Help & Manual 3.0.4.619 破解 (15千字)
大家好，写得比较乱，凑和着看看吧。一口气发了几篇，花了不少时间，最近我是不会再玩crack了，不过，我还是会常来论坛转转的，呵呵。
Help
& Manual 3.0.4.619 破解笔记
================================
sunrise,
2002-9-26
软件名称：Help & Manual
软件版本：3.0.4.619
软件简介：所见即所得的Help文件制作工具
软件主页：http://www.helpandmanual.com
保护方式：14天使用期限+Nag screen，有简单的反SOFTICE措施
使用工具：dede,ollydbg,hiew
主程序HelpMan_demo.exe未加壳，用PeID检测，报告是delphi程序。这下
dede可派上用场了。用dede反编译HelpMan_demo.exe，经过分析，程序开始
时出现的对话框的form是TFrmAbout
TFrmAbout.FormShow
00593268 55
push ebp
00593269
8BEC mov
ebp, esp
0059326B B905000000
mov ecx, $00000005
00593270 6A00
push $00
00593272 6A00
push $00
00593274 49
dec ecx
00593275 75F9
jnz 00593270
00593277
51 push
ecx
00593278 53
push ebx
00593279 56
push esi
0059327A 8BD8
mov ebx, eax
0059327C 33C0
xor eax, eax
0059327E
55 push
ebp
0059327F 68AB345900
push $005934AB
***** TRY
|
00593284 64FF30
push dword ptr fs:[eax]
00593287 648920
mov fs:[eax], esp
* Reference to field TFrmAbout.OFFS_0211
|
0059328A 80BB1102000003 cmp
byte ptr [ebx+$0211], $03
00593291 750D
jnz 005932A0
* Reference to field TFrmAbout.OFFS_003C
|
00593293 8B533C
mov edx, [ebx+$3C]
00593296 83C21E
add edx, +$1E
00593299 8BC3
mov eax, ebx
* Reference
to: controls.TControl.SetHeight(TControl;System.Integer);
|
0059329B
E88C3BEAFF call 00436E2C
* Reference to field TFrmAbout.OFFS_0300
|
005932A0
8D8300030000 lea eax, [ebx+$0300]
* Possible String Reference to: 'http://www.ec-software.com/order.ht
|
m'
|
005932A6 BAC0345900
mov edx, $005934C0
*
Reference to: system.@LStrAsg;
|
005932AB E87C0BE7FF
call 00403E2C
* Reference to
TDM instance
|
005932B0 A1FCF76A00
mov eax, dword ptr [$6AF7FC]
005932B5 8B00
mov eax,
[eax]
* Reference to field TDM.OFFS_006C
|
005932B7
83786C00 cmp dword
ptr [eax+$6C], +$00 ;剩余使用天数<0?
005932BB 0F8CAB000000
jl 0059336C
005932C1 8D45FC
lea eax, [ebp-$04]
005932C4 50
push eax
005932C5 8D4DF8
lea ecx, [ebp-$08]
*
Reference to TDM instance
|
005932C8 A1FCF76A00
mov eax, dword ptr [$6AF7FC]
005932CD
8B00 mov
eax, [eax]
* Reference to field TDM.OFFS_0070
|
005932CF
8B4070 mov
eax, [eax+$70]
* Possible String Reference to: 'EvalDue'
|
005932D2 BAF0345900 mov
edx, $005934F0
* Reference to: classes.TStrings.GetValue(TStrings;System.AnsiString):System.AnsiString;
| or: nmextstr.TExStringList.GetValue(TExStringList;System.AnsiString):System.AnsiString;
|
005932D7 E82007E8FF
call 004139FC
005932DC 8B45F8
mov eax, [ebp-$08]
005932DF
50 push
eax
005932E0 8D55EC
lea edx, [ebp-$14]
* Reference to TDM instance
|
005932E3 A1FCF76A00
mov eax, dword ptr [$6AF7FC]
005932E8 8B00
mov eax, [eax]
* Reference to field TDM.OFFS_006C
