輕輕鬆鬆進銷存基礎版V2.0
用UNFOXALL
2.0反編譯告知不是FOX檔案
用TRW2000動態跟蹤
下斷CREATEFILEA
當開啟檔名是主程式名時
下斷READFILE
中斷第三次是看看BUFFER中的內容
E6
DA 2D 73....
不是APP的檔案頭FE F2 ...
跟蹤程式如何處理這些資料,BPM 17AF00C
來到如下程式碼,位置是VFP6R.DLL的gtide段,說明程式用自己的dll檔案動態解密
*
Referenced by a CALL at Addresses:
|:0C2EF83A , :0C2EF929 , :0C2EF9F8
, :0C2EFAE0
|
:0C2F3486 55
push ebp
:0C2F3487 8BEC
mov ebp, esp
:0C2F3489
83EC08 sub esp,
00000008
:0C2F348C 53
push ebx
:0C2F348D 56
push esi
:0C2F348E 57
push edi
:0C2F348F
C745FC00000000 mov [ebp-04], 00000000
:0C2F3496
EB03 jmp
0C2F349B
* Referenced
by a (U)nconditional or (C)onditional Jump at Address:
|:0C2F34CB(U)
|
:0C2F3498
FF45FC inc [ebp-04]
<-已解碼位元組數
*
Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0C2F3496(U)
|
:0C2F349B
8B450C mov eax,
dword ptr [ebp+0C] <-需要解碼的位元組數
:0C2F349E 3945FC
cmp dword ptr [ebp-04],
eax <-比較,解碼完則轉
:0C2F34A1 732A
jnb 0C2F34CD
:0C2F34A3 8B45FC
mov eax, dword ptr
[ebp-04]
:0C2F34A6 8B4D08
mov ecx, dword ptr [ebp+08] <-加密文字緩衝區指標
:0C2F34A9
33D2 xor
edx, edx
:0C2F34AB 8A1401
mov dl, byte ptr [ecx+eax] <-取字元
:0C2F34AE
8A82DAD2320C mov al, byte ptr [edx+0C32D2DA]
<-查密碼本
:0C2F34B4 8845F8
mov byte ptr [ebp-08], al
:0C2F34B7 33C0
xor eax, eax
:0C2F34B9
8A45F8 mov al, byte
ptr [ebp-08]
:0C2F34BC 8A80DAD3320C mov
al, byte ptr [eax+0C32D3DA] <-查密碼本
:0C2F34C2 8B4DFC
mov ecx, dword ptr [ebp-04]
:0C2F34C5 8B5508
mov edx, dword ptr [ebp+08]
:0C2F34C8 88040A
mov byte ptr [edx+ecx], al
<-解密後字元送回
:0C2F34CB EBCB
jmp 0C2F3498
*
Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0C2F34A1(C)
|
:0C2F34CD
5F pop
edi
:0C2F34CE 5E
pop esi
:0C2F34CF 5B
pop ebx
:0C2F34D0 C9
leave
:0C2F34D1 C3
ret
從0c32d2da
開始的200h位元組是解密的金鑰
經過解密處理後再看看
FE F2 EE 已經是APP檔案的檔案頭了
將0c32d2da
開始的200h位元組寫入一個檔案,取名code.key
用hex workshop開啟主程式,查詢E6 DA 2D 73....,將一直到檔案結束的內容寫到另一個檔案,
取名code.app
寫一段程式解密
我使用vb寫的
Dim
keyfiledata(512) As Byte
Dim codefiledata As Byte
Dim middata As Byte
Dim
keyfilelen As Long
keyfilelen = FileLen("code.key")
Open "code.Key"
For Binary As #1
For i = 1 To keyfilelen
Get
#1, i, keyfiledata(i)
Next i
Close #1
keyfilelen
= FileLen("code.app")
Open "code.app" For Binary
As #2
For i = 1 To keyfilelen
Get #2, i, codefiledata
middata = keyfiledata(keyfiledata(codefiledata + 1) +
257)
Put #2, i, middata
Next i
Close #2
MsgBox "finish"
vb就是慢,登上一會之後,告知finish
用unfoxall
反編譯一下,所有的程式碼都能反編譯出來,你可以隨心所欲了!
想做成exe檔案嗎?
用vpf編譯一個exe檔案,將1e00h以後的東西刪掉,將code.app貼到1e00h開始的地方.
執行一下,完全正常