:[转载]快速判断Armadillo壳版本
发信人:yesky1
时 间:2004-08-24,10:32
详细信息:
偶尔看到的，试了一下，感觉比较好用
大概是这样：
设断点 CreateThread 或者SetProcessWorkingSetSize
停下来后，Ctrl+F9返回，
然后右键 Search for -- All Referenced text strings
到text reference窗口，右键 Search for text
选中Entire scope搜索字符串: armVersion
来到这里
Text strings referenced in 01030000..01077FFF, item 57
Address=0103481C
Disassembly=PUSH 106300C
Text string=ASCII " <armVersion xsi:type="xsd:string">%s</armVersion>"
貌似Armadillo的xml格式配置文件?
双击该行来到disassemble窗口，向上拖动一行
看到
01034817 68 44300601 PUSH 1063044 ; ASCII "3.76"
0103481C 68 0C300601 PUSH 106300C ; ASCII " <armVersion xsi:type="xsd:string">%s</armVersion>"
啊哈，这正是Armadillo的版本号，据说此法从Armadillo3.20c到最新版的Armadillo都支持。

二、Armadillo V4.X 目前还没有发现判断确切版本的方法
不过Armadillo自从V4.0新加了个Anti OllyDBG手段：OutputDebugStringA

ݣ

OllyDbg在处理调式包含格式串的消息时存在问题，被跟踪的应用程序可以使OllyDbg崩溃，或可能以进程权限执行任意指令。OutputDebugString函数可发送字符串到调试器上，然后OllyDbg会在底端显示相关状态消息，但是如果包含格式串消息，就可能使OllyDbg崩溃。
Armadillo以前的版本没有此种Anti，自V4.0始才有。

Armadillo Find Protected 目前可以识别出某些版本号，其特征码数据库还在完善中。
三、其实Armadillo版本判断并不重要，重要的是搞清楚其保护方式
1、Aramdillo单进程的都是标准壳

2、双进程的有标准壳更多是CopyMem-II。需要跟踪调试才能知道，如何跟踪？看N多Armadillo脱壳教程再跟随练习就明白了

3、CopyMem-II需要父进程解码子进程

4、Nanomites肯定是双进程，Debugger-Blocker or CopyMem-II
Nanomites需要配合SDK才能使用。被保护程序的子进程中某些跳转被改成Int3，执行到此会产生异常。父进程接管异常后返回子进程应该如何跳转的结果，这样就使得调试和脱壳的难度大大增加了。

5、Code Splicing和Import Table Elimination需要你去看。ArmInline修复这些很方便，虽然有些bug

6、研究一下Aramdillo's ARMHELP.chm、UserGuide.chm、API.chm，会大有裨益的
四、强烈推荐：Armadillo Find Protected
vel的Armadillo Find Protected可以识别出Armadillo的保护方式，vel将会成为另位Armadillo杀手。


]]> http://200708336.qzone.qq.com/blog/1205117456#comment 8389120 Mon, 10 Mar 2008 02:50:56 GMT http://200708336.qzone.qq.com/blog/1205117456 <![CDATA[对付易语言程序的反调试方法]]> http://200708336.qzone.qq.com/blog/1204716942 对付易语言程序的反调试
易语言会关闭调试器并退出，可以修改一下运行库和主程序强制跳过检测进程。
运行库修改处：
查找特征串：

ݣ

83 7D F4 00 0F 84 0C 05 00 00 8B 5D F0 89 5D E4 EB 01

找到这里，看起来乱七八糟：

ݣ

012F4BE6 /72 01 jb short 012F4BE9
012F4BE8 |7B 8B jpo short 012F4B75
012F4BEA 45 inc ebp
012F4BEB D889 45F4EB01 fmul dword ptr [ecx+1EBF445]
012F4BF1 8883 7DF4000F mov byte ptr [ebx+F00F47D], al
012F4BF7 840C05 00008B5D test byte ptr [eax+5D8B0000], cl
012F4BFE F0:895D E4 lock mov dword ptr [ebp-1C], ebx ; 不允许锁定前缀
012F4C02 EB 01 jmp short 012F4C05
012F4C04 BD 8B5DE4C7 mov ebp, C7E45D8B
012F4C09 0300 add eax, dword ptr [eax]
012F4C0B 0000 add byte ptr [eax], al

ݣ

把几个无用的花跳转nop掉，就看清楚了：
012F4BE6 90 nop
012F4BE7 90 nop
012F4BE8 90 nop
012F4BE9 8B45 D8 mov eax, dword ptr [ebp-28]
012F4BEC 8945 F4 mov dword ptr [ebp-C], eax
012F4BEF 90 nop
012F4BF0 90 nop
012F4BF1 90 nop
012F4BF2 837D F4 00 cmp dword ptr [ebp-C], 0
012F4BF6 0F84 0C050000 je 012F5108
012F4BFC 8B5D F0 mov ebx, dword ptr [ebp-10]
012F4BFF 895D E4 mov dword ptr [ebp-1C], ebx
012F4C02 EB 01 jmp short 012F4C05

