设为首页收藏本站官方微博

开启辅助访问切换到窄版

飘云阁»网站 › -= 逆向工程 =- › 『软件逆向』 › 切割大师加密狗破解的分析

[x86]PYG官方Dll优雅破解补丁制作工具

[x64]PYG官方DLL优雅破解补丁制作工具

[x86]PYG官方Exe优雅破解补丁制作工具

[x86/x64]Baymax Patch Tools

飘云阁工具包(已更新第4季)

发新帖

查看: 2951|回复: 2

[转贴] 切割大师加密狗破解的分析

TA的每日心情

	开心 2023-8-16 00:26

签到天数: 50 天

[LV.5]常住居民I

发表于 2015-10-3 09:45:38 | 显示全部楼层 |阅读模式

首要运用PEID的插件krypto Analyzer检查一下几个通用的算法

从上能够发现，一般来说用于加暗码的或许是base64和md5了
下面运用od载入软件，来到上帖提到的算法call
算法call地址：
[Asm] 纯文本检查复制代码
?
1
0040E0A7 |. E8 CCFAFFFF call SmartCut.0040DB78 ; 算法

F7单步步入进入，渐渐F8单步，能够发现一些有用的信息，由于我的叙说才干不是极好，所以直接上代码。
[Asm] 纯文本检查复制代码

0040DB78  /$  55          push ebp
0040DB79  |.  8BEC       mov ebp,esp
0040DB7B  |.  83C4 88    add esp,-0x78
0040DB7E  |.  894D F8    mov [local.2],ecx
0040DB81  |.  8955 FC    mov [local.1],edx
0040DB84  |.  8945 90    mov [local.28],eax
0040DB87  |.  B8 E0587200 mov eax,SmartCut.007258E0
0040DB8C  |.  E8 6F602E00 call SmartCut.006F3C00
0040DB91  |.  C745 B0 02000>mov [local.20],0x2
0040DB98  |.  8D55 FC    lea edx,[local.1]
0040DB9B  |.  8D45 FC    lea eax,[local.1]
0040DB9E  |.  E8 69482F00 call SmartCut.0070240C
0040DBA3  |.  FF45 B0    inc [local.20]
0040DBA6  |.  66:C745 A4 0C>mov word ptr ss:[ebp-0x5C],0xC
0040DBAC  |.  8D55 F8    lea edx,[local.2]
0040DBAF  |.  8D45 F8    lea eax,[local.2]
0040DBB2  |.  E8 55482F00 call SmartCut.0070240C
0040DBB7  |.  FF45 B0    inc [local.20]
0040DBBA  |.  66:C745 A4 18>mov word ptr ss:[ebp-0x5C],0x18
0040DBC0  |.  8D45 E0    lea eax,[local.8]
0040DBC3  |.  E8 B846FFFF call SmartCut.00402280
0040DBC8  |.  50          push eax
0040DBC9  |.  FF45 B0    inc [local.20]
0040DBCC  |.  BA 9D3C7200 mov edx,SmartCut.00723C9D
0040DBD1  |.  8D45 E4    lea eax,[local.7]
0040DBD4  |.  E8 F3472F00 call SmartCut.007023CC
0040DBD9  |.  FF45 B0    inc [local.20]
0040DBDC  |.  8D55 E4    lea edx,[local.7]
0040DBDF  |.  8D45 FC    lea eax,[local.1]
0040DBE2  |.  59          pop ecx                               ;  SmartCut.0040E0AC
0040DBE3  |.  E8 F0492F00 call SmartCut.007025D8
0040DBE8  |.  8D55 E0    lea edx,[local.8]
0040DBEB  |.  52          push edx
0040DBEC  |.  8D45 DC    lea eax,[local.9]
0040DBEF  |.  E8 8C46FFFF call SmartCut.00402280
0040DBF4  |.  8BC8       mov ecx,eax
0040DBF6  |.  FF45 B0    inc [local.20]
0040DBF9  |.  8D55 F8    lea edx,[local.2]
0040DBFC  |.  58          pop eax                               ;  SmartCut.0040E0AC
0040DBFD  |.  E8 D6492F00 call SmartCut.007025D8                ;  机器码和邮箱拼接
0040DC02  |.  8D55 DC    lea edx,[local.9]
0040DC05  |.  FF32       push dword ptr ds:[edx]                ;  SmartCut.00440033
0040DC07  |.  8D45 D8    lea eax,[local.10]
0040DC0A  |.  E8 7146FFFF call SmartCut.00402280
0040DC0F  |.  8BD0       mov edx,eax
0040DC11  |.  FF45 B0    inc [local.20]
0040DC14  |.  58          pop eax                               ;  SmartCut.0040E0AC
0040DC15  |.  E8 62D00300 call SmartCut.0044AC7C
0040DC1A  |.  8D55 D8    lea edx,[local.10]
0040DC1D  |.  8D45 F4    lea eax,[local.3]
0040DC20  |.  E8 1FDFFFFF call SmartCut.0040BB44                ;  转成小写
