吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

搜索
查看: 1027|回复: 4
收起左侧

[原创] Xara Photo & Graphic Designer 18.0.0.61670(X64)分析爆破

[复制链接]
speedboy 发表于 2021-4-7 19:05
【文章标题】: Xara Photo & Graphic Designer 18.0.0.61670(X64)分析爆破
【文章作者】: speedboy
【软件名称】: Xara Photo & Graphic Designer
【下载地址】:
【加壳方式】: 无
【编写语言】: Microsoft Visual C++
【使用工具】: x64dbg
【操作平台】: win7
【软件介绍】: Xara Photo & Graphic Designer - Realize your ideas easily. Make your photos pop Image editing, graphic design and illustration. Enjoy detailed photo editing, creative drawing and professional design from photo collages and print documents to digital artwork – realize each and every one of your creative ideas with Xara Photo & Graphic Designer! Create impressive designs in no time.
【作者声明】: 只做学习、交流
--------------------------------------------------------------------------------
【详细过程】
1、搜索“CheckSerialRegistration”得到如下信息
[Asm] 纯文本查看 复制代码
000000014063341D  lea rcx,qword ptr ds:[1414BA620]  L"After CheckSerialRegistration\n"

2、在此行双击来到反汇编区,发现上一行的Call是检测注册的,在此行F2下断
[Asm] 纯文本查看 复制代码
00000001406333F6 | 49:8B8F C8020000      | mov rcx,qword ptr ds:[r15+2C8]                                                                          |
00000001406333FD | 48:85C9               | test rcx,rcx                                                                                            |
0000000140633400 | 0F84 D30A0000         | je photographicdesigner.140633ED9                                                                       |
0000000140633406 | BA 01000000           | mov edx,1                                                                                               |
000000014063340B | E8 708A1300           | call <photographicdesigner.public: int __cdecl CopyProtectionVPL::IsRunable(int) __ptr64>               |
0000000140633410 | 85C0                  | test eax,eax                                                                                            |
0000000140633412 | 0F84 C10A0000         | je photographicdesigner.140633ED9                                                                       |
0000000140633418 | E8 13450100           | call <photographicdesigner.public: static void __cdecl InternetManager::CheckSerialRegistration(void)>  |
000000014063341D | 48:8D0D FC71E800      | lea rcx,qword ptr ds:[1414BA620]                                                                        | 00000001414BA620:L"After CheckSerialRegistration\n"
0000000140633424 | E8 87020100           | call <photographicdesigner.public: static void __cdecl Error::ReleaseTrace(wchar_t const * __ptr64,...) |

3、运行程序,没有断下而是出现“欢迎”提示窗口,说明前面有调用执行了,经分析,call <photographicdesigner.public: int __cdecl CopyProtectionVPL::IsRunable(int) __ptr64>调用了“欢迎”提示窗口,那就在此处下断,跟进分析,依次来到
[Asm] 纯文本查看 复制代码
000000014076BE80 | E9 EB080000           | jmp <photographicdesigner.private: int __cdecl CopyProtectionVPL::InitialCheck(int) __ptr64>

