PDFTiger 爆破、追码 by cqr2287

KaQqi

此处先做个铺垫，写爆破、追码过程。
软件名称：PDFTiger
下载地址：百度官方下载
文章作者：cqr2287/cqr2003


由于这个软件只能注册一次的原因，所以我们在爆破之后就不上图测试了。
运行起来，注册。提示

注册码错

载入od来玩吧。


爆破是一件很简单的事情，载入od后，发现是个典型的vboep。

[Asm] 纯文本查看 复制代码

00404A70 > $  68 74A94000   push PDFTiger.0040A974
00404A75   .  E8 EEFFFFFF   call <jmp.&MSVBVM60.#ThunRTMain_100>
00404A7A   .  0000          add byte ptr ds:[eax],al
00404A7C   .  0000          add byte ptr ds:[eax],al
00404A7E   .  0000          add byte ptr ds:[eax],al
00404A80   .  3000          xor byte ptr ds:[eax],al
00404A82   .  0000          add byte ptr ds:[eax],al
00404A84   .  3800          cmp byte ptr ds:[eax],al
00404A86   .  0000          add byte ptr ds:[eax],al
00404A88   .  0000          add byte ptr ds:[eax],al
00404A8A   .  0000          add byte ptr ds:[eax],al

对吗？我们先把数据窗口换成hex16位的unicode。
运行起来，搜索字符串Unicode，注册码错。

[Asm] 纯文本查看 复制代码

004922D8   .  E8 5524F7FF   call <jmp.&MSVBVM60.__vbaEnd>
004922DD   .  E9 BC000000   jmp PDFTiger.0049239E
004922E2   >  C745 FC 1F000>mov dword ptr ss:[ebp-0x4],0x1F
004922E9   .  C785 6CFFFFFF>mov dword ptr ss:[ebp-0x94],0x80020004
004922F3   .  C785 64FFFFFF>mov dword ptr ss:[ebp-0x9C],0xA
004922FD   .  C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],0x80020004
00492307   .  C785 74FFFFFF>mov dword ptr ss:[ebp-0x8C],0xA
00492311   .  C785 4CFFFFFF>mov dword ptr ss:[ebp-0xB4],PDFTiger.004>;  错误
0049231B   .  C785 44FFFFFF>mov dword ptr ss:[ebp-0xBC],0x8
00492325   .  8D95 44FFFFFF lea edx,dword ptr ss:[ebp-0xBC]
0049232B   .  8D4D 84       lea ecx,dword ptr ss:[ebp-0x7C]
0049232E   .  E8 1D24F7FF   call <jmp.&MSVBVM60.__vbaVarDup>
00492333   .  C785 5CFFFFFF>mov dword ptr ss:[ebp-0xA4],PDFTiger.004>;  注册码错.

很快找到了vb典型的判断尾部。追踪之。

[Asm] 纯文本查看 复制代码

00491E77   .  66:837D C4 FF cmp word ptr ss:[ebp-0x3C],0xFFFF
00491E7C      0F85 60040000 jnz PDFTiger.004922E2
00491E82      66:837D CC FF cmp word ptr ss:[ebp-0x34],0xFFFF
00491E87      0F85 55040000 jnz PDFTiger.004922E2
00491E8D      66:837D C0 FF cmp word ptr ss:[ebp-0x40],0xFFFF
00491E92      0F85 4A040000 jnz PDFTiger.004922E2
00491E98      66:837D C8 FF cmp word ptr ss:[ebp-0x38],0xFFFF
00491E9D      0F85 3F040000 jnz PDFTiger.004922E2
00491EA3   .  C745 FC 17000>mov dword ptr ss:[ebp-0x4],0x17
00491EAA   .  C785 5CFFFFFF>mov dword ptr ss:[ebp-0xA4],PDFTiger.004>;  APPDATA