0040DC25  |.  8345 B0 02 add [local.20],0x2
0040DC29  |.  FF4D B0    dec [local.20]
0040DC2C  |.  8D45 D8    lea eax,[local.10]
0040DC2F  |.  BA 02000000 mov edx,0x2
0040DC34  |.  E8 4F492F00 call SmartCut.00702588
0040DC39  |.  FF4D B0    dec [local.20]
0040DC3C  |.  8D45 DC    lea eax,[local.9]
0040DC3F  |.  BA 02000000 mov edx,0x2
0040DC44  |.  E8 3F492F00 call SmartCut.00702588
0040DC49  |.  FF4D B0    dec [local.20]
0040DC4C  |.  8D45 E0    lea eax,[local.8]
0040DC4F  |.  BA 02000000 mov edx,0x2
0040DC54  |.  E8 2F492F00 call SmartCut.00702588
0040DC59  |.  FF4D B0    dec [local.20]
0040DC5C  |.  8D45 E4    lea eax,[local.7]
0040DC5F  |.  BA 02000000 mov edx,0x2
0040DC64  |.  E8 1F492F00 call SmartCut.00702588
0040DC69  |.  66:C745 A4 0C>mov word ptr ss:[ebp-0x5C],0xC
0040DC6F  |.  66:C745 A4 24>mov word ptr ss:[ebp-0x5C],0x24
0040DC75  |.  8D45 F0    lea eax,[local.4]
0040DC78  |.  E8 93FDFFFF call SmartCut.0040DA10
0040DC7D  |.  8BD0       mov edx,eax
0040DC7F  |.  8345 B0 02 add [local.20],0x2
0040DC83  |.  8B45 F4    mov eax,[local.3]
0040DC86  |.  E8 85F80000 call SmartCut.0041D510                ; &nbs, p;MD5加密
0040DC8B  |.  66:C745 A4 0C>mov word ptr ss:[ebp-0x5C],0xC
0040DC91  |.  66:C745 A4 30>mov word ptr ss:[ebp-0x5C],0x30
0040DC97  |.  BA 9F3C7200 mov edx,SmartCut.00723C9F
0040DC9C  |.  8D45 EC    lea eax,[local.5]
0040DC9F  |.  E8 0CDEFFFF call SmartCut.0040BAB0
0040DCA4  |.  8345 B0 02 add [local.20],0x2
0040DCA8  |.  66:C745 A4 0C>mov word ptr ss:[ebp-0x5C],0xC
0040DCAE  |.  8D45 F0    lea eax,[local.4]
0040DCB1  |.  E8 5A020000 call SmartCut.0040DF10
0040DCB6  |.  8945 8C    mov [local.29],eax
0040DCB9  |.  66:C745 A4 0C>mov word ptr ss:[ebp-0x5C],0xC
0040DCBF  |.  837D 8C 00 cmp [local.29],0x0
0040DCC3  |.  7E 46       jle short SmartCut.0040DD0B
0040DCC5  |>  66:C745 A4 3C>/mov word ptr ss:[ebp-0x5C],0x3C       ;  反序
0040DCCB  |.  8D45 F0    |lea eax,[local.4]
0040DCCE  |.  8B55 8C    |mov edx,[local.29]
0040DCD1  |.  E8 5E020000 |call SmartCut.0040DF34
0040DCD6  |.  8BD0       |mov edx,eax
0040DCD8  |.  8A12       |mov dl,byte ptr ds:[edx]
0040DCDA  |.  8D45 D4    |lea eax,[local.11]
0040DCDD  |.  E8 82020000 |call SmartCut.0040DF64
0040DCE2  |.  8345 B0 02 |add [local.20],0x2
0040DCE6  |.  8D55 D4    |lea edx,[local.11]
0040DCE9  |.  8D45 EC    |lea eax,[local.5]
0040DCEC  |.  E8 C3020000 |call SmartCut.0040DFB4
0040DCF1  |.  836D B0 02 |sub [local.20],0x2
0040DCF5  |.  8D45 D4    |lea eax,[local.11]
0040DCF8  |.  BA 02000000 |mov edx,0x2
0040DCFD  |.  E8 EEDDFFFF |call SmartCut.0040BAF0
0040DD02  |.  FF4D 8C    |dec [local.29]
0040DD05  |.  837D 8C 00 |cmp [local.29],0x0
0040DD09  |.^ 7F BA       \jg short SmartCut.0040DCC5
0040DD0B  |>  66:C745 A4 48>mov word ptr ss:[ebp-0x5C],0x48
0040DD11  |.  8D45 D0    lea eax,[local.12]
0040DD14  |.  E8 F7FCFFFF call SmartCut.0040DA10
0040DD19  |.  8BD0       mov edx,eax
0040DD1B  |.  8345 B0 02 add [local.20],0x2
0040DD1F  |.  8B45 EC    mov eax,[local.5]