[Asm] 纯文本查看 复制代码
000000014076C770 | 40:57                 | push rdi                                                                                                |
000000014076C772 | 48:83EC 30            | sub rsp,30                                                                                              |
000000014076C776 | 48:C74424 20 FEFFFFFF | mov qword ptr ss:[rsp+20],FFFFFFFFFFFFFFFE                                                              |
000000014076C77F | 48:895C24 48          | mov qword ptr ss:[rsp+48],rbx                                                                           |
000000014076C784 | 48:897424 50          | mov qword ptr ss:[rsp+50],rsi                                                                           |
000000014076C789 | 8BF2                  | mov esi,edx                                                                                             |
000000014076C78B | 48:8BD9               | mov rbx,rcx                                                                                             |
000000014076C78E | 48:8D4C24 40          | lea rcx,qword ptr ss:[rsp+40]                                                                           |
000000014076C793 | E8 B850ECFF           | call <photographicdesigner.public: __cdecl DisableFPExceptions::DisableFPExceptions(void) __ptr64>      |
000000014076C798 | 90                    | nop                                                                                                     |
000000014076C799 | 33FF                  | xor edi,edi                                                                                             |
000000014076C79B | 48:39BB 30380000      | cmp qword ptr ds:[rbx+3830],rdi                                                                         |
000000014076C7A2 | 75 18                 | jne photographicdesigner.14076C7BC                                                                      |
000000014076C7A4 | 48:8BCB               | mov rcx,rbx                                                                                             |
000000014076C7A7 | E8 D4AA3900           | call <photographicdesigner.class IConsumerLibraryAdapter * __ptr64 __cdecl CreateConsumerLibraryAdapter |
000000014076C7AC | 48:8983 30380000      | mov qword ptr ds:[rbx+3830],rax                                                                         |
000000014076C7B3 | 48:85C0               | test rax,rax                                                                                            |
000000014076C7B6 | 75 04                 | jne photographicdesigner.14076C7BC                                                                      |
000000014076C7B8 | 8BDF                  | mov ebx,edi                                                                                             |
000000014076C7BA | EB 17                 | jmp photographicdesigner.14076C7D3                                                                      |
000000014076C7BC | 48:8B8B 30380000      | mov rcx,qword ptr ds:[rbx+3830]                                                                         |
000000014076C7C3 | 48:8B01               | mov rax,qword ptr ds:[rcx]                                                                              |
000000014076C7C6 | 85F6                  | test esi,esi                                                                                            | 》【1】修改为 xor
000000014076C7C8 | 0F95C2                | setne dl                                                                                                | 》此处使dl=0时,不出现欢迎提示窗口
000000014076C7CB | FF90 88000000         | call qword ptr ds:[rax+88]                                                                              | 》调用欢迎窗口
000000014076C7D1 | 8BD8                  | mov ebx,eax                                                                                             |
000000014076C7D3 | 45:33C9               | xor r9d,r9d                                                                                             |
000000014076C7D6 | 45:33C0               | xor r8d,r8d                                                                                             |
000000014076C7D9 | 33D2                  | xor edx,edx                                                                                             |
000000014076C7DB | B9 02000010           | mov ecx,10000002                                                                                        |
000000014076C7E0 | E8 BFCD3000           | call <photographicdesigner.UrlMkSetSessionOption>                                                       |
000000014076C7E5 | B8 01000000           | mov eax,1                                                                                               |
000000014076C7EA | 83FB 02               | cmp ebx,2                                                                                               |
000000014076C7ED | 0F44F8                | cmove edi,eax                                                                                           |
000000014076C7F0 | 48:8D4C24 40          | lea rcx,qword ptr ss:[rsp+40]                                                                           |
000000014076C7F5 | E8 9650ECFF           | call <photographicdesigner.public: __cdecl DisableFPExceptions::~DisableFPExceptions(void) __ptr64>     |
000000014076C7FA | 8BC7                  | mov eax,edi                                                                                             |
000000014076C7FC | 48:8B5C24 48          | mov rbx,qword ptr ss:[rsp+48]                                                                           |
000000014076C801 | 48:8B7424 50          | mov rsi,qword ptr ss:[rsp+50]                                                                           |
000000014076C806 | 48:83C4 30            | add rsp,30                                                                                              |
000000014076C80A | 5F                    | pop rdi                                                                                                 |
000000014076C80B | C3                    | ret           

4、经分析 此处000000014076C7CB call qword ptr ds:[rax+88] 调用欢迎窗口,下断跟进发现与dl的值有关,当dl=0时,不出现欢迎提示窗口,在函数的上一行恰是一个dl置值语句,当test esi,esi中的esi=0时,dl=0,所以只要把test esi,esi改为xor esi,esi即可实现破解
[Asm] 纯文本查看 复制代码
000000014076C7C6 | 85F6                  | test esi,esi                                                                                            | 》【1】修改为 xor
000000014076C7C8 | 0F95C2                | setne dl                                                                                                | 》此处使dl=0时,不出现欢迎提示窗口
000000014076C7CB | FF90 88000000         | call qword ptr ds:[rax+88]                                                                              | 》调用欢迎窗口