然后修改：

ݣ

012F4BE6 90 nop
012F4BE7 90 nop
012F4BE8 90 nop
012F4BE9 8B45 D8 mov eax, dword ptr [ebp-28]
012F4BEC 8945 F4 mov dword ptr [ebp-C], eax
012F4BEF 90 nop
012F4BF0 90 nop
012F4BF1 90 nop
012F4BF2 837D F4 00 cmp dword ptr [ebp-C], 0
012F4BF6 E9 0D050000 jmp 012F5108
012F4BFB 90 nop
012F4BFC 8B5D F0 mov ebx, dword ptr [ebp-10]
012F4BFF 895D E4 mov dword ptr [ebp-1C], ebx
012F4C02 EB 01 jmp short 012F4C05

主程序修改处：
查找特征串：

ݣ

83 7D F4 00 0F 84 FC 04 00 00 8B 5D F0 89 5D E4 EB 01

找到这里：
004F6EC5 - 0F83 7DF4000F jnb 0F506348
004F6ECB 84FC test ah, bh
004F6ECD 04 00 add al, 0
004F6ECF 008B 5DF0895D add byte ptr [ebx+5D89F05D], cl
004F6ED5 E4 EB in al, 0EB
004F6ED7 01B9 8B5DE4C7 add dword ptr [ecx+C7E45D8B], edi
004F6EDD 0300 add eax, dword ptr [eax]
004F6EDF 0000 add byte ptr [eax], al
004F6EE1 008B 5DF083C3 add byte ptr [ebx+C383F05D], cl
004F6EE7 04 89 add al, 89[/code]
把几个无用的花跳转nop掉，就看清楚了：

ݣ

004F6EC5 90 nop
004F6EC6 837D F4 00 cmp dword ptr [ebp-C], 0
004F6ECA 0F84 FC040000 je 004F73CC
004F6ED0 8B5D F0 mov ebx, dword ptr [ebp-10]
004F6ED3 895D E4 mov dword ptr [ebp-1C], ebx
004F6ED6 EB 01 jmp short 004F6ED9

然后修改：

ݣ

004F6EC5 90 nop
004F6EC6 837D F4 00 cmp dword ptr [ebp-C], 0
004F6ECA E9 FD040000 jmp 004F73CC
004F6ECF 90 nop
004F6ED0 8B5D F0 mov ebx, dword ptr [ebp-10]
004F6ED3 895D E4 mov dword ptr [ebp-1C], ebx
004F6ED6 EB 01 jmp short 004F6ED9
004F6ED8 B9 8B5DE4C7 mov ecx, C7E45D8B

修改后od可能会占用cpu较多，有点卡。

如果版本不同可能特征串不同，可以用下面方法找到：
下断点：OpenProcess
断下后，alt + F9 返回，然后 F8 单步向下走，一直走到一个向上的远程的跳转，跳上去，如果是call就进入，没有call的话，能直接看见，有call的走几下就看见了。把跳转强制跳走。 ]]> http://200708336.qzone.qq.com/blog/1204716942#comment 8389120 Wed, 05 Mar 2008 11:35:42 GMT http://200708336.qzone.qq.com/blog/1204716942 <![CDATA[ArmaDetach.v1.31_RES_tool如何使用？]]> http://200708336.qzone.qq.com/blog/1203435078

ݣ

Armadillo Process Detach v1.3 Final
Copyright (c) 2007 AvAtAr//TEAM RESURRECTiON
Special thanks to SunBeam {RES} & Ufo-Pu55y/SnD for their help, deroko/ARTeam for his tutorial about'anti-anti dump and non intrusive tracers'and finally to diablo2oo2 for his 'dup search and replace engine source code'.Great work guys, thanks!
Greetings fly out to:TEAM RESURRECTiON, REVENGE Crew, TSRh, SnD,ICU,ARTeam, AoRE, CracksLatinoS, AppzNet staff and the whole AppzNet community :-)

ArmaDetach.v1.31_RES_tool是RES出的分离Armadillo双进程保护为单进程的工具
运行ArmaDetach.exe，以Armadillo V5.00主程序为例，选择CopyMem-II
把Armadillo.exe拖入ArmaDetach的运行界面，等待

ݣ

Filename: Armadillo.exe
Parent process iD: [00000F88]
Processing...
[PROTECTiON SYSTEM]
Professional Edition
[PROTECTiON OPTiONS]
Debug-Blocker protection detected
CopyMem-II protection detected
Memory-Patching Protections enabled
Import Table Elimination enabled
Nanomites Processing enabled
[CHiLD iNFO]
Child process iD: [00000BA4]
Entry point: [0044709C]
Original bytes: [E88D5700]
Detached successfully :)