跟到了四个跳转。仔细一看发现，每个跳转上面都是一个cmp
这样，我们可以方便得把全部都nop。。。

[Asm] 纯文本查看 复制代码

00492232   .  C785 64FFFFFF>mov dword ptr ss:[ebp-0x9C],0xA
0049223C   .  C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],0x80020004
00492246   .  C785 74FFFFFF>mov dword ptr ss:[ebp-0x8C],0xA
00492250   .  C785 4CFFFFFF>mov dword ptr ss:[ebp-0xB4],PDFTiger.004>;  成功
0049225A   .  C785 44FFFFFF>mov dword ptr ss:[ebp-0xBC],0x8
00492264   .  8D95 44FFFFFF lea edx,dword ptr ss:[ebp-0xBC]
0049226A   .  8D4D 84       lea ecx,dword ptr ss:[ebp-0x7C]
0049226D   .  E8 DE24F7FF   call <jmp.&MSVBVM60.__vbaVarDup>
00492272   .  C785 5CFFFFFF>mov dword ptr ss:[ebp-0xA4],PDFTiger.004>;  注册成功! 请重新启动程序.
0049227C   .  C785 54FFFFFF>mov dword ptr ss:[ebp-0xAC],0x8
00492286   .  8D95 54FFFFFF lea edx,dword ptr ss:[ebp-0xAC]
0049228C   .  8D4D 94       lea ecx,dword ptr ss:[ebp-0x6C]

走到成功

下面追码
运行起来，到段首下段

[Asm] 纯文本查看 复制代码

00491A2A   > \55            push ebp
00491A2B   .  8BEC          mov ebp,esp
00491A2D   .  83EC 18       sub esp,0x18
00491A30   .  68 36464000   push <jmp.&MSVBVM60.__vbaExceptHandler>  ;  SE 处理程序安装
00491A35   .  64:A1 0000000>mov eax,dword ptr fs:[0]
00491A3B   .  50            push eax
00491A3C   .  64:8925 00000>mov dword ptr fs:[0],esp

跟踪它。
说错了，是f8跟踪它。
前面很无聊，可以走快点。

[Asm] 纯文本查看 复制代码

00491B3A   > \8B45 B8       mov eax,dword ptr ss:[ebp-0x48]
00491B3D   .  8985 DCFEFFFF mov dword ptr ss:[ebp-0x124],eax
00491B43   .  8365 B8 00    and dword ptr ss:[ebp-0x48],0x0

