BlindWrite Suite v5.1.5.132 的檔案補丁,寫得很屑

看雪資料發表於2004-06-23

Software : BlindWrite Suite v5.1.5.132 的檔案補丁
           能夠對“防拷保護”的光碟製作鏡象,能夠透過燒錄軟體將鏡象還原
           http://www.vso-software.fr/
Tools -- : W32Dasm、OllyDbg、MASM32、WIN2000
Cracker  : lq7972[bruceyu13@sina.com]

【】CloneCD 不支援那個電腦商送我的什麼牌子燒錄爛貨;聽說這個行,但只能 Try 20 Days

軟體開始就跳個東東出來說是"使用者要合法使用,任何非法行為及後果它不負責"云云(不曉得是不是這個意思?),
然後就是熟悉的介面:"This software is not ...",提供兩個按鈕:"Buy" OR "Try"(過期後自然只 Buy 了)
; $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $
從紛亂的跟蹤記錄中整理出下面的報告:
軟體在 "Legal Disclarmer" 後開始註冊判斷~
【1】、靜態分析
; W32Dasm >>
; 查詢"BW5.Log"
; 這個地方軟體啟動時來,註冊判斷
:005DE6BC 55                      push ebp
:005DE6BD 8BEC                    mov ebpesp
:005DE6BF B90F000000              mov ecx, 0000000F
; ...
* Possible StringData Ref from Code Obj ->"BW5.Log"
                                  |
:005DE751 B96CF05D00              mov ecx, 005DF06C
:005DE756 8B55FC                  mov edxdword ptr [ebp-04]
:005DE759 8B9214050000            mov edxdword ptr [edx+00000514]
; ...
:005E8EDA E8CDA6E1FF              call 004035AC
:005E8EDF 807DF300                cmp byte ptr [ebp-0D], 00
:005E8EE3 750C                    jne 005E8EF1
:005E8EE5 8B45FC                  mov eaxdword ptr [ebp-04]
:005E8EE8 80B82305000000          cmp byte ptr [eax+00000523], 00
:005E8EEF 7425                    je 005E8F16                 ; 關鍵判斷,要 jump,因為
; ...
* Reference To: user32.PostQuitMessage, Ord:0000h
                                  |
:005E8F11 E82EE6E1FF              Call 00407544

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:005E8EEF(C), :005E8F09(C)
|
:005E8F16 8B45FC                  mov eaxdword ptr [ebp-04]
:005E8F19 80B82305000000          cmp byte ptr [eax+00000523], 00
:005E8F20 750C                    jne 005E8F2E                ; 關鍵判斷,不要 jump,因為
:005E8F22 8B45FC                  mov eaxdword ptr [ebp-04]
:005E8F25 80B82205000000          cmp byte ptr [eax+00000522], 00
:005E8F2C 743B                    je 005E8F69                 ; 這裡
; ...
* Reference To: user32.PostQuitMessage, Ord:0000h
                                  |
:005E8F64 E8DBE5E1FF              Call 00407544

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:005E8F2C(C), :005E8F5C(C)
|
:005E8F69 8B45FC                  mov eaxdword ptr [ebp-04]
; ...

【2】、動態跟蹤
; W32Dasm >>
; 查詢"This software is not free. But "
; -----------------------------------------------------------------------------------
:005DB51C 55                      push ebp
; ...
:005DB52B E87CF9FFFF              call 005DAEAC
; -----------------------------------------------------------------------------------
* Referenced by a CALL at Address:
|:005DB52B   
|
:005DAEAC 55                      push ebp
; ...
* Possible StringData Ref from Code Obj ->"This software is not free. But "
                                        ->"you can try it for free."
                                  |
:005DAF16 BAA0B35D00              mov edx, 005DB3A0
; ...