5、到此在调试器下运行程序正常,但运行保存修改文件时会出现“重新启动程序错误提示窗口”,看来有暗桩,在分析过程中会发现包含IsTrialVersion的处理函数,所以Ctrl+N调出符号窗口,搜索IsTrialVersion,得到以下信息
[Asm] 纯文本查看 复制代码
000000013F7B99B0 符号  ?IsTrialVersion@Application@@QEAAHXZ                           public: int __cdecl Application::IsTrialVersion(void) __ptr64
000000014030EDA0 符号  ?IsTrialVersion@CCamApp@@QEAAHXZ                               public: int __cdecl CCamApp::IsTrialVersion(void) __ptr64
0000000140A05000 符号  ?IsTrialVersion@CMX_ProteinLib@ProtectionEnvironment@@QEBA_NXZ public: bool __cdecl ProtectionEnvironment::CMX_ProteinLib::IsTrialVersion(void)const __ptr64
0000000140A067D0 符号  ?IsTrialVersion@MXProtectionWrapper@@SA_NXZ                    public: static bool __cdecl MXProtectionWrapper::IsTrialVersion(void)
0000000140B920C6 符号  `CCamApp::IsTrialVersion'::`1'::dtor$0                         
0000000140B920D2 符号  `CCamApp::IsTrialVersion'::`1'::dtor$1                         
0000000140B920DE 符号  `CCamApp::IsTrialVersion'::`1'::dtor$2                         
0000000140B920EA 符号  `CCamApp::IsTrialVersion'::`1'::dtor$3                         
0000000140B920F6 符号  `CCamApp::IsTrialVersion'::`1'::dtor$4                         
0000000140B92102 符号  `CCamApp::IsTrialVersion'::`1'::dtor$5                         
0000000140B9210E 符号  `CCamApp::IsTrialVersion'::`1'::dtor$6                         
0000000140B9211A 符号  `CCamApp::IsTrialVersion'::`1'::dtor$8                         
0000000140B92126 符号  `CCamApp::IsTrialVersion'::`1'::dtor$9                         
0000000140B92132 符号  `CCamApp::IsTrialVersion'::`1'::dtor$10

6、经分析 0000000140A067D0   public: static bool __cdecl MXProtectionWrapper::IsTrialVersion(void) 是关键信息,双击此行来到反汇编区
[Asm] 纯文本查看 复制代码
0000000140A067D0 | 48:8D0D D1821001      | lea rcx,qword ptr ds:[<class ProtectionEnvironment::CMX_ProteinLib s_proteinLib>]

7、在此行的地址处“右键-查找引用-选定的地址”,会得到三个调用函数
[Asm] 纯文本查看 复制代码
00000001409ECAE6 call <photographicdesigner.public: static bool __cdecl MXProtectionWrapper::IsTrialVersion(void)>
00000001409EDE21 call <photographicdesigner.public: static bool __cdecl MXProtectionWrapper::IsTrialVersion(void)>
00000001409EDE60 call <photographicdesigner.public: static bool __cdecl MXProtectionWrapper::IsTrialVersion(void)>

