Myanmar CRG
Myanmar CRG
Myanmar CRG
(6) vltrsm;pk oHk;aeMuwJh tool awGudk odyfroHk;ygeJU/ Tool ajymif;oHk;Edkif&if ydkaumif;ygw,f/ 'grSom
shareware awGudka&;aewJh y&dk*&rfrmawGu oifh tool udk 0dkif;jyD;wdkufckdufwmudk rcH&rSmyg/ Tool wpfckudk
&SmjyD; avhvmyg/ uRrf;usifatmifvkyfyg/ oifudk,fwkdif tool wpfckjzpfygap/
(7) Cracking tzGJUtpnf;awGeJU qufoG,fyg/ ,m,Dtoif;0iftaeeJUjzpfygap toif;0ifyg/ 'Dtcg olwdkU
[m oifhudktultnDay;Muygvdrfhr,f/ oifuvJ tjcm;olawGudk tultnDay;aumif;ay;Edkifygvdrfhr,f/ aemuf
qHk;rSmawmh oifavhvmaewJh protection awGtaMumif; aumif;aumif; odvmygvdrfhr,f/
(8) tjrJwrf; topfjzpfaeygap/ 'Dtcsuf[m tvGefta&;MuD;ygw,f/ oif[m aemufqHk;xkwf tool awGudk
oHk;jyD; aemufqHk;ay:awGtaMumif; avhvmae&ygr,f/ Shareware a&;olawG&JUpm&if;udk oifh&JUtD;ar;vfrSm
aygif;xm;jyD; olwdkUeJU tquftoG,fvkyfyg/ olwdkUawG&JU enf;ynmawGudkavhvmyg/ olwdkUawGxJu wpf
a,mufavmuf eD;eD;jzpfatmif vkyfyg/
(9) udk,fwdkif &SmazGavhvmyg/ awGU&Sdcsuf^vSnfhuGuf topftqef;awGudk udk,fhbmomodatmifvkyfyg/ pmtkyf
pmwrf;rzwfbJ rdrdbmom ajz&Sif;EdkifzdkUvkyfyg/ topftqef;awG awGU&Sd&ifvJ tjcm;olawGudk oifMum;ay;zdkU
rarhygeJU/ udk,fwdkifavhvmjcif;uawmh taumif;qHk;ygyJ/
(10) aqmhzf0Jvfa&;om;olawG&JU y&dk*&rfawGudk tvGJoHk;pm;rvkyfygeJU/ olwdkUawG[m olwdkU&JUaqmhzf0JvfawG
jzpfvmatmif? atmifjrifvmatmif cufcufcJcJ MudK;pm;xm;&wmyg/ tjcm;olawG a&;xm;wJh crack/ keygen/
serial awGudkvJ tvGJoHk;pm; rvkyfygeJU/ 'guawmh w&m;rQwrIr&Sd? roifhawmfvdkUyg/
(11) uk'fawGrsm;rsm;a&;yg/ pmrsm;rsm;zwfyg/ Crack rsm;rsm;vkyfyg/ usLwdk&D&,f rsm;rsm;a&;yg/ Cracker
aumif;wpfa,muf jzpfvmygvdrfhr,f/
Cracking udk yxrqHk; pwifavhvmawmhr,fqdk&if oifhtaeeJU y&kd*&rfa&;om;jcif;eJU ywfoufwJh
tawGUtMuHK r&SdbJeJU vHk;0(vHk;0) rjzpfEdkifygbl;/ aqmhzf0Jvfawmfawmfrsm;rsm;udk Visual C++? Borland
Delphi eJU Dot.net y&dk*&rfbmompum;awGeJU a&;om;xm;wm jzpfygw,f/ ('Dbmompum;awGeJU a&;om;
xm;wmjzpfwJhtwGuf oifhtaeeJU 'Dy&dk*&rfbmompum;awGudk uRrf;usifwwfajrmuf&r,fvdkU qdkvdkwmr[kwf
ygbl;)/ Cracking vkyf&mrSm em;vnf&vG,fulzdkUtwGuf tultnDtay;EdkifqHk; bmompum;ESpfckuawmh C eJU
Assembly wdkUyg/ C [m Assembly xufpm&if ydkrkdvG,fulwJhtwGuf C udk t&ifavhvmvdkufyg/ oifhOmPf
&nfay:rlwnfjyD; tenf;qHk; 21&ufawmh Mumygvdrfhr,f/ 'DvdkavhvmjyD;rS crack vkyfzdkU MudK;pm;yg/ aemufwpf
ckuawmh Assembly bmompum;yg/ Assembly vdkUajymvdkuf&if vlawmfawmfrsm;rsm;u 16-bits acwfwkef;
u assembler awGudkyJ jrifjrifaewwfMuygw,f/ oifavhvm&r,fh Assembly bmompum;uawmh 32-bits
Assembly bmompum;yJ jzpfygw,f/
Cracking tajccHuawmh compile vkyfxm;wJh uGefysLwm binary uk'fawG (odkU) machine uk'fawG
udk avhvmzdkU jzpfygw,f/ y&dk*&rfawGudk uGefysLwmacwfOD;u vufcsnf;oufouf a&;cJhMuwmyg/ 'Dwkef;u
compiler qdkwm r&Sdao;ygbl;/ y&dk*&rfa&;wJh vkyfief;pOfuvJ t&rf;&IyfaxG;jyD; t&rf;yJ trSm;rsm;vSygw,f/
'gaMumifhrdkUvJ olwdkU[m vlom;pum;uae uGeyf sLwmbmompum;tjzpf ajymif;vJay;Edkifr,fh compiler udk
wDxGifcJhMuwmyg/ 'DaeUrSmawmh y&dk*&rfawG[m compile vkyfxm;wm (odkU) assemble vkyfxm;wmawG jzpfyg
w,f/ 'Duk'fawGudk disassembler wpfcktoHk;jyKjyD; binary uk'ftaeeJU jyefazmf&r,fqdk&if atmufygtwdkif;
awGU&rSmyg/
100100100101010010101010010100001100111001
Binary qdkwm ESpfvDpepfjzpfjyD; 0 eJU 1 udk tajccHygw,f/ 'gayr,fh 'Dvdkazmfjywm[m zwf&I&cufcJwJh
twGuf 16vDpepfjzpfwJh hexadecimal pepfudk xGifMuygw,f/ Hexadecimal pepfrSmawmh 0 uae 9 txd?
A (10) uae F (15) txd yg&Sdygw,f/ HEX uk'ftcsdKUudk azmfjyvdkufygw,f/
817D 0C 10010000 (HEX)
10000001011111010000110000010000000000010000000000000000 (BIN)
HEX uk'fawG[m toHk;rsm;vSygw,f/ bmaMumifhvJqdkawmh Intel xkwf CPU awG&JU mnemonic
rSmygwJh opcode awGudk HEX uk'fawGeJU azmfjyvdkUyg/
JNZ 00002A; 'Dae&mrSm JNZ mnemonic twGuf opcode [m 75h (117d) jzpfygw,f/
PUSH 0C8; 'Dae&mrSm PUSH mnemonic twGuf opcode [m 68h (104d) jzpfygw,f/
Assembly bmompum; tao;pdwfudkawmh ]tajccH Assembly bmompum;} oifcef;pmrSm zwf&I
avhvmyg/
'DaeUacwfrSmawmh vlodtrsm;qHk;eJU toHk;trsm;qHk; operating system uawmh Microsoft
Windows platform awGjzpfwJh Windows 98? Windows NT? Windows 2003? Windows XP?
tcef;(1) - Cracker rsm; odxm;oifhaom tcsufrsm; -7-
yHk(1)
tcef;(2) - tajccH C bmompum; -9-
Ctrl + F9 (Run) udk ESdyfvdkuf&ifawmh compiler u uRefawmfwdkU a&;xm;wJh source uk'fudk exe
uk'ftjzpfajymif;ay;rSm jzpfygw,f/ (wu,fawmh source uk'fudk compiler u assembly uk'ftjzpfajymif;
ay;jyD; assembly uk'fudk assembler u exe uk'ftjzpfajymif;vJay;wm jzpfygw,f/)
yHk(2)
yHk(1)uuk'fudk run vdkuf&if yHk(2)twdkif; jrif&rSmyg/ 'Dy&dk*&rfav;[m wu,fawmh bmtvkyfrS
aumif;aumif;vkyfrSm r[kwfygbl;/ uGefysLwmzefom;jyifrSm ]Welcome to Cracking World} qdkwJhpmwef;udk
jyoay;&HkygyJ/ aumif;ygjyD? y&dk*&rftvkyfvkyfyHkudk tao;pdwf MunfhvdkufMu&atmif/
(1) yxrpmaMumif;u include qdkwmuawmh keyword wpfckjzpfygw,f/ uRefawmfwdkUtoHk;jyKr,fh header
zdkifawGudk C:\BC5\ atmufu include qdkwJh zdk'gatmufrSm xm;&Sdr,fhtaMumif; uGefysLwmukd ajymMum;wmyg/
<stdio.h> qdkwmuawmh include zdk'gatmufu stdio qdkwJhtrnfeJU header zdkifudk toHk;jyKygr,fvdkU
ajymwmyg/ (<stdio.h>tpm; "stdio.h" qdk&ifawmh C++ compiler tvkyfvkyfaewJh? wlnDwJhzdk'gatmufu
stdio qdkwJhtrnfeJU header zdkifudk toHk;jyKygr,fvdkU ajymwmyg/) stdio &JU t&Snfaumufuawmh STandarD
Input/Output jzpfygw,f/ 'D header zdkifawG&JU trnf[m t"dyÜm,f&SdvSygw,f/ tcsuftvufawGudk toGif;
txkwfvkyfr,fqdkwJhtaMumif; uGefysLwmudk compiler u yPmrMudKajymxm;wm jzpfygw,f/ bmawGudk
toGif;txkwfvkyfr,fqdkwmudkawmh twdtusajymjcif; r&Sdao;ygbl;/ conio &JU t&Snfaumufuawmh
CONsole Input/Output jzpfygw,f/ conio eJU stdio [m oabmw&m;csif;wlygw,f/ conio u pmom;awG
udk ta&mifawGeJU jyEdkifwmav;yJ enf;enf;uGmygw,f/
(2) int main() qdkwmuawmh y&dk*&rfuk'fawG a&;xnfh&r,fh t"duae&mjzpfjyD; oifa&;xnfhcsifwJhuk'fawGudk
'D main() function xJu { } xJrSm a&;&rSmjzpfygw,f/ printf() qdkwmuawmh function wpfckjzpfjyD;
udk,fazmfjyapcsifwJh taMumif;t&m? tcsuftvufawGudk uGefysLwmzefom;jyifrSm jyoay;ygw,f/ printf() udk
oHk;r,fqdk&if stdio.h zdkifudk aMunmay;&rSm jzpfygw,f/
(3) getch() uawmh 'GET CHaracter' &JU twdkaumufyg/ uGefysLwmuD;bkwfuae &dkufr,fhpmvHk;wpfvHk;udk
vufcHwmyg/ 'gayr,fh &dkufxnfhwJh pmvHk;udkawmh zefom;jyifrSm jyrSmr[kwfygbl;/ bmaMumifh 'D function udk
oHk;&wmvJqdk&if y&dk*&rf[m printf() udkvkyfaqmifjyD;&if csufcsif;jyD;qHk;oGm;rSmrdkU y&dk*&rfudk cP&yfxm;csifvdkU
olUudkoHk;&wmyg/ uD;bkwfuae ESpfouf&m key wpfckckudk ESdyfvdkuf&if getch() &JUvkyfaqmifcsuf jyD;oGm;rSmyg/
getch() udk oHk;r,fqdk&if conio.h zdkifudk aMunmay;&rSm jzpfygw,f/
(4) return uawmh main() function eJU oufqdkifygw,f/ ol[m y&dk*&rfuk'u
f dk atmifjrifpGm vkyfaqmifEdkifcJh
jyDjzpfwJhtaMumif; y&dk*&rfqD taMumif;jyefygw,f/
(2) 'kwd,ajrmuf C y&dk*&rf
1 1 1 1 1 1 1 1
Z,m;&JU tuGufi,fwpfckpD[m 1 bit udk udk,fpm;jyKjyD; olUxJrSm 1 (odkU) 0 qdkwJh wefzdk;ESpfckudkyJ xnfh
xm;Edkifygw,f/ ESpfvDpepfudk,fpm;jyKwJhtwGuf olUxJrSmtrsm;qHk;xnfhEdkifwJh ta&twGuf[m 0 uae 255 xd
256 rsdK;xdyJjzpfygw,f/ 11111111 = 28 = 256 {0 rS 255 xd } (oknwefzdk;udkyg xnfhwGufjcif;jzpfonf/)
char eJU ywfoufwJh erlemawGudk avhvmMunfhygr,f/
char variable_name; // character pmvHk;wpfvHk;jzifhom tvkyfvkyfonf/
char variable_name [20]; // string pmvHk; 20jzifh tvkyfvkyfEdkifonf/
char * variable; // pointer string pmvHk;a& tuefUtowfrJh tvkyfvkyfEdkifonf/
char udk zdkifawGxJu tcsuftvufawGudk toGif;txkwfvkyf&mrSm jzpfjzpf? database y&dk*&rfawGudk
a&;&mrSmyJjzpfjzpf? password eJUqdkifwJh y&dk*&rfawGudk a&;&mrSmyJjzpfjzpf toHk;trsm;qHk; jzpfygw,f/
int udk oHk;&ifawmh uGefysLwm&JUrSwfOmPfrSm 2 bytes ae&m,lygw,f/ 'gaMumifh olUxJrSm odrf;qnf;
xm;EdkifwJh *Pef;wefzdk;uawmh 2 bytes = 16 bits = 216 = 65536 xdjzpfygw,f/ int &JU toHk;jyKyHkawG
uawmh -
signed int variable_name; // 2 bytes -32,768 rS 32,767 xd
unsigned int variable_name; // 2 bytes 0 rS 65,535 xd
short int variable_name; // 2 bytes -32,768 rS 32,767 xd
long int variable_name; // 4 bytes -2,147,483,648 rS 2,147,483,647 xd
unsigned long int variable_name; // 4 bytes 0 rS 4,294,967,295 xd
signed eJU short udk xnfhjyD;raMunmay;vJ &ygw,f/ wu,fvdkU int variable_name; vdkUyJ
aMunmxm;&if compiler u signed short int variable_name; vdkU em;vnfygw,f/ C y&dk*&rfa&;&mrSm
bmaMumifh signed/ unsigned eJU short/ long awG aMunmae&ovJqdkwJh taMumif;&if;&Sdygw,f/ 'Djyóem
u DOS acwfwkef;u MuHKawGUcJh&wmyg/ tJ'Dtcsdefwkef;u RAM awG&JU yrmP[m tckacwfrSmvdk 1GB awG?
4GB awG r[kwfygbl;/ 64KB? 128KB avmufom&Sdygw,f/ DOS &JU uefUowfcsufuvJ 1MB xuf
MuD;wJh C y&dk*&rfawGudk toHk;jyKcGifhray;ygbl;/ 'gaMumifh y&dk*&rfrmawG[m olwdkU&JU y&dk*&rfudk uGefysLwm
rSwfOmPfxJrSm ae&m,lrIenf;atmif twwfEdkifqHk; MuHpnfMu&ygw,f/ 'gaMumifhvJ rvdktyf&if twwfEdkifqHk;
rSwfOmPfacRwmEdkifzdkU long tpm; short udk toHk;jyKMuygw,f/ qdkvdkwmu y&dk*&rfu wGufcsufvdkU&&SdwJh
tajz[m 40000 eJU 50000 0ef;usifMum;yJ &Sdr,fqdk&if oifhtaeeJU 'D variable udk b,fvdkaMunmoifhw,f
xifygovJ/ unsigned int variable_name; vm;? long int variable_name; vm;/ 'Dar;cGef;u variable
wpfckxJtwGufqdk&if odyfta&;rMuD;ayr,fh variable awG aomif;eJUcsDvmcJh&if pOf;pm;zdkU vdkvmygjyD/ int
variable_name [200] [100]; qdk&ifaum/ oifbmudk a&G;cs,frSmygvJ/ Variable ta&twGuf 20000 udk
udkifwG,fajz&Sif;csdefrSmawmh ta&;MuD;vmygjyD/ long int vdkU aMunm&if uGefysLwm&JUrSwfOmPfrSm 200 x 100
= 20000 x 4 bytes = 80KB ae&m,lygvdrfhr,f/ oifh&JU RAM [m 64KB yJ &Sdr,fqdkygawmh/ 'Dy&dk*&rf[m
stack overflow jzpfjyD; tvkyfvkyfrSm r[kwfygbl;/ (rSwfcsuf/ / 'DaeUacwfrSmawmh uGefysLwmrSwfOmPfrSm
ae&mb,favmuf,l,l pdwfylp&mr&Sdawmhygbl;/)
float uawmh 'órudef;awGudk udkifwG,fajz&Sif;&mrSm toHk;jyKjyD; rSwfOmPfrSm 4 bytes ae&m,lyg
w,f/ double udkvJ 'órudef;awGudk udkifwG,fajz&Si;f &mrSm toHk;jyKjyD; rSwfOmPfrSm 8 bytes ae&m,lyg
w,f/ 'ór 15ae&mpmwduszdkUvdkwJh odyÜHqdkif&mwGufcsufrIawGrSm toHk;rsm;ygw,f/ long double uawmh
double eJU wlygw,f/ rSwfOmPfrSm 10 bytes ae&mpmae&m,lygw,f/
(4) Identifier
rdrdMudKufESpfouf&m ay;wJh variable awG&JUtrnfudk identifier vdkU ac:ygw,f/ Identifier awGukd
trnfay;csdefrSm atmufygpnf;rsOf;awGudk vdkufem&ygw,f/
(1) Identifier \tponf pmvHk; (A-Z, a-z) (odkU) underscore om jzpf&rnf/
(2) Underscore (_) oauFwrSty useftxl;tu©&mrsm; roHk;&/
(3) Identifier \ pmvHk;ta&twGufonf 255vHk;xuf rydk&/
(4) Keyword rsm;udk identifier tjzpf raMunm&/ (Oyrm case? return)
(5) MY_Variable123 eJU my_Variable123 wdkUonf rwlnDMuyg/ pmvHk;tMuD;tao; uGJjym;rI&Sdonf/
tcef;(2) - tajccH C bmompum; - 12 -
yHk(4)u printf("%7.0f %10.3f\n", fahr, celsius); udk Munfhvdkufyg/ %7.0f rSm 7 qdkwmuawmh
b,fuae pmvHk; 7 vHk;pm ae&m,lr,fvdkU ajymwmyg/ f uawmh 'órudef;awGudk tajzxkwfwmyg/ %10.3f
rSmawmh 10 u yxrpmom;uae 10ae&mpmae&m,lr,fvdkU ajymwmjzpfjyD; .3 uawmh 'ór 3 ae&meJU
jyay;ygvdkU qdkvdkjcif;jzpfygw,f/ aemufwpfckuawmh escape sequence taMumif;jzpfygw,f/ toHk;rsm;qHk;
awGuawmh \t eJU \n wdkU jzpfygw,f/ \t uawmh tab key wpfae&mpmae&m,lr,fvdkU ajymwmjzpfjyD; \n uawmh
aemufwpfaMumif;udk qif;r,fvdkU ajymwmyg/
(6) keyword
C bmompum;rSm toHk;jyKvQuf&SdwJh keyword awGuawmh atmufygtwdkif; jzpfygw,f -
auto break case char const
default do double else enum
extern far float for goto
huge if int long near
register return short signed sizeof
static struct switch typedef union
unsigned void volatile while
Identifier awGudkaMunm&mrSm keyword awGudk variable trnfay;vdkUr&ygbl;/ Keyword wdkif;rSm
olU&JUvkyfaqmifcsuftoD;oD; &SdvkdUyg/ ta&;ygtoHk;rsm;wJh keyword awG&JU vkyfaqmifcsufawGukd oD;jcm;
acgif;pOfawGeJU aqG;aEG;rSm jzpfygw,f/
(7) if statement
if statement udk tajctaewpf&yf&yf[m rSefovm;^rSm;ovm; qHk;jzwfcdkif;wJhtcgrSm toHk;jyKyg
w,f/ wcgw&HrSm else keyword eJU wGJoHk;wmvJ&Sdygw,f/ olU&JU jzpfEdkifwJhyHkpHtcsdKUuawmh 'Dvdkyg ...
(1)
if(condition) statement;
(2)
if(condition) statement;
else statement;
(3)
if(condition1) statement;
else if(condition2) statement;
…
else statement;
(4)
if(condition1) statement;
if(condition2) statement;
…
yHk(5)
tcef;(2) - tajccH C bmompum; - 14 -
yHk(6)
'Dy&dk*&rf[m uD;bkwfuae oif&dkufxnfhvdkufwJh *Pef;[m taygif;vm;? tEIwfvm;? oknvm;qdkwm
ppfaq;ay;rSm jzpfygw,f/ yHk(6)/ if statement udk oHk;jyD;a&;xm;wJh &dk;&Sif;vSwJh y&dk*&rfav;yg/ 'Dae&mrSm
topfxyfwdk;vmwmuawmh scanf() function yg/ olUtaMumif;udk tao;pdwfodcsif&ifawmh scanf ae&mrSm
mouse cursor udkxm;jyD; Ctrl+F1 udk ESdyfvdkufyg/ olUudk b,fvdktoHk;jyK&rvJqdkwJh Help ay:vmygvdrfhr,f/
yHk(7)/ tjcm; function awGudkvJ Ctrl+F1 EdSyfjyD; tao;pdwf MunfhvdkU&ygw,f/
yHk(7)
scanf() function udk uD;bkwfuae &dkufxnfhr,fh *Pef;? pmom;awGudkzwfzdkU toHk;jyKygw,f/
'Derlemy&dk*&rfrSm uRefawmfwdkUzwfr,fht&muawmh udef;jynfh*Pef;(%d) wpfck jzpfygw,f/ number_check
&JUa&SUrSm address sign (&) av;ygwm rarhygeJU/
Function awGtaMumif;odcsif&ifawmh Help udkrsm;rsm;zwfyg/ Help rSm ygvmwJh example awGudk
avhvmyg/ Example awGudk run Munfhyg/
(9) switch statement
if statement eJU oabmw&m;csif;wlwJh tjcm;wpfckuawmh switch statement jzpfygw,f/ olU&JU
toHk;jyK&r,fhyHkpHuawmh 'Dvdkyg ...