|
005932EA 8B406C
mov eax, [eax+$6C]
* Reference to: sysutils.IntToStr(System.Integer):System.AnsiString;overload;
|
005932ED E8EA60E7FF
call 004093DC
005932F2 8B45EC
mov eax, [ebp-$14]
005932F5
8945F0 mov
[ebp-$10], eax
005932F8 C645F40B
mov byte ptr [ebp-$0C], $0B
005932FC 8D55F0
lea edx, [ebp-$10]
005932FF 33C9
xor ecx, ecx
00593301 58
pop eax
|
00593302 E87974E7FF call
0040A780
00593307 8B55FC
mov edx, [ebp-$04]
;在about对话框上显示剩余的天数
* Reference to control TFrmAbout.PnlEval :
TPanel
|
0059330A 8B83DC020000
mov eax, [ebx+$02DC]
* Reference to: controls.TControl.SetText(TControl;System.String);
|
00593310 E8EF42EAFF
call 00437604
00593315 8D45E8
lea eax, [ebp-$18]
00593318
50 push
eax
以下略。。。
从上面的代码可知，使用天数是存在TDM类对象中传给TFrmAbout.FormShow的，用dede
看看TDM的事件函数：
TDM.DMCreate
005891FC 55
push ebp
005891FD 8BEC
mov ebp, esp
005891FF B933000000
mov ecx, $00000033
00589204 6A00
push $00
00589206 6A00
push $00
00589208 49
dec ecx
00589209
75F9 jnz
00589204
0058920B 53
push ebx
0058920C 56
push esi
0058920D 57
push edi
0058920E 8945F8
mov [ebp-$08], eax ;TDM类对象指针
00589211 33C0
xor eax, eax
00589213 55
push ebp
略去一些无关代码
* Reference to: sysutils.Date:System.TDateTime;
|
0058948E
E85D19E8FF call 0040ADF0
* Reference to: system.@TRUNC;
|
00589493 E82896E7FF
call 00402AC0
00589498
8B55E4 mov
edx, [ebp-$1C]
在dede的units info中可以发现 0052FFA0这个地址位于unit:RichEditOLE中
0058949B E8006BFAFF call
0052FFA0 ;***计算已经使用的天数，用负数表示
* Reference to GlobalVar_006B817C
|
005894A0 A37C816B00
mov dword ptr [$6B817C], eax ;保存已经使用的天数
* Reference to
DM
|
005894A5 8B45F8
mov eax, [ebp-$08]
* Reference to field TDM.OFFS_005D
设置非注册标志。0表示未注册，这是demo版，所以设成未注册。
修改这里的指令，将设的值改为1，about对话框就是splash
screen
而不是nag screen
|
005894A8 C6405D00
mov byte ptr [eax+$5D], $00
下面是随机的反跟踪softice的代码
随机生成一个0-29之间的整数，如果这个整数>=20，则调用反softice的代码
005894AC B81E000000 mov
eax, $0000001E
* Reference to: system.@RandInt;
|
005894B1
E8D297E7FF call 00402C88
005894B6 83F814
cmp eax, +$14
005894B9 7C23
jl 005894DE
005894BB 33D2
xor edx, edx
* Reference to DM
|
005894BD
8B45F8 mov
eax, [ebp-$08]
* Reference to : TDM.HasWi95()
|
HasWi95()调用CreateFileA 打开"\\.\SICE"
005894C0 E8B3010000
call 00589678
005894C5
84C0 test
al, al
005894C7 750E
jnz 005894D7 ;有就跳
005894C9
33D2 xor
edx, edx
* Reference to DM
|
005894CB 8B45F8
mov eax, [ebp-$08]
* Reference to : TDM.HasWiNT()
HasWiNT()调用CreateFileA
打开"\\.\NTICE"
005894CE E81D020000
call 005896F0
005894D3 84C0
test al, al
005894D5
7407 jz
005894DE
005894D7 EBFE
jmp 005894D7 ;发现有softice就死机
* Reference to: system.@Halt0;
|
005894D9 E822A7E7FF
call 00403C00
005894DE
33C0 xor