; OllyDbg >>
005DB51C 處斷點,檢視堆疊:0047418B,這個就是 CALL 指令壓入的返回地址

; W32Dasm >>
; ...
:0047417B 8BD8                    mov ebxeax
:0047417D 8BD0                    mov edxeax
:0047417F 8B83CC020000            mov eaxdword ptr [ebx+000002CC]
:00474185 FF93C8020000            call dword ptr [ebx+000002C8] ; 就是這個 CALL 了

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474179(C)
|
:0047418B 5B                      pop ebx
; ...

【3】、修改總結
(1) 005E8EEF : 7425 → 7525               (Offset : 001E82EF)
(2) 005E8F20 : 750C → 740C               (Offset : 001E8320)
(3) 00474185 :  CALL NOP 掉(6個90)        (Offset : 00073585)
或  005DB51C : 55 →  CC                  (Offset : 001DA91C)
(4) 005D9998 : 7571 → 7471               (Offset : 001D8D98)
在 [Settings]->[Registration] 中是 "This software is registered to ",而非 "This software is in trial mode "

【4】、自己動手寫檔案補丁
雖然有 KeyMake ,但今天自己動手明天豐衣足食

; Patch.asm
; +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
            .386
            .model flat, stdcall
            option casemap : none
; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include         windows.inc
include         user32.inc
includelib      user32.lib
include         kernel32.inc
includelib      kernel32.lib
; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
DLG_MAIN        equ      101
ICO_MAIN        equ      102
IDC_BACKUP      equ      1001
IDC_FILEEXT     equ      1002
; ***************************************************************************************
PATCH_POS01      equ      001D8D98h
PATCH_POS02      equ      001DA91Ch
PATCH_POS03      equ      001E82EFh
PATCH_POS04      equ      001E8320h
; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
         .data?
hInstance        dd      ?
szNewFilename    db      MAX_PATH dup (?)
         .data
szFileExtension  db      '.bak', 0
; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
         .const
dbPatched01      db   74h, 71h
dbPatched02      db   0CCh
dbPatched03      db   75h, 25h
dbPatched04      db   74h, 0Ch
ddFileSize       dd   3AD200h
szExeFilename    db   'BW.exe', 0
szInfo           db   'Info', 0
szOkInfo         db   'Success ...', 0
szErrExec        db   '<BW.exe> not found!', 0
szErrFileSize    db   '<BW.exe> is incorrect size!', 0
; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
         .code
; ***************************************************************************************
_ProcPatch  proc
            local   @hFile, @lpBuffer, @lpTemp
            pushad
            
            invoke   CreateFile, addr szExeFilename, GENERIC_READ or GENERIC_WRITE,\
                     0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL
            .if      eax == INVALID_HANDLE_VALUE
                     invoke   MessageBox, NULL, addr szErrExec, addr szInfo, MB_OK
            .else
                  mov      @hFile, eax
                  invoke   GetFileSize, @hFile, NULL
                  .if      eax != dword ptr [ddFileSize]
                           invoke   MessageBox, NULL, addr szErrFileSize,\
                                 addr szInfo, MB_OK
                  .else
; ***************************************************************************************
                        invoke   SetFilePointer, @hFile, PATCH_POS01,\
                                 NULL, FILE_BEGIN
                        invoke   WriteFile, @hFile, addr dbPatched01, 2,\
                                 addr @lpTemp, NULL
; ***************************************************************************************
                        invoke   SetFilePointer, @hFile, PATCH_POS02,\
                                 NULL, FILE_BEGIN
                        invoke   WriteFile, @hFile, addr dbPatched02, 1,\
                                 addr @lpTemp, NULL
; ***************************************************************************************
                        invoke   SetFilePointer, @hFile, PATCH_POS03,\
                                 NULL, FILE_BEGIN
                        invoke   WriteFile, @hFile, addr dbPatched03, 2,\
                                 addr @lpTemp, NULL
; ***************************************************************************************
                        invoke   SetFilePointer, @hFile, PATCH_POS04,\
                                 NULL, FILE_BEGIN
                        invoke   WriteFile, @hFile, addr dbPatched04, 2,\
                                 addr @lpTemp, NULL
; ***************************************************************************************   
                        invoke   MessageBox, NULL, addr szOkInfo, addr szInfo, MB_OK
                  .endif
            .endif
            