switch(expression){
case constant_expression1: statement;
case constant_expression2: statement;
default: : statement;
}
for loop &JU tvkyfvkyfyHkuawmh yxrqHk; expression1 udk initialize vkyfygw,f/ jyD;awmh
condition [m rSefovm;? rSm;ovm; ppfygw,f/ rSef&ifawmh statement qDudk oGm;ygw,f/ jyD;awmh
expression2 udk vkyfygw,f/ expression2 udk vkyfaqmifjyD;wJhtcgrSm expression1 qDjyefa&mufvmygw,f/
jyD;awmh condition udk rSef^rrSef xyfppfygw,f/ Condition [m rSefaeoa&GU statement udk aqmif&GufaerSm
jzpfjyD; rSm;wJhtcgusrSom loop [m jyD;qHk;rSmjzpfygw,f/
(13) 6ckajrmuf C y&dk*&rf
#include<stdio.h>
#include<conio.h>
int main()
{ /* Copyright © Myo Myint Htike, 2009 */
int x, y, z; /* Declare 3 unknown variables */
for(x=0; x<10; x++) // for(1; 2; 14) After 14, then go to 1
for(y=0; y<10; y++) // for(3; 4; 12) 3=13
for(z=0; z<10; z++) // for(5; 6; 10) 5=11
if(2*x+3*y-4*z == -3) // if 7 = true then do 8, else go to 10
if(4*x-2*y+z == 6) // if 8 = true then do 9
if(x-3*y-2*z == -15) // if 9 = true then print x, y, z
printf(" x= %d\n y= %d\n z= %d",x,y,z);
getch();
return 0;
}
yHk(8)
yHk(8)uawmh rodudef; 3vHk;&SmwJhykpäm jzpfygw,f/ x? y eJU z udk &Smay;&rSmyg/ for loop oHk;jyD; ajz&Sif;
xm;wmyg/ 'Dy&dk*&rfudk aocsmMunfhr,fqdk&if bmocsFmnDrQjcif;rS roHk;bJ ajz&Sif;oGm;wm awGU&rSmyg/ 'Denf;
[m cracking vkyfwJhtcg password awGudk cefUrSef;&mrSm awmfawmftoHk;0ifvSygw,f/ y&dk*&rftvkyfvkyfyHk
udk MunfhvdkufMu&atmif/
(1) yxrqHk; uRefawmfwdkU &SmcsifwJh rodudef; 3vHk;udk udef;jynfhawGtjzpfaMunmygw,f/ (rSwfcsuf/ / rod
udef;ykpämwdkif;&JU tajzawG[m tjrJwrf; udef;jynfhjzpfaerSmawmh r[kwfygbl;/ udef;jynfheJU &SmvdkUr&&if float
vdkU aMunmyg/)
tcef;(2) - tajccH C bmompum; - 16 -
(2) for loop udk pwifygw,f/ for loop &JUtvkyfvkyfyHkudk aocsmem;vnfatmifMunfhyg/ yxrqHk; x &JUwefzdk;
udk oknvdkUowfrSwfygw,f/ jyD;awmh x [m 10 xuf i,f^ri,f ppfygw,f/ i,fcJh&if aemufwpfaMumif;udk
qif;oGm;ygw,f/ y &JUwefzdk;udk oknvdkUowfrSwfygw,f/ jyD;awmh y [m 10 xuf i,f^ri,f ppfygw,f/
i,fcJh&if aemufwpfaMumif;udk qif;oGm;ygw,f/ z &JUwefzdk;udk oknvdkUowfrSwfygw,f/ jyD;awmh z [m 10
xuf i,f^ri,f ppfygw,f/ i,fcJh&if aemufwpfaMumif;udk qif;oGm;ygw,f/ 'DwpfcgrSm (x=0, y=0, z=0)udk
2x+3y-4z rSm tpm;oGif;jyD; -3 eJU nD^rnD ppfygw,f/ nDcJh&if aemufwpfaMumif;udk qif;oGm;rSm jzpfygw,f/
rnDcJh&ifawmh z &JU wefzdk;rSm wpfaygif;rSm jzpfygw,f/ 'Dwpfcg z=0 uae z=1 jzpfvmygw,f/ z [m 10
xuf i,f^ri,f xyfppfygw,f/ i,fcJh&if aemufwpfaMumif;udk qif;oGm;ygw,f/ 'DwpfcgrSm (x=0, y=0,
z=1)udk 2x+3y-4z rSm tpm;oGif;jyD; -3 eJU nD^rnD xyfppfygw,f/ nDcJh&if aemufwpfaMumif;udk qif;oGm;rSm
jzpfygw,f/ rnDcJh&ifawmh z &JU wefzdk;rSm wpfaygif;rSm jzpfygw,f/ 'DvdkeJU x,y,z wefzdk;toD;oD;udk wpfaygif;
oGm;jyD; nDrQjcif; 3aMumif;rSm nD^rnD ppfrSm jzpfygw,f/ ppfr,fhta&twGufuawmh wpfMudrfuae tMudrfwpf
axmiftwGif; jzpfygw,f/ wu,fvdkU nDcJh&ifawmh printf() function udk oHk;jyD; x,y,z wdkU&JUwefzdk;awGudk
tajzxkwfay;rSm jzpfygw,f/
(3) x++ qdkwmuawmh x = x+1; eJUwlygw,f/ (Operator acgif;pOfatmufwGif Munfhyg/)
(14) operator
Operator awGudk atmufygtwdkif; wl&mtkyfpkzGJUEdkifygw,f/
(u) Arithmetic operator
(c) Unary operator
(*) Relational operator
(C) Assignement operator
(i) Logical operator
(p) Conditional operator
(q) Bitwise operator
(u) Arithmetic operator
Arithmetic operator awGuawmh atmufygtwdkif;jzpfygw,f-
>> uawmh assembly bmompum;&JU SHR instruction eJUwljyD;? << uawmh assembly
bmompum;&JU SHR instruction eJUwlygw,f/ SHL eJU SHR [m register^rSwfOmPfae&mu bit awGudk
b,f^nmrSae owfrSwfxm;wJh bit ta&twGufudk a&wGufjyD; a&TUvdkufwmjzpfygw,f/ erlemMunfhyg/
int x = 0xBEEF; // x = 1011111011101111 (binaray)
x = x >> 4; // x = 0000101111101110
printf("x = %X", x); // x = BEE
ydkjyD;em;vnfapzdkU aemuferlemwpfckMunfhyg/
int x = 0xDEAD; // x = 1101111010101101 (bin)
x = (x >> 5) & ~ (~0 << 3); //
printf("x = %X", x); // x = 5 (101)
'Duk'fudk run vdkuf&ifawmh 5 qdkwJhtajz&rSmyg/ b,fvdk&ovJqdkwmawmh udk,fhbmomudk,f wGufMunfh
yg/ Hexadecimal uae binary? binary uae hexadecimal b,fvdkajymif;&rvJqdkwmudkawmh calculator
(calc.exe) eJU wGufcsufEdkifygw,f/
(15) Function
Function qdkwmuawmh vkyfaqmifcsufawGudk pkpnf;ay;xm;wJht&mwpfckjzpfjyD;? function wpfckrSm
yg0if&r,fh t*Fg&yfawGuawmh return type? function name? parameter list eJU uk'fa&;om;r,fh function
body wdkUjzpfygw,f/ Compiler rSm toifhygvmwJh function eJU rdrdudk,fwdkifzefwD;xm;wJh function qdkjyD;
function ESpfrsdK;ESpfpm; cGJjcm;Edkifygw,f/ Compiler rSmygvmwJh function awGuawmh printf()? scanf() pwJh
function awGjzpfygw,f/ olwdkUudk toHk;jyKawmhr,fqdk&if header file awG aMunmay;&ygw,f/ 'Dae&mrSm
awmh built-in function awGtaMumif;udk &Sif;jyrSm r[kwfygbl;/
(16) 7ckajrmuf C y&dk*&rf
#include<stdio.h> #include<conio.h>
int power (int m, int n);
int main()
{ int i;
for (i=0; i<10; ++i)
printf("%d %d %d\n", i, power(2,i), power(-3,i));
getch();
return 0; }
int power (int base, int n)
{ int i, p; p = 1;
for (i = 1; i <= n; ++i)
p = p * base; yHk(9)
return p; }
'Dy&dk*&rfuawmh 2 eJU -3 wdkU&JU xyfudef;wefzdk; q,fck (20, 21, 22, 23, 24, ..)udk &Smay;wmyg/
1/ int power (int m, int n); qdkwmuawmh uRefawmfwdkUzefwD;xm;wJh function udk toHk;jyKr,fvdkU aMunm
wmyg/ 'DvdkaMunmxm;wJhtwGuf main() function &JUtwGif;xJrSmyJjzpfjzpf? tjyifrSmyJjzpfjzpf MudKufwJhae&mu
ae power() function udk ac:oHk;vdkU &ygjyD/ bmaMumifh power() function udk MudKufwJhae&muae
ac:oHk;vdkU&wmvJqdkawmh olU&JU scope aMumifhyg/ wu,fawmh main() function &JU tjyifrSm int power (int
tcef;(2) - tajccH C bmompum; - 19 -
m, int n); vdkUa&;wm[m extern int power (int m, int n); vdkU a&;wmeJU twlwlygyJ/ 'Dae&mrSm extern [m
keyword wpfckjzpfjyD; olUudk storage class vdkUvJ ac:a0:ygw,f/
2/ Storage class 4rsdK;&Sdygw,f/ auto? extern? static eJU register wdkUyg/ Function wpfck&JUtwGif;rSm
bmrSa&;xm;jcif;r&SdbJ int? float? char vdkU&dk;&dk;wef;wef; aMunmxm;wJh data type awGtm;vHk;[m auto awG
ygyJ/ Function awG&JUtjyifbufrSm bmrSa&;xm;jcif;r&SdbJ int? float? char vdkU&dk;&dk;wef;wef; aMunmxm;wJh
data type awGtm;vHk;[m extern jzpfygw,f/ static eJU register wdkUuawmh toHk;enf;wJhtwGuf r&Sif;jy
awmhygbl;/ wu,fvdkU function awGrSm return jyefydkUp&m wefzdk;wpfckckr&SdcJh&if void vdkU aMunm&ygr,f/
(17) Array
Array qdkwmuawmh wlnDwJh data type awGudk pkpnf;ay;wJh variable wpfckyg/ wu,fvdkU rwlnDwJh
data type awGudk pkpnf;csif&ifawmh struct qdkwJh keyword udk toHk;jyK&rSmyg/ One dimensional array
wpfckudk aMunmyHkuawmh atmufygtwdkif;yg/
int myanmar[60];
int myanmar[60]; [m ausmif;om;ta,mufajcmufq,f&JU jrefrmpm&rSwfudk odrf;qnf;r,fvdkU aMu
nmwmyg/ wu,fvdkU array taeeJUom raMunmcJh&if uRefawmfwdkUtaeeJU int myanmar1, myanmar2,
myanmar3; ponfjzifh aMunm&rSmjzpfygw,f/ 'gqdk y&dk*&rf[m &Snfvsm;jyD; &IyfaxG;vmEdkifygw,f/ ydkjyD;
&Sif;vif;atmif aemufwpfckxyfMunfhygr,f/
int exam_result [60] [6];
'DyHkpHuawmh ausmif;om;ta,mufajcmufq,f&JU bmom&yfajcmufck&v'fudk odrf;qnf;r,fvdkU aMu
nmwmyg/ Two dimensional array wpfckjzpfygw,f/ 'Dae&mrSm &Sif;jyvdkwmuawmh exam_result [m
array &JUtrnfjzpfjyD;? 60 eJU 6 uawmh array element jzpfygw,f/ Array element udk wpfcgw&H array
index vdkUvJ ac:a0:ygw,f/ Array element [m tjrJwrf; 0 eJUpavh&SdjyD; tqHk;uawmh size-1 jzpfygw,f/
wu,fvdkU char udk array taeeJU aMunmr,fqdk&if character tpm; string jzpfoGm;aMumif; ]Data
type} acgif;pOfatmufrSm &Sif;jywm trSwf&yg/ 'gudk xyfMunfhygr,f/
char my_string [11] = "I Love You.";
int i;
for(i=0; i<11; i++)
printf("%c", my_string[i]);
'Duk'fudk run vdkuf&if 'I Love You.' qdkwJhpmom;udk jrif&rSmyg/ wu,fvdkU for(i=0; i<11; i++)
ae&mrSm for(i=1; i<12; i++) vdkUjyifvdkuf&if tajzuawmh ' Love You. ' jzpfrSmyg/ Full stop (.) &JUaemufrSm
space ( )udk awGU&rSmyg/ Array wpfck[m tjrJwrf; null terminator (\0) eJU qHk;avh&Sdygw,f/ wu,fvdkU 12
ae&mrSm 19 vkdUjyifvdkuf&if random pmvHk;awGxGufvmygvdrfhr,f/
(18) Pointer
Pointer qdw
k m variable wpfck&JU address udkodrf;xm;wJh variable wpfckyg/ Pointer udk C bmom
pum;rSm awmfawmfav; oHk;pGJwmawGU&ygw,f/ Pointer eJU array [mvJ awmfawmfav; qufpyfrI&Sdygw,f/
ydkjyD;&Sif;vif;atmif erlemwpfckudk Munfhygr,f/
int x = 1, y = 2, z[10]; // MOV DWORD PTR SS:[EBP-4], 1 (EBP udk 12FF8C vdkU ,lqygr,f/)
int *ip; // ip udk pointer taeeJUaMunmygw,f/
ip = &x; // LEA EAX, DWORD PTR SS:[EBP-4]
(ip [m x wefzdk;udk odrf;xm;wJh (load effective) address ae&mudkjyygr,f/ 12FF88 yg/)
y = *ip; // MOV EDX, DWORD PTR DS:[EAX] (y wefzdk;[m 1 jzpfvmygw,f/)
*ip = 0; // MOV DWORD PTR DS:[EAX], 0 (ip wefzdk;[m 0 jzpfvmygw,f/)
ip = &z[0]; // LEA EAX, DWORD PTR SS:[EBP-2C]
(ip [m z[0] wefzdk;udk odrf;xm;wJh (load effective) address ae&mudkjyygr,f/ 12FF60 yg/)
printf("%d %d %X %X", x, y, *ip, ip); // PUSH DWORD PTR SS:[EBP-4], PUSH EDX, PUSH
DWORD PTR DS:[EAX], PUSH EAX ('gaMumifh tajz[m 0 1 0 12FF60 jzpfygw,f/)
Unary operator wpfckjzpfwJh & uawmh object &JU address udk jyygw,f/ & operator [m
rSwfOmPfxJrSm variable eJU array element udkyJ point vkyfEdkifygw,f/ Expression? constant awGeJU
register variable awGudkawmh point vkyfEdkifjcif; r&Sdygbl;/
Unary operator (*) udkawmh indirection (odkU) dereferencing operator vdkU ac:ygw,f/ Pointer
tjzpftoHk;jyKcsdefrSm pointer u point vkyfwJh object udk &,lEdkifygw,f/
(19) 8ckajrmuf C y&dk*&rf
tcef;(2) - tajccH C bmompum; - 20 -
#include<stdio.h>
#include<conio.h>
int strlen(char *string);
int strcmp(char *string1, char *string2);
int main()
{ char get_string[100]; int length;
char *comp_str = "My Love";
gets(get_string);
length = strlen(get_string);
printf("String Length = %d", length);
if( (strcmp(get_string, comp_str)) !=0)
printf("\n\"%s\" and \"%s\" are not equal.",
get_string, comp_str);
getch(); return 0; }
/* strlen: return length of string s */
int strlen(char *s)
{
int n;
for (n = 0; *s != '\0'; s++)
n++; yHk(10)
return n;
}
\\ strcmp: return <0 if s<t, 0 if s==t, >0 if s>t
int strcmp(char *s, char *t)
{
for ( ; *s == *t; s++, t++)
if (*s == '\0') // if null-terminated string
return 0;
return *s - *t;
}
strcat(str1,str2) str2 ESifh str1 udk aygif;jyjcif;/ &v'fudk str1 wGif odrf;onf/
#include<stdio.h>
#include<conio.h>
#include<string.h>
void Password();
int main()
{ Password(); getch(); return 0; }
void Password(void)
{ /* Copyright © Myo Myint Htike, 2009 */
char password[80];
printf("\nEnter Password:");
gets(password);
if(strcmpi(password,"PASSWORD")==0)
printf("\nYou really did it. Congratulations!");
else{ printf("\nTry again!\n"); Password(); } yHk(11)
}
yHk(12)
tcef;(2) - tajccH C bmompum; - 22 -
yHk(13)
tcef;(2) - tajccH C bmompum; - 23 -
yHk(14)
tcef;(2) - tajccH C bmompum; - 24 -
tMudrf 80 loop ywfjyD;wJhtcgrSm &vmwJhtajzuawmh ESI = 0x2200 eJU EBX = 0xBFC8757F wdkU
jzpfygw,f/
21/ ESI eJU EBX wdkU&JUtajz[m 0x3810? 0x402A4FE7 wdkUeJUnD^rnDppfjyD; nDcJh&if tajzrSefudkxkwfay;yg
w,f/ (rSwf&ef/ / aaron tpm; firmware udk y&dk*&rfuzwfcsdefrSm for(j=0; j<character_count; j++){ }
u for(j=0; j<8; j++) jzpfvmygw,f/ 'DvdkeJU for(j=0; j<8; j++)udk 8Mudrf? for(i=0;i<16;i++) udk 16Mudrf?
pkpkaygif; 128Mudrf loop ywfjyD;wJhtcgrSm &vmwJhtajzuawmh ESI = 0x3810 eJU EBX = 0x402A4FE7 wdkU
jzpfygw,f/)
22/ owdjyKapcsifwJhtcsufuawmh a = 0x61? b = 0x62? c = 0x63? ... ? z = 0x7A ponfjzifhjzpfjyD; A =
0x41? B = 0x42? C = 0x43? ... ? Z = 0x5A ponfjzifhjzpfygw,f/
tcef;(3) - tajccH Assembly bmompum; - 26 -
rSwfOmPf
SEGMENT 1 SEGMENT 2 SEGMENT 3 SEGMENT
(64kb) (64kb) (64kb) 4(64kb)
ponfjzifh
eJU jyóem wufaumif;wufygvdrfhr,f/ olwdkUrSm offset awGyJ&SdjyD; ckcsdefrSmawmh olwdkUawG[m 32-bit awG
jzpfygw,f/ 'gaMumifh olwdkU&JUtwdkif;twm[m oknuae 4,294,967,295 xdjzpfvmygw,f/ rSwfOmPfxJu
b,fae&mrqdk offset eJUyJ nTefjyEdkifygw,f/ 'g[m 16-bit xufpm&if 32-bit &JU taumif;qHk; tusdK;aus;Zl;
awGxJu wpfckjzpfygw,f/ 'gaMumifhrdkU oifhtaeeJU segment register awGudk ckcsdefrSm arhxm;vdkU &EdkifjyD;
tjcm; register awGudk ydkrdk*&kpdkufvdkU &jyDjzpfygw,f/
(5.0) Opcodes
Opcode awG[m y&dkqufqmtwGuf instruction awGjzpfygw,f/ Opcode awG[m wu,fawmh
16vDpepfuk'frlMurf;&JU ]zwfvdkU&wJhpmom;} yHkpHawGyg/ 'DtwGufaMumifh assembler [m y&dk*&rfbmompum;
awGrSm tedrfhqHk;tqifh jzpfaewmjzpfjyD; assembler rSma&;wJhb,ft&mrqdk 16vDpepfuk'ftjzpf wdkuf&dkuf
ajymif;vJwm jzpfygw,f/
'Dtcef;rSmawmh wGufcsufrI? bitwise ydkif;eJUqdkifwJh opcode tcsdKUudk aqG;aEG;rSmjzpfygw,f/ tjcm;
opcode awGjzpfwJh jump instruction? compare opcode pwmawGudkawmh aemuftcef;usrS aqG;aEG;rSm
jzpfygw,f/
(5.1) tajccH opcodes wGufcsufrI
MOV
'D instruction udkawmh wefzdk;wpfckudk wpfae&muae aemufwpfae&mudk a&TUzdkU (ul;zdkU) toHk;jyKyg
w,f/ 'D ]ae&m} qdkwJh toHk;tEIef;rSm register wpfckaomfvnf;aumif;? rSwfOmPfae&mwpfckaomfvnf;aumif;?
vufiif;wefzdk; (rlvwefzdk;) wpfckaomfvnf;aumif; jzpfEdkifygw,f/ mov instruction &JU yHkpHuawmh -
mov destination, source;
oifhtaeeJU register wpfcku wefzdk;wpfckudk aemufwpfcq
k D a&TUEdkifygw,f/ (rSwf&ef/ / instruction
[m wu,fawmh olU&JUtrnf ]move} tpm; wefzdk;udk aemufwpfae&mqDudk yGm;ay;vdkufwmyg/)
mov edx, ecx;
txufrSmjycJhwJh instruction [m ECX rSm&SdwJh[mawGudk EDX qD ul;ay;vdkufwmyg/ Source eJU
destination &JU t&G,ftpm;[m wlnD&ygr,f/ atmufrSmazmfjyxm;wJh instruction uawmh rSefuefrI r&Sdygbl;/
mov al, ecx; // yHkpHtrSm;
'D opcode [m DWORD (32-bit) yrmP&SdwJh wefzdk;wpfckudk byte(8-bit) yrmPavmufom&SdwJh
register ae&mwpfckxJudk xnfhzdkUMudK;pm;aewmyg/ 'gudkawmh mov instruction u vkyfay;Edkifjcif; r&Sdygbl;/
(tjcm; instruction awGuawmh vkyfay;Edkifygw,f/) 'gayr,fh atmufu instruction awGudkawmh mov
instruction rSm toHk;jyKvdkU&ygw,f/ bmaMumifhvJqdkawmh source eJU destination [m t&G,ftpm; uGJjym;rI
r&SdvdkUyg/
mov al, bl;
mov cl, dl;
mov cx, dx;
mov ecx, ebx;
rSwfOmPf&JUwnf&mudk offset wpfckeJU nTefjyygw,f/ rSwfOmPf&UJ wduswJhae&mwpfckuae wefzdk;
wpfckudk&,ljyD; register wpfckxJrSm tJ'Dwefzdk;udk vmxm;vdkU &ygw,f/ atmufygZ,m;udk Oyrmtjzpf,lyg/
offset 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40 41 42
data 0D 0A 50 32 44 57 25 7A 5E 72 EF 7D FF AD C7
not ecx;
FFFF0000 = 11111111111111110000000000000000 (bin) (16 1's, 16 0's)
oifhtaeeJU bit wdkif;udk ajymif;jyefvkyf&if? &vmrSmuawmh
00000000000000001111111111111111 (16 0's, 16 1's) = 0000FFFF (hex)
'gaMumifhrdkU NOT operation jyD;wJhaemufrSm ECX &JUwefzdk;uawmh 0000FFFFh jzpfygw,f/
IN/DECREMENTS
t&dk;&Sif;qHk; instruction ESpfckuawmh DEC eJU INC yg/ 'D instruction awG[m rSwfOmPfwnf&m
(odkU) register udk wpfaygif;ay;^EIwfay;ygw,f/ &dk;&dk;av;a&;&Hkyg...
inc reg ‐> reg = reg + 1
dec reg ‐> reg = reg ‐ 1
inc dword ptr [103405] ‐> [103405] rSm&SdaewJh wefzdk;udk wpfaygif;ay;rSmyg/
dec dword ptr [103405] ‐> [103405] rSm&SdaewJh wefzdk;udk wpfEIwfay;rSmyg/
NOP
'D instruction uawmh vHk;vHk;MuD;udk bmrSrvkyfygbl;/ bmrSrvkyfEdkifvdkU toHk;r0ifbl;vdkUawmh rxif
ygeJU/ Crack vkyf&mrSm olUudk toHk;rsm;vSygw,f/ toHk;0ifqHk;ae&muawmh uk'fawGudk patch vkyfwJhae&mrSm
jzpfygw,f/
Bit Rotation and Shifting
rSwf&ef/ / atmufrSmazmfjyxm;wJh Oyrmawmfawmfrsm;rsm;[m 8-bit *Pef;awGudkyJ oHk;ygw,f/ 'gayr,fh ydk&Sif;
atmif yHkawGeJU jyygr,f/
Shift functions
SHL destination, count
SHR destination, count
SHL eJU SHR [m register^rSwfOmPfae&mu bit awGudk b,f^nmrSae a&wGufjyD; a&TUvdkufwmjzpfygw,f/
Oyrm
; 'Dae&mrSm al = 01011011 (bin) vdkU ,lqMunfhygr,f/
shr al, 3 ; al = 00001011
qdkvdkwmuawmh AL register xJu bit awGudk nmzuf 3ae&mpm a&TUvdkufwmyg/ 'gaMumifh AL [m
00001011 jzpfvmygw,f/ b,fzuftjcrf;u bit awGudk oknawGeJU tpm;xdk;vdkufjyD; nmzufu bit
awGudkawmh a&TUz,f&Sm;vdkufwmyg/ a&TUz,fvdkufwJh aemufqHk; bit udkawmh carry-flag xJrSm odrf;xm;ygw,f/
Carry-bit qdkwm y&dkqufqm&JU Flag register xJu bit wpfckyg/ ol[m wdkuf&dkufudkifwG,fEdkifwJh ('Dvdkvkyf
zdkU opcode awG&Sdaomfvnf;) EAX^ ECX vdk register wpfckr[kwfygbl;/ 'gayr,fh olU&JUtajz[m
instruction &JU&v'fay: rlwnfaeygw,f/ 'gudkaemufydkif;rSm &Sif;jyygr,f/ oifhtaeeJU rSwfxm;&rSmwpfck
uawmh carry qdkwm flag register xJu bit wpfckjzpfjyD; tzGifh^tydwf vkyfEdkifw,fqdkwmudkyg/ 'D bit [m
a&TUz,fcHvdkuf&wJh aemufqHk; bit eJU wlnDygw,f/
shl u shr eJUwlygw,f/ 'gayr,fh olu b,fzufudk a&TUwmyg/
; 'Dae&mrSm bl = 11100101 (binary) vdkU ,lqMunfhygr,f/
shl bl, 2;
Instruction jyD;wJhaemufrSmawmh BL [m 10010100 (bin) jzpfvmygw,f/ aemufqHk; bit ESpfckrSm
awmh oknawGeJU jznfhvdkufygw,f/ Carry bit uawmh 1 jzpfygw,f/ bmaMumifhvJqdkawmh aemufqHk;a&TUz,fcH
vdkuf&wJh bit u 1 jzpfaevdkUyg/
'DhaemufrSmawmh tjcm; opcode ESpfck &Sdygao;w,f/
SAL destination, count (Shift Arithmetic Left)
SAR destination, count (Shift Arithmetic Right)
tcef;(3) - tajccH Assembly bmompum; - 34 -
SAL u SHL eJUwlygw,f/ 'gayr,fh SAR uawmh SHR eJU rwlygbl;/ SAR u oknawGeJU
a&TUz,fwm r[kwfayr,fh MSB (most significant bit) udk ul;ydkUygw,f/ Oyrm -
al = 10100110
sar al, 3
al = 11110100
sar al, 2
al = 11111101
bl = 00100110
sar bl, 3
bl = 00000010
Rotation functions
rol destination, count ; b,fodkU vSnfhonf/
ror destination, count ; nmodkU vSnfhonf/
rcl destination, count ; Carry rSwqifh b,fodkU vSnfhonf/
rcr destination, count ; Carry rSwqifh nmodkU vSnfhonf/
vSnhfwm[m a&TYovdkygyJ/ uGJjym;wmuawmh a&TUz,fcHvdkuf&wJh bit awGudk tjcm;zufudk xyfa&TUvdkuf
wmygyJ/
Oyrm/ / ror (rotate right)
Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
rvSnfhrD 1 0 0 1 1 0 1 1
Rotate, count= 3 1 0 0 1 1 0 1 1 (a&TUz,f)
&v'f 1 1 0 1 0 0 1 1
tay:yHkrSm jrif&wJhtwdkif; bit awGudkvSnfhvdkufygw,f/ qdkvdkwmu wGef;xkwfcHvdkuf&wJh bit wdkif;[m
xyfrHjyD; tjcm;zufudk a&TUcH&ygw,f/ a&TUjcif;rSmvdkyJ carry bit awG[m aemufqHk;a&TUz,fcH&wJh bit udk
odrf;xm;ygw,f/ RCL eJU RCR uawmh ROL eJU RCR wdkUeJU wpfyHkpHwnf;yg/ olwdkU&JUtrnfawGudk,f
wdkifu ajymjywmuawmh olwdkU[m aemufqHk;a&TUz,fvdkufwJh bit udk nTefjyEdkifzdkU carry bit udk toHk;jyKMuyg
w,f/ ROL eJU ROR uvJ twlwlyJrdkU olwdkUtcsif;csif; uGJjym;rI r&SdMuygbl;/
Exchange
XCHG instruction uawmh vHk;vHk;MuD;udk &dk;&Sif;vSygw,f/ ol[m register ESpfck (odkU) register
wpfckeJU rSwfOmPfae&mwpfckudk vJvS,fay;Edkifygw,f/
eax = 237h
ecx = 978h
xchg eax, ecx
eax = 978h
ecx = 237h
(6.0) zdkifpepf
Assembly source zdkifawGudk section awGtaeeJU cGJxm;ygw,f/ Section awGuawmh code? data?
