慧琦网通-IE安全卫士 1.2 破解过程全面分析 (22千字)
慧琦网通-IE安全卫士 1.2 破解过程全面分析软件名称：慧琦网通-IE安全卫士 V1.2
软件简介：在浏览某些网站时，用户的个人电脑配置常常被这些网站偷梁换柱，许多人都碰到过这类情况。比如：网页的主页与标题被人设置，WINDOWS的某些功能被人禁用，每次开机时出现一些莫名其妙的网站等等。
下载地址：http://www.shareware.net.cn/download.asp?id={16A46F8E-45C7-4C22-9B0B-28F5EC38CA05}
未注册版限制：最多只能使用15次并有一些功能限制。
破解工具：W32DASM 8.93汉化版、PE iDentifier 0.7 Beta 汉化版、Hiew6.76、UPX 1.20。
破解人：飞鹰[BCG]
E-mail：flithawk@263.net
该软件的注册过程是通过你输入注册信息后，将软件关闭再打开，进行注册。
通过观察注册表可知，该软件的注册信息是被保存在注册表的 HKLM\SOFTWARE\Microsoft\tpcip\CurrentVersion 项目中；每次启动软件都要与该项中的键值比较，看你是否已经注册并判断注册信息是否正确。
下面，我们用 PE iDentifier 0.7 Beta 汉化版 查看可知该软件被用 UPX 加了壳，现在用 UPX 1.20 的 upx -d 命令进行脱壳后，用 W32DASM 8.93汉化版 反编译该软件，并查找 tpcip\CurrentVersion ，找到以下两处：
第一处：
* Possible StringData Ref from Code Obj ->"SOFTWARE\Microsoft\tpcip\CurrentVersion"
|
:0049A644 68E4A64900 push 0049A6E4
:0049A649 6802000080 push 80000002
* Reference To: advapi32.RegCreateKeyExA, Ord:0000h
|
:0049A64E E851C5F6FF Call 00406BA4
:0049A653 85C0 test eax, eax
:0049A655 7563 jne 0049A6BA
:0049A657 8D55F4 lea edx, dword ptr [ebp-0C]
:0049A65A 8B8360050000 mov eax, dword ptr [ebx+00000560]
:0049A660 E80F1DFAFF call 0043C374
:0049A665 8B4DF4 mov ecx, dword ptr [ebp-0C]
* Possible StringData Ref from Code Obj ->"Rotescode"
|
:0049A668 BA14A74900 mov edx, 0049A714
:0049A66D 8B45FC mov eax, dword ptr [ebp-04]
:0049A670 E85F55FDFF call 0046FBD4
:0049A675 8D55F0 lea edx, dword ptr [ebp-10]
:0049A678 8B8370050000 mov eax, dword ptr [ebx+00000570]
:0049A67E E8F11CFAFF call 0043C374
:0049A683 8B4DF0 mov ecx, dword ptr [ebp-10]
* Possible StringData Ref from Code Obj ->"RotesNum"
|
:0049A686 BA28A74900 mov edx, 0049A728
:0049A68B 8B45FC mov eax, dword ptr [ebp-04]
:0049A68E E84155FDFF call 0046FBD4
:0049A693 8D55EC lea edx, dword ptr [ebp-14]
:0049A696 8B8368050000 mov eax, dword ptr [ebx+00000568]
:0049A69C E8D31CFAFF call 0043C374
:0049A6A1 8B4DEC mov ecx, dword ptr [ebp-14]
* Possible StringData Ref from Code Obj ->"Object"
|
:0049A6A4 BA3CA74900 mov edx, 0049A73C
:0049A6A9 8B45FC mov eax, dword ptr [ebp-04]
:0049A6AC E82355FDFF call 0046FBD4
:0049A6B1 8B45FC mov eax, dword ptr [ebp-04]
:0049A6B4 50 push eax
* Reference To: advapi32.RegCloseKey, Ord:0000h
|
:0049A6B5 E8E2C4F6FF Call 00406B9C
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0049A629(C), :0049A655(C)
|
:0049A6BA 33C0 xor eax, eax
:0049A6BC 5A pop edx
:0049A6BD 59 pop ecx
:0049A6BE 59 pop ecx
:0049A6BF 648910 mov dword ptr fs:[eax], edx
:0049A6C2 68DCA64900 push 0049A6DC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049A6DA(U)
|
:0049A6C7 8D45EC lea eax, dword ptr [ebp-14]
:0049A6CA BA03000000 mov edx, 00000003