假码出现，做个标记。

[Asm] 纯文本查看 复制代码

00491BD2   . /E9 8C020000   jmp PDFTiger.00491E63
00491BD7   > |C745 FC 09000>mov dword ptr ss:[ebp-0x4],0x9
00491BDE   . |C745 9C 01000>mov dword ptr ss:[ebp-0x64],0x1
00491BE5   . |C745 94 02000>mov dword ptr ss:[ebp-0x6C],0x2
00491BEC   . |8D45 BC       lea eax,dword ptr ss:[ebp-0x44]
00491BEF   . |8985 5CFFFFFF mov dword ptr ss:[ebp-0xA4],eax
00491BF5   . |C785 54FFFFFF>mov dword ptr ss:[ebp-0xAC],0x4008
00491BFF   . |8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00491C02   . |50            push eax
00491C03   . |8D45 D0       lea eax,dword ptr ss:[ebp-0x30]
00491C06   . |50            push eax
00491C07   . |E8 042CF7FF   call <jmp.&MSVBVM60.__vbaI4Var>
00491C0C   . |50            push eax                                 ; |Start = 0x1
00491C0D   . |8D85 54FFFFFF lea eax,dword ptr ss:[ebp-0xAC]          ; |
00491C13   . |50            push eax                                 ; |dString8 = 00000001
00491C14   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]          ; |
00491C17   . |50            push eax                                 ; |RetBUFFER = 00000001
00491C18   . |E8 AD2CF7FF   call <jmp.&MSVBVM60.#rtcMidCharVar_632>  ; \rtcMidCharVar
00491C1D   . |C785 3CFFFFFF>mov dword ptr ss:[ebp-0xC4],PDFTiger.004>;  W
00491C27   . |C785 34FFFFFF>mov dword ptr ss:[ebp-0xCC],0x8008
00491C31   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]
00491C34   . |50            push eax                                 ; /var18 = 00000001
00491C35   . |8D85 34FFFFFF lea eax,dword ptr ss:[ebp-0xCC]          ; |
00491C3B   . |50            push eax                                 ; |var28 = 00000001
00491C3C   . |E8 9F2BF7FF   call <jmp.&MSVBVM60.__vbaVarTstEq>       ; \__vbaVarTstEq
00491C41   . |66:8985 20FFF>mov word ptr ss:[ebp-0xE0],ax
00491C48   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]
00491C4B   . |50            push eax
00491C4C   . |8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00491C4F   . |50            push eax
00491C50   . |6A 02         push 0x2
00491C52   . |E8 8F2BF7FF   call <jmp.&MSVBVM60.__vbaFreeVarList>
00491C57   . |83C4 0C       add esp,0xC
00491C5A   . |0FBF85 20FFFF>movsx eax,word ptr ss:[ebp-0xE0]
00491C61   . |85C0          test eax,eax
00491C63   . |74 0C         je short PDFTiger.00491C71
00491C65   . |C745 FC 0A000>mov dword ptr ss:[ebp-0x4],0xA
00491C6C   . |66:834D C4 FF or word ptr ss:[ebp-0x3C],0xFFFF
00491C71   > |C745 FC 0C000>mov dword ptr ss:[ebp-0x4],0xC
00491C78   . |C745 9C 01000>mov dword ptr ss:[ebp-0x64],0x1
00491C7F   . |C745 94 02000>mov dword ptr ss:[ebp-0x6C],0x2
00491C86   . |8D45 BC       lea eax,dword ptr ss:[ebp-0x44]
00491C89   . |8985 5CFFFFFF mov dword ptr ss:[ebp-0xA4],eax
00491C8F   . |C785 54FFFFFF>mov dword ptr ss:[ebp-0xAC],0x4008
00491C99   . |8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00491C9C   . |50            push eax
00491C9D   . |8D45 D0       lea eax,dword ptr ss:[ebp-0x30]
00491CA0   . |50            push eax
00491CA1   . |E8 6A2BF7FF   call <jmp.&MSVBVM60.__vbaI4Var>
00491CA6   . |50            push eax                                 ; |Start = 0x1
00491CA7   . |8D85 54FFFFFF lea eax,dword ptr ss:[ebp-0xAC]          ; |
00491CAD   . |50            push eax                                 ; |dString8 = 00000001
00491CAE   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]          ; |
00491CB1   . |50            push eax                                 ; |RetBUFFER = 00000001
00491CB2   . |E8 132CF7FF   call <jmp.&MSVBVM60.#rtcMidCharVar_632>  ; \rtcMidCharVar
00491CB7   . |C785 3CFFFFFF>mov dword ptr ss:[ebp-0xC4],PDFTiger.004>;  D
00491CC1   . |C785 34FFFFFF>mov dword ptr ss:[ebp-0xCC],0x8008
00491CCB   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]
00491CCE   . |50            push eax                                 ; /var18 = 00000001
00491CCF   . |8D85 34FFFFFF lea eax,dword ptr ss:[ebp-0xCC]          ; |
00491CD5   . |50            push eax                                 ; |var28 = 00000001
00491CD6   . |E8 052BF7FF   call <jmp.&MSVBVM60.__vbaVarTstEq>       ; \__vbaVarTstEq
00491CDB   . |66:8985 20FFF>mov word ptr ss:[ebp-0xE0],ax
00491CE2   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]
00491CE5   . |50            push eax
00491CE6   . |8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00491CE9   . |50            push eax
00491CEA   . |6A 02         push 0x2
00491CEC   . |E8 F52AF7FF   call <jmp.&MSVBVM60.__vbaFreeVarList>
00491CF1   . |83C4 0C       add esp,0xC
00491CF4   . |0FBF85 20FFFF>movsx eax,word ptr ss:[ebp-0xE0]
00491CFB   . |85C0          test eax,eax
00491CFD   . |74 0C         je short PDFTiger.00491D0B
00491CFF   . |C745 FC 0D000>mov dword ptr ss:[ebp-0x4],0xD
00491D06   . |66:834D CC FF or word ptr ss:[ebp-0x34],0xFFFF
00491D0B   > |C745 FC 0F000>mov dword ptr ss:[ebp-0x4],0xF
00491D12   . |C745 9C 01000>mov dword ptr ss:[ebp-0x64],0x1
00491D19   . |C745 94 02000>mov dword ptr ss:[ebp-0x6C],0x2
00491D20   . |8D45 BC       lea eax,dword ptr ss:[ebp-0x44]
00491D23   . |8985 5CFFFFFF mov dword ptr ss:[ebp-0xA4],eax
00491D29   . |C785 54FFFFFF>mov dword ptr ss:[ebp-0xAC],0x4008
