動態破解靜態加密軟件--simeon

1、查殼　UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo

2、脫殼
　
用OD載入，00491560 >  60              PUSHAD
00491561    BE 00904500     MOV ESI,CrackmeN.00459000//這裏用ESP定律

 

004916C3  - E9 B4FFFBFF     JMP CrackmeN.0045167C//ESP定律後到這裏,jmp到OEP
004916C8    E0 16           LOOPDNE SHORT CrackmeN.004916E0

0045167C    55              PUSH EBP//用OD的插件DUMP，用Import Fix 1.6修復
IAT地址爲5167C，便可運行

 

2、查找字符串「I am Sad」

超級字串參考, 項目 239
 地址=004513E6
 反彙編=MOV EDX,dump_.00451454
 文本字串=i am sad！

 

雙擊返回這裏

 

00451384    55              PUSH EBP
00451385    68 11144500     PUSH dump_.00451411
0045138A    64:FF30         PUSH DWORD PTR FS:[EAX]
0045138D    64:8920         MOV DWORD PTR FS:[EAX],ESP
00451390    8D55 FC         LEA EDX,DWORD PTR SS:[EBP-4]             ; loB
00451393    8B83 F4020000   MOV EAX,DWORD PTR DS:[EBX+2F4]           ; 8dB
00451399    E8 D2E1FDFF     CALL dump_.0042F570
0045139E    837D FC 00      CMP DWORD PTR SS:[EBP-4],0               ; 註冊碼與0比較
004513A2    75 12           JNZ SHORT dump_.004513B6                 ; 註冊碼不能爲空
004513A4    BA 28144500     MOV EDX,dump_.00451428                   ; 請輸入註冊碼
004513A9    8B83 F0020000   MOV EAX,DWORD PTR DS:[EBX+2F0]
004513AF    E8 ECF3FFFF     CALL dump_.004507A0
004513B4    EB 40           JMP SHORT dump_.004513F6
004513B6    8D55 F8         LEA EDX,DWORD PTR SS:[EBP-8]
004513B9    8B83 F4020000   MOV EAX,DWORD PTR DS:[EBX+2F4]
004513BF    E8 ACE1FDFF     CALL dump_.0042F570
004513C4    8B45 F8         MOV EAX,DWORD PTR SS:[EBP-8]
004513C7    8B15 2C3C4500   MOV EDX,DWORD PTR DS:[453C2C]            ;

固定碼,真碼yjcf&15202727
004513CD    E8 3632FBFF     CALL dump_.00404608                      ; 真假碼比較
004513D2    75 12           JNZ SHORT dump_.004513E6                 ; NOP這裏實現暴破
004513D4    BA 40144500     MOV EDX,dump_.00451440                   ; welcome！
004513D9    8B83 F0020000   MOV EAX,DWORD PTR DS:[EBX+2F0]
004513DF    E8 BCF3FFFF     CALL dump_.004507A0
004513E4    EB 10           JMP SHORT dump_.004513F6
004513E6    BA 54144500     MOV EDX,dump_.00451454                   ; i am sad！