OICQ HACK 1.0 B 可执行文件:OicqHack.exe
此程序未注册将无法开启多号码探测和号码文件列表模式。
演算方式:将用户输入的Register进行演算(输入的前6位不参于演算),将程序的Serial进行演算(同Award BIOS密码演算方法一样),比较两次演算的结果,相同则注册成功。
由于倒算注册码嫌麻烦,改用修改法:
破解过程如下:
:00405C65 8935EC5E4400 mov dword
ptr [00445EEC], esi
:00405C6B 8BD6
mov edx, esi
:00405C6D 83C224
add edx, 00000024
:00405C70 B911000000 mov ecx,
00000011
:00405C75 8B83D4010000 mov eax, dword
ptr [ebx+000001D4]
:00405C7B E8D48A0000 call
0040E754
:00405C80 A1EC5E4400 mov eax,
dword ptr [00445EEC]
:00405C85 50
push eax
:00405C86 E845F9FFFF call
004055D0――――――――――――――――进入总比较call
:00405C8B 59
pop ecx
:00405C8C 85C0
test eax, eax――――――――――――――――为0就为未注册
:00405C8E 7415
je 00405CA5
:00405C90 6A00
push 00000000
* Possible StringData Ref from Data Obj ->"Registration Successed"
|
:00405C92 68DF144400 push
004414DF
* Possible StringData Ref from Data Obj ->"Thanks for your registration, "――――――――通过
->"all limits
are removed now."
|
:00405C97 68A5144400 push
004414A5
:00405C9C 6A00
push 00000000
* Reference To: USER32.MessageBoxA, Ord:0000h
|
:00405C9E E8A3700300 Call
0043CD46
:00405CA3 EB13
jmp 00405CB8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405C8E(C)
|
:00405CA5 6A00
push 00000000
* Possible StringData Ref from Data Obj ->"Registration failed"
|
:00405CA7 680F154400 push
0044150F
* Possible StringData Ref from Data Obj ->"Incorrect register code."――――――――未通过
|
:00405CAC 68F6144400 push
004414F6
:00405CB1 6A00
push 00000000
* Reference To: USER32.MessageBoxA, Ord:0000h
|
:00405CB3 E88E700300 Call
0043CD46
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405CA3(U)
|
:00405CB8 6A03
push 00000003
:00405CBA 8B15EC5E4400 mov edx, dword
ptr [00445EEC]
:00405CC0 52
push edx
:00405CC1 E8EEF8FFFF call
004055B4
:00405CC6 83C408
add esp, 00000008
:00405CC9 8BC3
mov eax, ebx
:00405CCB E8203E0100 call
00419AF0
:00405CD0 8B55D8
mov edx, dword ptr [ebp-28]
:00405CD3 64891500000000 mov dword ptr fs:[00000000],
edx
:00405CDA 5E
pop esi
:00405CDB 5B
pop ebx
:00405CDC 8BE5
mov esp, ebp
:00405CDE 5D
pop ebp
:00405CDF C3
ret
总比较call
:004055D0 55
push ebp
:004055D1 8BEC
mov ebp, esp
:004055D3 53
push ebx
:004055D4 56
push esi
:004055D5 57
push edi
:004055D6 8B5D08
mov ebx, dword ptr [ebp+08]
:004055D9 8D4304
lea eax, dword ptr [ebx+04]
:004055DC 50
push eax
:004055DD 53
push ebx
:004055DE E8E5000000 call
004056C8
:004055E3 83C408
add esp, 00000008
:004055E6 8D7324
lea esi, dword ptr [ebx+24]
:004055E9 83C606
add esi, 00000006
:004055EC 56
push esi
:004055ED E8DA340300 call
00438ACC――――――――――――此call将用户输入的Register进行演算
:004055F2 59
pop ecx
由于程序此后还将多次调用此call对用户输入的Register进行计算并比较
:004055F3 8BF8
mov edi, eax
所以改下面的那个jne是没有用的,最好的方法是改这个call
:004055F5 897B44
mov dword ptr [ebx+44], edi
:004055F8 8D4304
lea eax, dword ptr [ebx+04]
:004055FB 50
push eax
:004055FC 53
push ebx
:004055FD E89A000000 call
0040569C――――――――――――此call将程序的Serial进行演算,我的Serial是:OH100B4003312064,经此call演算后为45303DA5
:00405602 83C408
add esp, 00000008
:00405605 3BF8
cmp edi, eax
:00405607 751A
jne 00405623
:00405609 8D5324
lea edx, dword ptr [ebx+24]
:0040560C 52
push edx
:0040560D 53
push ebx
:0040560E E82D040000 call
00405A40
:00405613 83C408
add esp, 00000008