uninitialized data? constants? resource eJU relocations wdkU jzpfygw,f/ Resource sections udk
resource zdkifu xkwfay;wm jzpfygw,f/ (aemufydkif;wGifMunfhyg/) Relocation section uawmh uRefawmfwdkU
twGuf ta&;rMuD;ygbl;/ (olUrSm y&dk*&rfudk rSwfOmPf&JUtjcm;wae&mrSm ul;wifay;zdkU PE loader twGuf
tcsuftvufawG ygaumif;ygygvdrfhr,f/) ta&;MuD;wJh section awGuawmh code? data? uninitialized data
eJU constants wdkUyg/ Code section rSmygwmuawmh oifxifxm;wJhtwdkif; uk'fawGyg/ Data sections
rSmawmh zwfvdkU&^a&;vdkU&wJh a'wmawG yg0ifygw,f/ Data section wpfckvHk;[m exe zdkifrSmyg0ifjyD; a'wm
awGeJU tpysdK;avh &Sdygw,f/
Unitialized data twGufuawmh tpydkif;rSm bmrSrygygbl;/ exe zdkifukd,fwdkifrSmawmif rygygbl;/
oluawmh Windows twGuf oD;oefUz,fxm;wJh rSwfOmPfwpfpdwfwpfa'oom jzpfygw,f/ 'D section rSm
a&;vdkU? zwfvdkU&ygw,f/ Constants uawmh data section eJU wlygw,f/ 'gayr,fh zwfvdkUyJ&ygw,f/ 'D
section udk constant twGufyJ toHk;jyKEdkifaomfvnf; ol[m include zdkifxJrSm constant awGudk aMunmxm;
&ifawmh ydkrdkvG,fuljyD;jrefqefvmygw,f/ 'DhaemufolwdkUudk vufiif;wefzdk;tjzpf oHk;&Hkyg/
tcef;(3) - tajccH Assembly bmompum; - 35 -
SF (Sign flag)
wu,fvdkU 'D flag udk oHk;cJh&if wGufcsufrIu &&SdvmwJhaemufqHk;udef;[m tEIwfjzpfygw,f/
CF (Carry flag)
wGufcsufrIjyD;wJhaemufrSmawmh xJrSm b,fzuftusqHk; bit yg0ifvmygw,f/
OF (Overflow flag)
wGufcsufwJhtcg ausmfvGefwGufcsufrdwmudk ajymwmyg/ qdkvdkwmu &v'f[m destination xJrSm
rawmfwm (rqefUwm)udk ajymwmyg/
'ghjyif tjcm; flags (Parity, Auxiliary, Trap, Interrupt, Direction, IOPL, Nested Task,
Resume & Virtual Mode) awGvnf; &Sdygao;w,f/ 'gayr,fh uRefawmfwdkU toHk;jyKrSm r[kwfwJhtwGuf
'gawGudk &Sif;jyawmhrSm r[kwfygbl;/
tcef;(3) - tajccH Assembly bmompum; - 38 -
STACK OPCODES
Stack opcodeawG taMumif;rajymjycifrSm stack qdkwmbmvJqdkwm t&if&Sif;jyyghr,f/ Stack qdkwm
rSwfOmPfxJu ae&mwpfckjzpfjyD; stack pointer register jzpfwJh ESP eJU nTefjyygw,f/ Stack [m ,m,D
wefzdk;awGxm;zdkU ae&mwpfck jzpfygw,f/ olUrSm wefzdk;awGudkxm;zdkUeJU jyef&,lzdkU PUSH eJU POP qdkwJh
instruction ESpfck&Sdygw,f/ PUSH uawmh stack xJudk wefzdk;wpfckvmxnfhjyD; POP uawmh xyfrHqGJxkwf
wmyg/ Stack xJudk aemufqHk;vmxnfhwmudk t&ifxkwf,lygw,f/ wefzdk;wpfckudk stack rSm vmxm;&if
stack pointer [m avsmhenf;vmygw,f/ z,f&Sm;csdefrSmawmh stack pointer wdk;vmygw,f/
OyrmudkMunfhyg/
(1) mov ecx, 100
(2) mov eax, 200
(3) push ecx ; ECX udk odrf;ygw,f/
(4) push eax
(5) xor ecx, eax
(6) add ecx, 400
(7) mov edx, ecx
(8) pop ebx
(9) pop ecx
&Sif;vif;csuf
1: ECX wGif 100 udk vmxm;onf/
2: EAX wGif 200 udk vmxm;onf/
3: push ecx (=100) (stack rSm yxrqHk;vmxm;wmyg/)
4: push eax (=200) (stack rSm aemufqHk;vmxm;wmyg/)
5/6/7: ECX eJU ywfoufwJhvkyfaqmifcsufawG vkyfygw,f/ ECX &JU wefzdk;awG ajymif;vJaeygw,f/
8: pop ebx: EBX [m 200 jzpfvmygw,f/ (aemufqHk;vmxm;vdkUyg/ t&ifqHk;xkwf,lygw,f/)
9: pop ecx: ECX [m 100 jzpfvmygw,f/ (yxrqHk;vmxm;vdkUyg/ aemufqHk;xkwf,lygw,f/)
PUSH/POP vkyfjcif;jzifh rSwfOmPfxJrmS bmawGjzpfysufaevJqdkwmMunfhzdkU atmufygZ,m;udk Munfh
yg/
Offset 1203 1204 1205 1206 1207 1208 1209 120A 120B
Value 00 00 00 00 00 00 00 00 00
ESP
('Dae&mrSm stack
[m yxrqHk; oknawG jznfhoGm;ygw,f/ 'gayr,hf wu,fhwu,frSmawmh 'Dvdk
r[kwfygbl;/ ESP [m ESP nTefjywJh offset udk &nf&G,fygw,f/)
mov ax, 4560h
push ax
tcef;(3) - tajccH Assembly bmompum; - 41 -
Offset 1203 1204 1205 1206 1207 1208 1209 120A 120B
Value 00 00 60 45 00 00 00 00 00
ESP
mov cx, FFFFh
push cx
Offset 1203 1204 1205 1206 1207 1208 1209 120A 120B
Value FF FF 60 45 00 00 00 00 00
ESP
pop edx
Offset 1203 1204 1205 1206 1207 1208 1209 120A 120B
Value FF FF 60 45 00 00 00 00 00
ESP
ckcsdefrSm EDX [m 4560FFFFh jzpfaeygjyD/
CALL & RET
Call wpfck[m tcsdKUuk'fawGqD ausmfvTm;EdkifjyD; RET-instruction udkawGUwJhtcg csufcsif;yJjyefa&muf
vmygw,f/ oifhtaeeJU olwdkUawGudk tjcm;y&kd*&rfbmompum;awGrSm function awGtjzpf? subroutine
awGtjzpf awGUEdkifygw,f/ Oyrm -
; ..code..
call 0455659
; ..more code..
; Code at 455659:
add eax, 500
mul eax, edx
ret
CALL instruction tvkyfvkyfwJhtcgrSm y&dkqufqm[m 455659 rSm&SdwJhuk'fqD ausmfoGm;jyD; RET
ra&mufrDxd instruction awGudk tvkyfvkyfygw,f/ jyD;awmh CALL tjyD;u instruction awGqD jyefvSnfh
ygw,f/ CALL u jump jzpfoGm;wJhuk'fudkawmh procedure vdkU ac:ygw,f/ CALL [m EIP (aemufnTef
Mum;csufudk tvkyfvkyfaprnfh pointer)udk stack ay: push vkyfygw,f/ jyD;awmh RET-instruction u pop
jyefvkyfay;ygw,f/ oifhtaeeJU CALL twGuf argument awG owfrSwfvdkU&ygw,f/ 'gudk PUSH eJU jyKvkyf
Edkifygw,f/
push something
push something2
call procedure
CALL twGif;rSmawmh argument awGudk stack xJuzwfjyD;toHk;jyKEdkifygw,f/ Local variables
(qdkvdkwmu procedure xJtwGif;rSmomvdkwJh a'wmrsm;) awGudkvJ stack xJrSmxm;odkvdkU&ygw,f/ uRefawmfh
taeeJU 'gawGudk tao;pdwfaqG;aEG;rSm r[kwfygbl;/ bmvdkUvJqdkawmh 'gawGudk masm (Macro Assembler)
eJU tasm (Turbo Assembler) rSm tvG,fwulvkyfEdkifvdkUyg/ oifhtaeeJU procedure awGudk jyKvkyfEdkifw,f
qdkwmeJU olwdkUawG[m parameter awGudkoHk;wm trSwf&&if awmfygjyD/ ta&;MuD;wmwpfcsuf uawmh -
Procedure wpfck&JU return value udk xnfhxm;zdkU EAX udk tjrJwrf;eD;yg; toHk;jyKygw,f/
'gawG[m windows function awGtwGufvJ rSefuefygw,f/ trSefrSmawmh oifh&JUudk,fydkif
procedure rSmawmh tjcm;b,f register udkrqdk toHk;jyKEdkifygw,f/ 'gayr,fh EAX uawmh pHwpfckjzpf
ygw,f/ pum;rpyf instruction wpfck&JU oHk;EHI;yHkudk &Sif;jyvdkygw,f/
lea edi, namebuffer ; EDI [m rdrd&dkufxnfhvdkufwJh trnfxm;okd&m address jzpfygw,f/
mov eax, dword ptr ds:[edi] ; EAX xJudk pmvHk;av;vHk; oGm;xm;wmyg/ bmaMumifhvJqdkawmh DWORD
(4 bytes) [m pmvHk; av;vHk;eJU nDvdkUyg/
(10.0) Windows ESifh ywfoufaom Assmebly bmompum; tajccH
(10.1) API
Windows rSmy&dk*&rfa&;om;jcif;&JU tajccHtusqHk;tcsufuawmh Windows API (Application
Programming Interface) awGay:rlwnfaeygw,f/ API qdkwm OS ujznfhpGrf;ay;EdkifwJh function awGudk
pkpnf;ay;xm;wmyg/ Windows y&dk*&rfwdkif;[m 'D function awGudk toHk;jyKygw,f/ 'D function awG[m
tcef;(3) - tajccH Assembly bmompum; - 42 -
Windows pepf&JU dll zdkifawGjzpfwJh kernel? user? gdi? shell? advapi pwJh zdkifawGxJrSm &Sdygw,f/ Function
ESpfrsdK;ESpfpm;&Sdygw,f/ ANSI eJU Unicode yg/ 'gawGuawmh string awGudk odrf;qnf;udkifwG,f&mrSm toHk;jyK
wJhenf;vrf;ESpfck jzpfygw,f/ ANSI eJUqdk&ifawmh pmvHk;wdkif;udk oauFw(ASCII uk'f)taeeJU azmfjyjyD;
string &JUtqHk;udkazmfjyzdkU \0 (null-terminated)udk toHk;jyKygw,f/ Unicode uawmh widechar ykHpHudk
toHk;jyKjyD; oauFwwpfckpDtwGuf pmvHk;ESpfvHk;toHk;jyKygw,f/ oluawmh w&kwf? jrefrmbmompum;awGvdk
pmvHk;a&ydkrdkvdktyfwJh bmompum;awGrSmtoHk;jyKygw,f/ Widechar string awG[m \20 eJU tqHk;owfavh
&Sdygw,f/ Windows uawmh ANSI function jzpfjzpf? Unicode function jzpfjzpf vufcHygw,f/ Oyrm
jy&&if -
MessageBoxA (ANSI)
MessageBoxW (W = widechar (unicode))
uRefawmfwdkUuawmh ANSI udk toHk;jyKrSm jzpfygw,f/
(10.2) DLL zdkifrsm;udk qGJ,loGif;jcif;
Windows API &JU function awGudk toHk;jyKzdkU DLL zdkifawGudk import vkyfzdkUvdkygw,f/ 'gawGudk
import libraries (.lib) awGeJU jyKvkyfEdkifygw,f/ 'D lib awG[m r&Sdrjzpfvdktyfygw,f/ bmaMumifhvJqdkawmh
olwdkU[m Windows pepfudk DLL awG ,m,Dul;,loHk;pGJzdkU cGifhjyKvdkUyg/ (qdkvdkwmu rSwfOmPfu dynamic
base addresse rSm)/ 'gudk includelib oHk;jyD; library wpfckudk xnfhoGif;Edkifygw,f/
includelib C:\masm32\lib\kernel32.lib (odkUr[kwf)
includelib \masm32\lib\kernel32.lib (odkUr[kwf)
includelib kernel32.lib
'gqdk kernel32.lib udk xnfhoGif;toHk;jyKawmhrSmyg/ 'Dae&mrSm include library wpfckwnf;uom
ta&;MuD;wm r[kwfygbl;/ include file (.inc) uvJ vdkygw,f/ 'gawGudkawmh l2inc y&dk*&rfoHk;jyD; library
awGuae tvdktavsmuf xkwfay;aewmyg/ include file wpfckudk a&;jy&r,fqdk&ifawmh 'Dvdkyg/
include \masm32\include\kernel32.inc
include file xJrSm DLL xJu function awGtwGuf prototype awGudk t"dyÜm,fzGifhxm;jyD;jzpfwm
aMumifh oifhtaeeJU invoke udk toHk;jyKjyD; oHk;pGJvdkU&ygjyD/
kernel32.inc:
...
MessageBoxA proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
MessageBox textequ <MessageBoxA>
...
include file xJrSm ANSI function awGeJU wu,fh function trnfeJU wxyfwnf;usatmifvkyfxm;
wJh 'A' rygwJh function awGudk t"dyÜm,fzGifhxm;wm jrif&rSmyg/ oifhtaeeJU MessageBoxA tpm;
MessageBox udk oHk;Edkifygw,f/ oHk;pGJr,fh function awGtwGuf include library eJU include file awGudk
aMunmowfrSwfjyD;oGm;&ifawmh 'D function awGudk toHk;jyKvdkU &ygjyD/
invoke MessageBox, NULL, ADDR MsgText, ADDR MsgTitle, NULL
(10.3) Windows include file
Windows rSm txl; include file wpfckjzpfwJh windows.inc zdkif&Sdygw,f/ tJ'DzdkifxJrSm Windows
API twGufvdktyfwJh constant eJU structure tm;vHk;yg0ifygw,f/ Oyrmjy&&if message box rSm yHkpHtrsdK;rsdK;
&Sdygw,f/ Function &JU av;ckajrmuf parameter uawmh pwdkifyg/ NULL u MB_OK udk qdkvdkjyD; ol[m
OK button jzpfygw,f/ Windows include file rSm 'DvdkpwdkifrsdK;awGtwGuf t"dyÜm,fzGifhqdkcsufawG yg0ifyg
w,f/
MB_OK = 0
MB_OKCANCEL = ...
MB_YESNO = ...
'Dvdk t"dyÜm,fzGifhxm;vdkUvJ 'DtrnfawGudk oifhtaeeJU constant taeeJU oHk;vdkU&aewmyg/
invoke MessageBox, NULL, ADDR MsgText, ADDR MsgTitle, MB_YESNO
'DOyrmtwGuf include file udk aMunmr,fqdk&ifawmh 'DvkdaMunm&ygr,f/
include \masm32\include\windows.inc
(10.4) Frame
tcef;(3) - tajccH Assembly bmompum; - 43 -
end start
'Duk'fawGudk assemble (Go All) vkyfvdkuf&if awGU&rSmawmh yHk(1)twdkif; jzpfygw,f/
yHk(1)
y&dk*&rftvkyfvkyfyHkudk &Sif;&&ifawmh ...
1/ MessageBox &JU toHk;jyKyHkuawmh 'Dvdkyg/ (Win32.hlp udk Munfhyg/)
int MessageBox(
HWND hWnd, // handle of owner window
LPCTSTR lpText, // address of text in message box
LPCTSTR lpCaption, // address of title of message box
UINT uType // style of message box
);
zefwD;r,fh message box &JU owner window udk owfrSwfygw,f/ wu,fvdkU 'D
hWnd
parameter [m NULL jzpfcJh&if message box rSm owner window &SdrSmr[kwfygbl;/
¾ MsgText uawmh yxr string &JU offset udk odrf;ygw,f/ MsgTitle uawmh 'kwd, string udk
odrf;ygw,f/ ckcsdefrSmawmh oifhtaeeJU MessageBox function udk oHk;vdkU&ygjyD/
invoke MessageBox, NULL, offset MsgText, offset MsgTitle, NULL
¾ invoke udk toHk;jyKxm;wmaMumifh oifhtaeeJU (ydkrdkpdwfcs&atmif) offset tpm; ADDR udk
toHk;jyKEdkifygw,f/
invoke MessageBox, NULL, ADDR MsgText, ADDR MsgTitle, NULL
tcef;(3) - tajccH Assembly bmompum; - 45 -
yHk(2)
4/
uType &JU t"dyÜm,fuawmh yHk(2)eJU yHk(3) twdkif; jzpfygw,f/
yHk(3)
(10.5) Win32 API
Windows API rSm Windows twGufvdktyfwJh y&dk*&rfawGzefwD;EdkifzdkU data type awG? constant
awG? function awGeJU structure awGyg0ifygw,f/ uRefawmfwdkUtoHk;jyKcJhwJh ExitProcess tygt0if API
function awmfawmfrsm;rsm;udk t"du DLL zdkif3ckjzpfwJh kernel32.dll? gdi32.dll eJU user32.dll wdkUrSm xm;&Sd
wmyg/
KERNEL32.DLL - Low level kernel services
GDI32.DLL - Graphics Device Interface: yHkqGJjcif;ESifh yHkESdyfjcif;/
USER32.DLL - User Interface controls? windows ESifh messaging services
BOOL SetWindowText(
HWND hWnd, // handle of window or control
LPCTSTR lpString // address of string);
'guawmh C yHkpHa&;xm;wmyg/ yHkpHtaeeJU jyefa&;jy&&if -
PUSH lpString;
PUSH hWnd;
CALL SetWindowText;
(11) &dk;&Sif;aom Dialog Box y&dk*&rf a&;om;jcif;
'DwpfcgrSmawmh Windows &JU zGJUpnf;wnfaqmufyHkudkausmfvdkufjyD; vufawGUy&dk*&rfa&;Munfhygr,f/
(tcgtcGifhoifhcJh&ifawmh &Sif;jyygr,f/) WinAsm Studio &JU File menu u New Project udk a&G;vdkufyg/
Project u Add new Rc udk a&G;vdkufyg/ jyD;&if Add New Dialog udka&G;yg/ 'DaemufrSmawmh caption
wpfck? button ESpfckeJU editbox wpfckudk zefwD;vdkufyg/ jyD;&if screen atmufajcem;u Resources tab udk
a&G;yg/ Caption box ukd ESpfcsufESdyfjyD; 'Simple Dialog Box Program' vdkU &dkufyg/ jyD;&if toolbox u edit
button udka&G;jyD; yHk(4)twdkif; qGJyg/
tcef;(3) - tajccH Assembly bmompum; - 46 -
yHk(4)
jyD;&if button ESpfckudk zefwD;jyD; button awGrSm 'Say Hello' eJU 'Exit' vdkU jyifvdkufyg/ yHk(5)/
yHk(5)
'gqdk F12 udkESdyfjyD; uRefawmfwdkUzefwD;xm;wJh dialog box udk uk'ftaeeJU MunfhvdkufMu&atmif/
;This Resource Script was generated by WinAsm Studio.
#define IDD_DLG1001 1001
#define IDC_EDIT1002 1002
#define IDC_BUTTON1003 1003
#define IDC_BUTTON1004 1004
IDD_DLG1001 DIALOGEX 0,0,170,72
CAPTION "Simple Dialog Box Program"
FONT 8,"MS Sans Serif"
STYLE 0x10cc0000
EXSTYLE 0x00000000
BEGIN
CONTROL "",IDC_EDIT1002,"Edit",0x50010080,10,9,121,19,0x00000200
CONTROL "Say Hello",IDC_BUTTON1003,"Button",0x50010000,17,46,51,16,0x00000000
CONTROL "Exit",IDC_BUTTON1004,"Button",0x50010000,102,46,50,16,0x00000000
END
uRefawmfwdkUtaeeJU Dialog Box template eJUywfoufwJhuk'fawGudk a&;EdkifatmifvdkU dialogbox?
editbox? button wdkUeJUywfoufwJh trnfawGeJU control ID awGudk odxm;zdkU vdkygw,f/ 'gudk resource
script &JU tay:yxrqHk; 4aMumif;rSm awGUEdkifygw,f/ jyD;&if dialogbox.asm udka&G;jyD; atmufyguk'fawGudk
&dkufxnfhvdkufyg/
option casemap:none
include WINDOWS.INC
include user32.inc
include kernel32.inc
includelib USER32.LIB
includelib KERNEL32.LIB
DlgProc proto :DWORD,:DWORD,:DWORD,:DWORD
.data
Message db "Hello World", 0
.data?
hInstance HINSTANCE ?