00491D33   . |8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00491D36   . |50            push eax
00491D37   . |8D45 D0       lea eax,dword ptr ss:[ebp-0x30]
00491D3A   . |50            push eax
00491D3B   . |E8 D02AF7FF   call <jmp.&MSVBVM60.__vbaI4Var>
00491D40   . |50            push eax                                 ; |Start = 0x1
00491D41   . |8D85 54FFFFFF lea eax,dword ptr ss:[ebp-0xAC]          ; |
00491D47   . |50            push eax                                 ; |dString8 = 00000001
00491D48   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]          ; |
00491D4B   . |50            push eax                                 ; |RetBUFFER = 00000001
00491D4C   . |E8 792BF7FF   call <jmp.&MSVBVM60.#rtcMidCharVar_632>  ; \rtcMidCharVar
00491D51   . |C785 3CFFFFFF>mov dword ptr ss:[ebp-0xC4],PDFTiger.004>;  8
00491D5B   . |C785 34FFFFFF>mov dword ptr ss:[ebp-0xCC],0x8008
00491D65   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]
00491D68   . |50            push eax                                 ; /var18 = 00000001
00491D69   . |8D85 34FFFFFF lea eax,dword ptr ss:[ebp-0xCC]          ; |
00491D6F   . |50            push eax                                 ; |var28 = 00000001
00491D70   . |E8 6B2AF7FF   call <jmp.&MSVBVM60.__vbaVarTstEq>       ; \__vbaVarTstEq
00491D75   . |66:8985 20FFF>mov word ptr ss:[ebp-0xE0],ax
00491D7C   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]
00491D7F   . |50            push eax
00491D80   . |8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00491D83   . |50            push eax
00491D84   . |6A 02         push 0x2
00491D86   . |E8 5B2AF7FF   call <jmp.&MSVBVM60.__vbaFreeVarList>
00491D8B   . |83C4 0C       add esp,0xC
00491D8E   . |0FBF85 20FFFF>movsx eax,word ptr ss:[ebp-0xE0]
00491D95   . |85C0          test eax,eax
00491D97   . |74 0C         je short PDFTiger.00491DA5
00491D99   . |C745 FC 10000>mov dword ptr ss:[ebp-0x4],0x10
00491DA0   . |66:834D C0 FF or word ptr ss:[ebp-0x40],0xFFFF
00491DA5   > |C745 FC 12000>mov dword ptr ss:[ebp-0x4],0x12
00491DAC   . |C745 9C 01000>mov dword ptr ss:[ebp-0x64],0x1
00491DB3   . |C745 94 02000>mov dword ptr ss:[ebp-0x6C],0x2
00491DBA   . |8D45 BC       lea eax,dword ptr ss:[ebp-0x44]
00491DBD   . |8985 5CFFFFFF mov dword ptr ss:[ebp-0xA4],eax
00491DC3   . |C785 54FFFFFF>mov dword ptr ss:[ebp-0xAC],0x4008
00491DCD   . |8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00491DD0   . |50            push eax
00491DD1   . |8D45 D0       lea eax,dword ptr ss:[ebp-0x30]
00491DD4   . |50            push eax
00491DD5   . |E8 362AF7FF   call <jmp.&MSVBVM60.__vbaI4Var>
00491DDA   . |50            push eax                                 ; |Start = 0x1
00491DDB   . |8D85 54FFFFFF lea eax,dword ptr ss:[ebp-0xAC]          ; |
00491DE1   . |50            push eax                                 ; |dString8 = 00000001
00491DE2   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]          ; |
00491DE5   . |50            push eax                                 ; |RetBUFFER = 00000001
00491DE6   . |E8 DF2AF7FF   call <jmp.&MSVBVM60.#rtcMidCharVar_632>  ; \rtcMidCharVar
00491DEB   . |C785 3CFFFFFF>mov dword ptr ss:[ebp-0xC4],PDFTiger.004>;  6
00491DF5   . |C785 34FFFFFF>mov dword ptr ss:[ebp-0xCC],0x8008
00491DFF   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]
00491E02   . |50            push eax                                 ; /var18 = 00000001
00491E03   . |8D85 34FFFFFF lea eax,dword ptr ss:[ebp-0xCC]          ; |
00491E09   . |50            push eax                                 ; |var28 = 00000001
00491E0A   . |E8 D129F7FF   call <jmp.&MSVBVM60.__vbaVarTstEq>       ; \__vbaVarTstEq
00491E0F   . |66:8985 20FFF>mov word ptr ss:[ebp-0xE0],ax
00491E16   . |8D45 84       lea eax,dword ptr ss:[ebp-0x7C]
00491E19   . |50            push eax
00491E1A   . |8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00491E1D   . |50            push eax
00491E1E   . |6A 02         push 0x2
00491E20   . |E8 C129F7FF   call <jmp.&MSVBVM60.__vbaFreeVarList>
00491E25   . |83C4 0C       add esp,0xC
00491E28   . |0FBF85 20FFFF>movsx eax,word ptr ss:[ebp-0xE0]
00491E2F   . |85C0          test eax,eax
00491E31   . |74 0C         je short PDFTiger.00491E3F
00491E33   . |C745 FC 13000>mov dword ptr ss:[ebp-0x4],0x13
00491E3A   . |66:834D C8 FF or word ptr ss:[ebp-0x38],0xFFFF
00491E3F   > |C745 FC 15000>mov dword ptr ss:[ebp-0x4],0x15
00491E46   . |8D85 F4FEFFFF lea eax,dword ptr ss:[ebp-0x10C]
00491E4C   . |50            push eax                                 ; /TMPend8 = 00000001
00491E4D   . |8D85 04FFFFFF lea eax,dword ptr ss:[ebp-0xFC]          ; |
00491E53   . |50            push eax                                 ; |TMPstep8 = 00000001
00491E54   . |8D45 D0       lea eax,dword ptr ss:[ebp-0x30]          ; |
00491E57   . |50            push eax                                 ; |Counter8 = 00000001
00491E58   . |E8 B52AF7FF   call <jmp.&MSVBVM60.__vbaVarForNext>     ; \__vbaVarForNext
00491E5D   . |8985 D8FEFFFF mov dword ptr ss:[ebp-0x128],eax
00491E63   > \83BD D8FEFFFF>cmp dword ptr ss:[ebp-0x128],0x0
00491E6A   .^ 0F85 67FDFFFF jnz PDFTiger.00491BD7