8、在第一个上面双击来到反汇编区,看到了吗?原来这里是检测程序版本的,上溯分析使得je photographicdesigner.1409ECAD3不跳转(至于为什么,你亲身调试一下看看,体会一下就会明白,跳转的话就会到试用版本那结束),再往上看到 CheckMuMaPatchFile (检查木马补丁文件?是不是我搞错了?嘻嘻)好直白呀,进入此Call,直接在段首ret返回试试(检测个毛哇)
[Asm] 纯文本查看 复制代码
00000001409ECAB0 | 48:83EC 28            | sub rsp,28                                                                                                      |
00000001409ECAB4 | 45:33C0               | xor r8d,r8d                                                                                                     |
00000001409ECAB7 | 41:8D50 01            | lea edx,qword ptr ds:[r8+1]                                                                                     |
00000001409ECABB | E8 E0F0FFFF           | call <photographicdesigner.public: int __cdecl CProductInterchangeAdapterForMumaEasy::invoke_CheckMuMaPatchFile |
00000001409ECAC0 | E8 7B9C0100           | call <photographicdesigner.public: static bool __cdecl MXProtectionWrapper::IsConsumerBoxVersion(void)>         |
00000001409ECAC5 | 84C0                  | test al,al                                                                                                      | 
00000001409ECAC7 | 74 0A                 | je photographicdesigner.1409ECAD3                                                                               | 》【2】不跳,修改为nop
00000001409ECAC9 | B8 01000000           | mov eax,1                                                                                                       |
00000001409ECACE | 48:83C4 28            | add rsp,28                                                                                                      |
00000001409ECAD2 | C3                    | ret                                                                                                             |
00000001409ECAD3 | E8 C89C0100           | call <photographicdesigner.public: static bool __cdecl MXProtectionWrapper::IsProfessionalBoxVersion(void)>     |
00000001409ECAD8 | 84C0                  | test al,al                                                                                                      |
00000001409ECADA | 74 0A                 | je photographicdesigner.1409ECAE6                                                                               |
00000001409ECADC | B8 02000000           | mov eax,2                                                                                                       |
00000001409ECAE1 | 48:83C4 28            | add rsp,28                                                                                                      |
00000001409ECAE5 | C3                    | ret                                                                                                             |
00000001409ECAE6 | E8 E59C0100           | call <photographicdesigner.public: static bool __cdecl MXProtectionWrapper::IsTrialVersion(void)>               |
00000001409ECAEB | 84C0                  | test al,al                                                                                                      |
00000001409ECAED | 74 0A                 | je photographicdesigner.1409ECAF9                                                                               | 
00000001409ECAEF | B8 04000000           | mov eax,4                                                                                                       |
00000001409ECAF4 | 48:83C4 28            | add rsp,28                                                                                                      |
00000001409ECAF8 | C3                    | ret                                                                                                             |
00000001409ECAF9 | E8 729C0100           | call <photographicdesigner.public: static bool __cdecl MXProtectionWrapper::IsNonextensibleDemoVersion(void)>   |
00000001409ECAFE | 84C0                  | test al,al                                                                                                      |
00000001409ECB00 | 74 0A                 | je photographicdesigner.1409ECB0C                                                                               |
00000001409ECB02 | B8 08000000           | mov eax,8                                                                                                       |
00000001409ECB07 | 48:83C4 28            | add rsp,28                                                                                                      |
00000001409ECB0B | C3                    | ret                                                                                                             |
00000001409ECB0C | E8 9F9C0100           | call <photographicdesigner.public: static bool __cdecl MXProtectionWrapper::IsSilverVersion(void)>              |
00000001409ECB11 | 84C0                  | test al,al                                                                                                      |
00000001409ECB13 | 74 0A                 | je photographicdesigner.1409ECB1F                                                                               | 
00000001409ECB15 | B8 10000000           | mov eax,10                                                                                                      |
00000001409ECB1A | 48:83C4 28            | add rsp,28                                                                                                      |
00000001409ECB1E | C3                    | ret                                                                                                             |
00000001409ECB1F | E8 5C9C0100           | call <photographicdesigner.public: static bool __cdecl MXProtectionWrapper::IsOEMVersion(void)>                 |
00000001409ECB24 | 84C0                  | test al,al                                                                                                      |
00000001409ECB26 | 74 0A                 | je photographicdesigner.1409ECB32                                                                               |
00000001409ECB28 | B8 20000000           | mov eax,20                                                                                                      | 20:' '
00000001409ECB2D | 48:83C4 28            | add rsp,28                                                                                                      |
00000001409ECB31 | C3                    | ret