.code
start:
invoke GetModuleHandle, NULL
mov hInstance, eax
invoke DialogBoxParam, hInstance, 1001, NULL, addr DlgProc, NULL
invoke ExitProcess, eax
⊕ DlgProc proc hWnd: HWND, uMsg: UINT, wParam: WPARAM, lParam: LPARAM
.if uMsg = = WM_COMMAND
mov eax, wParam
.if eax = = 1003
invoke SetDlgItemText, hWnd, 1002, ADDR Message
tcef;(3) - tajccH Assembly bmompum; - 47 -
yHk(7)
(12) Keygen y&dk*&rf a&;om;jcif;
'Doifcef;pmuawmh cracker awGtwGuf tvGefta&;MuD;ygw,f/ bmaMumifhvJqdkawmh cracker awG
twGuf keygen [m r&Sdrjzpf toHk;vdkvdkUyg/ Keygen &SdrSom rdrdESpfouf&m oHk;pGJoltrnfeJUoufqdkifwJh
registration uk'fudk xkwfay;EdkifvdkUyg/ erlem keygen tcsdKUudk Munfhyg/ yHk(8)/
yHk(8)
aumif;jyD? keygen udk pa&;MunfhvdkufMu&atmif/ WinAsm Studio udkzGifhvdkufjyD; atmufygyHktwdkif;
jrif&atmif vkyfvdkufyg/ yHk(9)/ Edit control ESpfck? static text ESpfck? button oHk;ck &Sd&ygr,f/
yHk(9)
tcef;(3) - tajccH Assembly bmompum; - 48 -
yHk(1)
'Denf;udktoHk;jyKjcif;&JU tusdK;aus;Zl;wpfckuawmh tjcm;enf;awGudk toHk;jyKwmxufpm&if xnfhvdkuf
wJha'wmawGudk memory rSm rodrf;qnf;bJ tjcm;enf;awGeJU XOR vkyfjcif; (odkUr[kwf) jyefvnfwGufcsuf
tcef;(4) - aqmhzf0Jvf protection - 51 -
yHk(2)
y&dk*&rfrm[m ydktawGUtMuHK? t&nftcsif;&Sdav cracker awGtwGuf protection udk zsufqD;zdkY
ydkrdkcufcJatmif vkyfEdkifavygyJ/ bmyJjzpfjzpf b,fvdk&IyfaxG;wJh wGufcsufrIenf;pepfawGoHk;oHk; cracker
awGtaeeJYuawmh rSefuefwJh registration number udk&&SdzdkU y&dk*&rfuk'fawGudk aemufa,mifcHMutkef;rSmygyJ/
(1.3) Registration number onf oHk;pGJol\ uGefysLwmay:rlwnfí ajymif;vJjcif;?
'Denf;uawmh cracker awGtwGuf rtDromjzpfapwJh trsdK;tpm;yg/ *&krxm;wJh cracker qdk&if
aMumifawmifaMumifoGm; Edkifavmufygw,f/ bmvdkYvJqdkawmh olwdkU[m olwdkUuGefysLwmrSm b,fvdkyJ register
vkyfvkyf vkyfvdkYr&vdkUyg/ bmaMumifhvJqdkawmh registration number [m (Oyrm - hard drive &JY serial
number ay:rlwnfjyD;) ajymif;vJaevdkYyg/ yHk(3)/ (ta&;tMuD;qHk;u registration number udk owdxm;jyD;
azsmufxm;zdkYyg/ wu,fvdkY registration number udk awGYoGm;vdkU&Sd&if vG,fvifhwul rlaoeHygwfajymif;jyD;
y&dk*&rfudk b,fpufrSmrqdk wlnDwJh registration number eJU register vkyfEdkifvdkYyg/)
yHk(3)
(1.4) Registration number udk Visual basic odkUr[kwf Delphi y&dk*&rfrsm;jzifh jyKvkyfMujcif;
Visual Basic (VB) rSma&;xm;wJh registration number udk crack vkyf&wm[m rvG,fulvSygbl;/
bmvdkUvJqdkawmh y&dk*&rf bmompum;udk,fwdkifudku high level jzpfaevdkUygyJ/ uRefawmfwdkUtaeeJU crack
vkyfzdkUtwGuf debugger (disassembler) awGudk oHk;&wmjzpfwJhtwGuf high level jzpfvmavav
debugger u assembly uk'ftjzpfajymif;ay;&wm cufavavygyJ/ 'gaMumifh VB eJUa&;xm;wJh y&dk*&rfawG
udk debugger awGu bmomjyefay;jyD; xGufvmwJh assembly uk'f[m vlopfwef; cracker awG em;vnfzdkU
cufcJvSygw,f/
VB y&dk*&rfawGudk 'Dvdktkyfpk (3)pk cGJjcm;Edkifygw,f/
tcef;(4) - aqmhzf0Jvf protection - 52 -
(1.4.1) VB4?
(1.4.2) VB5 ESifhtxuf?
(1.4.3) VB5 ESifhtxuf? (packed code wGif compile vkyfxm;aom)
(1.4.1) VB4
oHk;pGJolawmfawmfrsm;rsm;twGuf rodomvSaomfvnf; VB4 [m y&dk*&rfawGxJrSmawmh pdwfcs&rI
tvGefenf;ygw,f/ tawGUtMuHK&SdwJh cracker taeeJUuawmh registration number udk 5rdepftwGif; &SmawGU
Edkifygw,f/ yHk(4)/ bmaMumifhvJqdkawmh VB4 y&dk*&rfawG[m rsm;aomtm;jzifh &dkufoGif;vdkufwJh registration
number eJU MudKwifowfrSwfxm;wJh registration number udk EdIif;,SOfzdkU vb40016.dll (odkU) vb40032.dll
zdkifudk toHk;jyKvdkUyg/
yHk(4)
(1.4.2) VB5 ESifhtxuf
VB5 eJU umuG,fxm;wJh y&dk*&rfudk crack vkyf&wm[m VB4 eJUEdIif;,SOf&if tawmfav;ydkcufvmyg
w,f/ Cracker awmfawmfrsm;rsm;[m VB5 udk debugger awGeJU debug vkyfzdkU odyfjyD;pdwfrygMuygbl;/
bmvdkUvJqdkawmh uk'fawG[m zwfzdkUeJU em;vnfEdkifzdkU cufvdkUyg/ jyD;awmh ajc&maumufzdkYvnf; cufvdkYyg/
y&dk*&rfawGudk crack vkyfzdkY olwdkY&JYenf;vrf;awGuawmh oHk;pGJolwpfOD;wnf;oHk;EdkifwJh registration number
udkomxkwfay;jcif; (keygen rsm; ra&;om;jcif;udk qdkvdkygonf/) eJU vlwdkif;rdrdESpfouf&m registration
number udk xnfhoGif;Edkifatmif y&dk*&rfuk'fudk jyKjyifrGrf;rHjcif;wdkUom jyKvkyfMuygonf/ tawmfqHk; cracker
awGuom keygen awGudk a&;om;Muygw,f/ Cracker awGMum;rSmawmh VB5 y&dk*&rfawG[m rausmfMum;
vSygbl;/ bmvdkYvJqdkawmh registration number generator awGa&;zdkU cufcJvdkUyg/
'gqdk&if EdkifiHwumu y&dk*&rfrmawG[m olwdkU&JU y&dk*&rfawGudk VB eJU bmvdkUra&;MuygovJ/
uRefawmf a&SUrSmwifjycJhwmu VB y&dk*&rfawGudk debugger awGeJU uk'fjyefazmfwJhenf;yg/ Debugger awGeJU
uk'fjyefazmf&wm[m tvGefcufcJvSwJhtwGuf 'DjyoemawGudk ajz&Sif;EdkifzdkU taumif;qHk;enf;awGukd cracker
awGu &SmazGawGU&SdvmMuygw,f/ 'Denf;uawmh Smart Check eJU VB Decompiler tool awG&JU tultnDeJU
uk'fawGudk jyefazmfMuvmwmyg/ 'DtcgrSm jyefazmfvdkU&wJhuk'f[m b,favmufxdawmif vG,fulvmovJqdk
awmh compile rvkyfcif rl&if; soucre uk'ftxdeD;eD;wlwJhuk'fudk &atmiftxd jyefazmfvmEdkifygw,f/ 'Dvdk tool
awGudkawmh debugger vdkU rac:a0:bJ decompiler vdkUom ac:a0:Muygw,f/ 'D tool awG[m VB6 txd
aumif;aumif; decompile vkyfEdkifygw,f/ 'D tool awG ay:csdefupjyD; VB eJUa&;om;aeMuwJhy&dk*&rfrmawG
'ku©a&mufukefMujyD; Microsoft uvJ VB bmompum;udk qufvuftqifhjrifha&mif;csjcif; r&Sdawmhygbl;/
'gaMumifhrdkU VB [m version 6 rSmyJ &yfwefUaecJh&ygw,f/ oleJUtwl a&mif;cscJhwJh Visual C++ uawmh
vuf&SdrSm version 8 txd xGuf&SdaejyD; toHk;trsm;qHk; jzpfaevsuf&Sdygw,f/
VB y&dk*&rfawGudk b,folrS ra&;MuawmhbJ bmaMumifh &Sif;jyaewmvJvdkU oifhtaeeJU xifaumif;
xifaeygvdrfhr,f/ EdkifiHwumrSm VB y&dk*&rfawG[m 2001ckEpS fem;avmufrSm ed*Hk;csKyfoGm;cJhygw,f/ 'gayr,fh
jrefrmEdkifiHrSmawmh vuf&Sd 2009ckESpfxd aqmhzf0JvfawG&JU 50&mcdkifEIef;ausmfudk VB eJU a&;om;aeMuwkef;ygbJ/
'Davmufqdk em;vnfavmufjyD xifygw,f/
(1.5) Registration number udk tGefvdkif;wGif ppfaq;jcif;
tcsdKUy&dk*&rfawG[m registration number udk awmfwnfhrSefuefpGm toHk;jyKapzdkU aemufqHk;ay: enf;
ynmawGudk toHk;jyKvmMuygw,f/ Registration number udk &dkufoGif;vdkuf&if y&dk*&rfu tJ'gudk ppfaq;zdkU
twGuf tifwmeufuwqifh ydkYvdkufygw,f/ qmAmu tJ'Duk'f rSefrrSefudk prf;oyfjyD; taMumif;jyefygw,f/
y&dk*&rfuawmh rSefuefpGm register vkyfxm;jcif; &Sd^r&Sd ppfaq;ygw,f/ yHk(5)/ 'DvdktrsdK;tpm;awGeJU umuG,f
jcif;[m vG,fulvGef;vSwJhtwGuf tawGUtMuHK&SdwJh cracker awGuawmh tvG,fwul z,f&Sm;ypfEdkifygw,f/
tcef;(4) - aqmhzf0Jvf protection - 53 -
yHk(5)
(2) tcsdef? tMudru f efUowfcsufxm;jcif;
tcsdefuefUowfcsuf&SdwJh y&dk*&rfawG[m oHk;pGJzdkUcGifhjyKxm;wJh umvausmfvGefjcif; &Sd^r&Sd ppfaq;yg
w,f/ 'Dvdkenf;eJUumuG,fwm[m odyfjyD;awmh xda&mufrIr&SdvSygbl;/ bmvdkYvJqdkawmh cracker wpfa,muf
[m tcsdefuefUowfcsufudk z,f&Sm;vdkuf&HkeJU y&kd*&rfudk vGwfvyfpGmtoHk;jyKEdkifvdkUyg/ yHk(6)/ Unregistered
version awGrSm oHk;pGJEdkifpGrf;yrmPudk uefUowfjcif;u ydkjyD; tqifajyygvdrfhr,f/ y&dk*&rf&JU vkyfaqmifEdkifpGrf;
tukefvHk;udk oHk;pGJcsif&ifawmh registered version udk 0,f,lapjcif;eJY oHk;pGJoludk zdtm;ay;EdkifrSmyg/
yHk(6)
tcsdefuefUowfcsufudk enf;rsdK;pHkeJY a&;om;avh&SdMuygw,f/ jzpfEdkifwmawGuawmh-
(2.1) rSefuefaom registration number xnfhjcif;jzifh tcsdefuefUowfcsufudk z,f&Sm;jcif;?
(2.2) Registration zdkifxnfhjcif;jzifh tcsdefuefUowfcsufudk z,f&Sm;jcif;?
(2.3) tcsdefuefUowfcsufudk z,f&Sm;jcif;jzifh full version udk roHk;pGJEdkifjcif;? (0,f,lrSom tjynfht0 oHk;pGJEdkif
jcif;)
(2.4) tcsdefuefUowfcsufudk Visual Basic jzifha&;om;jcif;?
(2.5) oHk;pGJrIuefUowfcsufudk oHk;pGJonfhtMudrfta&twGufESifhom owfrSwfjcif;/
(2.1) rSefuefaom registration number xnfhjcif;jzifh tcsdefuefUowfcsufudk z,f&Sm;jcif;?
'Denf;[m registration number enf;eJU twlwlygyJ/ rSefuefwJh registration number udk xnfhay;
vdkuf&HkeJY tcsdefuefUowfcsufudk z,f&Sm;ay;EdkifrSmyg/ yHk(7)/ uGJjym;wmwpfckuawmh rSefuefwJh registration
number rxnfhoGif;Edkif&if cGifhjyKxm;wJh tcsdefumvausmfomG ;wJhtcg y&dk*&rfudk vHk;0oHk;pGJvdkY r&atmif jyKvkyf
vdkufwmygyJ/
owdjyK&rSmuawmh 'Dvdky&dk*&rfudk a&;om;r,fqdk&if yxrqHk; y&dk*&rfudk pwifoHk;pGJwJYaeUudk registry
(odkUr[kwf) zdkifwpfzdkifrSm taotcsmrSwfxm;zdkYygyJ/ 'DvdkrSr[kwf&ifawmh oHk;pGJolu olUuGefysLwm&JU &ufpGJudk
aemufqkwfvdkuf&HkeJU uefUowfcsufudk ausmfvTm;oGm;ygvdrfhr,f/
tcef;(4) - aqmhzf0Jvf protection - 54 -
yHk(7)
(2.2) Registration zdkifxnfhjcif;jzifh tcsdefuefUowfcsufudk z,f&Sm;jcif;?
'Denf;uawmh odyfoHk;avhoHk;xr&SdwJh tHhtm;oifhp&menf;yg/ pOf;pm;oifhwJhtcsufuawmh registrati-
on zdkifudk tifwmeufuae rydkYrdzdkYygyJ/ Cracker awG[m tcsdefuefUowfcsufudk a&;xm;wJh routine udk t"d
uxm;&SmazGygvdrfhr,f/ 'gaMumifh oif[m 'D&efuumuG,fEdkifatmif routine udk vHkjcHKrI&Sdatmif aqmif&Guf
&ygr,f/ Cracker wpfa,muf[m rSefuefwJh registration zdkifudk zefwD;cJygw,f/ yHk(8)/ bmvdkUvJqdkawmh
'DvdkvkyfzdkU tawmfav;cufvdkYyg/ olUtwGufydkvG,fwmu y&dk*&rfxJrSmygwJh tcsdefuefUowfcsuf routine udk
z,f&Sm;jcif;yJ jzpfygw,f/
yHk(8)
y&dk*&rfa&;om;wJhtcgrSm registration zdkifudk y&dk*&rf&JU directory atmufrSm &Sd^r&SdeJU zdkifxJrSm
rSefuefwJh a'wmawG yg^ryg ppfaq;wJh function awG ra&;rdygapygeJU/
(2.3) tcsdefuefUowfcsufudk z,f&Sm;&Hkjzifh full version udk roHk;pGJEdkifjcif;? (0,f,rl Som tjynfht0 oHk;pGJEdkif
jcif;)
Demo version y&dk*&rfawGuawmh 'Denf;udk toHk;rsm;ygw,f/ 'Dvdky&dk*&rfawGrSmqdk registration
number &dkufxnfhvdkYr&ygbl;/ oufwrf;ukefoGm;&if y&dk*&rfudk vHk;0oHk;pGJvdkU r&awmhygbl;/ oHk;pGJcsif&if
y&dk*&rfudk rjzpfrae 0,f&ygawmhr,f/ yHk(9)/
yHk(9)
Cracker awGuawmh tcsdefuefUowfcsuf routine udk&SmjyD; y&dk*&rfuk'fukd wkduf&dkuf ausmfvdkufyg
w,f/ 'gaMumifh y&dk*&rf[m oufwrf;ukef^rukef ppfaq;raeawmhyJ olUvkyfjrJtvkyfudk vkyfygawmhw,f/
(2.4) tcsdeu f efUowfcsufudk Visual Basic jzifha&;om;jcif;?
'Denf;udk ckacwfrSm us,fjyefUpGm toHk;rjyKMuawmhygbl;/
(2.5) oHk;pGJrIuefUowfcsufudk oHk;pGJonfhtMudrfta&twGufESifhom owfrSwfjcif;/
'Denf;[m tjcm;tcsdefuefUowfcsufenf;awGeJU tajccHtm;jzifh twlwlygyJ/ 'gayr,fh olu oHk;pGJwJh
aeUudk a&wGufwJhtpm; oHk;pGJwJhtMudrfudkom a&wGufjcif;yg/ 'Dvdka&wGufjcif;u reverser awGudk
tcef;(4) - aqmhzf0Jvf protection - 55 -
yHk(10)
wu,fvdkY oif[m 'Denf;udk toHk;jyKr,fqdk&if registration zdkifudk encode vkyfzdkYvdkygw,f/ 'grSom
reverser [m registration zdkifudk vG,fvifhwul rzefwD;EdkifrSm jzpfygw,f/
(3.2) rSefuefaomzdkifudk toHk;rjyKygu y&dk*&rfudk tcsdefuefUowfcsuf xm;&Sdjcif;/
Antivirus ukrÜPDtrsm;pkuawmh 'Denf;udk toHk;jyKMuygw,f/ rSefuefwJh registration zdkifudk
toHk;rjyKygu y&dk*&rf[m unregistered jzpfjyD; tcsdefuefUowfcsuf &SdrSmjzpfygw,f/
(4) Hardware key (Dongle) rsm;toHk;jyKjcif;
Hardware key awGeJU umuG,fjcif;[m tjcm;enf;vrf;wpfckjzpfjyD; toHk;vJenf;vSygw,f/ cdk;ul;
wmudk umuG,fwJhypönf;jzpfwJh dongle udk uGefysLwm&JY I/O aygufrSm wyfqifjyD; toHk;jyKr,fh y&dk*&rfudkvJ
run xm;&ygr,f/
olUrSmawmh umuG,fjcif; (2)rsdK; &Sdygw,f/
(4.1) Hardware key rygbJ y&dk*&rfudk rpwifEdkifjcif;?
(4.2) y&dk*&rf\ vkyfaqmifcsuftcsdKUudk hardware key rygvQif toHk;jyKcGifh ray;jcif;/
HASP eJU Sentinel uawmh toHk;rsm;qHk; hardware key awGyg/ taumif;qHk;awGvdkUvJ ajymvdkU
&ygw,f/
tcef;(4) - aqmhzf0Jvf protection - 56 -
yHk(11)
(4.2) y&dk*&rf\ vkyaf qmifcsuftcsdKUudk hardware key rygvQif toHk;jyKcGifh ray;jcif;/
'Denf;uawmh tvGef &dk;&Sif;ygw,f/ hardware key wyfxm;csdefrSm y&dk*&rfu tvkyfvkyfjyD; rwyf
xm;csdefrSm y&dk*&rf&JU tcsdKUvkyfaqmifrIawG tvkyfrvkyfygbl;/ bmvdkUvJqdkawmh y&dk*&rf&JY tcsdKUaomvkyf
aqmifcsufawGudk hardware key xJrSm wcgwnf; xnfhoGif;xm;vdkYyg/ 'Denf;uawmh tvGefyJ aumif;rGefvS
ygw,f/ Key awGtwGif;rSm rSwfOmPfxJ function awGudk decode vkyfzdkU uk'fawGawmif ygwwfygw,f/
Encoding uom aumif;aecJhr,fqdk&if protection udk key rygbJ z,f&Sm;zdkYqdkwm rjzpfEdkifygbl;/
HASP key
HASP key udk Aladdin Knowledge Systems rS xkwfvkyfygw,f/ yHk(12)/ HASP [m aqmhzf
0Jvfudk install vkyfcsdefrSm hardware key eJY csdwfqufvdkU&atmif olU&JUudk,fydkif driver awGudk install vkyfyg
w,f/
yHk(12)
Sentinel key
Rainbow Technology (www.rainbow.com) rS xkwfvkyfygw,f/ Sentinel [m HASP eJU
tvGefwlygw,f/ yHk(13)/
yHk(13)
tcef;(5) - Cracker wpfOD;twGuf vdktyfaom tool rsm; - 57 -
(c) Decompilers
Disassembler eJU tvm;wlwJh decompiler awGuawmh exe uk'fawGudk high-level bmompum;
uk'ftaeeJU jyefxkwfay;wmjzpfygw,f/ rMumcPqdkovdkyJ high-level bmompum;[m C jzpfaeygw,f/
bmaMumifhvJqdkawmh C [m decompilation vkyf&mrSm vG,fulacsmarGUapzdkU awmfawmfav; &dk;&Sif;jyD; a&S;us
vGef;ygw,f/ Decompilation vkyf&mrSmvJ olUtm;enf;csufeJUol jzpfygw,f/ bmaMumifhvJqdkawmh compila-
tion vkyfuwnf;uudk tcsuftvufawmfawmfrsm;rsm;[m aysmufqHk;oGm;vdkU jzpfygw,f/ 'gawGudk decompi-
lation u jyefjyD;azmfay;EdkifrSm r[kwfygbl;/ Decompilation enf;ynm[m rzGHjzdK;ao;ygbl;/ 'gayr,fh &v'f
uawmh aumif;aew,fvdkU ajym&rSmyg/
Decompilation vkyfEdkif^rvkyfEdkif
Compiler taumif;pm;awG ay:aewJhacwfrSm ]decompilation vkyfzdkU jzpfEdkifao;vm;} vdkU tar;cHcJh
&&if obm0usrSm r[kwfygbl;/ tajzuawmh rsm;aomtm;jzifh vkyfvdkU&w,fvdkU ajz&rSmjzpfygw,f/ bmyJ
ajymajym trSm;r&SdwJh taumif;qHk; decompiler uawmh ,aeUxdawmh ray:ao;bl;vdkU ajym&rSmjzpfygw,f/
vuf&Sd decompiler awGuawmh cracker awGtwGuf tultnD&&Hkoufoufavmufom &Sdygao;w,f/
Decompiler rsm;
DCC Decompiler
Dcc uawmh decompilation vkyf&mrSm taumif;qHk;jzpfayr,fh vuf&SdrSmawmh zdkiftao;pm;av;awG
udkyJ vufcHygw,f/
http://www.itee.uq.edu.au/~cristina/dcc.html
Boomerang Decompiler Project
Boomerang decompiler udkawmh tpGrf;xufwJh decompiler jzpfatmifjyKvkyfaejyD; ,cktxdawmh C
uk'ftaeeJUyJ decompile vkyfEdkifygao;w,f/
http://boomerang.sourceforge.net
Reverse Engineering Compiler
REC uawmh tpGrf;xufwJh decompiler jzpfjyD; assembly uk'fawGudk C yHkoP²mefuk'ftaeeJU
decompile vkyfay;ygw,f/ xGuf&SdvmwJhuk'f[m C eJU assembly ESpfrsdK;jzpfaejyD; assembly oufoufxuf
pm&ifawmh ydkjyD;zwf&wm tqifajyygw,f/
http://www.backerstreet.com/rec/rec.htm
ExeToC
ExeToC uawhm &v'faumif;awG&SdwJh decompiler wpfckjzpfygw,f/
http://sourceforge.net/projects/exetoc
code-dump
code-dump uawmh PowerPC (PPC) Objective-C decompiler jzpfygw,f/
http://sourceforge.net/projects/code-dump
(*) Debuggers
Debugger awGuawmh cracker awG&JU taumif;qHk;rdwfaqGjzpfjyD; oHk;pGJolawG[m y&dk*&rfuk'fawGudk
wpfqifhcsif; tvkyfvkyfEdkifatmif cGifhjyKygw,f/ jyD;awmh wefzdk;trsdK;rsdK;eJU vkyfaqmifcsuftrsdK;rsdK;wkdUudk ppfaq;
Edkifygw,f/
tqifhjrifh debugger awGrSmawmh rMumcPqdkovdkyJ tajccH disassembler wpfck? HEX uk'fawG
wnf;jzwfzdkUeJU assemble jyefvkyfzdkU t*Fg&yfawG tenf;qHk; yg0ifavh&Sdygw,f/ Debugger awG[m oHk;pGJol
awGudk instruction? function call eJU rSwfOmPfae&mawGrSm breakpoint owfrSwfvdkU&atmif vkyfay;ygw,f/
Windows Debugger rsm;
OllyDbg
OllyDbg uawhm tpGrf;xufwJh Windows debugger jzpfjyD; olUrSm disassembly eJU assembly
engine wcgwnf;yg0ifygw,f/ tvGefrsm;jym;wJh feature awGyg0ifjyD; wefzdk;uawmh tcrJhjzpfygw,f/
Patching? disassembling eJU debugging vkyfzdkUtwGuf tvGeftoHk;0ifvSygw,f/
http://www.ollydbg.de/
tcef;(5) - Cracker wpfOD;twGuf vdktyfaom tool rsm; - 60 -
SoftICE
SoftICE udk local kernel debugging twGuf toHk;jyKEdkifygw,f/ 'g[m tvGef&Sm;yg;vSwJh feature
wpfckjzpfjyD; tvGefwefzdk;&SdvSygw,f/ SoftICE [m 2006? {jyDrSmawmh aps;uGufrSm t0,fvdkufygw,f/
WinDBG
WinDBG uawhm MicroSoft u tcrJhay;wJh aqmhzf0Jvftpdwftydkif;wpfckjzpfjyD; user-mode
debugging odkU remote kernel-mode debugging twGuf toHk;jyKEdkifygw,f/ WinDBG [m emrnfMuD;
Visual Studio Debugger eJU rwlayr,fh GUI aumif;aumif;eJU vmygw,f/ 32-bit eJU 64-bit version
awGtaeeJU xGuf&Sdygw,f/
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx
IDA Pro
DataRescue uxkwfvkyfjyD; y&dkqufqmrsdK;pHk? OS rsdK;pHkrSm tvkyfvkyfEdkifygw,f/
http://www.datarescue.com
(C) Hex Editors
Hex editor awGuawmh cracking vkyf&mrSm emrnfMuD;wJh tool awGr[kwfayr,fh binary source file
awGudk Munfh&mrSm? wdkuf&dkufwnf;jzwf&mrSmawmh toHk;0ifvSygw,f/ Hex editor awG[m debugger?