出现此提示后运行OllyDBG，Attach进程中的Armadillo.exe
Shift+F9，F12

ݣ

0044709C EB FE jmp short 0044709C
//F12后停在死循环处
0044709E 90 nop
0044709F 90 nop
004470A0 00E9 add cl,ch
004470A2 16 push ss
004470A3 FE ???
004470A4 FFFF ???
004470A6 6A 0C push 0C
004470A8 68 E8874700 push 4787E8
004470AD E8 2AF2FFFF call 004462DC

恢复死循环处代码为E88D5700即可以单进程方式调试Armadillo双进程保护方式 ]]> http://200708336.qzone.qq.com/blog/1203435078#comment 512 Tue, 19 Feb 2008 15:31:18 GMT http://200708336.qzone.qq.com/blog/1203435078 <![CDATA[为破解易语言写的一个脚本]]> http://200708336.qzone.qq.com/blog/1202954037

ݣ

VAR Num
mov Num,10
gpa "GetProcessHeap","kernel32.dll"
cmp $RESULT,0
jz err
bp $RESULT
runit:
run
cmp [eax],"WTNE / MADE BY E COMPILER - WUTAO "
jz ok
dec Num
cmp Num,0
jz err
jmp runit
ok:
bc $RESULT
rtu
find eip,#FFE0#
cmp $RESULT,0
jz err
bp $RESULT
run
bc $RESULT
sto
msg "胜利到达易语言的程序核心代码开始处，现在可以利用OD字符插件搜索有没有关键字符了"
ret
err:
msg "出错拉,有可能不是易语言写的!"
ret
 ]]> http://200708336.qzone.qq.com/blog/1202954037#comment 512 Thu, 14 Feb 2008 01:53:57 GMT http://200708336.qzone.qq.com/blog/1202954037 <![CDATA[Inline Patch破解XX自动关机系统]]> http://200708336.qzone.qq.com/blog/1202230887 1.干掉次数限制
2.使程序可以修改密码

1.准备工作
我们要干掉次数限制，就首先需要知道次数为0时程序会干什么
OK,我自己打开关闭了程序XX次 -_-bbb
把次数用完了，结果如图

OK,点击退出，我们开始工作

2.调试
首先大概看了下软件界面，应该用了外部控件美化
打开OD,下断bp CreateFileA
注意堆栈
数次F9后就会看到
2.jpg
已经开始搞SkinMagic的皮肤美化了
好，到这里程序应该已经解码完了
Ctrl+F9数次返回这里
 004CCBBC 90 nop
004CCBBD 90 nop
004CCBBE 90 nop
004CCBBF 90 nop
004CCBC0 8B4424 04 mov eax, dword ptr [esp+4]
004CCBC4 53 push ebx
004CCBC5 56 push esi
004CCBC6 57 push edi
004CCBC7 68 6C4D5300 push 00534D6C ; ASCII "rb"
004CCBCC 8BF1 mov esi, ecx
004CCBCE 50 push eax
004CCBCF E8 92FD0400 call 0051C966
004CCBD4 8BF8 mov edi, eax ; skinmagi.00537580
我们可以把CreateFileA断点K掉
换在004CCBC0这里下个断
好了，F8跟，走过一堆垃圾指令【对我们来说，嘿嘿】
来到这里
0040EE0D /75 0A jnz short 0040EE19
0040EE0F |E8 8C090000 call 0040F7A0
0040EE14 |E9 B7020000 jmp 0040F0D0
0040EE19 \8D9424 14010000 lea edx, dword ptr [esp+114]
0040EE20 52 push edx
0040EE21 E8 8A240000 call 004112B0
0040EE26 C68424 20170000>mov byte ptr [esp+1720], 1
0040EE2E A1 C4BF4200 mov eax, dword ptr [42BFC4]
0040EE33 3BC3 cmp eax, ebx
0040EE35 7E 45 jle short 0040EE7C
0040EE37 83F8 02 cmp eax, 2
0040EE3A 7E 13 jle short 0040EE4F
0040EE3C 83F8 05 cmp eax, 5
0040EE3F 75 3B jnz short 0040EE7C
0040EE41 E8 DA0A0000 call 0040F920
0040EE46 84C0 test al, al
0040EE48 74 32 je short 0040EE7C