9、进入00000001409ECABB  call <photographicdesigner.public: int __cdecl CProductInterchangeAdapterForMumaEasy::invoke_CheckMuMaPatchFile,在段首直接ret
[Asm] 纯文本查看 复制代码
00000001409EBBA0 | 40:53                 | push rbx                                                                                                        |》【3】改为ret
00000001409EBBA2 | 48:83EC 20            | sub rsp,20                                                                                                      | 
00000001409EBBA6 | 803D 48271201 00      | cmp byte ptr ds:[141B0E2F5],0                                                                                   |
00000001409EBBAD | 41:8BD8               | mov ebx,r8d                                                                                                     |
00000001409EBBB0 | 75 14                 | jne photographicdesigner.1409EBBC6                                                                              |
00000001409EBBB2 | E8 99AA0100           | call <photographicdesigner.bool __cdecl InitCopyProtection(void)>                                               |
00000001409EBBB7 | C605 37271201 01      | mov byte ptr ds:[141B0E2F5],1                                                                                   |
00000001409EBBBE | 8805 3CB0F000         | mov byte ptr ds:[1418F6C00],al                                                                                  |
00000001409EBBC4 | EB 07                 | jmp photographicdesigner.1409EBBCD                                                                              |
00000001409EBBC6 | 0FB605 33B0F000       | movzx eax,byte ptr ds:[1418F6C00]                                                                               |
00000001409EBBCD | 84C0                  | test al,al                                                                                                      |
00000001409EBBCF | 74 4E                 | je photographicdesigner.1409EBC1F                                                                               |
00000001409EBBD1 | 85DB                  | test ebx,ebx                                                                                                    |
00000001409EBBD3 | 74 2C                 | je photographicdesigner.1409EBC01                                                                               |
00000001409EBBD5 | 48:8D5424 48          | lea rdx,qword ptr ss:[rsp+48]                                                                                   |
00000001409EBBDA | 48:8D0D C72E1201      | lea rcx,qword ptr ds:[<class ProtectionEnvironment::CMX_ProteinLib s_proteinLib>]                               |
00000001409EBBE1 | C74424 48 00000000    | mov dword ptr ss:[rsp+48],0                                                                                     |
00000001409EBBE9 | E8 229D0100           | call <photographicdesigner.public: virtual enum ProtectionEnvironment::t_proteinResult __cdecl ProtectionEnviro |
00000001409EBBEE | 8B4C24 48             | mov ecx,dword ptr ss:[rsp+48]                                                                                   |
00000001409EBBF2 | 85C0                  | test eax,eax                                                                                                    |
00000001409EBBF4 | 74 1A                 | je photographicdesigner.1409EBC10                                                                               |
00000001409EBBF6 | 85C9                  | test ecx,ecx                                                                                                    |
00000001409EBBF8 | 74 16                 | je photographicdesigner.1409EBC10                                                                               |
00000001409EBBFA | 0FB605 FFAFF000       | movzx eax,byte ptr ds:[1418F6C00]                                                                               |
00000001409EBC01 | 84C0                  | test al,al                                                                                                      |
00000001409EBC03 | 74 1A                 | je photographicdesigner.1409EBC1F                                                                               |
00000001409EBC05 | B8 01000000           | mov eax,1                                                                                                       |
00000001409EBC0A | 48:83C4 20            | add rsp,20                                                                                                      |
00000001409EBC0E | 5B                    | pop rbx                                                                                                         |
00000001409EBC0F | C3                    | ret    

10、破解前后对比
2021-04-07_183715.jpg 2021-04-07_181915.jpg

免费评分

参与人数 3吾爱币 +8 热心值 +2 收起 理由
Hmily + 7 + 1 欢迎分析讨论交流,吾爱破解论坛有你更精彩!
zz0147 + 1 我很赞同!
zxy2006 + 1 谢谢@Thanks!

查看全部评分

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

ciker_li 发表于 2021-4-7 21:12
感谢楼主分享
djxding 发表于 2021-4-8 11:16
楼主:你好!
按照你写的教程,一步一步操作。当操作到:
“在分析过程中会发现包含IsTrialVersion的处理函数,所以Ctrl+N调出符号窗口,搜索IsTrialVersion”
时,就操作不了啦。
w12.jpg

搜索不到IsTrialVersion内容。
请问是什么原因呢?哪儿错啦?


请指教,谢谢。


YiMengYanYu 发表于 2021-4-8 16:42
djxding 发表于 2021-4-11 19:32
本帖最后由 djxding 于 2021-4-11 19:34 编辑

终于成功啦。
为了让其它像我一样,也是新手的网友不再走我的冤枉路,特说明一下。

在调出符号窗口时,一定要把“锁定”勾上,并且在左边按模块排序,然后从用户模块的第一个, 分别点击查看右边窗口是否有数据。
没有输出显示,就依次点下一个用户模块,直到所有用户模块点击走完一遍。


WW23.jpg

这样,就一 定会找到IsTrialVersion符号。


希望对新手有用。
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则 警告:本版块禁止灌水或回复与主题无关内容,违者重罚!

快速回复 收藏帖子 返回列表 搜索

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2021-4-19 05:06

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表