decompiler? disassembler awGeJUrMunfhEdkifwJh png vdk? jpg vdk zdkiftrsdK;tpm;awGudk Munfh&mrSmawmh
tvGeftoHk;0ifygw,f/ Hex editor awGtrsm;MuD;&Sdayr,fh toHk;trsm;qHk; tool awGudk azmfjyvdkufygw,f/
Windows Hex Editor rsm;
Cygnus Hex Editor FREE EDITION
tvGefjrefjyD; oHk;&vG,fulwJh tool jzpfygw,f/
http://www.softcircuits.com/cygnus/fe/
WinHex
zdkifeJU disk awGwnf;jzwfzdkU xkwfvkyfxm;wJh tool jzpfjyD; uGefysLwmrIcif;qdkif&meJU tcsuftvufjyef
vnf&SmazGa&;twGuf tqifhjrifhwJh pGrf;aqmif&nfrsm;ydkifqkdifygw,f/ (tpdk;&ydkif;qdkif&mESifh wyfrawmfwdkUwGif
vnf; toHk;jyKonf/)
http://www.x-ways.net/index-m.html
HexEdit
tpGrf;xufvSjyD; binary zdkifawGeJU disk awGudk wnf;jzwfEdkifygw,f/ Free version rSmawmh source
uk'fudk tcrJh&&SdEdkifjyD; shareware version vJ&Sdygw,f/
http://www.hexedit.com/
FlexHex
FAT32 zdkifawGxuf &IyfaxG;vSwJh NTFS zdkifawGtwGuf tjynfht0 toHk;jyKEdkifygw,f/ FlexHex
[m Sparse zdkifawGeJU b,f NTFS volume &JUzdkifawGeJU ywfoufwJh Alternate data stream udkvnf; vufcH
ygw,f/ OLE compound zdkifawG? flash card awGeJU tjcm; physical drive trsdK;tpm;awGtwGufvnf;
toHk;jyKEdkifygw,f/
http://www.heaventools.com/flexhex-hex-editor.htm
(i) tjcm; tool rsm;
'Dacgif;pOfatmufrSmawmh tool wpfckcsif;taMumif;udk tao;pdwf aqG;aEG;awmhrSm r[kwfygbl;/
SysInternals Tools
SysInternals uxkwfwJh tool awGrSm taumif;qHk; utility awGyg0ifjyD; olwdkUxJutrsm;pk[m
vHkjcHKa&;qdkif&muRrf;usifolawG? network administrator awGeJU cracker awGtwGuf tvGeftoHk;0ifvSyg
w,f/ txl;toHk;jyKoifhwJh utility awGuawmh Process Monitor? FileMon? TCPView? RegMon eJU
Process Explorer wdkU jzpfygw,f/
API Monitors
API monitor tool awGuawmh process (odkU) y&dk*&rfwpfck[m Win32 API &JU b,f function
awGudk ac:oHk;aew,fqdkwmudk apmifhMunfhay;wmyg/ 'gawG[m cracker awGtwGuf tvGefta&;ygvSygw,f/
tcef;(5) - Cracker wpfOD;twGuf vdktyfaom tool rsm; - 61 -
Rohitab &JU API Monitor? Vitaly Evseenko &JU API Spy32? www.nektra.com &JU Spy Studio wdkUudk
toHk;jyKEdkifygw,f/
PE Tools
PE scanner uawmh udk,f debug vkyfcsifwJh exe y&dk*&rfudk b,fy&dk*&rfbmompum;eJU a&;xm;
w,f? b,f protector awGeJU umuG,fxm;w,fqdkwm ppfaq;ay;ygw,f/ 'ghtjyif tcsdKU tool awG[m PE
header udkvnf;wnf;jzwfEdkifygao;w,f/ PE tool awGuawmh Lord PE? PE Browse? PE Detective? PE
Disassembler? PE Explorer? PE Insight? PE Optimizer? PE Rebuilder? PE Tools? PE Viewer?
PEditor? PEiD? Stud PE? WPE eJU CFF Explorer wdkUjzpfygw,f/ toHk;trsm;qHk;uawmh Lord PE? PEiD
eJU CFF Explorer wdkUjzpfygw,f/
Resource Editors
Resource editor uawmh pmom;awG? &kyfyHkawGudk jyifzdkU&meJU resource topfawGudk xyfxnfh&mrSm
t"dutoHk;jyKygw,f/ toHk;trsm;qHk; resource editor awGuawmh Exe Scope? Resource Editor?
Resource Hacker? Restorator? Window Hack eJU XN Resource Editor wdkU jzpfygw,f/
Compilers
Compiler awGuawmh cracking qdkif&mjyoemawGajz&Sif;&mrSm toHk;jyKzdkU jzpfygw,f/ oifESpfouf&m
y&dk*&rfbmompum;ay:rlwnfjyD; compiler trsdK;tpm;uGJjym;oGm;ygvdrfhr,f/
Dictionary Files
Dictionary zdkifawGuawmh password awGudk jyefazmf&mrSm toHk;jyKzdkU jzpfygw,f/ pmvHk;pHkav
password jyef&Sm&mrSm ydkvG,favjzpfygw,f/
Password Recovery Tools
Password revovery tool awGudk password jyefazmf&mrSm toHk;0ifvSygw,f/ emrnfMuD; tool
awGuawmh Elcomsoft Password Recovery eJU Passware Kit Enterprise wdkUjzpfygw,f/ 'D tool awGudk
toHk;jyKjyD; e-mail? internet? MS Word? MS Excel? MS Access? MS Powerpoint? Windows
password tp&SdwmawGudk jyefvnfazmf,lEdkifygw,f/
csefvSyfxm;cJhaom Tool rsm;
wu,fawmh tao;pdwfr&Si;f jyyJ csefvSyfxm;cJhwJh tool awGtrsm;MuD; &Sdygw,f/ 'gawGuawmh Visual
Basic y&dk*&rfawGudk decompile vkyfwJhtcgtoHk;jyKwJh tool awGjzpfwJh SmartCheck eJU VB Decompiler?
Delphi y&dk*&rfawGtwGuf DeDe? Foxpro y&dk*&rfawGtwGuf UnFox All? Java y&dk*&rfawGtwGuf Java
Decompiler eJU DJ Java Decompiler? Flash (SWF) zdkifawGtwGuf Sothink SWF Decompiler? MSI
zdkifawGtwGuf MSI Unpacker? Dot.Net y&dk*&rfawGtwGuf Crack.NET ? DisSharp eJU RedGate
DotNet Reflector wdkUjzpfygw,f/ Packer/unpacker awGtaMumif;udkawmh ]Packer (protector) rsm;}
acgif;pOfatmufrSm aqG;aEG;rSm jzpfygw,f/
tcef;(6) - Olly Debugger rdwfquf - 63 -
yHk(1)
Disassembler Window
Disassembler window rSm Address? Hex dump? Disassembly eJU Comment qdkjyD; aumfvH
4ck&Sdygw,f/ yHk(2)/
yHk(2)
Address — address aumfvH rSm memory ay:ul;wifr,fh command &JU virtual address yg0ifygw,f/
Column udk ESpfcsufEdSyfvdkuf&ifawmh address awGtpm; vuf&Sd address uae pwifa&wGufay;r,fh offset
awGtjzpf ajymif;vJoGm;rSm jzpfygw,f/ ($, $-2, $+4,… )
Hex dump — uk'faumfvHrSm uk'fawGudk operand wefzdk;taeeJY awGUjrif&ygvdrfhr,f/ 'ghjyif aumfvH[m
oifhtaeeJU y&dk*&rf&JUtvkyfvkyfyHkudk em;vnfapEdkifzdkU oauFwtrsdK;rsdK;udk jznfhpGrf;ay;ygw,f/ om"utm;
jzifh oauFwawG[m command awGudk b,fae&mudk jump (>) vkyf&r,f? jyD;awmh tay:^atmuf ( ˆ ? ˇ)
jump vkyfr,fqdkwm owfrSwfygw,f/ 'DaumfvHudk ESpc f sufEdSyfcJhr,fqdk&if yxraumfvHrSm&SdwJh address [m
tcef;(6) - Olly Debugger rdwfquf - 64 -
teDa&mif highlight eJU jyaeygr,f/ qdkvdkwmu oifhtaeeJU tJ'D command (address) ae&mudk breakpoint
tjzpfowfrSwfvdkufwmygyJ/ 'Dae&ma&muf&if y&kd*&rftvkyfvkyfwm cP&yfay;ygvdkU cdkif;vdkufwmyg/
Disassembly — 'DaumfvHrSmawmh command twGuf Assembly &JU mnemonics awGyg0ifrSm jzpfyg
w,f/ Command udk ESpfcsufEdSyfcJhr,fqdk&if Assembly command udk wnf;jzwfEdkifzdkU window wpfck
ay:vmrSmjzpfygw,f/ tJ'Dae&mrSm oifhtaeeJU command udk MudKufovdk jyifqifEdkifygw,f/ jyifqifjyD;om;
command udkawmh rMumrD debug vkyf&mrSm toHk;jyKygvdrfhr,f/ 'Dhtjyif jyKjyifxm;wJh y&dk*&rfpmom; (uk'f)
awGudk executable module tjzpf ajymif;vJay;Edkifygw,f/ 'g[m tMuD;rm;qHk; tcGifhta&;wpf&yf jzpfyg
w,f/
Comment — 'DaumfvHrSmawmh command eJUywfoufwJh tjcm;tcsuftvufawG yg0ifygw,f/ 'Dae&mrSm
y&dk*&rf[m API functions eJU library functions awG&JU trnfawGudk pdppfygw,f/ 'DaumfvHudk ESpfcsufEdSyfcJh
r,fqdk&if oifhtaeeJU Assembly uk'f&JU vdkif;toD;oD;rSm&SdwJh comment awGrSm oifMudKufwmudk trSwft
om; vkyfEdkifygw,f/
The Data Window
'D window rSmawmh Address? Hex dump eJU ASCII (Unicode) qdkjyD; aumfvH 3ck ygygw,f/
'kwd,eJU wwd,aumfvHawGuawmh interpret vkyfwJhtcg ajymif;vJoGm;Edkifygw,f/ qdkvdkwmu cell xJrSm&SdwJh
pmom;awGudk Unicode tjzpfajymif;vJwJhtcg Hex dump aumfvHae&mrSm ASCII aumfvHa&muf&SdvmjyD;
Hex dump aumfvH aysmufoGm;rSmjzpfygw,f/ yHk(3)/
yHk(3)
The Registers Window
Registers window rSmawmh taxGaxGoHk; registers & FPU registers? taxGaxGoHk; registers &
MMX registers eJU taxGaxGoHk; registers & 3DNow registers qdkjyD; registers tkyfpk 3 pkyg0ifEdkifygw,f/
ESpfcsufEdSyfcJhr,fqdk&ifawmh oufqdkif&m register awGudk wnf;jzwfvdkU &ygw,f/ jrSm;awG tay:ESdyfcJh&if
registers window ajymif;vJaerSm jzpfygw,f/ yHk(4)/
yHk(4)
The Stack Window
Stack window uawmh stack xJrSm&SdwJht&mawGudk jyygw,f/ yxraumfvH (Address) uawmh
stack xJrSm&SdwJh cell address udk jyygw,f/ 'kwd,aumfvH (Value) uawmh cell xJrSmygwmawGudk
jyygw,f/ wwd,aumfvH (Comment) rSmawmh cell wefzdk;eJYywfoufwJh jzpfEdkifwJh comment awGyg0ifyg
w,f/ yHk(5)/
yHk(5)
tcef;(6) - Olly Debugger rdwfquf - 65 -
yHk(6)
Trace mode twGuf atmufyg condition awGudk owfrSwfEdkifygw,f –
(u) Break vkyfwJhtcg ae&m,lr,fh address awG&JU range?
(c) tajctaeowfrSwfcsufrsm; ( EAX>100000 uJhodkUaom)/ wu,fvdkU EAX>100000 om rSefuefcJhr,f
qdk&if tracing vkyfwm &yfoGm;rSm jzpfygw,f/
(*) Tracing vkyfaecsdefrSm &yfwefYr,hf tcsdKU command awG&JY ta&twGuf/
Procedure u return udk rawGUcifxdom uk'fudk execute vkyfapzdkY debugger udk ckdif;apzdkU
jzpfEdkifygw,f/ (execute till return)/ aemufwpfrsdK;ajym&&if vuf&Sd procedure &JY uk'ftm;vHk;udkom
execute vkyfrSm jzpfygw,f/ <Ctrl>+<F9> key udk toHk;jyKygw,f/
aemufqHk;taeeJU wu,fvdkU tracing vdkufaecsdefrSm wpfae&m&ma&mufvdkU oifhtaeeJY e,fuRHoGm;jyD
xifjyD; jyefxGufcJhcsif&ifawmh (execute till user code) command oHk;jyD; xGufvdkU&ygw,f/ 'grSr[kwf
<Alt>+<F9> key udk toHk;jyKEdkifygw,f/
Breakpoints
Breakpoint qdkwmuawmh wu,ftpGrf;xufvSwJh debugging tool wpfckyg/ Breakpoint awG[m
oifhudk y&dk*&rf&JUtvkyfvkyfyHkudk t&Sif;vif;qHk; em;vnfapEdkifygw,f/ owfrSwfxm;wJh tcsdefrSm&SdwJh registers?
stack eJU data awG&JU taetxm;udk rSwfom;ay;ygw,f/
Ordinary Breakpoints
Ordinary breakpoint awGudkawmh a&G;cs,fxm;wJh command awGeJU owfrSwfygw,f/ <F2> key
udk ESdyfjcif;jzifhaomfvnf;aumif;? (Hex dump) window ay:rSm ESpfcsufESdyfjcif;jzifhaomfvnf;aumif; toHk;jyK
Edkifygw,f/ &v'ftaeeJUuawmh yxraumfvHrSm&SdwJh address [m teDa&mifajymif;oGm;wmygyJ/ 'ghjyif
register? variable? stack awG&JU tajctaeudkvnf; ppfaq;Edkifygw,f/ <F2> key udk aemufwpfMudrfESdyf
&ifawmh breakpoint udk z,f&Sm;jyD;om; jzpfrSmyg/ 'D breakpoint udk b,fvdktcsdefrSm toHk;rsm;ovJqdkawmh
Windows API function awGudk apmifhMunfhwJhtcsdefrSm jzpfygw,f/
Conditional Breakpoints
Conditional breakpoint awGudkawmh <Shift>+<F2> key ESdyfjyD; toHk;jyKEdkifygw,f/ <Shift>+
<F2> key wGJudkESdyfvdkuf&if yHk(7)rSm jyxm;wJhtwdkif; combo box ay:vmrSmyg/ combo box xJrSm udk,fESpf
ouf&m condition wpfckudk xnfhoGif;xm;Edkifygw,f/ wu,fvdkU tJ'D condition [m rSefuefcJhr,fqdk&if
awmh command awGudk execute vkyfwm &yfoGm;rSmyg/ Debugger [m condition awGtrsm;MuD;ygwJh
&IyfaxG;vSwJh azmfjycsufawGudkawmif em;vnfygw,f/ 'D[mawGuawmh OyrmawGyg -
tcef;(6) - Olly Debugger rdwfquf - 67 -
yHk(7)
(u) EAX = = 1 — 'guawmh EAX register [m wpfjzpfcJh&if debugger udk execute vkyfwm&yfapzdkU
trdefUay;wmyg/
(c) EAX = 0 and ECX > 10 — 'guawmh EAX register [m oknjzpfjyD; ECX register [m
wpfq,fxufMuD;cJh&if debugger tvkyfvkyfaewm&yfapzdkU trdefUay;wmyg/
(*) [STRING 427010] == 'Error' — 'guawmh virtual address (VA) 427010H rSm 'Error' qdkwJh
pmom;udk awGUcJU&if debugger udk execute vkyfwm&yfapzdkU trdefUay;wmyg/ 'DvdkvJa&;vdkU&ygw,f/ EAX =
= 'Error'/ 'gqdk EAX xJrSm&SdwJht&mtm;vHk;udk pointer uae pmom;tjzpfajymif;vJay;rSmyg/
(C) [427070] = 1231 — 'guawmh VA 427070H xJrSm&SdwJht&m[m 1231H eJU nDcJhr,fqdk&if
breakpoint udk owfrSwfrSmyg/
(i) [[427070]] = 1231 — 'guawmh address udk oG,f0dkuf toHk;jyKjcif;yg/ ajym&r,fqdk&if VA 427070H
xJrSm tjcm; VA wpfckygjyD; tJ'D VA xJrSm&SdwJht&m[m 1231H eJU nDrnDppfjyD; breakpoint udk
owfrSwfwmyg/
Conditional Breakpoints with a Log
oluawmh conditional breakpoints &JU tydkvkyfief;pOf extension wpfckom jzpfygw,f/
Conditional logging breakpoint udk owfrSwfzdkU <Shift>+<F4> key udk EdSyfEdkifygw,f/ b,ftcsdefrSmrqdk
'Dvdk breakpoint udk toHk;jyKcJhr,fqdk&if tJ'DjzpfpOfudk log zdkiftaeeJU rSwfwrf;wifxm;ygw,f/ Log
xJrSmygwJh t&mawGudk jyefMunfhcsifw,fqdk&if <Alt>+<L> key udk ESdyfjyD;aomfvnf;aumif;? View menu rS
Log command udk ESdyfjyD;aomfvnf;aumif; Munfh&IEdkifygw,f/ yHk(8)/
yHk(8)
Breakpoint to Windows Messages
Window function qD (twdtusajym&&if window class function qD) messages awG a&mufvm
wmaMumifh tcsdKU windows message rSm breakpoint udk owfrSwfEdkifzdkU application window [m
yGifhaezdkUvdkygw,f/ wenf;ajym&&if windowing application awG[m execution vkyfzdkUtwGuf pwif&yg
w,f/ &Sif;vif;vG,fulapzdkU &dk;&Sif;vSwJh application wpfckudk window wpfckeJYtwl debugger xJudk
oGif;vdkufygw,f/ 'D application udk pwifzdkUtwGuf <Ctrl>+<F8> udk ESdyfyg/ 'D application window [m
wpfpuúefUavmuf MumjyD;wJhtcgrSm touf0ifygw,f/ y&dk*&rf&JY wpfpdwfwpfa'oudk qufwdkuf execute
vkyfaecsdefrSmawmh owdxm;ay;yg/ Window function qDa&mufzdkU application u pHkprf;jyD; zefwD;xm;wJh
windows pm&if;udk ac:,l zdkUvdkygw,f/ 'gudk View menu u Windows udk toHk;jyKEdkifygw,f/ yHk(9)/
tcef;(6) - Olly Debugger rdwfquf - 68 -
yHk(9)
yHk(9)rSm jyxm;wJh window [m investigator udk window descriptor? olU&JUtrnf? olU&JU
identifier eJU ta&;MuD;qHk;jzpfwJh window procedure &JU address (ClsProc)awG &SmazGapEdkifygw,f/
Window procedure &JY address eJY ywfoufwJh tcsuftvufawGu investigator udk window function
awG &SmEdkifapwJhtjyif omref breakpoint a&m? conditional breakpoint yg owfrSwfEdkifygw,f/ bmyJjzpfjzpf
window functions awGeJU tvkyfvkyfwJhtcg window message awG &SdwJhae&mrSm breakpoint awG
owfrSwfwm taumif;qHk;yg/ 'gaMumifh yHk(9)rSm jyxm;wJh window udk ESdyfvdkufjyD; context menu rS
Message breakpoint on ClassProc udk a&G;vdkufyg/ aemufxyf window wpfckay:vmrSmjzpfjyD; tJ'DrSm
atmufyg breakpoint parameter awGudk owfrSwfEdkifrSm jzpfygw,f/ yHk(10)/
(u) Drop-down list rS message udk a&G;yg/ atmufygwdkUudk rSwfom;yg/
(1) Message tpm; event udk a&G;cs,fvdkUvnf; &ygw,f/ tJ'D event awG[m window (odkU)
keyboard event awGudk zefwD;^zsufqD;jcif;uJhodkUaom message aygif;rsm;pGmjzpfEdkifygw,f/
(2) rdrdbmom rdrdowfrSwfEdkifwJh message awGudkvnf; a&G;cs,fEdkifygw,f/
(c) b,f message awG[m olwdkUxJub,folUqDuae a&mufvmovJqdkwmudk qHk;jzwfEdkifapzdkU track
vdkufr,fh window awGudk pm&if;jyKpkyg/ ay;xm;wJh window? ay;xm;wJh title eJY window tm;vHk;? (odkU)
window tm;vHk; yg0ifygw,f/
(*) Breakpoint b,fESpfMudrf touf0ifw,fqdkwm odapzdkU counter udk owfrSwfxm;yg/
(C) Breakpoint touf0ifcsdefrSm y&dk*&rftvkyfvkyfwmudk &yfoifh^ r&yfoifhqdkwm owfrSwfyg/
(i) Breakpoint touf0ifcsdefrSm record udk log xJ b,fvdka&;&rvJqdkwm owfrSwfxm;yg/
yHk(10)
Breakpoints to the Import Functions
Debug vkyfzdkY module xJudk import tvkyfcH&wJh trnfpm&if;udk vdkcsif&ifawmh <Ctrl>+<N> udk
ESdyfyg/ yHk(11)/ 'DhaemufrSm window udk right click ESdyfjyD; atmufygwdkUudkvnf; jyKvkyfEdkifygw,f-
(u) Import vkyfxm;wJh function udk ac:,ltoHk;jyKcsdefrSm breakpoint udk owfrSwfEdkifygw,f/ (Toggle
breakpoint on import)
(c) Import vkyfxm;wJh function udk ac:,ltoHk;jyKcsdefrSm conditional breakpoint udk owfrSwfEdkifyg
w,f/ (Conditional breakpoint on import)
tcef;(6) - Olly Debugger rdwfquf - 69 -
(*) Import vkyfxm;wJh function udk ac:,ltoHk;jyKcsdefrSm conditional breakpoint udk log vkyfjyD;
owfrSwfEdkifygw,f/ (Conditional log breakpoint on import)
(C) owfrSwfxm;wJh trnfeJYqdkifwJh tcsdwftqufwdkif;rSm breakpoint udk owfrSwfEdkifygw,f/ (Set
breakpoint on every reference) {'D command u Find references to import (Enter key) eJU
wlygw,f/ jcm;em;csufu Find references to import u breakpoint udk udk,fvdkcsifrS
xyfrHa&G;cs,f&wmyg/}
(i) ay;xm;wJhJ trnfeJYqufEG,faewJh reference wdkif;rSm log vkyfjyD; breakpoint udk owfrSwfEdkifygw,f/
Set log breakpoint on every reference)
(p) Breakpoint tm;vHk;udk z,f&Sm;wmyg/ (Remove all breakpoints)
yHk(11)
Breakpoints at the Memory Area
OllyDbg debugger u memory area rSm breakpoint wpfckwnf;udk owfrSwfzdkY vufcHygw,f/
'DvdkvkyfzdkU disassembler window (odkU) data window udk a&G;cs,fyg/ 'Dhaemuf context menu rS
Breakpoint | Memory on access (odkU) Breakpoint | Memory on write command awGudk
a&G;cs,fEdkifygw,f/ 'gjyD;&ifawmh rMumcifuowfrSwfvdkufwJh breakpoint udk toHk;jyKzdkU toifhjzpfaerSmyg/
Breakpoint yxrwpfrsdK;uawmh (on access) uk'feJU a'wmawGtwGuf jzpfEdkifayr,fh 'kwd, breakpoint
wpfrsdK;uawmh (on write) uk'fawGtwGufom jzpfEdkifygw,f/ Breakpoint awGudk context menu rS