这时你可以设置从那个jmp让他走，不过要经过程序的校验，我最怕麻烦，所以直接往下
很快来到此
0040F001 8B4424 10 mov eax, dword ptr [esp+10]
0040F005 3BC3 cmp eax, ebx
0040F007 77 41 ja short 0040F04A
0040F009 833D C4BF4200 0>cmp dword ptr [42BFC4], 2
0040F010 74 2E je short 0040F040
哈，挖到了，那个ja就是检测次数的关键了
把它改成jmp就可以跳向主程序，记录下来
0040F007 77 41 ja short 0040F04A
改成0040F007 /EB 41 jmp short 0040F04A
顺便记下0040F001 . 8B4424 10 mov eax, dword ptr [esp+10]
当成解码标示吧，这个随便了

一会要用
好了，现在F9走了，输入密码进入程序
进入第二部分
破解密码修改功能，点击下，弹出了对话框
OK,bp MessageBoxW下断
0012DFA0 0040F9DB /CALL 到 MessageBoxW 来自 shutdown.0040F9D5
0012DFA4 00020180 |hOwner = 00020180 (class='#32770',parent=00230098)
0012DFA8 005D9068 |Text = ""B8,"行",BB,"您的支持?,AC,"",B4,"讼罟",A6,"能",D7,"",A2,"",B2,"嵊煤?,B2,"拍苁褂茫",A1,""
0012DFAC 005DABD0 |Title = ""B6,"",A8,"时关",BB,"?3000?,A8,"试用",B0,"妫",A1,"",BB,"箍梢允杂?",B4,"危",A1,"）"
0012DFB0 00000040 \Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0012DFB4 0C496AA5
0012DFB8 005D9068
右击第一行，反汇编窗口中跟随
来到这里
0040F9D2 51 push ecx
0040F9D3 52 push edx
0040F9D4 50 push eax
0040F9D5 FF15 B8F74100 call dword ptr [41F7B8] ; USER32.MessageBoxW
0040F9DB 8D4C24 04 lea ecx, dword ptr [esp+4]
0040F9DF FF15 08F44100 call dword ptr [41F408] ; MFC80U.7834DD87
Ctrl+A下，到段首
0040F980 /$ 6A FF push -1
0040F982 |. 68 D9BB4100 push 0041BBD9
一大堆调用，汗，怎么看都像VC8的XX调用方式-_-xx
右键，查看调用树
右键，在每个调用上设置断点，好了，F9让程序回去，再次点击修改密码
00406600 > \8B4E 20 mov ecx, dword ptr [esi+20]
00406603 . 51 push ecx
00406604 . 6A 6C push 6C
00406606 . E8 75930000 call 0040F980
0040660B . 83C4 08 add esp, 8
断在了这里，OD提示
跳转来自 004065A5, 004065AC
跟上去
004065A5 . /74 59 je short 00406600
004065A7 . |837C24 08 58 cmp dword ptr [esp+8], 58
004065AC . |75 52 jnz short 00406600
004065AE . |EB 04 jmp short 004065B4
很明显了，改成这样
004065A5 /EB 07 jmp short 004065AE
004065A7 . |837C24 08 58 cmp dword ptr [esp+8], 58
004065AC . |75 52 jnz short 00406600
004065AE . \EB 04 jmp short 004065B4
 你Nop掉也可以，不过等下InlinePatch要浪费空间
好了，信息收集完成，开始Patch

掏出ASProtect SKE Inline Patcher V0.2工具
设置如图，标示刚才我记下了
0040F001 . 8B4424 10 mov eax, dword ptr [esp+10]
就随便用这个了，设置以及成功样子如图



RVA就是VA减去基址400000完了
注意看工具给出的提示
ZonaLibreVA 49D417
[我的不是英文版，不知是哪国鸟文，-_-b]

好了，OD载入改好的程序，Ctrl+G到49D417去，嘿嘿，工具已经给我们准备好空间写代码了
还记得我们要Patch的两处吗？
0040F007 /EB 41 jmp short 0040F04A
004065A5 /EB 07 jmp short 004065AE
好了，开始写代码，注意代码倒序原则
0049D417 mov dword ptr [40F007], 41EB
0049D421 mov dword ptr [4065A5], 7EB
OK.现在保存修改，运行，成功了，嘿嘿
附图一张
程序标题估计从第一次跳的地方可过去
 不过太懒，不搞了



--------------------------------------------------------------------------------
【经验总结】
实在扒不下来壳就只有带壳搞了，Loader/Patcher随便了
我是小菜鸟一只，有疏漏之处请大侠们指正

--------------------------------------------------------------------------------
【版权声明】: 本文由本人所写，仅供学习指正，对于滥用破解造成的一切纠纷概不负责
 ]]> http://200708336.qzone.qq.com/blog/1202230887#comment 515 Tue, 05 Feb 2008 17:01:27 GMT http://200708336.qzone.qq.com/blog/1202230887 <![CDATA[浅谈手动脱壳VB加壳程序的OEP寻找]]> http://200708336.qzone.qq.com/blog/1202126008 找VB6和VB5编译的程序观察其OEP