            popad
            ret
_ProcPatch  endp
; ***************************************************************************************
_ProcDlgMain    proc   uses ebx edi esi hWnd, wMsg, wParam, lParam

            mov       eax, wMsg
            .if       eax == WM_CLOSE
                      invoke   EndDialog, hWnd, NULL
            .elseif   eax == WM_INITDIALOG
                      invoke   SetDlgItemText, hWnd, IDC_FILEEXT, addr szFileExtension
                      invoke   CheckDlgButton, hWnd, IDC_BACKUP, BST_CHECKED
            .elseif   eax == WM_COMMAND
                  mov      eax, wParam
                  .if      ax == IDOK
                           invoke   IsDlgButtonChecked, hWnd, IDC_BACKUP
                           .if      eax == BST_CHECKED
                                    invoke   GetDlgItemText, hWnd, IDC_FILEEXT,\
                                             addr szFileExtension, sizeof szFileExtension
                                    invoke   lstrcpy, addr szNewFilename, addr szExeFilename
                                    invoke   lstrcat, addr szNewFilename, addr szFileExtension
                                    invoke   CopyFile, addr szExeFilename,\
                                             addr szNewFilename, FALSE
                        .endif
                        call        _ProcPatch
                  .elseif   ax == IDCANCEL
                        invoke   EndDialog, hWnd, NULL
                  .endif
            .else
                  mov      eax, FALSE
                  ret
            .endif
            mov      eax, TRUE
            ret

_ProcDlgMain   endp
; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
      invoke   GetModuleHandle, NULL
      mov      hInstance, eax
      invoke   DialogBoxParam, hInstance, DLG_MAIN, NULL, addr _ProcDlgMain, NULL
      invoke   ExitProcess, NULL
; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
      end      start

// Patch.rc
// ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#include <resource.h>

#define DLG_MAIN                        101
#define ICO_MAIN                        102
#define IDC_BACKUP                      1001
#define IDC_FILEEXT                     1002

ICO_MAIN            ICON            "Patch.ico"

DLG_MAIN DIALOGEX 0, 0, 91, 109
STYLE DS_MODALFRAME | DS_CENTER | WS_POPUP | WS_CAPTION | WS_SYSMENU
CAPTION "BlindWrite 檔案補丁"
FONT 10, "System"
BEGIN
    DEFPUSHBUTTON   "補丁",IDOK,9,62,31,12
    PUSHBUTTON      "退出",IDCANCEL,50,62,31,12
    LTEXT           "除去所有的限制\nCrack by lq7972\nbruceyu13@sina.com",
                    IDC_STATIC,9,28,72,28,WS_DISABLED,WS_EX_STATICEDGE
    LTEXT           "BlindWrite Suite\n v5.1.5.132 檔案補丁",IDC_STATIC,9,6,
                    72,18,WS_BORDER
    GROUPBOX        "",IDC_STATIC,8,77,73,25
    CONTROL         "檔案備份",IDC_BACKUP,"Button",BS_AUTOCHECKBOX | 
                    WS_TABSTOP,14,88,43,8
    EDITTEXT        IDC_FILEEXT,58,86,19,12,ES_AUTOHSCROLL
END

# makefile
# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
NAME = Patch
OBJS = $(NAME).obj
RES = $(NAME).res

LINK_FLAG = /subsystem:windows
ML_FLAG = /c /coff

$(NAME).exe: $(OBJS) $(RES)
   Link $(LINK_FLAG) $(OBJS) $(RES)

.asm.obj:
   ml $(ML_FLAG) $<
.rc.res:
   rc $<
   
clean:
   del *.obj
   del *.res

相關文章