Breakpoint | Remove memory breakpoint udk a&G;cs,fjcif;jzifh z,f&Sm;Edkifygw,f/ yHk(12)/
yHk(12)
Breakpoints in the Memory Window
Memory window (Alt + M) uawmh debug vkyfxm;wJh y&dk*&rftwGuf (odkU) olUbmom
olUenf;olU[efeJY debug vkyfxm;wJh y&dk*&rfawGu oD;oefUcsefxm;wJh memory block awGudk jyoygw,f/ 'D
window rSm breakpoint wpfckudk owfrSwfzdkYom jzpfEdkifygw,f/ 'DvdkvkyfzdkU right-click rS Set memory
breakpoint on access udk (odkU) Set memory breakpoint on write udk a&G;cs,fyg/ Breakpoint udk
z,f&Sm;csif&ifawmh Remove memory breakpoint udk a&G;Edkifygw,f/
Hardware Breakpoints
omref breakpoint awGudkawmh INT 3 interrupt vector twGuf toHk;jyKygw,f/ 'Dvdk breakpoint
awGudk toHk;jyKjcif;u y&dk*&rfudk tvkyfvkyfcdkif;&mrSm aES;oGm;apygw,f/ b,fvdkyJqdkygap? Intel Pentium
microprocessor awGuawmh debug registers (DR0-DR3) 4ckudk jznfhpGrf;ay;xm;ygw,f/ 'D register
awGrSm breakpoint 4ckeJU vuf&Sdy&dk*&rf&JU virtual address wdkU yg0ifEdkifygw,f/ Command wpfcku
toHk;jyKxm;wJh address [m 'D register wpfckwpfavawGxJu address eJUnDaecsdefrSm? processor [m
debugger rSm &Sdxm;wJh exception wpfckudk xkwfvdkufygw,f/ Hardware breakpoint awGuawmh debug
vkyfxm;wJh y&dk*&rf&JY tvkyfvkyfyHkudkawmh aES;auG;aprSmr[kwfygbl;/ bmyJjzpfjzpf? olwdkUxJu 4ckrQom jzpfyg
w,f/ Hardware breakpoint wpfckudk owfrSwfr,fqdk&ifawmh disassembler window udk oGm;yg/ jyD;&if
context menu u Breakpoint | Hardware on execution commandudk a&G;yg/ 'grSr[kwf&if main
tcef;(6) - Olly Debugger rdwfquf - 70 -
yHk(13)
tjcm;pGrf;aqmifEdkifrIrsm;
Watch expressions Window
OllyDbg u expression awGudk apmifhMunfhzdkU special window wpfckudk ay;xm;ygw,f/
Conditional breakpoint awGtaMumif; &Sif;jycJhwkef;u expression awGtaMumif;ygvmcJhwmudk trSwf&yg/
Memory cell awGeJU register awGyg0ifwJh &IyfaxG;vSwJh expression awGudk toHk;jyKzdkUqdkwm jzpfEdkifygw,f/
'D expression awGudk vkdtyfovdk &IyfaxG;apvdkU &ygw,f/ Watch expressions window udk zGifhzdkUuawmh
View | Watches command udk toHk;jyKyg/ Watch expressions window yGifhvmcsdefrSmawmh right click
ESdyfjyD; Add Watches command udk a&G;cs,fyg/ 'gjyD;&ifawmh debugger u apmifhMunfhay;r,fh expression
wpfckudk owfrSwfEdkifygw,f/ aemufwpfrsdK;ajym&&ifawmh olU&JU HEX wefzdk;udk jyoygw,f/ yHk(14)rSm
expression 4ckyg0ifwJh Watch expressions window udk jyoxm;wmjzpfjyD; b,f processor &JU
command udkrqdk execute vkyfjcif;jzihf wefzdk;awGudk apmifhMunfhaejyD;jyoygw,f/
yHk(14)
tcsuftvufrsm;udk &SmazGjcif;
OllyDbg rSm MudKufwJhowif;tcsuftvuf (ASCII? UNICODE? HEX )awGudk <Ctrl>+<B>
key ESdyfjyD; &SmazGEdkifygw,f/ yHk(15)/ Command wpfckcsif;udk &Smr,fqdk&if <Ctrl>+<F> key? command
awGaygif;xm;wmudk &Smr,fqdk&if <Ctrl>+<S> key udk toHk;jyKEdkifygw,f/ <Ctrl>+<L> key (Next)
uawmh aemufqHk; &SmcJhwJh[mudkyJ xyf&Smay;wmyg/
yHk(15)
Executable Module udk jyifqifodrf;qnf;jcif;
OllyDbg rSm uRefawmfwdkU jyifcJhwJhuk'fawGudk odrf;qnf;jyD; executable y&dk*&rftopftjzpf odrf;
qnf;Edkifygw,f/ 'Dvdkvkyfcsif&if Copy to execution | Selection (odkU) Copy to execution | All
modifications command udk a&G;vdkuf&HkygyJ/ jyD;&if udk,fxm;csifwJhae&mrSm udk,fMudKufwJh zdkiftrnfopf
ay;jyD; odrf;qnf;vdkuf&HkygyJ/
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 71 -
yHk(1)
(3) exe uk'fudk ul;wifjcif;
yHk(2)
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 72 -
yHk(3)
yHk(4)
(4) Disassembler Window
yHk(5)
yHk(6)
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 73 -
yHk(7)
yHk(8)
yHk(9)
(5) tjcm; Window rsm;
yHk(10)
yHk(11)
yHk(12)
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 74 -
yHk(13)
yHk(14)
yHk(15)
yHk(16)
yHk(17)
yHk(18)
yHk(19)
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 75 -
yHk(20)
yHk(21)
yHk(22)
yHk(23)
(6) Menu ESifh toolbar
if ( LCData ) {
lstrcpyA(v5, &LCData);
v7 = LoadLibraryExA(ValueName, 0, 2u);
v3 = v7;
if ( !v7 )
{
v14 = 0;
lstrcpyA(v5, &LCData);
v3 = LoadLibraryExA(ValueName, 0, 2u);
}
}
yHk(24)
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 76 -
yHk(25)
yHk(26)
(7) Built-In IDA Pro y&dk*&rfbmompum;
#include <idc.idc>
static main(void)
{
// Your Code here;
}
yHk(27)
yHk(28)
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 77 -
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 78 -
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 79 -
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 80 -
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 81 -
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 82 -
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 83 -
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 84 -
tcef;(7) – IDA Pro Advanced 5.2 rdwfquf - 85 -
tcef;(8) - PE Header - 86 -
tcef;(8) - PE Header
(1) PE zdkifzGJUpnf;yHk
Portable Executable (PE) qdkwm 32-bit eJU 64-bit Windows OS awGrSm toHk;jyKaeMuwJh
executable (EXE) zdkif? object (DLL) zdkifawGtwGuf zdkifyHkpHwpfck jzpfygw,f/ Portable qdkwJhtoHk;tEIef;
udku 32-bit eJU 64-bit Windows OS awGMum; tjyeftvSef vG,fvifhwul toHk;jyKEdkifwmudk &nfnTef;wm
yg/ PE yHkpHqdkwm tajccHtm;jzifhawmh wrapped executable code awGudk pDrHzdkU Windows OS loader
twGuf vdktyfwJhowif;tcsuftvufawGudk encapsulate vkyfay;wJh data structure wpfckyg/ tJ'DrSm link
vkyfzdkUtwGuf dynamic library reference awG? API udk export eJU import vkyfzdkU table awG? resource
management data awGeJU TLS data awGyg0ifygw,f/ 'DyHkpHudk pdwful;xkwfvkyfcJhwmuawmh Microsoft
jzpfjyD; 1993rSmawmh pHjzpfvmygw,f/
"Portable Executable" vdkU a&G;cs,fvdkuf&wmuawmh intent [m Windows tm;vHk;twGuf tajccH
tusqHk;zdkifyHkpHjzpfjyD; CPU wdkif;rSm tvkyfvkyfEdkifvdkUyg/ ajym&&ifawmh Windows NT rsdK;quf? Windows
95 rsdK;qufeJU Windows CE wdkUrSm toHk;jyKEdkifvkdUyg/
yHk(1)rSm jyxm;wmuawmh PE zdkifwpfckrSmyg0ifwJh tajccHzGJUpnf;wnfaqmufyHk jzpfygw,f/
yHk(1)
tenf;qHk;awmh PE zdkifrSm section ESpfck&Sdygw,f/ wpfckuawmh uk'af wGtwGufjzpfjyD;? aemufwpfcku
awmh a'wmawGtwGuf jzpfygw,f/ Windows NT &JU application wpfckrSmawmh 9ckavmuf&Sdygw,f/
olwdkUawGuawmh .text? .bss? .rdata? .data? .rsrc? .edata? .idata? .pdata eJU .debug wdkU jzpfygw,f/ tcsKdU
application awGuawmh 'D section awGtm;vHk;rvdkygbl;/ tcsdKUuawmh olwdkU&JUvdktyfcsufeJUywfoufjyD;
'DxufydkwmvJ jzpfEdkifygw,f/
zdkifwpfckrSm tawGUrsm;wJh section awGuawmh ...
- executable code section .text (Microsoft)? CODE (Borland)
- data section .data, .rdata, .bss (Microsoft)? DATA, BSS (Borland)
- resources section .rsrc
- export data section .edata
- import data section .idata
- debug information section .debug
Section trnfawG[m wu,fawmh ta&;rygvSygbl;/ OS uvJ 'DtrnfawGudk vspfvsL&Ixm;yg
w,f/ ta&;MuD;wJhtcsufuawmh disk ay:rSm&SdwJh PE zdkifwpfck&JU zGJUpnf;yHk[m rSwfOmPfay:ul;wifvdkufcsdef
rSm&SdwJh tajctaeeJU wpfyHkpHwnf;ygbJ/ 'gaMumifhrdkU wu,fvdkU oifhtaeeJU tcsuftvufawGudk disk ay:u
zdkifrSmae&mcsxm;Edkifr,fqdk&if?zdkifudkrSwfOmPfay:ul;wifvdkufcsdefrSmvJ'DtcsuftvufawGudk &SmazGvdkU&&ygr,f/
b,fvdkyJjzpfygap olUudk rSwfOmPfay: wpfyHkpHwnf; ul;wifvdkufwm r[kwfygbl;/ Windows loader
u b,ftydkif;awGudk map in vkyfzdkUvdkovJ? b,ftydkif;awGudk csefxm;cJh&rvJqdkwmudk qHk;jzwfygw,f/ Map
tcef;(8) - PE Header - 87 -
yHk(2)
Virtual memory &JU vkyfaqmifcsufuawmh aqmhzf0JvfawG[m physical memory udkwdkuf&dkuf
oHk;pGJapr,fhtpm; y&dkqufqmeJU OS wdkU[m olwdkUESpfckMum; rjrif&wJhtvTmwpfckudk zefwD;vdkufwmyg/
rSwfOmPfeJU csdwfqufzdkUMudK;pm;vdkufwkdif; y&kdqufqm[m b,f process uae b,f physical memory
address udk wu,foHk;pGJr,fqdkwmudk page table eJU nSdEdIif;ygw,f/ rSwfOmPfu pmvHk;toD;oD;twGuf table
entry wpfck&SdzdkUqdkwm vufawGUrSmawmh rjzpfEdkifygbl;/ (page table [m physical memory pkpkaygif;xuf
MuD;aeygw,f/) 'gaMumifh y&dkqufqmawG[m rSwfOmPfudk page awGtjzpf ydkif;jcm;&wmjzpfygw,f/ 'g&JU
tusdK;&v'fawGuawmh -
(1) ajrmufjrm;vSpGmaom address space awGudk zefwD;Edkifygw,f/ Address space qdkwmuawmh rSwfOmPf
eJU access vkyfzdkUom cGifhjyKxm;wJh oD;jcm; page wpfckjzpfygw,f/ qdkvdkwmuawmh vuf&Sd y&dk*&rf (odkU)
process eJUom oufqdkifygw,f/ aocsmwmu y&dk*&rfawG[m wpfckeJUwpfck oD;jcm;pD&SdaeMuwmyg/ 'gaMumifh
rdkUvJ y&dk*&rfwpfckrSm crash jzpfcJh&if tjcm;y&dk*&rfwpfck&JU address space udk taESmifht,Sufrjzpfapwmyg/
(2) rSwfOmPfudk b,fvdk access vkyf&rvJqdkwJh pnf;rsOf;awGtwGuf y&dkqufqmudk twif;tMuyfvkyfcdkif;
Edkifygw,f/ PE zdkifawGrSm section awGudk vdktyfygw,f/ bmaMumifhvJqdkawmh zdkifxJu e,fy,ftrsdK;rsdK;udk
module wpfck ul;wifvdkufcsdefwdkif; memory manager u rwlnDpGm oabmxm;vdkUyg/ ul;wifcsdefrSm
section header xJu olwdkU&JU setting awGtay: tajccHwJh section trsdK;rsdK;twGuf memory manager [m
memory page awGay:rSm access vkyfEdkifwJhtcGifhtmPmudk owfrSwfygw,f/ 'Dtcsufu owfrSwfxm;wJh
section [m zwfvdkU&wmvm;? a&;vdkU&wmvm;? execute vkyfvdkU&wmvm; qHk;jzwfygw,f/ Section toD;
oD;[m xHk;pHtwdkif;yJ fresh page wpfckuaepoifhw,fvdkU qdkvdkjcif;jzpfygw,f/
bmyJjzpfjzpf Windows twGuf page size uawmh 4096 bytes (1000h) jzpfygw,f/ Disk ay:u page
boundary twdkif; exe uk'fudk nSd,lr,fqdk&ifawmh tv[ójzpfue k frSmyg/ bmaMumifhvJqdkawmh vdktyfwm
xufydkjyD; t&G,ftpm;MuD;rm;aprSm jzpfvdkUyg/ 'gaMumifhrdkUvJ PE header rSmrwlnDwJh Alignment field
ESpfck&Sdygw,f/ olwdkUawGuawmh section alignment eJU file alignment yg/ Section alignment qdkwm
uawmh tay:rSmqdkxm;wJhtwdkif; rSwfOmPfxJrSm section awGudk b,fvdknSd,lrvJqdkwm jzpfygw,f/
tcef;(8) - PE Header - 88 -
PE zdkifxJrSm&SdwJh DOS header &JU magic ydkif;rSmyg0ifwmuawmh 4Dh? 5Ah wefzdk; (MS-DOS &JU
rlvyHkpHjyKolawGxJuwpfOD;jzpfwJh Mark Zbikowsky udkudk,fpm;jyKwJh MZ pmvHk;) jzpfjyD;? ol[m rSefuefwJh
DOS header jzpfaMumif; oabmaqmifygw,f/ MZ [m yxrqHk; pmvHk;ESpfvHk;jzpfjyD; hex editor eJUzGifhxm;
wJh b,f PE zdkifrSmrqdk awGYjrifEdkifygw,f/
lfanew [m DWORD wpfckjzpfjyD; DOS header &JU tqHk;eJU DOS stub rpcifMum;rSm wnf&Sdyg
w,f/ olUrSmy&dk*&rftpeJUywfoufwJh PE header &JU offset yg0ifygw,f/ Windows loader u 'D offset udk
&SmazGygw,f/ 'gaMumifhrdkUvJ DOS stub udk ausmfEdkifjyD; PE header qDwdkuf&dkufoGm;Edkifwmyg/ (rSwf&ef/ /
DWORD (double word) = 4bytes (odkU) 32bit? WORD = 2bytes (odkU) 16bit/ wcgw&HrSm DWORD
udk dd vdkUvJ jrif&Edkifygw,f/ dw uawmh WORD jzpfjyD; byte twGufuawmh db yg/ yHk(3)/
yHk(3)
DOS header udkawmh PE zdkif&JU yxrqHk; 64 bytes tjzpfawGU&aMumif; ajymcJhygw,f/ qdkvdkwmu
yHk(3)&JU yxrqHk; 4aMumif; (offset 0000 uae offset 0040 xd)jzpfygw,f/ DOS stub rpcif aemufqHk;
tcef;(8) - PE Header - 89 -
DWORD rSm yg0ifwmuawmh 00h 01h 00h 00h jzpfygw,f/ aemufqHk;pmvHk;uae ajymif;jyefjyefpD&if
jzpfvmrSmuawmh 00 00 01 00h jzpfjyD;? PE header pwifr,fhae&mjzpfygw,f/ PE header [mvnf;
olUoauFwjzpfwJh 50h, 45h, 00h, 00h eJU pwifygw,f/ ("PE" qdkwJhpmvHk;aemufrSm oknawGvdkufygw,f/)
wu,fvdkUom PE header &JU oauFwae&mrSm PE tpm; NE vdkUawGU&if 'Dzdkif[m 16-bit
Windows rSmtvkyfvkyfwJh NE zdkifjzpfygw,f/ tvm;wl LE vdkUawGU&if Windows 3.x virtual device
driver (VxD) jzpfjyD;? LX vdkUawGU&if OS/2 2.0 zdkifjzpfygw,f/
(3) PE Header
PE header uawmh IMAGE_NT_HEADERS vdkUac:wJh structure wpfckjzpfygw,f/ 'D structure
rSm Windows loader u r&SdrjzpfvdktyfwJh tcsuftvufawGyg0ifygw,f/ IMAGE_NT_HEADERS rSm
member 3ckyg0ifjyD; olwdkUudk windows.inc rSm t"dyÜm,fzGifhqdkxm;jyD;jzpfygw,f/
IMAGE_NT_HEADERS STRUCT
Signature DWORD ?
FileHeader IMAGE_FILE_HEDER <>
OptionalHeader IMAGE_OPTIONAL_HEADER32 <>
IMAGE_NT_HEADERS END
- Signature uawmh DWORD jzpfjyD; olUrSmyg0ifwmuawmh 50h, 45h, 00h, 00h qdkwJh wefzdk;
(oknawGvdkufwJh ]PE}) jzpfygw,f/
- FileHeader uawmh PE zdkif&JU aemufxyf 20bytes jzpfjyD; zdkif&JU physical layout eJU *kPfowdåawG
yg0ifygw,f/ (Oyrm- section ta&twGuf)
- OptionalHeader uawmh aemufxyf 224bytes jzpfjyD; PE zdkiftwGif;u logical layout eJU
ywfoufwJhtaMumif;awG yg0ifygw,f/ (Oyrm- AddressOfEntryPoint)/ olU&JUt&G,ftpm;udk ay;Edkifwm
uawmh FileHeader &JU member wpfckuyg/ 'D member awG&JU structure udkvnf; windows.inc rSm
t"dyÜm,fzGifhqdkxm;jyD;jzpfygw,f/
FileHeader udk atmufygtwdkif;azmfjyEdkifygw,f/
IMAGE_FILE_HEADER STRUCT
Machine WORD ?
NumberOfSections WORD ?
TimeDateStamp DWORD ?
PointerToSymbolTable DWORD ?
NumberOfSymbols DWORD ?
SizeOfOptionalHeader WORD ?
Characteristics WORD ?
IMAGE_FILE_HEADER ENDS
'DxJuawmfawmfrsm;rsm;udkawmh uRefawmfwdkU toHk;jyKrSmr[kwfygbl;/ 'gayr,fh NumberOfSections
udkawmh PE zdkifxJu section awGudk zsufcsif&ifyJjzpfjzpf? xyfxnfhcsif&ifyJjzpfjzpf toHk;jyK&ygw,f/
Characteristics rSmawmh flag awGyg0ifjyD; olwdkU[m PE zdkifudk executable zdkif(odkU) DLL zdkifvm;qdkwmudk
ajymay;Edkifygw,f/ PE header &JUtpuae 7ckajrmufpmvHk;[m NumberOfSections ygyJ/ Section b,fESpf
ckygovJqdkwm ajymygw,f/ yHk(4)/
yHk(4)
yHk(4)t& uRefawmfwdkU zGifhxm;wJh PE zdkifrSm section 5ck&Sdaewm awGU&ygw,f/ PE browse eJU Lord
PE wdkUudk toHk;jyKxm;ygw,f/
OptionalHeader uawmh 224bytes ae&m,lygw,f/ aemufqHk; 128bytes rSmawmh DataDirectory
yg0ifygw,f/
tcef;(8) - PE Header - 90 -
IMAGE_OPTIONAL_HEADER32 STRUCT
Magic WORD ?
MajorLinkerVersion BYTE ?
MinorLinkerVersion BYTE ?
SizeOfCode DWORD ?
SizeOfInitializedData DWORD ?
SizeOfUninitializedData DWORD ?
AddressOfEntryPoint DWORD ?
BaseOfCode DWORD ?
BaseOfData DWORD ?
ImageBase DWORD ?
SectionAlignment DWORD ?
FileAlignment DWORD ?
MajorOperatingSystemVersion WORD ?
MinorOperatingSystemVersion WORD ?
MajorImageVersion WORD ?
MinorImageVersion WORD ?
MajorSubsystemVersion WORD ?
MinorSubsystemVersion WORD ?
Win32VersionValue DWORD ?
SizeOfImage DWORD ?
SizeOfHeaders DWORD ?
CheckSum DWORD ?
Subsystem WORD ?
DllCharacteristics WORD ?
SizeOfStackReserve DWORD ?
SizeOfStackCommit DWORD ?
SizeOfHeapReserve DWORD ?
SizeOfHeapCommit DWORD ?
LoaderFlags DWORD ?
NumberOfRvaAndSizes DWORD ?
DataDirectory IMAGE_DATA_DIRECTORY
IMAGE_OPTIONAL_HEADER32 ENDS
yHk(5)
PE header taMumif;udk Olly rSmvJ tao;pdwf MunfhvdkU&ygw,f/ Olly debugger udk zGifhjyD; Alt +
M udkESdyfyg/ yHk(6)twdkif; jrif&ygr,f/
yHk(6)
yHk(6)u PE header qdkwJh pmom;ae&mudk right-click ESdyfjyD; Dump in CPU udk a&G;&if yHk(7)twdkif;
jrif&rSm jzpfygw,f/
yHk(7)
tcef;(8) - PE Header - 92 -
yHk(7)u hex window rSm right-click ESdyfjyD; special u PE header udk a&G;vdkuf&ifawmh yHk(8)
twdkif; jrif&rSmyg/
yHk(8)
(4) Data Directory
DataDirectory taMumif; xyfajym&r,fqdk&ifawmh DataDirectory qdkwm OptionalHeader &JU
aemufqHk; 128bytes yJjzpfygw,f/ OptionalHeader qdkwmuvJ PE header jzpfwJh IMAGE_NT_
HEADERS &JU aemufqHk; member jzpfygw,f/
a&SUrSmajymcJhovdk DataDirectory [m 16 ck&SdwJh IMAGE_DATA_DIRECTORY &JU array
wpfckjzpfjyD; structure wpfckpD[m PE zdkifxJu ta&;MuD;wJh data structure wpfckpDeJU qufEG,faeygw,f/
Array toD;oD;[m import table vdk MudKwifowfrSwfxm;whJ item wpfckpDudk &nfnTef;ygw,f/ Structure rSm
member ESpfck&SdjyD; wpfcku wnfae&meJU aemufwpfcku t&G,ftpm;udk jyygw,f/
IMAGE_DATA_DIRECTORY STRUCT
VirtualAddress DWORD ?
isize DWORD ?