:00405616 C70301000000 mov dword
ptr [ebx], 00000001
:0040561C B801000000 mov eax,
00000001
:00405621 EB06
jmp 00405629
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405607(C)
|
:00405623 33D2
xor edx, edx
:00405625 33C0
xor eax, eax
:00405627 8913
mov dword ptr [ebx], edx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405621(U)
|
:00405629 5F
pop edi
:0040562A 5E
pop esi
:0040562B 5B
pop ebx
:0040562C 5D
pop ebp
:0040562D C3
ret
此call将用户输入的Register进行演算(有N多个地方将调用它,也就可知演算不只一次)
* Referenced by a CALL at Addresses:
|:004016B8 , :004017E3 , :00401F0F , :00401F19 , :004023A5
|:004023AF , :004023D1 , :004037E2 , :004037F3 , :0040389E
|:004038AA , :00403BC4 , :00403C51 , :0040439E , :004043A7
|:004047EC , :00404815 , :0040483E , :00404977 , :00404986
|:004049C5 , :004049D1 , :00405560 , :004055ED , :00438B3B
|
:00438ACC 55
push ebp
:00438ACD 8BEC
mov ebp, esp
:00438ACF 53
push ebx
:00438AD0 56
push esi
:00438AD1 57
push edi
:00438AD2 33FF
xor edi, edi
:00438AD4 8B7508
mov esi, dword ptr [ebp+08]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438AE6(C)
|
:00438AD7 8A1E
mov bl, byte ptr [esi]
:00438AD9 46
inc esi
:00438ADA 0FBEC3
movsx eax, bl
:00438ADD 50
push eax
:00438ADE E8DD1B0000 call
0043A6C0
:00438AE3 59
pop ecx
:00438AE4 85C0
test eax, eax
:00438AE6 75EF
jne 00438AD7
:00438AE8 80FB2B
cmp bl, 2B
:00438AEB 7405
je 00438AF2
:00438AED 80FB2D
cmp bl, 2D
:00438AF0 750E
jne 00438B00
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438AEB(C)
|
:00438AF2 80FB2D
cmp bl, 2D
:00438AF5 0F94C0
sete al
:00438AF8 83E001
and eax, 00000001
:00438AFB 8A1E
mov bl, byte ptr [esi]
:00438AFD 46
inc esi
:00438AFE EB18
jmp 00438B18
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438AF0(C)
|
:00438B00 33C0
xor eax, eax
:00438B02 EB14
jmp 00438B18
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B20(C)
|
:00438B04 0FBECB
movsx ecx, bl
:00438B07 8BD7
mov edx, edi
:00438B09 8A1E
mov bl, byte ptr [esi]
:00438B0B 03D2
add edx, edx
:00438B0D 8D1492
lea edx, dword ptr [edx+4*edx]
:00438B10 03D1
add edx, ecx
:00438B12 83C2D0
add edx, FFFFFFD0
:00438B15 46
inc esi
:00438B16 8BFA
mov edi, edx
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438AFE(U), :00438B02(U)
|
:00438B18 80FB30
cmp bl, 30
:00438B1B 7C05
jl 00438B22
:00438B1D 80FB39
cmp bl, 39
:00438B20 7EE2
jle 00438B04
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B1B(C)
|
:00438B22 85C0
test eax, eax―――――――不管别的,将这一锅改为:mov eax,45303DA5
:00438B24 7406
je 00438B2C――――――――――――
nop
:00438B26 8BC7
mov eax, edi――――――――――――
nop
:00438B28 F7D8
neg eax――――――――――――――
nop
:00438B2A EB02
jmp 00438B2E――――――――――――
nop
nop
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
nop
|:00438B24(C)
nop
|
:00438B2C 8BC7
mov eax, edi―――――――一共7个nop,这样字节数刚好。这样退出此call后eax就是45303DA5
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B2A(U)
|
:00438B2E 5F
pop edi
:00438B2F 5E
pop esi
:00438B30 5B
pop ebx
:00438B31 5D
pop ebp
:00438B32 C3
ret
最后整理:
用UltraEdit载入OicqHack.exe
查找:7c 05 80 fb 39 7e e2 85 c0 74 06 8b c7 f7 d8 eb 02 8b c7
5f 5e 5b 5d
改为:― ― ― ― ― ― ― b8 a5 3d 30 45 90 90 90 90 90 90 90 ― ― ― ―
注:( ― 为不改变)
改完收工!!!
经过以上其实还有问题,你们自己看看动动手吧。