逆向学习笔记01——文件验证
1.文件验证
文件验证类型:.ini ; .dat ; .dll ……
2.破解思路
不管怎么样文件验证,一定会有 读取文件 这一步骤。 一般破解的方法都在 读取文件 这一代吗周围展开
3.破解方法
找关键跳
4.模拟实例
编写一个基于MFC的简单模拟文件验证程序
代码如下:
1 // FILE验证Dlg.cpp : implementation file 2 // 3 4 #include "stdafx.h" 5 #include "FILE验证.h" 6 #include "FILE验证Dlg.h" 7 8 #ifdef _DEBUG 9 #define new DEBUG_NEW 10 #undef THIS_FILE 11 static char THIS_FILE[] = __FILE__; 12 #endif 13 14 ///////////////////////////////////////////////////////////////////////////// 15 // CAboutDlg dialog used for App About 16 17 class CAboutDlg : public CDialog 18 { 19 public: 20 CAboutDlg(); 21 22 // Dialog Data 23 //{{AFX_DATA(CAboutDlg) 24 enum { IDD = IDD_ABOUTBOX }; 25 //}}AFX_DATA 26 27 // ClassWizard generated virtual function overrides 28 //{{AFX_VIRTUAL(CAboutDlg) 29 protected: 30 virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support 31 //}}AFX_VIRTUAL 32 33 // Implementation 34 protected: 35 //{{AFX_MSG(CAboutDlg) 36 //}}AFX_MSG 37 DECLARE_MESSAGE_MAP() 38 }; 39 40 CAboutDlg::CAboutDlg() : CDialog(CAboutDlg::IDD) 41 { 42 //{{AFX_DATA_INIT(CAboutDlg) 43 //}}AFX_DATA_INIT 44 } 45 46 void CAboutDlg::DoDataExchange(CDataExchange* pDX) 47 { 48 CDialog::DoDataExchange(pDX); 49 //{{AFX_DATA_MAP(CAboutDlg) 50 //}}AFX_DATA_MAP 51 } 52 53 BEGIN_MESSAGE_MAP(CAboutDlg, CDialog) 54 //{{AFX_MSG_MAP(CAboutDlg) 55 // No message handlers 56 //}}AFX_MSG_MAP 57 END_MESSAGE_MAP() 58 59 ///////////////////////////////////////////////////////////////////////////// 60 // CFILEDlg dialog 61 62 CFILEDlg::CFILEDlg(CWnd* pParent /*=NULL*/) 63 : CDialog(CFILEDlg::IDD, pParent) 64 { 65 //{{AFX_DATA_INIT(CFILEDlg) 66 m_EditKey = _T(""); 67 //}}AFX_DATA_INIT 68 // Note that LoadIcon does not require a subsequent DestroyIcon in Win32 69 m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME); 70 } 71 72 void CFILEDlg::DoDataExchange(CDataExchange* pDX) 73 { 74 CDialog::DoDataExchange(pDX); 75 //{{AFX_DATA_MAP(CFILEDlg) 76 DDX_Text(pDX, EDIT_KEY, m_EditKey); 77 //}}AFX_DATA_MAP 78 } 79 80 BEGIN_MESSAGE_MAP(CFILEDlg, CDialog) 81 //{{AFX_MSG_MAP(CFILEDlg) 82 ON_WM_SYSCOMMAND() 83 ON_WM_PAINT() 84 ON_WM_QUERYDRAGICON() 85 ON_BN_CLICKED(BTN_LOGIN, OnLogin) 86 //}}AFX_MSG_MAP 87 END_MESSAGE_MAP() 88 89 ///////////////////////////////////////////////////////////////////////////// 90 // CFILEDlg message handlers 91 92 BOOL CFILEDlg::OnInitDialog() 93 { 94 CDialog::OnInitDialog(); 95 96 // Add "About..." menu item to system menu. 97 98 // IDM_ABOUTBOX must be in the system command range. 99 ASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX); 100 ASSERT(IDM_ABOUTBOX < 0xF000); 101 102 CMenu* pSysMenu = GetSystemMenu(FALSE); 103 if (pSysMenu != NULL) 104 { 105 CString strAboutMenu; 106 strAboutMenu.LoadString(IDS_ABOUTBOX); 107 if (!strAboutMenu.IsEmpty()) 108 { 109 pSysMenu->AppendMenu(MF_SEPARATOR); 110 pSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu); 111 } 112 } 113 114 // Set the icon for this dialog. The framework does