ݣ

004019DA FF25 70104000 jmp dword ptr ds:[401070] ; MSVBVM60.rtcTypeName
004019E0 FF25 08114000 jmp dword ptr ds:[401108] ; MSVBVM60.EVENT_SINK_QueryInterface
004019E6 FF25 C0104000 jmp dword ptr ds:[4010C0] ; MSVBVM60.EVENT_SINK_AddRef
004019EC FF25 F8104000 jmp dword ptr ds:[4010F8] ; MSVBVM60.EVENT_SINK_Release
004019F2 FF25 A4114000 jmp dword ptr ds:[4011A4] ; MSVBVM60.ThunRTMain
004019F8 68 141D4000 push 401D14
//VB6 OEP
004019FD E8 F0FFFFFF call 004019F2 ; <jmp.&MSVBVM60.#100>


ݣ

004011DA FF25 94514000 jmp dword ptr ds:[405194] ; MSVBVM50.EVENT_SINK_QueryInterface
004011E0 FF25 78514000 jmp dword ptr ds:[405178] ; MSVBVM50.EVENT_SINK_AddRef
004011E6 FF25 8C514000 jmp dword ptr ds:[40518C] ; MSVBVM50.EVENT_SINK_Release
004011EC FF25 C8514000 jmp dword ptr ds:[4051C8] ; MSVBVM50.ThunRTMain
004011F2 0000 add byte ptr ds:[eax],al
004011F4 68 E81C4000 push 401CE8
//VB5 OEP
004011F9 E8 EEFFFFFF call 004011EC ; <jmp.&MSVBVM50.#100>

VB的入口一般都会调用ThunRTMain
所以VB程序加壳的OEP很容易确定
在ThunRTMain设置普通断点或者硬件断点，中断后看堆栈即可找到OEP代码

ݣ

0013FFBC 00401A02 返回到 test.00401A02 来自 <jmp.&MSVBVM60.#100>
0013FFC0 00401D14 test.00401D14

ݣ

0013FFBC 004011FE 返回到 crackme.004011FE 来自 <jmp.&MSVBVM50.#100>
0013FFC0 00401CE8 crackme.00401CE8

从这个意义上来说，加壳对VB程序OEP Stolen Code是没多大意义的
还有，VB的输入表相比于其他语言编译的程序输入表来说也好修复点

当然，这并不是说 VB Program && AnyPack =0
http://www.unpack.cn/viewthread.php?tid=21579
VB自然编译的文件如果使用Themida等壳普通保护那没啥强度，但是如果使用VM处理或者使用Armadillo的CC保护，那强度还是很高的. ]]> http://200708336.qzone.qq.com/blog/1202126008#comment 514 Mon, 04 Feb 2008 11:53:28 GMT http://200708336.qzone.qq.com/blog/1202126008 <![CDATA[WinLicense一机一码加壳方式图解]]> http://200708336.qzone.qq.com/blog/1201955271 最近UnPacKcN上有不少朋友询问WinLicense一机一码加壳方式，虽然大家有了文字回复，但是有些人还不是太明白，所以找点时间用图解的方式来演示
硬件綁定加壳大家所疑惑的是如何使试用加壳后文件显示目标机器的硬件信息，其实WinLicense Help.chm中已经有说明了
%machineid Current Hardware ID for current machine.
下面图解WinLicense几种硬件綁定的加壳情况，仅供参考
_____________________________________________________________一.新建保护工程

Winlicense添加界面上某些字符没有汉化好
工程命名为：Winlicense V1.9.5.0.Test.Machine
点击主界面的“软件”搜索图标选择刚才建立的工程

_____________________________________________________________
二.试用设置

保护选项、虚拟机、替换代码等设置这里就不谈了，大家根据需求自己设置
点击“试用设置”

这里可以设置一些试用规则，先演示时间限制，选择30天数

_____________________________________________________________
三.注册


1.可以设置License的方式，如key文件、注册表文件、SmartActivate等
2.SmartActivate必须试用SDK才能实现

ݣ

As you might know, an application can be registered via a file key or a Registry key. SmartActivate keys is another way to register an application but it's basically the same as a file or Registry key, though we have to make use of some APIs in order to install the SmartActivate key as a file or Registry key.
The steps are the following:
①. In the Registration panel, we have to check the option Enable SmartActivate System for user-side generated keys
②. We have to choose if we will finally install the SmartActivate key as file or Registry key, so we check the option "Single File" (In the Registration panel) if we plan to finally install the SmartActivate key as a file key
③. In your application, you have to implement a dialog where you allow a user to register the application via SmartActivate keys (See examples in the WinLicense examples folder)
④. Protect your application
⑤. Let's create a SmartActivate key from the WinLicense License Manager. You have to give your client the SmartActivate key information in order to register your application
⑥. When your customer inserts the SmartActivate key in the dialog where you allow the insertion of SmartActivate keys, you have to call the API WLRegSmartKeyCheck and if it returns TRUE, you have to install the SmartActivate key as file (or Registry) using WLRegSmartKeyInstallToFile (or WLRegSmartKeyInstallToRegistry)
⑦. Restart your application and it should run as registered!