关键算法在此。我们不分析算法，在底部f4，观察堆栈即可、

[Asm] 纯文本查看 复制代码

00491E5D   .  8985 D8FEFFFF mov dword ptr ss:[ebp-0x128],eax
00491E63   >  83BD D8FEFFFF>cmp dword ptr ss:[ebp-0x128],0x0
00491E6A   .^ 0F85 67FDFFFF jnz PDFTiger.00491BD7

16次后跳转不实闲，eax为0
下方悲催了。。。

[Asm] 纯文本查看 复制代码

00491E58   .  E8 B52AF7FF   call <jmp.&MSVBVM60.__vbaVarForNext>     ; \__vbaVarForNext
00491E5D   .  8985 D8FEFFFF mov dword ptr ss:[ebp-0x128],eax
00491E63   >  83BD D8FEFFFF>cmp dword ptr ss:[ebp-0x128],0x0
00491E6A   .^ 0F85 67FDFFFF jnz PDFTiger.00491BD7

把ebp-0x128的指针给了eax，而ebp-0x128的指针为0.
于是追踪，得到
N752886DV8J1WDHW208586V43Y1NDSW261386FW8N1ADYW102386VS1G6NDD
我擦，什么鬼，但是注册成功了。


爆破地址：
00491E7C
90909090909066837DCCFF90909090909066837DC0FF90909090909066837DC8FF909090909090


今天我来骗大家的热心，不知能骗多少。

苏紫方璇

华视科技 发表于 2016-11-6 21:58
大神，可以发个豪迪的追码过程吗？，那个非常适合我们新手，求大神了

我怎么记得豪迪貌似是网络验证，本地只判断长度

某中二绅士

沙发我的，前来支持~~

ShadowY

楼主有病毒？

苏紫方璇

二楼是不是叫板凳，顺便支持下楼主

czc476

支持楼主，看了楼主的很多的破解教程，厉害

hhhdhzm

小白不知道这个用什么用处!

受训者02580

支持老大 我请你吃麻辣烫~~~~~~~

ccxxin

爆破之后就不上图测试