:0049A6CF E8C49FF6FF call 00404698
:0049A6D4 C3 ret
上面这些汇编代码的作用是：当软件退出时，把你输入的注册信息写入到注册表相关的项目中。
第二处：
* Possible StringData Ref from Code Obj ->"SOFTWARE\Microsoft\tpcip\CurrentVersion"
|
:0049A0FB 6850A44900 push 0049A450
:0049A100 6802000080 push 80000002
* Reference To: advapi32.RegCreateKeyExA, Ord:0000h
|
:0049A105 E89ACAF6FF Call 00406BA4
:0049A10A 85C0 test eax, eax
:0049A10C 7548 jne 0049A156
:0049A10E 8D45FC lea eax, dword ptr [ebp-04]
:0049A111 50 push eax
* Possible StringData Ref from Code Obj ->"PPPPP"
|
:0049A112 B980A44900 mov ecx, 0049A480
* Possible StringData Ref from Code Obj ->"Rotescode"
|
:0049A117 BA90A44900 mov edx, 0049A490
:0049A11C 8B45F0 mov eax, dword ptr [ebp-10]
:0049A11F E87859FDFF call 0046FA9C
:0049A124 8D45F8 lea eax, dword ptr [ebp-08]
:0049A127 50 push eax
* Possible StringData Ref from Code Obj ->"H012123"
|
:0049A128 B9A4A44900 mov ecx, 0049A4A4
* Possible StringData Ref from Code Obj ->"RotesNum"
|
:0049A12D BAB4A44900 mov edx, 0049A4B4
:0049A132 8B45F0 mov eax, dword ptr [ebp-10]
:0049A135 E86259FDFF call 0046FA9C
:0049A13A 8D45F4 lea eax, dword ptr [ebp-0C]
:0049A13D 50 push eax
:0049A13E 33C9 xor ecx, ecx
* Possible StringData Ref from Code Obj ->"Object"
|
:0049A140 BAC8A44900 mov edx, 0049A4C8
:0049A145 8B45F0 mov eax, dword ptr [ebp-10]
:0049A148 E84F59FDFF call 0046FA9C
:0049A14D 8B45F0 mov eax, dword ptr [ebp-10]
:0049A150 50 push eax
* Reference To: advapi32.RegCloseKey, Ord:0000h
|
:0049A151 E846CAF6FF Call 00406B9C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049A10C(C)
|
:0049A156 8B45F8 mov eax, dword ptr [ebp-08]
* Possible StringData Ref from Code Obj ->"AHF000186"
|
:0049A159 BAD8A44900 mov edx, 0049A4D8
:0049A15E E80DA9F6FF call 00404A70
:0049A163 7516 jne 0049A17B
:0049A165 8D55D8 lea edx, dword ptr [ebp-28]
:0049A168 8B45F8 mov eax, dword ptr [ebp-08]
:0049A16B E884E6F6FF call 004087F4
:0049A170 8B55D8 mov edx, dword ptr [ebp-28]
:0049A173 8D45F8 lea eax, dword ptr [ebp-08]
:0049A176 E891A5F6FF call 0040470C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049A163(C)
|
:0049A17B 8D4DD4 lea ecx, dword ptr [ebp-2C]
:0049A17E 8B55F8 mov edx, dword ptr [ebp-08]
:0049A181 8B45FC mov eax, dword ptr [ebp-04]
:0049A184 E85B53FDFF call 0046F4E4
:0049A189 8B45D4 mov eax, dword ptr [ebp-2C]==>EAX中存着算出的真注册码
:0049A18C 8B55F4 mov edx, dword ptr [ebp-0C]==>EDX是存着你输入的注册码
:0049A18F E8DCA8F6FF call 00404A70
:0049A194 740C je 0049A1A2==>判断输入注册码是否正确，正确则跳转
:0049A196 C683E005000001 mov byte ptr [ebx+000005E0], 01
:0049A19D E9BC000000 jmp 0049A25E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049A194(C)
|