3.必须选择：“允许只是硬件（锁）的依赖注册”（这个汉化的真别扭），否则就没有硬件綁定了。
4.如果想设置无key不运行的保护模式，则选择：“应用程序只有在注册后才能运行”

_____________________________________________________________
四.硬件锁

1.可以选择全部硬件

ݣ

· CPU: This option uses the CPU features for the current computer. Note that the CPU features are the same for all computers with the same CPU. It is not a good idea to use only this option to generate the final Machine ID.
· BIOS: This option uses the BIOS serial number for the current computer. This serial number should be unique among computers, unless the BIOS serial number has been manipulated from flash.
· MAC Address: This option uses the MAC address for the current computer. MAC address should be unique among computers. Be careful including this option if your customers usually change their network cards.
· HDD Serial: This option uses the primary hard drive serial number for the current computer. This serial number should be unique among computers.

2.可以设置运行替换某硬件的次数

_____________________________________________________________
五.密码保护

这个与硬件綁定无关，类似WinRar的压缩包密码
This Password Protection form allows an application to be protected with user/password protection. WinLicense will ask for a valid user/password to run the protected application.
这里就不涉及了

_____________________________________________________________
六.定制对话框

如何使试用加壳后文件显示目标机器的硬件信息，这里的设置很关键
1.试用版界面显示硬件码

ݣ

MsgID14 : 试用版界面（提醒）
This is a shareware reminder. You can register your
copy at http://www.yourcompany.com
(Days left = %daysleft, Executions left = %execleft)
UnPacKcN保护演示WinLicense硬件綁定机器码：
%machineid

蓝色字是需要添加的信息，这样就可以在试用界面显示目标机器上的硬件码了
加壳后运行效果：

2.应用程序只有在注册后才能运行
第三步“注册”界面中选择了必须要有key才能运行

ݣ

MsgID34 : 需要序列号来运行
Sorry, this software cannot be run without a license key.
http://www.unpack.cn
UnPacKcN保护演示WinLicense硬件綁定机器码：
%machineid

蓝色字是需要添加的信息，这样就可以在试用界面显示目标机器上的硬件码了
加壳后运行效果：

]]> http://200708336.qzone.qq.com/blog/1201955271#comment 513 Sat, 02 Feb 2008 12:27:51 GMT http://200708336.qzone.qq.com/blog/1201955271 <![CDATA[THEMIDA脚本（for IAT restore）]]> http://200708336.qzone.qq.com/blog/1198943218

ݣ

/*
Script written by okdodo 2007/03
Tested for themida IAT restore and OEP find~
Ollyice: Ignore all exceptions (add 0EEDFADE,C0000005,C000001E)
HideOD : Check HideNtDebugBit and ZwQueryInformationProcess(method2)
Test Environment : Ollyice 1.1 + HideOD
ODBGScript 1.52 under WINXP
Thanks :
kanxue - author of HideOD
hnhuqiong - author of ODbgScript 1.52
*/