IMAGE_DATA_DIRECTORY ENDS
VirtualAddress uawmh data structure &JU relative virtual address (RVA) jzpfygw,f/ isize
uawmh byte eJUjywJh data structure &JU t&G,ftpm;jzpfygw,f/
windows.inc rSm aMunmxm;wJh directory 16 ck&JUtrnfawGuawmh atmufygtwdkif; jzpfygw,f -
tcef;(8) - PE Header - 93 -
IMAGE_DIRECTORY_ENTRY_EXPORT equ 0
IMAGE_DIRECTORY_ENTRY_IMPORT equ 1
IMAGE_DIRECTORY_ENTRY_RESOURCE equ 2
IMAGE_DIRECTORY_ENTRY_EXCEPTION equ 3
IMAGE_DIRECTORY_ENTRY_SECURITY equ 4
IMAGE_DIRECTORY_ENTRY_BASERELOC equ 5
IMAGE_DIRECTORY_ENTRY_DEBUG equ 6
IMAGE_DIRECTORY_ENTRY_COPYRIGHT equ 7
IMAGE_DIRECTORY_ENTRY_GLOBALPTR equ 8
IMAGE_DIRECTORY_ENTRY_TLS equ 9
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG equ 10
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT equ 11
IMAGE_DIRECTORY_ENTRY_IAT equ 12
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT equ 13
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR equ 14
IMAGE_NUMBEROF_DIRECTORY_ENTRIES equ 16
yHk(9)
yHk(9)udk Munfhr,fqdk&if tjyma&mif highlight jc,fxm;wJh 4ckrSty usefwJhtoHk;rjyKwJhtuGufae&m
awGrSm oknawGeJU jynhfaewm awGU&rSmyg/
yHk(10)
yHk(10)udkMunfhr,fqdk&if import directory udk yef;a&mifeJU jyxm;ygw,f/ yxrqHk; 4bytes uawmh
40000h (ajymif;jyefpDwmjzpfygw,f) jzpfygw,f/ Import directory &JU t&G,ftpm;uawmh 1CDCh bytes
jzpfygw,f/ PE header &JUtpuae DWORD 80bytes [m tjrJwrf; import directory &JU RVA
yJjzpfygw,f/ t0ga&mifuawmh resource directory jzpfjyD;? c&rf;a&mifuawmh TLS directory jzpfygw,f/
wduswJh directory wpfckudk xm;&SdzdkUtwGuf oifhtaeeJU data directory uaepjyD; virtual address
udkwGufcsuf&ygr,f/ 'Dhaemufawmh b,f directory [m b,f section xJrSm&Sdw,fqdkwm odEdkifzdkU virtual
tcef;(8) - PE Header - 94 -
address udk toHk;jyKyg/ b,f section xJrSm b,f directory awGygovJqdkwm odwmeJU wduswJh offset udk
&SmEdkifzdkU 'D section &JU section header udk toHk;jyKyg/
(5) Section Table
Section table uawmh PE header aemufrSm uyfvdkufvmwmyg/ ol[m IMAGE_SECTION_
HEADER structure yHkpH array wpfckjzpfjyD; member toD;oD;rSm attribute eJU virtual offset pwJh PE
zdkifxJu section toD;oD;&JUtaMumif;tcsufawGyg0ifygw,f/ Section ta&twGufudkazmfjyEdkifwmu file
header &JU 'kwd, member jzpfw,fqdkwm trSwf&yg/ (PE header &JUtprS 6bytes pmae&m)/ wu,fvdkU
om PE zdkifrSm section 8ck&Sdw,fqdk&if table xJu 'D structure xJrSmvJ tyGm; 8 ck&SdrSmyg/ Header
structure toD;oD;[m 40bytes &SdjyD; windows.inc rSm 'DvdkaMunmxm;ygw,f/
IMAGE_SECTION_HEADER STRUCT
Name1 BYTE IMAGE_SIZEOF_SHORT_NAME dup (?)
union Misc
PhysicalAddress DWORD ?
VirtualSize DWORD ?
ends
VirtualAddress DWORD ?
SizeOfRawData DWORD ?
PointerToRawData DWORD ?
PointerToRelocations DWORD ?
PointerToLinenumbers DWORD ?
NumberOfRelocations WORD ?
NumberOfLinenumbers WORD ?
Characteristics DWORD ?
IMAGE_SECTION_HEADER ENDS
IMAGE_SIZEOF_SHORT_NAME equ 8
yHk(11)
yHk(11)u tpdrf;a&mifeJU jyxm;wmuawmh PointerToRawData yg/ ydkjyD;&Sif;vif;atmif yHk(12)twdkif;
LordPE eJU Munfhygr,f/
yHk(12)
Section header tjyD;rSmawmh section awGudk &Smygw,f/ Disk ay:uzdkifxJrSmawmh section
toD;oD;[m wpfckuaepwifygw,f/ qdkvdkwmu Optional header rSmawGU&wJh FileAlignment wefzdk;&JU
ajrSmufazmfudef;tcsdKUuaejzpfygw,f/ Section toD;oD;&JU a'wmawGMum;rSmawmh oknawGjzpfaerSmyg/
RAM ay:udkul;wifcsdefrSm section awG[m page boundary ay:rSmyJtjrJwrf; pwifMuygw,f/
'gaMumifhrdkU section toD;oD;&JU yxrqHk; byte [m memory page eJU oufqdkifwmyg/ x86 CPU &JU page
awGuawmh 4kB eJU align vkyfxm;jyD; IA-64 uawmh 8kB eJU align vkyfxm;ygw,f/ 'D alignement
wefzdk;udkawmh OptionalHeader rSmvdkyJ SectionAlignment xJrSm odrf;xm;ygw,f/
Oyrmjy&&if? wu,fvdkU optional header [m file offset 981 rSmqHk;jyD; FileAlignment [m 512
jzpfr,fqdk&if yxrqHk; section [m byte 1024 rSm pygvdrfhr,f/ rSwfxm;&rSmuawmh oifhtaeeJU section
awGudk PointerToRawData (odkU) VirtualAddress uae &SmEdkifygw,f/ 'gaMumifh alignment awGeJU
tjiif;yGm;aep&m rvdkawmhygbl;/
(6) PE File Sections
Section awGrSm yg0ifwmuawmh uk'f? a'wm? resource eJUtjcm; tcsuftvufawGyg0ifygw,f/
Section toD;oD;rSm header wpfckeJU body (raw data)wpfckyg0ifygw,f/ Section table xJrSm section
header awGyg0ifayr,fh section body awGrSm tMurf;zsif; zdkifzGJUpnf;yHk ryg&Smygbl;/ a'wmawGudk decipher
jyefazmfzdkU header rSm vHkavmufwJhtcsuftvufawGeJU jynfhpHkaeoa&GU linker u olwdkUudk pkpnf;csif&if
pkpnf;Edkifygw,f/
Windows NT application wpfckrSm MudKwifowfrSwfxm;wJh section trnf 9 ckavmuf&Sdygw,f/
olwdkUawGuawmh .text? .bss? .data? .rdata? .rsrc? .edata? .idata? .pdata eJU .debug wdkUjzpfygw,f/ tcsdKU
application awGrSmawmh 'D section awGtm;vHk;rvdkygbl;/ tcsdKUawGrSmawmh 'DxufydkjyD;vdktyfEdkifygw,f/
tcef;(8) - PE Header - 96 -
yHk(13)
'D tool udk dialog box awGMunfh&mrSm toHk;rsm;vSygw,f/ tcsdKU shareware application
awGrSmygwJh nag screen awGudkvG,fulpGmzsufypfEdkifygw,f/
(6.4) Export data section
.edata section rSmawmh application (odkU) DLL twGufvdktyfwJh export directory yg0ifygw,f/
olUrSm export vkyfxm;wJh function awG&JU address awGeJU trnfawGyg0ifygw,f/ 'gudkawmh aemufydkif;usrS
tao;pdwf &Sif;jyygr,f/
(6.5) Import data section
.idata section rSmawmh Import Directory eJU Import Address Table tygt0if import
vkyfxm;wJh function awGeJUywfoufwJh tcsuftvufrsdK;pHk yg0ifygw,f/ olUudkvJ aemufrSyJ tao;pdwf
aqG;aEG;rSm jzpfygw,f/
(6.6) Debug inforamtion section
Debug information udkawmh .debug section rSm yxrqHk;xm;&Sdygw,f/ PE zdkif[m oD;jcm;pD&SdwJh
debug zdkifawGudk vufcHygw,f/ (omreftm;jzifhawmh .dbg extension eJU jzpfygw,f/) Debug section rSm
debug information awGyg0ifayr,fh debug directory awGuawmh tapmydkif;uajymcJhwJh .rdata section rSm
&SdMuwmyg/ Debug directory toD;oD;[m .debug section rSm&SdwJh debug information udkyJ jyefnTef;Mu
ygw,f/
tcef;(8) - PE Header - 97 -
hModule
Identifies the DLL module that contains the function. The LoadLibrary or GetModuleHandle function
returns this handle.
lpProcName
Points to a null-terminated string containing the function name, or specifies the function's ordinal value. If
this parameter is an ordinal value, it must be in the low-order word; the high-order word must be zero.
Return Values
If the function succeeds, the return value is the address of the DLL's exported function.
If the function fails, the return value is NULL. To get extended error information, call GetLastError.
Remarks
The GetProcAddress function is used to retrieve addresses of exported functions in DLLs.
The spelling and case of the function name pointed to by lpProcName must be identical to that in the EXPORTS
statement of the source DLL's module-definition (.DEF) file.
The lpProcName parameter can identify the DLL function by specifying an ordinal value associated with the
function in the EXPORTS statement. GetProcAddress verifies that the specified ordinal is in the range 1 through
the highest ordinal value exported in the .DEF file. The function then uses the ordinal as an index to read the
function's address from a function table. If the .DEF file does not number the functions consecutively from 1 to N
(where N is the number of exported functions), an error can occur where GetProcAddress returns an invalid, non-
NULL address, even though there is no function with the specified ordinal.
In cases where the function may not exist, the function should be specified by name rather than by ordinal value.
See Also
FreeLibrary, GetModuleHandle, LoadLibrary
GetProcAddress u 'gudk bmaMumifhvkyfEdkifwmvJqdkawmh export vkyfxm;wJh function &JU trnf
awGeJU address awGudk Export Directory xJu structure wpfckrSm odrf;qnf;xm;vdkUyg/ uRefawmfwdkUtae
eJU Export Directory udk &SmazGEdkifygw,f/ bmaMumifhvJqdkawmh ol[m data directory xJu yxrqHk;
element jzpfjyD; oleJUywfoufwJh RVA [m PE header tp&JU offset 78h ae&mrSm &SdvdkUyg/
Export structure udk IMAGE_EXPORT_DIRECTORY vdkUac:ygw,f/ olUrSm member tae
eJU 11 ck&SdjyD; tcsdKUuawmh ta&;rMuD;ygbl;/
IMAGE_EXPORT_DIRECTORY STRUCT
Characteristics DWORD ?
TimeDateStamp DWORD ?
MajorVersion WORD ?
MinorVersion WORD ?
nName DWORD ?
nBase DWORD ?
NumberOfFunctions DWORD ?
NumberOfNames DWORD ?
AddressOfFunctions DWORD ?
AddressOfNames DWORD ?
AddressOfNameOrdinals DWORD ?
IMAGE_EXPORT_DIRECTORY ENDS
nName - Module &JU internal trnfjzpfygw,f/ 'D field [m vkdtyfygw,f/ bmaMumifhvJqdkawmh zdkif
trnfudk oHk;pGJolu ajymif;vJEdkifvdkUyg/ 'Dvkdajymif;cJhr,fqdk&if PE loader u 'D internal trnfudk toHk;jyKyg
vdrfhr,f/
nBase - Starting ordinal number (index awGudk function &JU address array tjzpf&SdaezdkUvdkygw,f/)
NumberOfFunctions - Module u export vkyfxm;wJh function pkpkaygif; (oauFwawGtjzpfvJ
&nfnTef;avh&Sdygw,f)
NumberOfNames - trnft& export vkyfxm;wJh oauFw*Pef;/ 'Dwefzdk;[m module xJrSm&SdwJh
function/symbol tm;vHk;&JU*Pef; r[kwfygbl;/ 'D*Pef;twGuf oifhtaeeJU NumberOfFunctions udk
ppfaq;zdkUvdktyfygw,f/ ol[m 0 jzpfEdkifygw,f/ 'Dae&mrSmawmh module udk ordinal taeeJUom export
vkyfEdkifygw,f/ wu,fvdkU yxrudpörSm export vkyfr,fh function/symbol omr&SdcJh&if? data directory
xJu export table &JU RVA [m oknjzpfygvdrfhr,f/
AddressOfFunctions - Module/Export Address Table (EAT) xJrSm&SdwJh function awG&JU RVA
eJUqdkifwJh pointer awG&JU array wpfckudk nTefjywJh RVA wpfck/ Module xJrSm&SdwJh function
awGtm;vHk;eJUqdkifwJh RVA awGudkawmh array wpfckrSm odrf;qnf;xm;jyD;? 'D field [m array &JU head udk
nTefjyaeygw,f/
tcef;(8) - PE Header - 99 -
yHk(14)
'gaMumifhrdkU IMAGE_EXPORT_DIRECTORY structure [m array oHk;ckeJU ASCII string
table wpfckudk nTefaeygw,f/ ta&;tMuD;qHk; array uawmh EAT jzpfjyD;? ol[m export vkyfxm;wJh
function awG&JU address awGyg0ifwJh function pointer awG&JU array wpfckjzpfygw,f/ tjcm; array ESpfck
(EAT eJU EOT)uawmh assending tpDtpOfeJU tjydKif run EdkifjyD; function trnfay:rlwnfygw,f/
'gaMumifhrdkU function wpfck&JU trnftwGuf binary search udk aqmif&GufEdkifwmjzpfjyD; tjcm; array
wpfckrSmawGU&SdwJh olU&JU ordinal rSm tajzxkwfygvdrfhr,f/ Ordinal uawmh &dk;&dk;wef;wef; index wpfckjzpfjyD;
'D function twGuf EAT jzpfygw,f/
EOT array [m trnfawGeJU address awGMum; linkage wpfcktjzpfwnf&SdwmaMumifh olUrSm ENT
array xuf element ydkjyD;yg0ifEdkifrSm r[kwfygbl;/ qdkvdkwmu trnftoD;oD;rSm associated address
wpfckom&SdEdkifvdkUyg/ ajymif;jyefqdk&ifawmh rrSefygbl;? address wpfckrSm associate vkyfxm;wJh trnftajrmuf
tjrm;&SdvdkUyg/ wu,fvdkU alias awGeJU function awG[m wlnDwJh address udkyJ &nfnTef;Mur,fqdk&if? 'Dh
aemufrSm ENT uvJ EOT xuf element awGydk&Sdvmygvdrfhr,f/
yHk(15)
tcef;(8) - PE Header - 100 -
oauFw (function)wpfckudk forward vkyfcsdefrSm olU&JU RVA [m vuf&Sd module xJrSm&SdwJh uk'f^
a'wm address rjzpfEdkifygbl;/ EAT table rSm DLL &JU ASCII string eJUqdkifwJh pointer wpfckyg0if&r,hf
tpm; forward vkyfr,fh function trnfyJ yg0ifygw,f/ a&SUOyrmrSmawmh ol[m ntdll.dll &JU RtlAlloc
Heap jzpfygvdrfhr,f/
wu,fvdkU function wpfcktwGuf EAT entry [m Export section (qdkvdkwmu ASCII string)
xJrSm&SdwJh address wpfckudk point vkyfjyDqdk&if oifhtaeeJU 'D function udk forward vkyfxm;w,fqdkwm
odxm;&ygr,f/
(8) Import Sections
Import section (.idata) rSmawmh DLL uae import vkyfxm;wJh function awGtm;vHk;&JU
tcsuftvufawGyg0ifygw,f/ 'D tcsuftvufawGudk rsm;pGmaom data structure awGrSm odrf;qnf;xm;wm
yg/ olwdkUxJu ta&;tMuD;qHk;uawmh aemufydkif;rSmaqG;aEG;r,hf Import Directory eJU Import Address
Table wdkUjzpfygw,f/ tcsdKU executable zdkifawGrSm Bound_Import eJU Delay_Import directory wdkUvJ
&SdEdkifygw,f/ Delay_Import uawmh uRefawmfwdkUtwGuf odyfta&;rMuD;ygbl;/ 'gayr,fh Bound_Import
directory udkawmh aemufydkif;rSm aqG;aEG;rSm jzpfygw,f/
Windows loader &JUwm0efuawmh application u toHk;jyKwJh DLL awGxJutm;vHk;udk load
vkyfzdkUeJU olwdkUudk process address space tjzpf map vkyfay;zdkU jzpfygw,f/ 'ghjyif trsdK;rsdK;aom DLL
awGxJrSm&SdwJh import vkyfxm;wJh function awGtm;vHk;&JU address awGudk &SmazGzdkUvJjzpfjyD; load vkyfcH&wJh
tcsdefrSm executable twGuf toHk;jyKvdkU&atmifvJ vkyfay;ygw,f/
DLL wpfckxJu function awG&JU address awG[m static rjzpfygbl;/ 'gayr,fh DLL twGuf
updated version awGxGufvmcsdefrSmawmh ajymif;vJukefygw,f/ 'gaMumifh application awGudk taotcsma&;
om;xm;wJh function address awG toHk;jyKjyD; wnfaqmufvdkU r&Edkifawmhygbl;/ 'DhtwGufaMumifh run
aecsdefrSm executable zdkifwpfck&JUuk'fawGudk Mudrfzefrsm;pGm ajymif;vJrIvkyfp&mrvdkwJh mechanism wpfckudk
zefwD;zdkUvdktyfvmygw,f/ 'gudk Import Address Table (IAT) wpfcktoHk;jyKjyD; ajz&Sif;Edkifygw,f/ 'g[m
windows loader u DLL tjzpf load vkyfcsdefrSm jznfhqnf;ay;wJh function address awGeJUqdkifwJh pointer
awG&JU table wpfckomjzpfygw,f/
Pointer table wpfckudk toHk;jyKjcif;jzifh loader [m uk'fxJu b,fae&mrSmrqdk olwdkUudk ac:,loHk;wJh
tcgrSm import vkyfxm;wJh function awG&JU address awGudk ajymif;vJzdkU vdkawmhrSmr[kwfygbl;/ vkyf&rSmu
import table xJu ae&mwpfckrSm rSefuefwJh address udk aygif;&rSmjzpfygw,f/
(8.1) Import Directory
Import Directory qdkwm wu,fawmh IMAGE_IMPORT_DESCRIPTOR structure &JU array
wpfckomjzpfygw,f/ Structure wdkif;[m 20bytes jzpfjyD; uRefawmfwdkU PE zdkifu b,f function awGukd
import vkyfxm;w,fqdkwJh DLL eJUywfoufwJhtaMumif;awG yg0ifygw,f/Oyrmjy&&if wu,fvdkU uRefawmf
wdkU PE zdkifu rwlnDwJh DLL zdkif 10cku function awGudk import vkyfcJhr,fqdk&if 'D array xJrSm IMAGE_
IMPORT_DESCRIPTOR 10ck&SdaerSm jzpfygw,f/ 'D array xJu structure ta&twGufudk nTefjywJh
field awmh &SdrSmr[kwfygbl;/ 'Dtpm; aemufqHk; structure rSm oknawGeJUjynfhaewJh filed awGyJ &SdaerSmyg/
Export Directory rSmvdkyJ oifhtaeeJU Import Directory b,fae&mrSm &SdovJqdkwm &SmazGEdkifyg
w,f/ (PE header tp&JU 80 bytes jzpfygw,f/) yxrqHk;eJU aemufqHk; member awGuawmh ta&;MuD;qHk;
jzpfygw,f/
IMAGE_IMPORT_DIRECTORY STRUCT
union
Characteristics DWORD ?
OriginalFirstThunk DWORD ?
ends
TimeDateStamp DWORD ?
ForwardChain DWORD ?
Name1 DWORD ?
FirstThunk DWORD ?
IMAGE_IMPORT_DIRECTORY ENDS
Hint - Hint rSmawmh function wnf&Sd&m DLL &JU Export Address Table eJUqdkifwJh index yg0ifygw,f/
'Dudkawmhh u toHk;jyKzdkU jzpfygw,f/ 'gaMumifhrdkU DLL &JU Export Address Table xJu function udk
tjrefMunfh&IEdkifwmyg/ 'D index rSm&SdwJh trnfudk MudK;pm;wJhtcg? wu,fvdkU ol[m match rjzpfcJhbl;qdk&if
binary search [m trnfudk&SmazG jyD;ajrmufjyDjzpfygw,f/ 'Dwefzdk;[m r&Sdrjzpfawmh r[kwfygbl;/ tcsdKU
linker awGuawmh 'Dae&mrSm oknvdkU owfrSwfMuygw,f/
Name1 - Name1 rSmawmh import vkyfxm;wJh function &JUtrnfyg0ifygw,f/ trnfuawmh null-
terminated (\0) ASCII string jzpfygw,f/ rSwfxm;&rSmu Name1 &JU t&G,ftpm;udk byte taeeJU
t"dyÜm,fzGifhxm;wmjzpfygw,f/ 'gayr,fh ol[m wu,fwrf;rSmawmh variable t&G,ftpm;&SdwJh field wpfck
jzpfygw,f/ Structure wpfckxJrSm variable t&G,ftpm;&SdwJh field wpfckudk azmfjyEdkifzdkU enf;vrf;r&SdvdkUyg/
ta&;tMuD;qHk;tydkif;awGuawmh import vkyfxm;wJh DLL trnfawGeJU IMAGE_THUNK_
DATA structure &JU array awGyJ jzpfygw,f/ IMAGE_THUNK_DATA structure toD;oD;[m DLL
uae import vkyfxm;wJh function wpfckqDeJU qufEG,faeygw,f/ OriginalFirstThunk eJU FirstThunk u
nTefjywJh array awG[m wjydKifwnf; run EdkifjyD; null DWORD eJU tqHk;owfygw,f/ Import vkyfxm;wJh
DLL toD;oD;twGuf olwdkUawG[m IMAGE_THUNK_DATA structure &JU oD;jcm;pD&SdaewJh array
twGJawGjzpfygw,f/
'grSr[kwf 'gudkxm;zdkU tjcm;enf;vrf;uawmh ajrmufrsm;vSpGmaom IMAGE_IMPORT_BY_
NAME structure awGyJjzpfygw,f/ oifhtaeeJU array ESpfckudk zefwD;Edkifygw,f/ jyD;awmh olwdkUudk IMAGE
_IMPORT_BY_NAME structure awG&JU RVA awGeJU jznfhqnf;&rSmjzpfygw,f/ 'gaMumifh array ESpfckvHk;
rSm wlnDwJhwefzdk;awG yg0ifae&ygr,f/ (qdkvdkwmu wduswJh duplicate)/ tcktcgrSmawmh oifhtaeeJU yxr
qHk; array &JU RVA udk OriginalFirstThunk eJU nDay;&rSmjzpfjyD; 'kwd, array &JU RVA udkawmh First
Thunk eJUnDay;&rSmjzpfygw,f/
OriginalFirstThunk eJU FirstThunk xJrSm&SdwJh element ta&twGufuawmh DLL uae import
vkyfxm;wJh function ta&twGufay: rlwnfygw,f/ Oyrmjy&&if? wu,fvdkU PE zdkifu user32.dll uae
function q,fckudk import vkyfr,fqdk&if IMAGE_IMPORT_DESCRIPTOR structure xJrSm&SdwJh
Name1 rSm user32.dll string &JU RVA yg0ifrSmjzpfjyD;? array toD;oD;rSm IMAGE_THUNK_DATA
q,fck&SdrSmjzpfygw,f/
tcef;(8) - PE Header - 103 -
yHk(16)
Import vkyfxm;wJh function awG&JU call awG[m IAT xJu function pointer uwpfqifh
tvkyfvkyfMuwmyg/ yHkpH 2rsdK;taeeJU vkyfEdkifygw,f/ wpfckuawmh aemufwpfckxufydkjyD; toHk;0ifygw,f/
OyrmtaeeJU FirstThunk array &JU entry awGxJuwpfckudk &nfnTef;wJh address 00405030 udk pOf;pm;Munfh
vdkufMu&atmif/ olUudk loader u user32.dll xJu GetMessage &JU address eJUtwl overwrite vkyfxm;
ygw,f/
GetMessage udkac:oHk;zdkU toifhawmfqHk;enf;vrf;uawmh atmufygtwdkif;jzpfygw,f/
0040100C CALL DWORD PTR [00405030]
'Denf;uawmh odyftqifrajyygbl;/
0040100C CALL [00402200]
…
…
00402200 JMP DWORD PTR [00405030]
qdkvdk&if;uawmh 'kwd,enf;uvJ &v'ftwlwlygyJ/ 'gayr,fh xyfxnfh&r,fhuk'fpmvHk;[m 5vHk;ydkvm
rSmjzpfjyD; tydk jump aMumifh execute vkyf&mrSmvJ ydkMumrSmjzpfygw,f/
tcef;(8) - PE Header - 104 -
IMAGE_BOUND_IMPORT_DESCRIPTOR STRUCT
TimeDateStamp DWORD ?
OffsetModuleName WORD ?
NumberOfModuleForwarderRefs WORD ?