:0049A1A2 C683E005000000 mov byte ptr [ebx+000005E0], 00
:0049A1A9 837DF800 cmp dword ptr [ebp-08], 00000000
:0049A1AD 0F84AB000000 je 0049A25E==>这里如果跳转就OVER了
:0049A1B3 8B45F8 mov eax, dword ptr [ebp-08]==>将你输入的用户编码赋给eax
:0049A1B6 8A00 mov al, byte ptr [eax]==>取用户编码的第一位16进制值赋给al
:0049A1B8 04BF add al, BF==>al=al+BF
:0049A1BA 2C1A sub al, 1A==>al=al-1A
:0049A1BC 731E jnb 0049A1DC==>CF位的值是1则不跳，一跳就进入作者设好的陷井了
:0049A1BE 8B45F8 mov eax, dword ptr [ebp-08]==>将你输入的用户编码赋给eax
:0049A1C1 8A4001 mov al, byte ptr [eax+01]==>取用户编码的第二位16进制值赋给al
:0049A1C4 04BF add al, BF==>al=al+BF
:0049A1C6 2C0C sub al, 0C==>al=al-0C
:0049A1C8 7312 jnb 0049A1DC==>CF位的值是1则不跳，一跳就进入作者设好的陷井了
:0049A1CA 8B45F8 mov eax, dword ptr [ebp-08]==>将你输入的用户编码赋给eax
:0049A1CD 8A4002 mov al, byte ptr [eax+02]==>取用户编码的第三位16进制值赋给al
:0049A1D0 04BF add al, BF==>al=al+BF
:0049A1D2 2C1A sub al, 1A==>al=al-1A
:0049A1D4 722E jb 0049A204==>CF位的值是1则跳，一跳就快注册成功了
:0049A1D6 04FA add al, FA==>al=al+FA
:0049A1D8 2C06 sub al, 06==>al=al-06
:0049A1DA 7228 jb 0049A204==>CF位的值是1则跳，不跳将会进入作者设好的陷井
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0049A1BC(C), :0049A1C8(C)
|
:0049A1DC C683E005000001 mov byte ptr [ebx+000005E0], 01 -------+软
:0049A1E3 B804000000 mov eax, 00000004 -------+件
-------+作
* Referenced by a (U)nconditional or (C)onditional Jump at Address: -------+者
|:0049A202(C) -------+布
| -------+置
:0049A1E8 8B55F8 mov edx, dword ptr [ebp-08] -------+的
:0049A1EB 8A5402FF mov dl, byte ptr [edx+eax-01] -------+陷
:0049A1EF 80C2D0 add dl, D0 -------+井
:0049A1F2 80EA0A sub dl, 0A -------+用
:0049A1F5 7207 jb 0049A1FE -------+来
:0049A1F7 C683E005000001 mov byte ptr [ebx+000005E0], 01 -------+破
-------+坏
* Referenced by a (U)nconditional or (C)onditional Jump at Address: -------+你
|:0049A1F5(C) -------+的
| -------+分
:0049A1FE 40 inc eax -------+析
:0049A1FF 83F80A cmp eax, 0000000A -------+思
:0049A202 75E4 jne 0049A1E8 -------+路
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0049A1D4(C), :0049A1DA(C)
|
:0049A204 80BBE005000000 cmp byte ptr [ebx+000005E0], 00
:0049A20B 7551 jne 0049A25E==>这里如果跳转就OVER了
:0049A20D 8B55FC mov edx, dword ptr [ebp-04]
:0049A210 8B8360050000 mov eax, dword ptr [ebx+00000560]
:0049A216 E88921FAFF call 0043C3A4
:0049A21B 8B55F8 mov edx, dword ptr [ebp-08]
:0049A21E 8B8370050000 mov eax, dword ptr [ebx+00000570]
:0049A224 E87B21FAFF call 0043C3A4
:0049A229 8B55F4 mov edx, dword ptr [ebp-0C]
:0049A22C 8B8368050000 mov eax, dword ptr [ebx+00000568]
:0049A232 E86D21FAFF call 0043C3A4
:0049A237 33D2 xor edx, edx
:0049A239 8B8360050000 mov eax, dword ptr [ebx+00000560]
:0049A23F 8B08 mov ecx, dword ptr [eax]
:0049A241 FF5164 call [ecx+64]