data:
var cbase
var csize
var dllimg
var pmbase
var apibase
var mem
gmi eip,CODEBASE
mov cbase,$RESULT
gmi eip,CODESIZE
mov csize,$RESULT
gmemi eip,MEMORYBASE
mov dllimg,$RESULT
log dllimg
findapibase:
gpa "GetLocalTime", "kernel32.dll"
mov tmpbp,$RESULT
cmp tmpbp,0
je stop
bphws tmpbp ,"x"
esto
bphwc tmpbp
rtu
gpa "VirtualAlloc", "kernel32.dll"
mov tmpbp,$RESULT
cmp tmpbp,0
je stop
bphws tmpbp ,"x"
esto
bphwc tmpbp
rtu
mov apibase,eax
log apibase
gpa "LoadLibraryA", "kernel32.dll"
mov tmpbp,$RESULT
cmp tmpbp,0
je stop
bphws tmpbp ,"x"
esto
bphwc tmpbp
rtu
findVirtualAlloc:
find apibase,#558BECFF7514FF7510FF750CFF75086AFFE8090000005DC21000#
mov tmpbp,$RESULT
cmp tmpbp,0
je stop
bphws tmpbp ,"x"
iatloop:
esto
mov tmp,[esp]
find dllimg,#50516033C0#
cmp $RESULT,0
jne iatpatch
jmp iatloop
iatpatch:
bphwc tmpbp
find eip,#C21000#
bphws $RESULT,"x"
esto
bphwc $RESULT
sti
mov tmpbp,tmp
find tmpbp,#0F850A000000C785#
mov tmpbp,$RESULT
mov [tmpbp],0A0EEB
find tmpbp,#0F84390000003B8D#
mov tmpbp,$RESULT
mov [tmpbp],3928EB
alloc 1000
mov mem, $RESULT
log mem
mov tmp,mem
mov [tmp],#A3000000008908ADC746FC00000000E90000000050A1000000008907807FFFE8750866C747FEFF15EB0666C747FEFF2558E90000000050A100000000894701807FFFE8750866C747FFFF15EB0666C747FFFF25580F8500000000E90000000083C704E900000000#
mov memtmp,tmp
add memtmp,100
add tmp,1
mov [tmp],memtmp
add tmp,15
mov [tmp],memtmp
add tmp,22
mov [tmp],memtmp
mov tmp,mem
find tmpbp,#8908AD#
mov tmpbp,$RESULT
mov addr1,tmpbp
add addr1,0A
eval "jmp {tmp}"
asm tmpbp, $RESULT
find tmpbp,#E92400000058#
mov tmpbp,$RESULT
add tmp,14
eval "jmp {tmp}"
asm tmpbp, $RESULT
find tmpbp,#0F851800000083BD#
mov tmpbp,$RESULT
mov addr3,tmpbp
add addr3,06
add tmp,22
eval "jmp {tmp}"
asm tmpbp, $RESULT
find tmpbp,#884704#
mov tmpbp,$RESULT
mov addr2,tmpbp
add addr2,03
mov [tmpbp],#909090#
find tmpbp,#ABAD#
mov tmpbp,$RESULT
mov [tmpbp],#90#
add tmpbp,9
add tmp,29
eval "jmp {tmp}"
asm tmpbp, $RESULT
mov memtmp,mem
add memtmp,0F
eval "jmp {addr1}"
asm memtmp, $RESULT
add memtmp,22
eval "jmp {addr2}"
asm memtmp, $RESULT
add memtmp,23
eval "jne {addr2}"
asm memtmp, $RESULT
add memtmp,06
eval "jmp {addr3}"
asm memtmp, $RESULT
add memtmp,08
eval "jmp {addr1}"
asm memtmp, $RESULT
find eip,#C7010000000083C104#
mov tmpbp,$RESULT
add tmpbp,14
bphws tmpbp,"x"
esto
bphwc tmpbp
mov tmp,cbase
add tmp,csize
findoep:
bprm cbase,csize
esto
bpmc
cmp eip,tmp
ja findoep
msg "script finished,check the oep place by yourself~"
ret
stop:
pause
apierror:
pause
]]> http://200708336.qzone.qq.com/blog/1198943218#comment 8389120 Sat, 29 Dec 2007 15:46:58 GMT http://200708336.qzone.qq.com/blog/1198943218 <![CDATA[Themida & WinLicen 1.1.X - 1.8.X 系列脱壳脚本]]> http://200708336.qzone.qq.com/blog/1197511960 测试过1.1.X ~ 1.8.X 等几个版本通过