0040DD22  |.  E8 E9F70000 call SmartCut.0041D510                ;  再次md5加密
0040DD27  |.  8D55 D0    lea edx,[local.12]
0040DD2A  |.  8D45 CC    lea eax,[local.13]
0040DD2D  |.  E8 52DEFFFF call SmartCut.0040BB84
0040DD32  |.  FF45 B0    inc [local.20]
0040DD35  |.  FF30       push dword ptr ds:[eax]                ;  SmartCut.00725EB8
0040DD37  |.  8D45 C8    lea eax,[local.14]
0040DD3A  |.  E8 4145FFFF call SmartCut.00402280
0040DD3F  |.  8BD0       mov edx,eax
0040DD41  |.  FF45 B0    inc [local.20]
0040DD44  |.  58          pop eax                               ;  SmartCut.0040E0AC
0040DD45  |.  E8 6ACE0300 call SmartCut.0044ABB4
0040DD4A  |.  8D55 C8    lea edx,[local.14]
0040DD4D  |.  8D45 C4    lea eax,[local.15]
0040DD50  |.  E8 EFDDFFFF call SmartCut.0040BB44                ;  转成大写
0040DD55  |.  8345 B0 02 add [local.20],0x2
0040DD59  |.  8D55 C4    lea edx,[local.15]
0040DD5C  |.  8D45 EC    lea eax,[local.5]
0040DD5F  |.  E8 70020000 call SmartCut.0040DFD4
0040DD64  |.  836D B0 02 sub [local.20],0x2
0040DD68  |.  8D45 C4    lea eax,[local.15]
0040DD6B  |.  BA 02000000 mov edx,0x2
0040DD70  |.  E8 7BDDFFFF call SmartCut.0040BAF0
0040DD75  |.  FF4D B0    dec [local.20]
0040DD78  |.  8D45 C8    lea eax,[local.14]
0040DD7B  |.  BA 02000000 mov edx,0x2
0040DD80  |.  E8 03482F00 call SmartCut.00702588
0040DD85  |.  FF4D B0    dec [local.20]
0040DD88  |.  8D45 CC    lea eax,[local.13]
0040DD8B  |.  BA 02000000 mov edx,0x2
0040DD90  |.  E8 F3472F00 call SmartCut.00702588
0040DD95  |.  836D B0 02 sub [local.20],0x2
0040DD99  |.  8D45 D0    lea eax,[local.12]
0040DD9C  |.  BA 02000000 mov edx,0x2
0040DDA1  |.  E8 4ADDFFFF call SmartCut.0040BAF0
0040DDA6  |.  66:C745 A4 54>mov word ptr ss:[ebp-0x5C],0x54
0040DDAC  |.  8D45 E8    lea eax,[local.6]
0040DDAF  |.  E8 CC44FFFF call SmartCut.00402280
0040DDB4  |.  FF45 B0    inc [local.20]
0040DDB7  |.  66:C745 A4 0C>mov word ptr ss:[ebp-0x5C],0xC
0040DDBD  |.  33D2       xor edx,edx
0040DDBF  |.  8955 88    mov [local.30],edx
0040DDC2  |.  66:C745 A4 0C>mov word ptr ss:[ebp-0x5C],0xC
0040DDC8  |.  837D 88 05 cmp [local.30],0x5
0040DDCC  |.  0F8D A5000000 jge SmartCut.0040DE77
0040DDD2  |>  837D 88 00 /cmp [local.30],0x0                   ;  每五个用-切割，一共五组
0040DDD6  |.  7E 31       |jle short SmartCut.0040DE09
0040DDD8  |.  66:C745 A4 60>|mov word ptr ss:[ebp-0x5C],0x60
0040DDDE  |.  BA A03C7200 |mov edx,SmartCut.00723CA0             ;  UNICODE "-Untitled"
0040DDE3  |.  8D45 C0    |lea eax,[local.16]
0040DDE6  |.  E8 E1452F00 |call SmartCut.007023CC
0040DDEB  |.  FF45 B0    |inc [local.20]
0040DDEE  |.  8D55 C0    |lea edx,[local.16]
0040DDF1  |.  8D45 E8    |lea eax,[local.6]
0040DDF4  |.  E8 CB472F00 |call SmartCut.007025C4
0040DDF9  |.  FF4D B0    |dec [local.20]
0040DDFC  |.  8D45 C0    |lea eax,[local.16]
0040DDFF  |.  BA 02000000 |mov edx,0x2
0040DE04  |.  E8 7F472F00 |call SmartCut.00702588
0040DE09  |>  66:C745 A4 6C>|mov word ptr ss:[ebp-0x5C],0x6C
0040DE0F  |.  8D45 BC    |lea eax,[local.17]
