脱壳教程－－-天然码输入法的(2)

　2006-07-03 20:26:15　来源：WEB开发网　闂傚倸鍊搁崐鎼佸磹妞嬪孩顐芥慨姗嗗厳缂傛氨鎲稿鍫罕闂備礁婀遍搹搴ㄥ窗閺嶎偆涓嶆い鏍仦閻撱儵鏌ｉ弴鐐测偓鍦偓姘炬嫹

闂傚倸鍊搁崐鎼佸磹妞嬪海鐭嗗〒姘ｅ亾妤犵偛顦甸弫鎾绘偐閹绘帞鈧參姊哄Ч鍥х仼闁诲繑鑹鹃悾鐑藉蓟閵夛妇鍘甸梺瑙勵問閸犳牠銆傛總鍛婄厱閹艰揪绱曟牎闂侀潧娲ょ€氫即鐛幒妤€绠ｆ繝闈涘暙娴滈箖鏌ｉ姀鈶跺湱澹曟繝姘厵闁绘劦鍓氶悘杈ㄤ繆閹绘帞澧涚紒缁樼洴瀹曞崬螖閸愬啠鍓濈换娑樼暆婵犱胶鏁栫紓浣介哺閹瑰洤鐣烽幒鎴僵闁瑰吀鐒﹂悗鎼佹⒒娴ｇ儤鍤€闁搞倖鐗犻獮蹇涙晸閿燂拷

濠电姷鏁告慨鐑藉极閸涘﹥鍙忔い鎾卞灩缁狀垶鏌涢幇闈涙灈鐎瑰憡绻冮妵鍕箻鐎靛摜鐣奸梺纭咁潐濞茬喎顫忕紒妯肩懝闁逞屽墮宀ｈ儻顦查悡銈夋煏閸繃鍋繛宸簻鎯熼梺瀹犳〃閼冲爼宕濋敃鈧—鍐Χ閸℃鐟愰梺鐓庡暱閻栧ジ宕烘繝鍥у嵆闁靛骏绱曢崢顏堟⒑閹肩偛鍔楅柡鍛⊕缁傛帟顦寸紒杈ㄥ笚濞煎繘鍩℃担閿嬵潟闂備浇妗ㄩ悞锕傚箲閸ヮ剙鏋侀柟鍓х帛閺呮悂鏌ㄩ悤鍌涘闂傚倸鍊搁崐鎼佸磹妞嬪孩顐芥慨姗嗗厳缂傛氨鎲稿鍫罕闂備礁婀遍搹搴ㄥ窗閺嶎偆涓嶆い鏍仦閻撱儵鏌ｉ弴鐐测偓鍦偓姘炬嫹　　闂傚倸鍊搁崐鎼佸磹閻戣姤鍤勯柤鍝ユ暩娴犳氨绱撻崒娆掑厡缂侇噮鍨堕妴鍐川閺夋垹鍘洪悗骞垮劚椤︻垶宕￠幎鑺ョ厪闊洦娲栨牎闂佽瀵掗崜鐔奉潖閾忓湱纾兼俊顖氭惈椤矂姊虹拠鑼婵ǜ鍔戦崺鈧い鎺嶇閸ゎ剟鏌涢幘璺烘瀻妞ゎ偄绻愮叅妞ゅ繐瀚悗顓烆渻閵堝棙绀€闁瑰啿閰ｅ畷婊勫鐎涙ǚ鎷洪梻渚囧亞閸嬫盯鎳熼娑欐珷妞ゆ柨澧界壕鐓庮熆鐠虹尨鍔熺紒澶庢閳ь剚顔栭崰鏍€﹂柨瀣╃箚婵繂鐭堝Σ鐑芥⒑缁嬫鍎愰柟鐟版搐铻為柛鎰╁妷濡插牊绻涢崱妤冪婵炲牊锕㈠缁樻媴妞嬪簼瑕嗙紓鍌氱М閸嬫挻绻涚€涙ḿ鐭ら柛鎾跺枛瀹曟椽鍩€椤掍降浜滈柟鐑樺灥閳ь剙缍婂鎶筋敆閸曨剛鍘遍柣搴秵娴滅兘鐓鍌楀亾鐟欏嫭纾婚柛妤€鍟块锝夊磹閻曚焦鞋闂備礁鎼Λ瀵哥不閹捐钃熼柕濞炬櫆閸嬪棝鏌涚仦鍓р槈妞ゅ骏鎷�

核心提示：用dump出的trm32.ime替换原来的文件，再次运行输入法管理器，脱壳教程－－-天然码输入法的(2)，选天然码，点“属性”，点“确定”可来到注册窗口，我的机器码为123456789012，将弹出MESSAGEBOX说没有指纹盘或disk serial不对，contro