ݣ

/*
Script written by a__p
Script : Themida & WinLicen 1.1.X - 1.8.X 系列脱壳脚本
Date : 2007-05-25
Test Environment : OllyDbg 1.1, ODBGScript 1.52, Winxp Win2003
*/
var modulebase
var codebase
var codesize
var TZM
var gjd1
var gjd2
var tmpbp
var apibase
var mem
var tmp
BPHWCALL
gmi eip,MODULEBASE
mov modulebase,$RESULT
gmi eip,CODEBASE
mov codebase,$RESULT
gmi eip,CODESIZE
mov codesize,$RESULT
bpwm codebase,codesize
ESTO
REP:
ESTO
ESTO
find eip,#F3A4????#
cmp $RESULT,0
je REP
STI
STO
ESTO
LODS:
find eip,#8908AD??#
cmp $RESULT,0
je TZM
jmp DM
TZM:
ESTO
find eip,#8908AD??#
cmp $RESULT,0
jmp LODS
DM:
bpmc
mov add,eip
findmem #0F850A000000C785#
mov add1,$RESULT
mov [add1],0A0EEB
findmem #0F84390000003B8D#
mov add2,$RESULT
mov [add2],3928EB
mov tmpbp,add1
alloc 1000
mov mem, $RESULT
log mem
mov tmp,mem
mov [tmp],#A3000000008908ADC746FC00000000E90000000050A1000000008907807FFFE8750866C747FEFF15EB0666C747FEFF2558E90000000050A100000000894701807FFFE8750866C747FFFF15EB0666C747FFFF25580F8500000000E90000000083C704E900000000#
mov memtmp,tmp
add memtmp,100
add tmp,1
mov [tmp],memtmp
add tmp,15
mov [tmp],memtmp
add tmp,22
mov [tmp],memtmp
mov tmp,mem
find tmpbp,#8908AD#
mov tmpbp,$RESULT
mov addr1,tmpbp
add addr1,0A
eval "jmp {tmp}"
asm tmpbp, $RESULT
find tmpbp,#E92400000058#
mov tmpbp,$RESULT
add tmp,14
eval "jmp {tmp}"
asm tmpbp, $RESULT
find tmpbp,#0F851800000083BD#
mov tmpbp,$RESULT
mov addr3,tmpbp
add addr3,06
add tmp,22
eval "jmp {tmp}"
asm tmpbp, $RESULT
find tmpbp,#884704#
mov tmpbp,$RESULT
mov addr2,tmpbp
add addr2,03
mov [tmpbp],#909090#
find tmpbp,#ABAD#
mov tmpbp,$RESULT
mov [tmpbp],#90#
add tmpbp,9
add tmp,29
eval "jmp {tmp}"
asm tmpbp, $RESULT
mov memtmp,mem
add memtmp,0F
eval "jmp {addr1}"
asm memtmp, $RESULT
add memtmp,22
eval "jmp {addr2}"
asm memtmp, $RESULT
add memtmp,23
eval "jne {addr2}"
asm memtmp, $RESULT
add memtmp,06
eval "jmp {addr3}"
asm memtmp, $RESULT
add memtmp,08
eval "jmp {addr1}"
asm memtmp, $RESULT
find eip,#C7010000000083C104#
mov tmpbp,$RESULT
add tmpbp,14
bphws tmpbp,"x"
esto
bphwc tmpbp
mov tmp,codebase
add tmp,codesize
oep:
bprm codebase,codesize
esto
bpmc
cmp eip,tmp
ja oep
msg "脚本执行完毕!请注意OEP是否被偷代码!"
ret
]]> http://200708336.qzone.qq.com/blog/1197511960#comment 512 Thu, 13 Dec 2007 02:12:40 GMT http://200708336.qzone.qq.com/blog/1197511960 <![CDATA[不被OD分析原因之一和修补方法]]> http://200708336.qzone.qq.com/blog/1196266937

ݣ

今在论坛里看到有人发贴说有程序不让OD分析.这很常见了,很多脱壳后的文件,弄得不好还就是不能用OD打开分析.但这种情况是程序一般也是不能运行的.现在的问题就是,程序可以正常运行,可是OD不能打开分析,说"Bad or unknown format of 32-bit executeable file '**.exe'".这句话说这个程序不是有效的32位可执行程序.明明可以运行的嘛.
下面来给大家做个试验再说明原因.
1.用十六进制工具打开NotePad,(别的EXE文件也行.)选中从'PE'开始的大小为0xE0的数据,复制,然后到文件地址为0x40处粘贴.(大家都知道,这里是DOS头的区域,除非在DOS下运行程序才会用到这一段数据.)
2.把后面多余的数据用'0'填上[0x120-0x1BF]. 然后就是修正了.因为PE头位置定位到了0x40,所以得把0x3C处改为0x40.这个大家都是知道的.
3.最后就是关键问题所在了. 把0x54地址的数据改为'8001',就是0x180.
好,现在保存,运行程序看,OK,可以运行,没有问题.用OD再打开试试?哈哈,报错啦.
下面说说原因,有说得不好的地方,大家不要笑话偶.
OD在加载程序时,会先对程序进行分析.OD的作者写此程序就只是针对Win32下的PE文件(好像作者现在在开发2.0版本的,是分析64位程序的.)所以有比较SizeOfOptionalHandler,而在PE定义中,这个值是0xE0,是一个定值.OD比较这个值,如果是0xE0就对了,不等就是错误的EXE文件.
我们刚才做的就是改变PE Handler的大小,后面多余的数据填'0'也是有意义的.这就是系统可以正常运行的原因.后面多余的'0'归属于DataDirectory中了.系统在加载时只加载16组数据,后面的顶多算为是PE结构的保留数据,好像在前16组中,也是有保留数据的.所以不会出错.
附件中有我修改PE文件的录相,可以下载参考一下.
修复这一BUG方法,把0045C671处的je改为jge,就是大于等于就可以了.
通过小小修改PE就可以不让OD加载,但这也都是些小花样.OD的BUG是可以补的嘛.一定还会有更多的BUG,有待大家的发现.
 ]]> http://200708336.qzone.qq.com/blog/1196266937#comment 512 Wed, 28 Nov 2007 16:22:17 GMT http://200708336.qzone.qq.com/blog/1196266937