0040DE12  |.  E8 F9FBFFFF |call SmartCut.0040DA10
0040DE17  |.  50          |push eax
0040DE18  |.  8345 B0 02 |add [local.20],0x2
0040DE1C  |.  8B55 88    |mov edx,[local.30]
0040DE1F  |.  8D1492       |lea edx,dword ptr ds:[edx+edx*4]
0040DE22  |.  42          |inc edx
0040DE23  |.  8D45 EC    |lea eax,[local.5]
0040DE26  |.  B9 05000000 |mov ecx,0x5
0040DE2B  |.  E8 ACFCFFFF |call SmartCut.0040DADC
0040DE30  |.  8D55 BC    |lea edx,[local.17]
0040DE33  |.  8D45 B8    |lea eax,[local.18]
0040DE36  |.  E8 49DDFFFF |call SmartCut.0040BB84
0040DE3B  |.  FF45 B0    |inc [local.20]
0040DE3E  |.  8D55 B8    |lea edx,[local.18]
0040DE41  |.  8D45 E8    |lea eax,[local.6]
0040DE44  |.  E8 7B472F00 |call SmartCut.007025C4
0040DE49  |.  FF4D B0    |dec [local.20]
0040DE4C  |.  8D45 B8    |lea eax,[local.18]
0040DE4F  |.  BA 02000000 |mov edx,0x2
0040DE54  |.  E8 2F472F00 |call SmartCut.00702588
0040DE59  |.  836D B0 02 |sub [local.20],0x2
0040DE5D  |.  8D45 BC    |lea eax,[local.17]
0040DE60  |.  BA 02000000 |mov edx,0x2
0040DE65  |.  E8 86DCFFFF |call SmartCut.0040BAF0
0040DE6A  |.  FF45 88    |inc [local.30]
0040DE6D  |.  837D 88 05 |cmp [local.30],0x5
0040DE71  |.^ 0F8C 5BFFFFFF \jl SmartCut.0040DDD2
0040DE77  |>  66:C745 A4 78>mov word ptr ss:[ebp-0x5C],0x78
0040DE7D  |.  8D55 E8    lea edx,[local.6]
0040DE80  |.  8B45 08    mov eax,[arg.1]
0040DE83  |.  E8 28472F00 call SmartCut.007025B0
0040DE88  |.  8B45 08    mov eax,[arg.1]
0040DE8B  |.  66:C745 A4 84>mov word ptr ss:[ebp-0x5C],0x84
0040DE91  |.  50          push eax
0040DE92  |.  FF4D B0    dec [local.20]
0040DE95  |.  8D45 E8    lea eax,[local.6]
0040DE98  |.  BA 02000000 mov edx,0x2
0040DE9D  |.  E8 E6462F00 call SmartCut.00702588
0040DEA2  |.  836D B0 02 sub [local.20],0x2
0040DEA6  |.  8D45 EC    lea eax,[local.5]
0040DEA9  |.  BA 02000000 mov edx,0x2
0040DEAE  |.  E8 3DDCFFFF call SmartCut.0040BAF0
0040DEB3  |.  836D B0 02 sub [local.20],0x2
0040DEB7  |.  8D45 F0    lea eax,[local.4]
0040DEBA  |.  BA 02000000 mov edx,0x2
0040DEBF  |.  E8 2CDCFFFF call SmartCut.0040BAF0
0040DEC4  |.  836D B0 02 sub [local.20],0x2
0040DEC8  |.  8D45 F4    lea eax,[local.3]
0040DECB  |.  BA 02000000 mov edx,0x2
0040DED0  |.  E8 1BDCFFFF call SmartCut.0040BAF0
0040DED5  |.  FF4D B0    dec [local.20]
0040DED8  |.  8D45 F8    lea eax,[local.2]
0040DEDB  |.  BA 02000000 mov edx,0x2
0040DEE0  |.  E8 A3462F00 call SmartCut.00702588
0040DEE5  |.  FF4D B0    dec [local.20]
0040DEE8  |.  8D45 FC    lea eax,[local.1]
0040DEEB  |.  BA 02000000 mov edx,0x2
0040DEF0  |.  E8 93462F00 call SmartCut.00702588
0040DEF5  |.  58          pop eax                               ;  SmartCut.0040E0AC
0040DEF6  |.  66:C745 A4 78>mov word ptr ss:[ebp-0x5C],0x78
0040DEFC  |.  FF45 B0    inc [local.20]
0040DEFF  |.  8B55 94    mov edx,[local.27]
0040DF02  |.  64:8915 00000>mov dword ptr fs:[0],edx
0040DF09  |.  8BE5       mov esp,ebp
0040DF0B  |.  5D          pop ebp                               ;  SmartCut.0040E0AC
0040DF0C  \.  C2 0400    retn 0x4

