逆向学习笔记01——文件验证

1.文件验证

  文件验证类型:.ini ; .dat ; .dll ……

 

2.破解思路

  不管怎么样文件验证,一定会有 读取文件 这一步骤。 一般破解的方法都在 读取文件 这一代吗周围展开

 

3.破解方法

  找关键跳

4.模拟实例

  编写一个基于MFC的简单模拟文件验证程序

 

  代码如下:

  1 // FILE验证Dlg.cpp : implementation file
  2 //
  3 
  4 #include "stdafx.h"
  5 #include "FILE验证.h"
  6 #include "FILE验证Dlg.h"
  7 
  8 #ifdef _DEBUG
  9 #define new DEBUG_NEW
 10 #undef THIS_FILE
 11 static char THIS_FILE[] = __FILE__;
 12 #endif
 13 
 14 /////////////////////////////////////////////////////////////////////////////
 15 // CAboutDlg dialog used for App About
 16 
 17 class CAboutDlg : public CDialog
 18 {
 19 public:
 20     CAboutDlg();
 21 
 22 // Dialog Data
 23     //{{AFX_DATA(CAboutDlg)
 24     enum { IDD = IDD_ABOUTBOX };
 25     //}}AFX_DATA
 26 
 27     // ClassWizard generated virtual function overrides
 28     //{{AFX_VIRTUAL(CAboutDlg)
 29     protected:
 30     virtual void DoDataExchange(CDataExchange* pDX);    // DDX/DDV support
 31     //}}AFX_VIRTUAL
 32 
 33 // Implementation
 34 protected:
 35     //{{AFX_MSG(CAboutDlg)
 36     //}}AFX_MSG
 37     DECLARE_MESSAGE_MAP()
 38 };
 39 
 40 CAboutDlg::CAboutDlg() : CDialog(CAboutDlg::IDD)
 41 {
 42     //{{AFX_DATA_INIT(CAboutDlg)
 43     //}}AFX_DATA_INIT
 44 }
 45 
 46 void CAboutDlg::DoDataExchange(CDataExchange* pDX)
 47 {
 48     CDialog::DoDataExchange(pDX);
 49     //{{AFX_DATA_MAP(CAboutDlg)
 50     //}}AFX_DATA_MAP
 51 }
 52 
 53 BEGIN_MESSAGE_MAP(CAboutDlg, CDialog)
 54     //{{AFX_MSG_MAP(CAboutDlg)
 55         // No message handlers
 56     //}}AFX_MSG_MAP
 57 END_MESSAGE_MAP()
 58 
 59 /////////////////////////////////////////////////////////////////////////////
 60 // CFILEDlg dialog
 61 
 62 CFILEDlg::CFILEDlg(CWnd* pParent /*=NULL*/)
 63     : CDialog(CFILEDlg::IDD, pParent)
 64 {
 65     //{{AFX_DATA_INIT(CFILEDlg)
 66     m_EditKey = _T("");
 67     //}}AFX_DATA_INIT
 68     // Note that LoadIcon does not require a subsequent DestroyIcon in Win32
 69     m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);
 70 }
 71 
 72 void CFILEDlg::DoDataExchange(CDataExchange* pDX)
 73 {
 74     CDialog::DoDataExchange(pDX);
 75     //{{AFX_DATA_MAP(CFILEDlg)
 76     DDX_Text(pDX, EDIT_KEY, m_EditKey);
 77     //}}AFX_DATA_MAP
 78 }
 79 
 80 BEGIN_MESSAGE_MAP(CFILEDlg, CDialog)
 81     //{{AFX_MSG_MAP(CFILEDlg)
 82     ON_WM_SYSCOMMAND()
 83     ON_WM_PAINT()
 84     ON_WM_QUERYDRAGICON()
 85     ON_BN_CLICKED(BTN_LOGIN, OnLogin)
 86     //}}AFX_MSG_MAP
 87 END_MESSAGE_MAP()
 88 
 89 /////////////////////////////////////////////////////////////////////////////
 90 // CFILEDlg message handlers
 91 
 92 BOOL CFILEDlg::OnInitDialog()
 93 {
 94     CDialog::OnInitDialog();
 95 
 96     // Add "About..." menu item to system menu.
 97 
 98     // IDM_ABOUTBOX must be in the system command range.
 99     ASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX);
100     ASSERT(IDM_ABOUTBOX < 0xF000);
101 
102     CMenu* pSysMenu = GetSystemMenu(FALSE);
103     if (pSysMenu != NULL)
104     {
105         CString strAboutMenu;
106         strAboutMenu.LoadString(IDS_ABOUTBOX);
107         if (!strAboutMenu.IsEmpty())
108         {
109             pSysMenu->AppendMenu(MF_SEPARATOR);
110             pSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu);
111         }
112     }
113 
114     // Set the icon for this dialog.  The framework does this automatically
115     //  when the application's main window is not a dialog
116     SetIcon(m_hIcon, TRUE);            // Set big icon