用dump出的trm32.ime替换原来的文件。再次运行输入法管理器。选天然码，点“属性”，将弹出MESSAGEBOX说没有指纹盘或disk serial不对。control-n激活trw2k，“pmodule”，“确定”后，回到trw2k：

:00401514 89442410 mov dword ptr [esp+10], eax
:00401518 8B442434 mov eax, dword ptr [esp+34]
:0040151C 50 push eax
:0040151D E88EFCFFFF call 004011B0 〈=====进入
:00401522 8BD8 mov ebx, eax
:00401524 3BDE cmp ebx, esi
:00401526 7528 jne 00401550
:00401528 56 push esi
* Possible StringData Ref from Data Obj ->"DiskSerial"
|
:00401529 68DC704000 push 004070DC
:0040152E B8847F4000 mov eax, 00407F84
* Possible StringData Ref from Data Obj ->"Disk not exists or process failed "
->"!"
|
:00401533 68B8704000 push 004070B8
:00401538 56 push esi
:00401539 89442424 mov dword ptr [esp+24], eax
:0040153D 89442428 mov dword ptr [esp+28], eax
:00401541 89442420 mov dword ptr [esp+20], eax
* Reference To: USER32.MessageBoxA, Ord:01BEh
|
:00401545 FF15C8604000 Call dword ptr [004060C8]
:0040154B E9A1000000 jmp 004015F1

注意这时是在getdiskserial.exe的领空。（也就是说trm32.ime产生getdiskserial.exe进程）。往上看，注意0040151D处的call 004011B0，在此处下断点，再次运行进入“call 004011B0”来到这：

017F:00401439 50 PUSH EAX
017F:0040143A 8D8C2488030000 LEA ECX,[ESP+0388]
017F:00401441 6A04 PUSH BYTE +04
017F:00401443 51 PUSH ECX
017F:00401444 6A00 PUSH BYTE +00
017F:00401446 6A00 PUSH BYTE +00
017F:00401448 6A01 PUSH BYTE +01
017F:0040144A 56 PUSH ESI
017F:0040144B FF1514604000 CALL `KERNEL32!DeviceIoControl` 〈=调用vxd
017F:00401451 56 PUSH ESI
017F:00401452 FF151C604000 CALL `KERNEL32!FindCloseChangeNotification`
017F:00401458 8BB42490130000 MOV ESI,[ESP+1390]
017F:0040145F 8A843484030000 MOV AL,[ESP+ESI+0384]
017F:00401466 84C0 TEST AL,AL 〈==是否有指纹盘或disk serial ？
017F:00401468 744D JZ 004014B7 〈==没有就跳
017F:0040146A 8BC6 MOV EAX,ESI

017F:0040144B处调用diskserial.vxd绝对读磁盘，017F:00401468处是判断。因为没有指纹盘，将此处改为nop;nop;替换getdiskserial.exe（在window的system下）。

再次运行，这次可以来到“属性”窗口，点“确定”可来到注册窗口，我的机器码为123456789012，输入用户名leo_cyl,注册码12121212。下断点hmemcpy,跟踪来到这里：

:10001FC2 8D4C240C lea ecx, dword ptr [esp+0C]
:10001FC6 8D542414 lea edx, dword ptr [esp+14]
:10001FCA 51 push ecx
:10001FCB 8D442434 lea eax, dword ptr [esp+34]
:10001FCF 52 push edx
:10001FD0 50 push eax
:10001FD1 E85A5E0000 call 10007E30
:10001FD6 83C40C add esp, 0000000C
:10001FD9 E822600000 call 10008000 《=====注意
:10001FDE A1ACF90110 mov eax, dword ptr [1001F9AC]
:10001FE3 6A00 push 00000000
:10001FE5 85C0 test eax, eax
:10001FE7 7425 je 1000200E 〈===跳的话就注册失败
:10001FE9 6878F10010 push 1000F178
:10001FEE 686CF10010 push 1000F16C
:10001FF3 56 push esi
* Reference To: user32.MessageBoxA, Ord:01B7h
|
:10001FF4 FF15A0D10010 Call dword ptr [1000D1A0]
:10001FFA 6A01 push 00000001
:10001FFC 56 push esi
* Reference To: user32.EndDialog, Ord:00B9h
|
:10001FFD FF1590D20010 Call dword ptr [1000D290]
:10002003 5F pop edi
:10002004 5E pop esi
:10002005 33C0 xor eax, eax
:10002007 5B pop ebx
:10002008 83C438 add esp, 00000038
:1000200B C21000 ret 0010