:0049A244 33D2 xor edx, edx
:0049A246 8B8370050000 mov eax, dword ptr [ebx+00000570]
:0049A24C 8B08 mov ecx, dword ptr [eax]
:0049A24E FF5164 call [ecx+64]
:0049A251 33D2 xor edx, edx
:0049A253 8B8368050000 mov eax, dword ptr [ebx+00000568]
:0049A259 8B08 mov ecx, dword ptr [eax]
:0049A25B FF5164 call [ecx+64]
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0049A19D(U), :0049A1AD(C), :0049A20B(C)
|
:0049A25E 8D55C8 lea edx, dword ptr [ebp-38]
:0049A261 A1ACDA4900 mov eax, dword ptr [0049DAAC]
:0049A266 8B00 mov eax, dword ptr [eax]
:0049A268 E89725FCFF call 0045C804
:0049A26D 8B45C8 mov eax, dword ptr [ebp-38]
:0049A270 8D55CC lea edx, dword ptr [ebp-34]
:0049A273 E81C8AFFFF call 00492C94
:0049A278 8B4DCC mov ecx, dword ptr [ebp-34]
:0049A27B 8D45D0 lea eax, dword ptr [ebp-30]
* Possible StringData Ref from Code Obj ->"当前版本号："
|
:0049A27E BAECA44900 mov edx, 0049A4EC
:0049A283 E8F0A6F6FF call 00404978
:0049A288 8B55D0 mov edx, dword ptr [ebp-30]
:0049A28B 8B8388050000 mov eax, dword ptr [ebx+00000588]
:0049A291 E80E21FAFF call 0043C3A4
:0049A296 33D2 xor edx, edx
:0049A298 8B83F4020000 mov eax, dword ptr [ebx+000002F4]
:0049A29E E835E5FCFF call 004687D8
:0049A2A3 80BBE005000000 cmp byte ptr [ebx+000005E0], 00
:0049A2AA 7467 je 0049A313==>这里如果跳转就注册成功了
:0049A2AC 33D2 xor edx, edx
:0049A2AE 8B8340040000 mov eax, dword ptr [ebx+00000440]
:0049A2B4 8B08 mov ecx, dword ptr [eax]
:0049A2B6 FF5164 call [ecx+64]
:0049A2B9 33D2 xor edx, edx
:0049A2BB 8B83AC040000 mov eax, dword ptr [ebx+000004AC]
:0049A2C1 8B08 mov ecx, dword ptr [eax]
:0049A2C3 FF5164 call [ecx+64]
:0049A2C6 33D2 xor edx, edx
:0049A2C8 8B8398050000 mov eax, dword ptr [ebx+00000598]
:0049A2CE 8B08 mov ecx, dword ptr [eax]
:0049A2D0 FF5164 call [ecx+64]
:0049A2D3 33D2 xor edx, edx
:0049A2D5 8B83E0030000 mov eax, dword ptr [ebx+000003E0]
:0049A2DB 8B08 mov ecx, dword ptr [eax]
:0049A2DD FF5164 call [ecx+64]
* Possible StringData Ref from Code Obj ->"本版为未注册试用版，部分功能只能在注册后才能使"
->"用！"
|
==>未注册版出现的提示
:0049A2E0 BA04A54900 mov edx, 0049A504
:0049A2E5 8B8380050000 mov eax, dword ptr [ebx+00000580]
:0049A2EB E8B420FAFF call 0043C3A4
:0049A2F0 8D55C4 lea edx, dword ptr [ebp-3C]
:0049A2F3 8BC3 mov eax, ebx
:0049A2F5 E87A20FAFF call 0043C374
:0049A2FA 8D45C4 lea eax, dword ptr [ebp-3C]
* Possible StringData Ref from Code Obj ->"[未注册功能限制版]"
|
==>未注册版出现的提示
:0049A2FD BA40A54900 mov edx, 0049A540
:0049A302 E82DA6F6FF call 00404934
:0049A307 8B55C4 mov edx, dword ptr [ebp-3C]
:0049A30A 8BC3 mov eax, ebx
:0049A30C E89320FAFF call 0043C3A4
:0049A311 EB63 jmp 0049A376
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0049A2AA(C)
|
