软件名称：IMCaster ICQ E-Marketer Enterprise 8.13.13
*******************************************
作者：龙岱客
Email：longdike@163.com
下载地址：http://www.imcaster.com/productemarketer.htm
http://www.imcaster.com/Downloads/IMCastSetupEnt.exe
破解工具：OllyDbg1.10B 汉化修改版 PEiD v0.92
破解难度：一般
******************************************
破解分析：
PEiD 0.92查MoleBox 2.x.x加壳，脱后不能运行，我就让它穿着马夹：）再用PEiD的加密算法分析插件分析脱壳后的文件：MD5+SHA+RIJNDAEL，恐怖
用OD载入原程序，说有壳要继续分析吗，点否！F9运行，探索参考字符串，看到以下明显的提示字符串
------------------------------------------------------------------
"Invalid Key Code!
Please contact IMCast Support."
"Unregistered Demo"
"License Expired. Please Enter New Code."
"Unregistered Enterprise Version.
Please Register To Activate."
-------------------------------------------------------------------------------
第一次判断
按About，被断，读注册表
[HKEY_CURRENT_USER\Software\G&SSoftware\IMCaster Enterprise\Key]
"Key"=""
00402985 68 B4504900 PUSH imcast.004950B4 ; ASCII "Key"
0040298A 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C]
0040298E 68 B4504900 PUSH imcast.004950B4 ; ASCII "Key"
00402993 50 PUSH EAX
00402994 8BCF MOV ECX,EDI
00402996 C64424 34 02 MOV BYTE PTR SS:[ESP+34],2
0040299B E8 78320800 CALL imcast.00485C18 ; JMP to MFC42.#3522
004029A0 50 PUSH EAX
004029A1 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
004029A5 C64424 28 03 MOV BYTE PTR SS:[ESP+28],3
004029AA E8 9B300800 CALL imcast.00485A4A ; JMP to MFC42.#858
004029AF 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
004029B3 C64424 24 02 MOV BYTE PTR SS:[ESP+24],2
004029B8 E8 87300800 CALL imcast.00485A44 ; JMP to MFC42.#800
004029BD 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8]
004029C1 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18]
004029C5 51 PUSH ECX
004029C6 52 PUSH EDX
004029C7 E8 A4310100 CALL imcast.00415B70 ;在这下断，关键Call，偷懒，改为MOV EAX,-5
004029CC 83C4 08 ADD ESP,8
004029CF 83F8 FB CMP EAX,-5
004029D2 8BCE MOV ECX,ESI
004029D4 68 E9030000 PUSH 3E9
004029D9 75 10 JNZ SHORT imcast.004029EB
004029DB E8 18310800 CALL imcast.00485AF8 ; JMP to MFC42.#3092
004029E0 85C0 TEST EAX,EAX
004029E2 74 28 JE SHORT imcast.00402A0C
004029E4 68 A0504900 PUSH imcast.004950A0 ; ASCII "December 31, 2006"
004029E9 EB 0E JMP SHORT imcast.004029F9
004029EB E8 08310800 CALL imcast.00485AF8 ; JMP to MFC42.#3092
004029F0 85C0 TEST EAX,EAX
004029F2 74 18 JE SHORT imcast.00402A0C
004029F4 68 8C504900 PUSH imcast.0049508C ; ASCII "Unregistered Demo"，向上找关键Call
004029F9 8BCE MOV ECX,ESI
004029FB 68 E9030000 PUSH 3E9
00402A00 E8 F3300800 CALL imcast.00485AF8 ; JMP to MFC42.#3092
00402A05 8BC8 MOV ECX,EAX
00402A07 E8 8C300800 CALL imcast.00485A98 ; JMP to MFC42.#6199
00402A0C 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
00402A10 C64424 24 01 MOV BYTE PTR SS:[ESP+24],1
00402A15 E8 2A300800 CALL imcast.00485A44 ; JMP to MFC42.#800
00402A1A 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
00402A1E C64424 24 00 MOV BYTE PTR SS:[ESP+24],0
00402A23 E8 1C300800 CALL imcast.00485A44 ; JMP to MFC42.#800
00402A28 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
00402A2C C74424 24 FFFFF>MOV DWORD PTR SS:[ESP+24],-1
00402A34 E8 0B300800 CALL imcast.00485A44 ; JMP to MFC42.#800
00402A39 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+1C]
00402A3D 5F POP EDI
00402A3E B8 01000000 MOV EAX,1
00402A43 5E POP ESI
00402A44 64:890D 0000000>MOV DWORD PTR FS:[0],ECX
00402A4B 83C4 20 ADD ESP,20
00402A4E C3 RETN
------------------------------------------------------------------------------
第二次判断：
进入关键Call发现注册码为24位，Enter Code...填入24位假码
00402AF0 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
00402AF4 51 PUSH ECX
00402AF5 52 PUSH EDX
00402AF6 C68424 84000000>MOV BYTE PTR SS:[ESP+84],1
00402AFE E8 6D300100 CALL imcast.00415B70 ;在这下断，关键Call，用PEiD的加密分析插件说是MD5+SHA+RIJNDAEL，恐怖，很烦，初看了一下，对算法不是很了解：），只好偷懒，将此处改为MOV EAX,-5
00402B03 83C4 08 ADD ESP,8
00402B06 83F8 FE CMP EAX,-2 ;经过跟踪发现EAX=-2应该为未注册版或注册码不正确；EAX=-3应该为注册过期版；EAX=-5为注册版本或注册码正确，注册码为24位
00402B09 75 26 JNZ SHORT imcast.00402B31
00402B0B 53 PUSH EBX
00402B0C 53 PUSH EBX
00402B0D 68 18514900 PUSH imcast.00495118 ; ASCII "Invalid Key Code!
Please contact IMCast Support."，向上找关键Call
00402B12 E8 19310800 CALL imcast.00485C30 ; JMP to MFC42.#1200
00402B17 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
00402B1B 885C24 7C MOV BYTE PTR SS:[ESP+7C],BL
00402B1F E8 202F0800 CALL imcast.00485A44 ; JMP to MFC42.#800
00402B24 C74424 7C 02000>MOV DWORD PTR SS:[ESP+7C],2
00402B2C E9 A6000000 JMP imcast.00402BD7
00402B31 83F8 FD CMP EAX,-3
00402B34 75 1A JNZ SHORT imcast.00402B50
00402B36 &
[1] [2] [3] 下一页