eax, eax
005894E0 55
push ebp
005894E1 6878955800
push $00589578
*****
TRY
|
005894E6 64FF30
push dword ptr fs:[eax]
005894E9 648920
mov fs:[eax], esp
取程序的路径和文件名
005894EC
8D85A0FEFFFF lea eax, [ebp+$FFFFFEA0]
005894F2 50
push eax
005894F3 8D9574FEFFFF
lea edx, [ebp+$FFFFFE74]
* Reference
to TApplication instance
|
005894F9 A1A8F76A00
mov eax, dword ptr [$6AF7A8]
005894FE
8B00 mov
eax, [eax]
* Reference to: forms.TApplication.GetExeName(TApplication):System.AnsiString;
|
00589500 E81BD4ECFF
call 00456920
00589505 8B8574FEFFFF
mov eax, [ebp+$FFFFFE74] ;->程序的路径和文件名
将取得的文件的扩展名替换为.dpl
0058950B
8D8D78FEFFFF lea ecx, [ebp+$FFFFFE78]
* Possible String Reference to: '.dpl'
|
00589511 BA70965800
mov edx, $00589670
*
Reference to: sysutils.ChangeFileExt(System.AnsiString;System.AnsiString):System.AnsiString;
|
00589516 E81504E8FF
call 00409930
0058951B 8B8578FEFFFF
mov eax, [ebp+$FFFFFE78] ;->扩展名换后的路径和文件名
查找这个文件
我看了看，在我的机器上没这个文件
* Reference to: system.@LStrToPChar;
|
00589521 E812ADE7FF
call 00404238
00589526
50 push
eax
* Reference to: kernel32.FindFirstFileA()
|
00589527
E84CDAE7FF call 00406F78
0058952C 8BD8
mov ebx, eax
0058952E 83FBFF
cmp ebx, -$01
00589531
743B jz
0058956E
00589533 8D45E8
lea eax, [ebp-$18]
00589536 50
push eax
00589537 8D85ACFEFFFF lea
eax, [ebp+$FFFFFEAC]
0058953D 50
push eax
* Reference
to: kernel32.FileTimeToLocalFileTime()
|
0058953E E825DAE7FF
call 00406F68
00589543
85C0 test
eax, eax
00589545 7421
jz 00589568
00589547 8D45FC
lea eax, [ebp-$04]
0058954A 50
push eax
0058954B 8D45FE
lea eax, [ebp-$02]
0058954E
50 push
eax
0058954F 8D45E8
lea eax, [ebp-$18]
00589552 50
push eax
* Reference to: kernel32.FileTimeToDosDateTime()
|
00589553
E808DAE7FF call 00406F60
00589558 85C0
test eax, eax
0058955A 740C
jz 00589568
0058955C 8B45FC mov
eax, [ebp-$04]
* Reference to: sysutils.FileDateToDateTime(System.Integer):System.TDateTime;
|
0058955F E84009E8FF
call 00409EA4
00589564 DD5DF0
fstp qword ptr [ebp-$10]
00589567
9B wait
00589568 53
push ebx
* Reference to: kernel32.FindClose()
|
00589569 E802DAE7FF call
00406F70
0058956E 33C0
xor eax, eax
00589570 5A
pop edx
00589571 59
pop ecx
00589572 59
pop ecx
00589573
648910 mov
fs:[eax], edx
00589576 EB0A
jmp 00589582
****** EXCEPT
|
00589578 E99F9FE7FF jmp
0040351C
* Reference to: system.@DoneExcept;
|
0058957D
E8F6A2E7FF call 00403878
****** END
|
* Reference to DM
|
00589582
8B45F8 mov
eax, [ebp-$08]
* Reference to field TDM.OFFS_005C
|
00589585
C6405C01 mov byte
ptr [eax+$5C], $01
00589589 A17C816B00
mov eax, dword ptr [$6B817C]
0058958E 83C00E
add eax, +$0E
;14天试用期-已经使用的天数(因为用负数表示)