首要call将机器码和邮箱两个参数合并成一个字符串，格局是“机器码,邮箱”，然后将大写字母转成小写，往后进行MD5加密，加密往后再倒序过来（假定原来是ABCDEF，改换往后即是FEDCBA了）。
接下来进行二次MD5加密，加密后转成大写字母，终究是将MD5加密往后的32位字符串截取前25个，以五个一组算计五组，在基地加上“-”进行联络。即成注册码了。


注：附加的可实施程序或许由于操作剪切板复制注册码而被杀毒软件报毒，假定有不放心的，请从速删去，避免致使电脑爆破，火山喷发等不良影响。并细心检查源代码无后门后从头编译即可。

以上仅仅自己的一点管见，假定有啥过失的当地，还请各位大牛指出。

终究依然是说了N遍的话，假定觉得好或许学到了啥，还请给我支持和评分，热心和CB就不必藏着掖着了，评分又不会扣自己的分对不！~~

PYG19周年生日快乐！

回复

使用道具举报

TA的每日心情

	开心 4 小时前

签到天数: 961 天

[LV.10]以坛为家III

发表于 2015-10-3 09:52:55 | 显示全部楼层

我说，你的id 不想要了么？

PYG19周年生日快乐！

回复支持反对

使用道具举报

TA的每日心情

	开心 2019-10-19 08:50

签到天数: 91 天

[LV.6]常住居民II

发表于 2015-10-28 15:30:02 | 显示全部楼层

这个比较高深啊，不过后面的总结看懂啦

PYG19周年生日快乐！

回复支持反对

使用道具举报

发新帖

小黑屋|手机版|Archiver|粤公网安备 44010602010026号|飘云阁安全论坛 ( 粤ICP备15107817号-2 )|扫码赞助

Powered by Discuz! Copyright © 2001-2022, Tencent Cloud.

快速回复 返回顶部 返回列表