吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

搜索
查看: 668|回复: 4
收起左侧

[原创] Acon Digital Acoustica Premium 7.3.0 x64分析爆破

[复制链接]
speedboy 发表于 2021-4-14 15:34
【文章标题】: Acon Digital Acoustica Premium 7.3.0 x64分析爆破
【文章作者】: speedboy
【软件名称】: Acon Digital Acoustica Premium
【下载地址】:
【加壳方式】: 无
【编写语言】: Microsoft Visual C++
【使用工具】: x64dbg
【操作平台】: win7
【软件介绍】: Acon Digital Media Acoustica Premium is an ideal solution for audio editing and mastering. The program contains everything you need to create great sounding recordings and audio CDs, including professional tools for recording, analysis, editing and CD burning. The Acoustica user interface was designed with speed, accuracy and ease of use in mind. The support for audio resolutions up to 32 bit and sampling rates up to 192 kHz allows you to record and edit in an amazing audio quality.
【作者声明】: 只做学习、交流
--------------------------------------------------------------------------------
【详细过程】
1、运行程序,会出现一个提示窗口,有可用信息"Your trial version has expired.",所以我们搜索"Your trial version has expired."得到如下信息:
[Asm] 纯文本查看 复制代码
000000014075BE5E  lea rdx,qword ptr ds:[141119018]  "Your trial version has expired."

2、双击此行来到反汇编区,上溯分析来到代码段首。
[Asm] 纯文本查看 复制代码
0000000140759320 | 48:894C24 08          | mov qword ptr ss:[rsp+8],rcx            |
0000000140759325 | 55                    | push rbp                                |
0000000140759326 | 53                    | push rbx                                |
0000000140759327 | 56                    | push rsi                                |
0000000140759328 | 57                    | push rdi                                |
0000000140759329 | 41:54                 | push r12                                |
000000014075932B | 41:55                 | push r13                                |
000000014075932D | 41:56                 | push r14                                |
000000014075932F | 41:57                 | push r15                                |
0000000140759331 | 48:8DAC24 28FDFFFF    | lea rbp,qword ptr ss:[rsp-2D8]          |
0000000140759339 | 48:81EC D8030000      | sub rsp,3D8                             |
0000000140759340 | 0F29B424 C0030000     | movaps xmmword ptr ss:[rsp+3C0],xmm6    |
0000000140759348 | 48:8BF9               | mov rdi,rcx                             |
000000014075934B | 33C9                  | xor ecx,ecx                             |
000000014075934D | 898D 28030000         | mov dword ptr ss:[rbp+328],ecx          |
0000000140759353 | 898D 30030000         | mov dword ptr ss:[rbp+330],ecx          |
0000000140759359 | 4C:8D35 E8FDB400      | lea r14,qword ptr ds:[1412A9148]        |
0000000140759360 | 4C:8977 08            | mov qword ptr ds:[rdi+8],r14            |
………………
………………
………………
000000014075BE4E | 0F85 CF000000         | jne acoustica.14075BF23                 |
000000014075BE54 | E8 BBCCC3FF           | call acoustica.140398B14                |
000000014075BE59 | E9 C5000000           | jmp acoustica.14075BF23                 |
000000014075BE5E | 48:8D15 B3D19B00      | lea rdx,qword ptr ds:[141119018]        | rdx:EntryPoint, 0000000141119018:"Your trial version has expired."
000000014075BE65 | 48:8D8D 08020000      | lea rcx,qword ptr ss:[rbp+208]          |
000000014075BE6C | E8 5F35B8FF           | call acoustica.1402DF3D0                |
000000014075BE71 | 90                    | nop                                     |

3、在段首地址处“右键——查找引用——选定的地址”,得到如下信息:
[Asm] 纯文本查看 复制代码
00000001407D9A1C  call acoustica.140759320

4、在此行双击来到反汇编区。
[Asm] 纯文本查看 复制代码
00000001407D9A00 | 48:895C24 10          | mov qword ptr ss:[rsp+10],rbx           |
00000001407D9A05 | 57                    | push rdi                                |
00000001407D9A06 | 48:81EC 90010000      | sub rsp,190                             |
00000001407D9A0D | 48:8BD9               | mov rbx,rcx                             |
00000001407D9A10 | 48:8B91 F0000000      | mov rdx,qword ptr ds:[rcx+F0]           | rdx:EntryPoint
00000001407D9A17 | 48:8D4C24 40          | lea rcx,qword ptr ss:[rsp+40]           |
00000001407D9A1C | E8 FFF8F7FF           | call acoustica.140759320                | 》2.调用试用过期窗口
00000001407D9A21 | 90                    | nop                                     |
00000001407D9A22 | 0FB68424 E8000000     | movzx eax,byte ptr ss:[rsp+E8]          |
00000001407D9A2A | 33FF                  | xor edi,edi                             |

5、上溯到代码段首,在段首地址处“右键——查找引用——选定的地址”,得到如下信息:
[Asm] 纯文本查看 复制代码
00000001407D945E  call acoustica.1407D9A00