;得到剩余天数
* Reference to DM
|
00589591 8B55F8
mov edx, [ebp-$08]
* Reference
to field TDM.OFFS_006C
|
00589594 89426C
mov [edx+$6C], eax ;保存剩余天数
又随机反跟踪，无聊：)
00589597
B201 mov
dl, $01
* Reference to DM
|
00589599 8B45F8
mov eax, [ebp-$08]
* Reference to : TDM.HasWi95()
|
0058959C E8D7000000
call 00589678
005895A1
84C0 test
al, al
005895A3 751F
jnz 005895C4
005895A5 B201
mov dl, $01
* Reference to DM
|
005895A7 8B45F8
mov eax, [ebp-$08]
*
Reference to : TDM.HasWiNT()
|
005895AA E841010000
call 005896F0
005895AF 84C0
test al,
al
005895B1 7511
jnz 005895C4
005895B3 33D2
xor edx, edx
005895B5
33C0 xor
eax, eax
|
005895B7 E8E469FAFF
call 0052FFA0
005895BC 84C0
test al, al
005895BE 7504
jnz 005895C4
005895C0 33C0
xor eax, eax
005895C2
EB02 jmp
005895C6
005895C4 B001
mov al, $01
* Reference to DM
|
005895C6 8B55F8 mov
edx, [ebp-$08]
* Reference to field TDM.OFFS_005C
|
005895C9 88425C mov
[edx+$5C], al ;有softice时，此标志置1
* Reference
to DM
|
005895CC 8B45F8
mov eax, [ebp-$08]
* Reference to field TDM.OFFS_006C
|
005895CF 8B406C
mov eax, [eax+$6C] ;eax=剩余天数
剩余天数应该>=0 <=14
005895D2 83F80E
cmp eax, +$0E
005895D5 7F04
jnle 005895DB
005895D7 85C0
test eax, eax
005895D9
7D0A jnl
005895E5
* Reference to DM
|
005895DB 8B45F8
mov eax, [ebp-$08]
* Reference to field TDM.OFFS_006C
|
005895DE C7406CFFFFFFFF
mov dword ptr [eax+$6C], $FFFFFFFF
当前日期不能早于那个.dpl文件的日期
* Reference
to: sysutils.Date:System.TDateTime;
|
005895E5 E80618E8FF
call 0040ADF0
* Reference
to: system.@INT;
|
005895EA E88194E7FF
call 00402A70
005895EF DBBD68FEFFFF
fstp tbyte ptr [ebp+$FFFFFE68]
005895F5
9B wait
005895F6 DD45F0 fld
qword ptr [ebp-$10] ;.dpl文件的日期
* Reference
to: system.@INT;
|
005895F9 E87294E7FF
call 00402A70
005895FE DBAD68FEFFFF
fld tbyte ptr [ebp+$FFFFFE68]
00589604
DED9 fcompp
00589606 DFE0
fstsw ax
00589608 9E
sahf
00589609 730A
jnb 00589615
* Reference to DM
|
0058960B 8B45F8
mov eax, [ebp-$08]
* Reference
to field TDM.OFFS_006C
|
0058960E C7406CFFFFFFFF
mov dword ptr [eax+$6C], $FFFFFFFF
00589615
33C0 xor
eax, eax
00589617 5A
pop edx
00589618 59
pop ecx
00589619 59
pop ecx
0058961A 648910
mov fs:[eax], edx
****** FINALLY
|
* Possible String Reference to: '_^[嬪]?
|
0058961D
683A965800 push $0058963A
00589622 8D8574FEFFFF lea
eax, [ebp+$FFFFFE74]
00589628 BA0B000000
mov edx, $0000000B
* Reference to: system.@LStrArrayClr;
|
0058962D E8CAA7E7FF
call 00403DFC
00589632 C3
ret
00589633 E998A1E7FF
jmp 004037D0
00589638
EBE8 jmp
00589622
****** END
|
0058963A 5F
pop edi
0058963B
5E pop
esi
0058963C 5B
pop ebx
0058963D 8BE5
mov esp, ebp
0058963F 5D
pop ebp
00589640 C3
ret