this automatically 115 // when the application's main window is not a dialog 116 SetIcon(m_hIcon, TRUE); // Set big icon 117 SetIcon(m_hIcon, FALSE); // Set small icon 118 119 // TODO: Add extra initialization here 120 121 DWORD dwValue = PROCESS_ALL_ACCESS; 122 123 HANDLE hFile = CreateFile("文件验证.txt", GENERIC_WRITE, FILE_SHARE_WRITE, 124 NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL); 125 126 CHAR szKey[] = "文件密码"; 127 128 if(INVALID_HANDLE_VALUE == hFile) 129 { 130 // AfxMessageBox("产生机器码文件失败!"); 131 } 132 else 133 { 134 // AfxMessageBox("产生机器码文件成功!"); 135 136 137 DWORD dwWriteLen = 0; 138 139 WriteFile(hFile, szKey, sizeof(szKey) - 1, &dwWriteLen, NULL); 140 } 141 142 143 CloseHandle(hFile); 144 145 146 return TRUE; // return TRUE unless you set the focus to a control 147 } 148 149 void CFILEDlg::OnSysCommand(UINT nID, LPARAM lParam) 150 { 151 if ((nID & 0xFFF0) == IDM_ABOUTBOX) 152 { 153 CAboutDlg dlgAbout; 154 dlgAbout.DoModal(); 155 } 156 else 157 { 158 CDialog::OnSysCommand(nID, lParam); 159 } 160 } 161 162 // If you add a minimize button to your dialog, you will need the code below 163 // to draw the icon. For MFC applications using the document/view model, 164 // this is automatically done for you by the framework. 165 166 void CFILEDlg::OnPaint() 167 { 168 if (IsIconic()) 169 { 170 CPaintDC dc(this); // device context for painting 171 172 SendMessage(WM_ICONERASEBKGND, (WPARAM) dc.GetSafeHdc(), 0); 173 174 // Center icon in client rectangle 175 int cxIcon = GetSystemMetrics(SM_CXICON); 176 int cyIcon = GetSystemMetrics(SM_CYICON); 177 CRect rect; 178 GetClientRect(&rect); 179 int x = (rect.Width() - cxIcon + 1) / 2; 180 int y = (rect.Height() - cyIcon + 1) / 2; 181 182 // Draw the icon 183 dc.DrawIcon(x, y, m_hIcon); 184 } 185 else 186 { 187 CDialog::OnPaint(); 188 } 189 } 190 191 // The system calls this to obtain the cursor to display while the user drags 192 // the minimized window. 193 HCURSOR CFILEDlg::OnQueryDragIcon() 194 { 195 return (HCURSOR) m_hIcon; 196 } 197 198 void CFILEDlg::OnLogin() 199 { 200 UpdateData(); 201 202 203 HANDLE hFile = CreateFile("半斤八两.txt", GENERIC_READ, FILE_SHARE_READ, 204 NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); 205 206 207 208 BYTE szReadKey[255] = {0}; 209 DWORD dwReadLen = 0; 210 211 212 if(INVALID_HANDLE_VALUE == hFile) 213 { 214 AfxMessageBox("读取机器码文件失败!"); 215 } 216 else 217 { 218 // AfxMessageBox("读取机器码文件成功!"); 219 220 ReadFile(hFile, szReadKey, 255, &dwReadLen, NULL); 221 } 222 223 if(strcmp((LPTSTR)szReadKey, m_EditKey.GetBuffer(0)) == 0) 224 { 225 AfxMessageBox("注册成功!"); 226 227 228 m_VIPDlg.DoModal(); 229 } 230 else 231 { 232 AfxMessageBox("注册失败!"); 233 } 234 235 236 CloseHandle(hFile); 237 }
要想绕过文件验证,得找到关键跳:判断验证码是否正确,然后入时间验证一样破解
找关键跳:
1.从读取文件入手

下单字节的文件读取,没有断下来试下双字节的。

程序断下来了。
2.ESP堆栈跟过来

注意这里是系统领空,我们要返回程序的领空。这里我们执行到返回或者执行到用户代码。
3.找关键跳

5.破解
(1)改Z标志位

(2)NOP掉关键位

6.保存为破解版
其他思路:
查找超级字符串

直接定位到注册失败位置即可。

浙公网安备 33010602011771号