117     SetIcon(m_hIcon, FALSE);        // Set small icon
118     
119     // TODO: Add extra initialization here
120 
121     DWORD dwValue = PROCESS_ALL_ACCESS;
122 
123     HANDLE hFile = CreateFile("文件验证.txt", GENERIC_WRITE, FILE_SHARE_WRITE,
124         NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL);
125     
126     CHAR szKey[] = "文件密码";
127     
128     if(INVALID_HANDLE_VALUE == hFile)
129     {
130 //        AfxMessageBox("产生机器码文件失败!");
131     }
132     else
133     {
134 //        AfxMessageBox("产生机器码文件成功!");
135 
136 
137         DWORD dwWriteLen = 0;
138 
139         WriteFile(hFile, szKey, sizeof(szKey) - 1, &dwWriteLen, NULL);
140     }
141     
142     
143     CloseHandle(hFile);
144     
145     
146     return TRUE;  // return TRUE  unless you set the focus to a control
147 }
148 
149 void CFILEDlg::OnSysCommand(UINT nID, LPARAM lParam)
150 {
151     if ((nID & 0xFFF0) == IDM_ABOUTBOX)
152     {
153         CAboutDlg dlgAbout;
154         dlgAbout.DoModal();
155     }
156     else
157     {
158         CDialog::OnSysCommand(nID, lParam);
159     }
160 }
161 
162 // If you add a minimize button to your dialog, you will need the code below
163 //  to draw the icon.  For MFC applications using the document/view model,
164 //  this is automatically done for you by the framework.
165 
166 void CFILEDlg::OnPaint() 
167 {
168     if (IsIconic())
169     {
170         CPaintDC dc(this); // device context for painting
171 
172         SendMessage(WM_ICONERASEBKGND, (WPARAM) dc.GetSafeHdc(), 0);
173 
174         // Center icon in client rectangle
175         int cxIcon = GetSystemMetrics(SM_CXICON);
176         int cyIcon = GetSystemMetrics(SM_CYICON);
177         CRect rect;
178         GetClientRect(&rect);
179         int x = (rect.Width() - cxIcon + 1) / 2;
180         int y = (rect.Height() - cyIcon + 1) / 2;
181 
182         // Draw the icon
183         dc.DrawIcon(x, y, m_hIcon);
184     }
185     else
186     {
187         CDialog::OnPaint();
188     }
189 }
190 
191 // The system calls this to obtain the cursor to display while the user drags
192 //  the minimized window.
193 HCURSOR CFILEDlg::OnQueryDragIcon()
194 {
195     return (HCURSOR) m_hIcon;
196 }
197 
198 void CFILEDlg::OnLogin() 
199 {
200     UpdateData();
201 
202 
203     HANDLE hFile = CreateFile("半斤八两.txt", GENERIC_READ, FILE_SHARE_READ,
204         NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
205     
206     
207     
208     BYTE szReadKey[255] = {0};
209     DWORD dwReadLen = 0;
210 
211     
212     if(INVALID_HANDLE_VALUE == hFile)
213     {
214         AfxMessageBox("读取机器码文件失败!");
215     }
216     else
217     {
218 //        AfxMessageBox("读取机器码文件成功!");
219 
220         ReadFile(hFile, szReadKey, 255, &dwReadLen, NULL);
221     }
222 
223     if(strcmp((LPTSTR)szReadKey, m_EditKey.GetBuffer(0)) == 0)
224     {
225         AfxMessageBox("注册成功!");
226 
227         
228         m_VIPDlg.DoModal();
229     }
230     else
231     {
232         AfxMessageBox("注册失败!");
233     }
234 
235     
236     CloseHandle(hFile);
237 }

 

  要想绕过文件验证,得找到关键跳:判断验证码是否正确,然后入时间验证一样破解

 

  找关键跳: 

    1.从读取文件入手

      

      下单字节的文件读取,没有断下来试下双字节的。

      

      程序断下来了。

    2.ESP堆栈跟过来

      

    注意这里是系统领空,我们要返回程序的领空。这里我们执行到返回或者执行到用户代码。

  3.找关键跳

    

   5.破解

     (1)改Z标志位

      

     (2)NOP掉关键位

      

  6.保存为破解版

 

其他思路:

    查找超级字符串

      

    直接定位到注册失败位置即可。

 

    

  

posted @ 2016-04-08 15:36  Stone学技术  阅读(196)  评论(0)    收藏  举报