6、此call调用了过期提示窗口,他的上面有两个跳转je、jmp,分析发现je不跳转即可实现跳过试用过期提示call,所以00000001407D943E  call acoustica.140534C80是关键call,只要使返回的al=1即可实现预期。
[Asm] 纯文本查看 复制代码
00000001407D943A | 49:8B4D 00            | mov rcx,qword ptr ds:[r13]              |
00000001407D943E | E8 3DB8D5FF           | call acoustica.140534C80                | 》F7跟进,使返回al=1
00000001407D9443 | 84C0                  | test al,al                              |
00000001407D9445 | 74 14                 | je acoustica.1407D945B                  | 》不跳
00000001407D9447 | 8B4424 40             | mov eax,dword ptr ss:[rsp+40]           |
00000001407D944B | 83F8 03               | cmp eax,3                               |
00000001407D944E | 41:0F44C7             | cmove eax,r15d                          |
00000001407D9452 | 41:8986 B0000000      | mov dword ptr ds:[r14+B0],eax           |
00000001407D9459 | EB 2E                 | jmp acoustica.1407D9489                 |
00000001407D945B | 49:8BCE               | mov rcx,r14                             |
00000001407D945E | E8 9D050000           | call acoustica.1407D9A00                | 》1.调用试用过期窗口
00000001407D9463 | 84C0                  | test al,al                              |
00000001407D9465 | 0F84 2D050000         | je acoustica.1407D9998                  |
00000001407D946B | 49:8B4D 00            | mov rcx,qword ptr ds:[r13]              |
00000001407D946F | E8 0CC0D5FF           | call acoustica.140535480                |

7、F7跟进call acoustica.140534C80来到此,经分析0000000140534CC0 jne acoustica.140535443 跳转实现即可来到0000000140535443 mov al,1语句,实现al=1的目的。
[Asm] 纯文本查看 复制代码
0000000140534C80 | 48:895C24 18          | mov qword ptr ss:[rsp+18],rbx           |
0000000140534C85 | 55                    | push rbp                                |
0000000140534C86 | 56                    | push rsi                                |
0000000140534C87 | 57                    | push rdi                                |
0000000140534C88 | 41:54                 | push r12                                |
0000000140534C8A | 41:55                 | push r13                                |
0000000140534C8C | 41:56                 | push r14                                |
0000000140534C8E | 41:57                 | push r15                                |
0000000140534C90 | 48:8DAC24 50FEFFFF    | lea rbp,qword ptr ss:[rsp-1B0]          |
0000000140534C98 | 48:81EC B0020000      | sub rsp,2B0                             |
0000000140534C9F | 48:8B05 1A89FC00      | mov rax,qword ptr ds:[1414FD5C0]        |
0000000140534CA6 | 48:33C4               | xor rax,rsp                             |
0000000140534CA9 | 48:8985 A0010000      | mov qword ptr ss:[rbp+1A0],rax          |
0000000140534CB0 | 4C:8BF2               | mov r14,rdx                             | rdx:EntryPoint
0000000140534CB3 | 4C:8BE9               | mov r13,rcx                             |
0000000140534CB6 | 33F6                  | xor esi,esi                             |
0000000140534CB8 | 897424 30             | mov dword ptr ss:[rsp+30],esi           |
0000000140534CBC | 40:3871 11            | cmp byte ptr ds:[rcx+11],sil            |
0000000140534CC0 | 0F85 7D070000         | jne acoustica.140535443                 | 》【1】跳转,修改为jmp即可实现破解
0000000140534CC6 | 8D7E FF               | lea edi,qword ptr ds:[rsi-1]            |
0000000140534CC9 | 48:3971 08            | cmp qword ptr ds:[rcx+8],rsi            |
………………
………………
………………
0000000140535437 | FFCF                  | dec edi                                 |
0000000140535439 | 83FF FF               | cmp edi,FFFFFFFF                        |
000000014053543C | 75 05                 | jne acoustica.140535443                 |
000000014053543E | E8 D136E6FF           | call acoustica.140398B14                |
0000000140535443 | B0 01                 | mov al,1                                | 》注册标志 al=1
0000000140535445 | 48:8B8D A0010000      | mov rcx,qword ptr ss:[rbp+1A0]          |
000000014053544C | 48:33CC               | xor rcx,rsp                             |
000000014053544F | E8 9C36E6FF           | call acoustica.140398AF0                |
0000000140535454 | 48:8B9C24 00030000    | mov rbx,qword ptr ss:[rsp+300]          |
000000014053545C | 48:81C4 B0020000      | add rsp,2B0                             |
0000000140535463 | 41:5F                 | pop r15                                 |
0000000140535465 | 41:5E                 | pop r14                                 |
0000000140535467 | 41:5D                 | pop r13                                 |
0000000140535469 | 41:5C                 | pop r12                                 |
000000014053546B | 5F                    | pop rdi                                 |
000000014053546C | 5E                    | pop rsi                                 |
000000014053546D | 5D                    | pop rbp                                 |
000000014053546E | C3                    | ret                                     |

8、破解前后对比

1.jpg
2.jpg

免费评分

参与人数 3吾爱币 +9 热心值 +3 收起 理由
nmy124 + 1 + 1 用心讨论,共获提升!
当时明月在 + 1 + 1 我很赞同!
Hmily + 7 + 1 欢迎分析讨论交流,吾爱破解论坛有你更精彩!

查看全部评分

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

Chieh 发表于 2021-4-14 15:48
支持表哥发技术贴,加油
pizazzboy 发表于 2021-4-14 15:53
nmy124 发表于 2021-4-14 23:04
taxuewuhen 发表于 2021-4-15 08:43
不错 不错 不错
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则 警告:本版块禁止灌水或回复与主题无关内容,违者重罚!

快速回复 收藏帖子 返回列表 搜索

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2021-5-19 07:26

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表