IMAGE_BOUND_IMPORT_DESCRIPTOR ENDS
'D structure eJU jyD;cJhwJh structure ESpfckudk EdIif;,SOfvdkuf&if aemufqHk; member jzpfwJh Reserved
rSwyg; usefwmawGtm;vHk; wlwmawGU&rSmyg/ tjcm; DLL udk forward vkyfwJh function wpfckeJUywfoufjyD;
bind vkyfcsdefrSm 'D forward vkyfxm;wJh DLL &JU rSefuefrIudk ul;wifwJhtcsdefrSmvJ ppfaq;&ygr,f/ IMAGE
_BOUND_FORWARDER_REF rSm forward vkyfxm;wJh DLL awG&JU tao;pdwftcsuftvufawG
yg&Sdygw,f/
Oyrmjy&&if kernel32.dll xJu function wpfckjzpfwJh HeapAlloc [m ntdll.dll xJu RtlAllocate
Heap udk forward vkyfw,fvdkU,lqMuygpdkU/ wu,fvdkU uRefawmfwdkUu HeapAlloc udk import vkyfxm;wJh
application wpfckudk zefwD;vdkufjyD; application rSm bind.exe udk toHk;jyKvdkufr,fqdk&if ntdll.dll &JU
IMAGE_BOUND_FORWARDER_REF uajc&mcHr,fh kernel32.dll twGuf IMAGE_BOUND_
IMPORT_DESCRIPTOR wpfck&Sdvmygr,f/
owdjyK&ef/ / Function awG&JUtrnfawG[m 'D structure awGxJrSm yg0ifrSmr[kwfygbl;/ bmaMumifhvJqdkawmh
loader u b,f function awGudk IMAGE_IMPORT_DESCRIPTOR uae bound vkyfr,fqdkwm
odxm;vdkUyg/
(9) Loader
'Dtcef;uawmh r&Sdrjzpfawmh r[kwfayr,fh OS &JU tvkyfvkyfyHkudk eufeufeeJ Jodvdkolrsm;twGuf &nf
&G,fygw,f/ jyD;cJhwJh tcef;i,f(7)eJU tcef;i,f(8)wdkUb,fvdkqufEG,frI&SdovJqdkwmudkvJ &Sif;jycsifwmyg/
(9.1) Loader ubmvkyfovJ/
Executable zdkifwpfck tvkyfvkyfcsdefrSm Windows loader u process twGuf virtual address
vGwfwpfckudk zefwD;vdkufjyD; executable module udk disk uae process &JU address vGwfxJ ae&mcsxm;
vdkufygw,f/ Loader u image udk toifhawmfqHk; base address rSm ul;wifzdkUMudK;pm;jyD; rSwfOmPfxJrSm
Section awGudk ae&mcsxm;ygw,f/ Loader u section table udk ausmfvTm;jyD;? base address rSm section
&JU RVA udkaygif;jyD; wGufcsufvdkU&vmwJh address rSm section toD;oD;udk ae&mcsygw,f/ Page attribute
awGudkawmh section &JU characteristic vdktyfcsuft& owfrSwfwmjzpfygw,f/ rSwfOmPfxJrSm section awGudk
ae&mcsxm;jyD;aemufrSmawmh load address [m ImageBase xJrSm&SdwJh toihfawmfqHk; base address eJUnD^
rnD loader u base relocation udkaqmif&Gufygw,f/
'DhaemufrSmawmh import table udkppfaq;jyD; vdktyfwJh DLL awGudk process &JU address ae&mvGwx f J
map vkyf,lygw,f/ DLL module awGtm;vHk;udk ae&mcsxm;jyD;aemufrSmawmh loader u DLL toD;oD;&JU
export section udkppfaq;jyD; import vkyfxm;wJh wu,fh function address udk nTefjyEdkifzdkU IAT udk jyifyg
w,f/ wu,fvdkU oauFwr&SdcJh&if (tvGefjzpfcJygw,f) loader u error jyrSmyg/
Cracking vkyf&mrSm pdwf0ifpm;zdkUaumif;wmawGuawmh DLL awGudk ul;wifjyD; import awGudk
ajz&Sif;&wmjzpfygw,f/ 'DjzpfpOfawG[m &IyfaxG;vSjyD; Microsoft u a&;om;xkwfa0jcif;r&SdwJh ntdll.dll
xJrSm&SdwJh (forward vkyfxm;wJh) trsdK;rsdK;aom function awGeJU routine awGoHk;jyD;ajz&Sif;&ygw,f/ uRefawmf
tapmydkif;u ajymcJhovdkyJ Function forwarding qdkwm bHkjzpfwJh Win32 API set wpfckudk vSpf[jyozdkUeJU
tcef;(8) - PE Header - 106 -
rwlnDwJh OS awGMum; low-level function awGuGJjym;jcm;em;rIudk zHk;uG,fzdkU toHk;jyKwJh Microsoft &JU enf;
vrf;wpf&yfjzpfygw,f/ GetProcesAddress vdk &if;ESD;uRrf;0ifaewJh kernel32 function awmfawmfrsm;rsm;
[m wu,fvkyf&wJh LdrGetProcAddress vdk ntdll.dll udk export vkyfcsdefrSmjzpfaewJh &dk;&Sif;vSwJh wrapper
awGomjzpfygw,f/
'gawGudk vufawGUusus jrifcsif&ifawmh oifhtaeeJU Win Debugger 6.x eJU windows symbol
package (Microsoft uae tcrJh&,lEdkifygw,f)udk install vkyfzdkUvdkygw,f/ 'grSr[kwf&ifawmh SoftIce 4.x
vdk kernel-mode debugger udk install vkyfzdkUvdkygw,f/ oifhtaeeJU Olly rSmawmh Microsoft
symbolserver udk toHk;jyKr,fvdkU configure vkyfxm;&if 'D function awGudk Munfh&HkoufoufMunfhvdkU&rSm
yg/ 'DvdkrSr[kwf&ifawmh oifjrif&rSmu function trnfawGrygwJh pointer awGeJU memory address awGyg/
bmyJjzpfjzpf Olly uawmh user-mode debugger jzpfjyD; oifh&JY application udk load vkyfjyD;csdefrSm bmawG
jzpfysufaewmudkom jyygvdrfhr,f/ Loading process udkMunfhEdkifzdkU oifhudk cGifhjyKrSmawmh r[kwfygbl;/ Win
Debugger &JUvkyfaqmifcsufawGu Olly eJU EdIif;,SOfr,fqdk&if bmrSrajymyavmufayr,fh OS eJU wom;wnf;
jzpfjyD; loading process udk jyoygvdrfhr,f/ yHk(17)/
yHk(17)
Exe zdkifudk load vkyfwJhtcgrSm wGJvsufygvmMuwJh API trsdK;rsdK;[m kernel32.dll &JU
LoadLibraryExW function rSm vma&mufpkqHkvmMujyD; ntdll.dll &JU LdrpLoadDll function qD
OD;wnfoGm;ygw,f/ 'D function [m atmufygvkyfaqmifcsufawGudk aqmif&GufwJh LdrpCheckForLoader
Dll? LdrpMapDll? LdrpWalkImportDescriptor? LdrpUpdateLoadCount? LdrpRunInitialize
Routines eJU LdrpClearLoadInProgress pwJh subroutine 6 ckudk wdkuf&dkufac:,loHk;pGJygw,f/
1/ Module udk ul;wifxm;jyD; jzpf^rjzpf od&atmif ppfygw,f/
2/ Module eJU taxmuftyHhjzpfapr,fh tcsuftvufawGudk rSwfOmPfrSm ae&mcsygw,f/
3/ Module &JU import descriptor table qD oGm;ygw,f/ ('Dwpfckudk import vkyfaecsdefrSm tjcm; module
awGudk &Smygw,f/)
4/ 'D DLL aMumifhygvmwJh tjcm;[mawGvdkyJ module &JU load count udk update vkyfygw,f/
5/ Module udk initialize vkyfygw,f/
6/ ul;wifjyD;aMumif;jywJh tcsdKU flag awGudk &Sif;vif;ygw,f/
tcef;(8) - PE Header - 107 -
yHk(18)
DLL wpfck[m cascade taeeJUcsdwfxm;wJh tjcm; module awGudk import vkyfEdkifygw,f/ Loader
[m load vkyfzdkU vdktyfwmawGeJU oleJUywfoufwJh dependency awGudk od&Sdppfaq;EdkifzdkU module toD;oD;
uwqifh loop ywfzdkUvkdygvdrfhr,f/ 'gaMumifh LdrpWalkImportDescriptor yg0ifvm&jcif; jzpfygw,f/
olUrSm subroutine ESpfck&Sdygw,f/ LdrpLoadImportModule eJU LdrpSnapIAT wdkUjzpfygw,f/ yxrqHk;
Bound Imports Descriptor eJU yHkrSef Import Descriptor table awGudk ae&mcsxm;zdkU RtlImageDirectory
EntryToData qD call ESpfckeJU pwifygw,f/ rSwfxm;zdkUu loader [m bound imports awGudk yxrqHk;ppf
aq;wmyg/ Import directory r&Sdayr,fhvJ bound import awG&SdwJhtwGuf application u run wmjzpfyg
w,f/
aemufwpfckjzpfwJh LdrpLoadImportModule uawmh Import directory xJrSm&SdwJh DLL
toD;oD;twGuf Unicode string wpfckudk wnfaqmufygw,f/ 'DhaemufrSmawmh olwdkUawGudk ul;wifjyD;^rjyD;
odEdkifatmifvdkU LdrpCheckForLoadedDll udk toHk;csygw,f/
aemufwpfckjzpfwJh LdrpSnapIAT routine uawmh Import directory xJrSm&SdwJh DLL reference
awGtm;vHk;udk -1 wefzdk;jzpfaejcif;&Sd^r&Sd ppfaq;ygw,f/ (qdkvdkwmu xyfjyD; bound import awGudk yxrqHk;
ppfaq;ygw,f/) 'Dhaemuf IAT &JU memory prtotection udk PAGE_READWRITE tjzpf ajymif;vJjyD;
LdrpSnapThunk subroutine qDroGm;cif IAT xJrSm&SdwJh entry toD;oD;udk ppfaq;zdkU qufvufvkyfaqmif
ygw,f/
LdrpSnapThunk uawmh olU&JU address udkae&mcsxm;zdkU function wpfck&JU ordinal udk toHk;jyKjyD;
'gudk forward vkyfxm;jcif;&Sd^r&Sd qHk;jzwfygw,f/ 'grSr[kwf&ifawmh ol[m ordinal udk tjrefae&mcsxm;Edkif
zdkUtwGuf export table ay:u binary search wpfckudk toHk;jyKwJh LdrpNameToOrdinal udk ac:oHk;yg
w,f/ wu,fvkdU function udk rawGUbl;qdk&if STATUS_ENTRYPOINT_NOT_FOUND udk jyefydkUjyD;?
r[kwf&ifawmh API &JU entry point &SdwJh IAT xJrSm entry udk tpm;xkd;jyD; memory protection udk restore
jyefvkyfwJh LdrpSnapIAT qD jyefoGm;ygw,f/ ol[m vkyfief;tprSmwif ajymif;vJoGm;jyD; IAT yg0ifwJh
memory block ay:rSm cache refresh jyKvkyfEdkifzdkUtwGuf NtFlushInstructionCache udkac:oHk;jyD;
LdrpWalkImportDescriptor qD jyefoGm;ygw,f/
'g[m Windows version awGMum; wpfrlxl;jcm;wJh uGJjym;jcm;em;rIjzpfygw,f/ Windows 2000
rSmawmh exe zdkifudk ul;rwifcif ntdll.dll udk bound import taeeJUa&m? yHkrSef import directory taeeJUa&m
ul;wifzdkU twif;awmif;qdkygw,f/ Windows 9x eJU Windows XP rSmawmh import awGrygvJ application
udk tvkyfvkyfapEdkifygw,f/ Loader u rSwfOmPfxJrSm&SdwJh wu,fh address wpfckudk wGufcsufEdkifzdkUeJU API
wpfck[m forward vkyfxm;cH&jcif;&Sd^r&Sd odEdkifatmifvdkU import vkyfxm;wJh API wdkif;udk ppfaq;&rSmjzpfyg
w,f/ Import vkyfxm;wJh DLL toD;oD;rSm aemufxyf module awGygvmEdkifjyD; process uvJ dependen-
cy awGtm;vHk;udk ppfaq;jyD;pD;onfhwdkifatmif xyfcgxyfcg vkyfaqmifae&rSmjzpfygw,f/
tcef;(8) - PE Header - 108 -
yHk(19)
'Dae&mrSm uRefawmfwdkU jrif&wmuawmh VirtualSize (00029E88) u SizeOfRawData (0002A0
00) xuf enf;enf;av;i,faewm awGU&ygw,f/ SizeOfRawData qdkwmuawmh oifh&JU hard disk ay:rSm
zdkifudk ae&mcsxm;wJhtcg ,lr,fhae&myrmPukd ajymjcif;jzpfygw,f/ rSwfxm;&rSmu 'Dzdkif&JU VirtualSize u
hard disk ay:rSm ae&m,lr,fh t&G,ftpm;xuf i,faeygw,f/ 'gu bmaMumifhjzpf&wmvJqdkawmh compiler
awG[m rMumcPqdkovdk wlnDwJhe,fedrdwfay:u section wpfckeJU ndSzdkU t&G,ftpm;udk teD;pyfqHk;jzpfatmif
,l&vdkUyg/ Hex editor eJU Munfh&ifawmh CODE section &JUtqHk; (DATA section rpwifcif) udk yHk(20)
twdkif; awGU&rSmyg/
yHk(20)
'Dae&mvGwfawGudk toHk;rjyKovdk rSwfOmPfxJudkvJ ul;rwifygbl;/ uRefawmfwdkUtaeeJU aocsmatmif
vkyf&rSmu uRefawmfwdkU xnfhoGif;r,fh uk'fawGudk rSwfOmPfxJul;atmif vkyfzdkUygyJ/ uRefawmfwdkUtaeeJU 'Dvdk
jzpfatmif size attribute udk ajymif;ay;&ygr,f/ ckcsdefrSmawmh 'D section &JU virtual size u 29E88 omjzpfyg
w,f/ bmaMumifhvJqdkawmh compiler u 'DavmufyJ vdktyfvdkUyg/ uRefawmfwdkUtaeeJUawmh 'Dxufenf;enf;
av; ydkvdktyfygw,f/ 'gaMumifhvJ LordPE rSm CODE section &JU virtual size udk 29FFF vdkU jyifvdkufyg
r,f/ ('g[m uRefawmfwdkU jyifEdkifwJh tjrifhqHk;t&G,ftpm;jzpfygw,f/ RawSize uawmh 2A000 jzpfygw,f/)
'DvdkjyKvkyfzdkU CODE qdkwJhpmom;ay:rSm right-click ESdyfjyD; edit section header udk a&G;yg/ VirtualSize
ae&mrSm 29FFF vdkUjyifjyD; zdkifudk odrf;qnf;vdkufyg/
'DwpfcgrSmawmh uRefawmfwdkU patch vkyfr,fhuk'fudk odrf;qnf;zdkU oifhawmfwJhae&mwpfckudk jyKvkyfvdkU
jyD;ygjyD/ uRefawmfwdkU jyifcJhwmu Section Table xJu CODE section twGuf VirtualSize DWORD
wefzdk;jzpfygw,f/ 'gudk uRefawmfwdkUtaeeJU hexeditor rSm udk,fwdkifjyifvJ &ygw,f/
'DxufydkjyD; &Sif;vif;atmifjyEdkifzdkUtwGuf erlem assembly stub av;a&;Munfhygr,f/ yxrqHk;vkyf&
rSmu LordPE rSmawGUcJhwJh entry point wefzdk; 0002ADB4 eJU ImageBase wefzdk; 400000 udk rSwfom;yg/
'gaMumifh Olly [m application udk ul;wifcsdefrSmawmh entry point [m 0042ADB4 jzpfrSmyg/ uRefawmf
wdkUtaeeJU atmufyguk'fawGudk aygif;xnfhjyD; entry point udk yxrqHk;uk'f&Sd&m 42AF00 udk ajymif;ygr,f/
MOV EAX, 0042ADB4 ; Load in EAX the Original Entry Point (OEP)
tcef;(8) - PE Header - 109 -
yHk(21)
'DhaemufrSmawmh jyifxm;wJhuk'fawGudk odrf;qnf;zdkU right-click ESdyfjyD; Copy to executable u All
modification udka&G;yg/ 'Dtcg ay:vmwJh message box rSm Copy udka&G;vdkuf&if window wpfcktopfyGifh
vmygr,f/ 'D window rSm right-click ESdyfjyD; Save file udk a&G;jyD; MudKufESpfouf&mtrnfeJU odrf;vdkufyg/
zdkifudkodrf;jyD;oGm;&if LordPE rSm Entry point udk 0002AF00 vdkUajymif;jyD; zdkifudkodrf;qnf;vdkufyg/
Application tvkyfrvkyfprf;Munfhyg/ jyD;&if odrf;xm;wJhzdkifudk Olly rSm jyefzGifhMunfhyg/ Entry point ajymif;
aewm awGU&ygr,f/
yHk(22)
Hexeditor rSmMunfhvdkuf&if yHk(23)twdkif; awGU&rSmjzpfjyD; ae&mvGwfawG trsm;MuD; usefao;wmawGU&
rSmyg/
yHk(23)
(&SdjyD;om; section udkcsJUjcif;eJU section topfwdk;jcif;wdkUudk pmtkyfxlrnfpdk;í razmfjyawmhyg/ tao;pdwfodvdk
vQif ARTeam rS Goppit a&;om;aom PE File Format udk zwf&IygvdkU tMuHay;vdkygw,f/)
(11) PE header jyóemrsm;ajz&Sif;jcif;
(FOR ONLY FULL VERSION)
yHk(24)
tcef;(8) - PE Header - 110 -
yHk(25)
yHk(26)
yHk(27)
yHk(28)
yHk(29)
yHk(30)
tcef;(8) - PE Header - 111 -
yHk(31)
yHk(32)
yHk(33)
yHk(34)
yHk(35)
yHk(36)
tcef;(8) - PE Header - 112 -
yHk(37)
yHk(38)
yHk(39)
tcef;(8) - PE Header - 113 -
yHk(40)
yHk(41)
yHk(42)
yHk(43)
tcef;(8) - PE Header - 114 -
FILE_MACHINE_I386
Intel 80386 (odkU) aemufydkif;armf',frsm;ESifh o[Zmwjzpfaomy&dkqufqmrsm;/
FILE_MACHINE_AMD64
x64
FILE_MACHINE_IA64
Intel Itanium y&dkqufqmtkyfpkrsm;/
(3) Characteristics 0x10f (zdkif&JU0daooudk jyowJh flag awGyg/)
FILE_RELOCS_STRIPPED 0x1
(0x1 om jzpfcJhr,fqdk&if zdkifrSm base relocation rygygbl;/ 'ghaMumihf loader [m olU&JU base address rSmyJ
&Sd&rSmyg/ wu,fvdkU base address omr&SdcJhbl;qdk&if loader [m error jzpfaMumif;jyrSmyg/ Linker &JU yHkrSef
tvkyfuawmh EXE zdkifuae base relocaion udk z,fzdkYyg/)
FILE_EXECUTABLE_IMAGE 0x2
('guawmh image zdkif[m rSefuefaMumif;eJU tvkyfvkyfEdkifaMumif; jywmyg/ wu,fvdkU 'D flag om r&Sdbl;qdk
&if olu linker error jzpfaMumif; jyrSmyg/)
FILE_LINE_NUMS_STRIPPED 0x4
(COFF vdkif;awG z,f&Sm;cHvdkuf&wmyg/)
FILE_LOCAL_SYMS_STRIPPED 0x8
(Local oauFwawGtwGuf COFF oauFwZ,m;&JU entry awG z,f&Sm;cHvdkuf&wmyg/)
FILE_32BIT_MACHINE 0x100
(uGefysLwm[m 32-bit enf;ynmudk tajccHxm;wmyg/)
(4) Subsystem SUBSYSTEM_WINDOWS_GUI
'D image udk tvkyfvkyfzdkUtwGuf vdktyfwJh pepfcGJawGjzpfygw,f/ jzpfEdkifwJh wefzdk;awGuawmh -
SUBSYSTEM_NATIVE
Device driver rsm;ESifh Window \ rlv process rsm;/
SUBSYSTEM_WINDOWS_GUI
Window \ GUI
SUBSYSTEM_WINDOWS_CUI
Window \ pmvHk;pepfcGJ/
SUBSYSTEM_POSIX_CUI
Posix pmvHk;pepfcGJ/
SUBSYSTEM_WINDOWS_CE_GUI
Windows CE
SUBSYSTEM_EFI_APPLICATION
Extensible Firmware Interface (EFI) application.
SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER
Boot services yg0ifaom EFI driver/
SUBSYSTEM_EFI_RUNTIME_DRIVER
Run-time services yg0ifaom EFI driver/
SUBSYSTEM_EFI_ROM
EFI \ ROM image/
(5) LinkerVersion 5.12
zdkiftjzpf wnfaqmufzdkU toHk;jyKwJh linker &JU version/ Microsoft linker uaejzpfvmwJh PE
zdkifawGtwGufawmh 'D version eHygwf[m Visual Studio &JU version eHygwfeJU oufqdkifygw,f/
tcef;(8) - PE Header - 116 -
yHk(1)
yHk(1)rSm jrif&wmuawmh unregistered version jzpfwJhtaMumif;yg/ 'gaMumifh register vkyfMunfhyg
r,f/ Help menu u Register udk a&G;vdkufyg/ yHk(2)twdkif; jrif&ygr,f/
yHk(2)
yHk(2)u Your name ae&mrSm Myanmar Cracking Team vdkU&dkufxnfhjyD; Registration code
ae&mrSm 4780610 (BABE16)vdkU &dkufMunfhygr,f/ 'gqdk yHk(3)twdkif; awGU&ygr,f/
yHk(3)
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 121 -
yHk(4)
yHk(4)t&qdk&ifawmh 'Dy&dk*&rfudk Visual C++ 6.0 eJU a&;xm;wmjzpfygw,f/ 'Davmufqdk uRefawmf
wdkUtwGuf vHkavmufygjyD/ pro.exe udk Olly rSm zGifhygr,f/ yHk(5)/
yHk(5)
yHk(5)rSmjrif&wmuawmh y&dk*&rf&JU entry point ae&myg/ (rSwfcsuf/ / Visual C++ jzifha&;xm;aom
y&dk*&rfrsm;onf yHk(5)wGifjyxm;onfhtwdkif; kernel32.GetVersion \tay:zuf&Sd PUSH EBP uk'f&Sd&m
virtual address onf entry point jzpfonf/) 'Dy&dk*&rfudk enf;(2)enf;eJU crack vkyfjyrSmjzpfygw,f/
yxrenf;uawmh SND Team u nick123b oHk;wJhenf;jzpfygw,f/ 'kwd,enf;uawmh ARTeam u
ThunderPwr oHk;wJhenf;jzpfygw,f/ tjcm;enf;awGudkawmh tvsOf;oifhwJhtcef;rSm azmfjyoGm;rSmjzpfygw,f/
(2) yxrenf; (nick123b@SND Team)
yHk(2)rSm register vkyfwkef;u yHk(3)twdkif; error message ay:vmwmrSwfrdr,fxifygw,f/
'Dmessage pmom;udk Olly rSm&SmMunfhvdkufMu&atmif/ yHk(5)rSm right-click ESdyfjyD; Search for u All
referenced text strings udk a&G;vdkufyg/ 'gqdk &Smxm;wJh text string awGygwJh window wpfckay:vmygr,f/
yHk(6)
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 122 -
yHk(7)
yHk(8)
yHk(8)udkMunfhvdkufawmh uRefawmfwdkU&SmaewJh message udkawGU&ygw,f/ yHk(7^8)wdkUudk PE Explorer
1.99 (www.heaventools.com) rSm zGifhMunfhxm;wmjzpfygw,f/
yHk(6)twdkif; text string udk&Smwm &SmrawGUvdkU oifhtaeeJU acgif;awmfawmfajcmufaeavmufjyD xifyg
w,f/ 'D message udk&SmawGUrSom uRefawmfwdkUtaeeJU serial a&;xm;wJh registration routine udkawGUjyD;
serial udk &SmazGEdkifrSm jzpfygw,f/ aumif;jyD? nick123b &JUenf;eJU serial udk &SmMunfhMu&atmif/
Olly rSm Ctrl + N (View Names) udk ESdyfvdkufyg/ yHk(9)twdkif; API awGudk jrif&ygr,f/
yHk(9)
yHk(9)rSm jyxm;wJhtwdkif; USER32.GetWindowTextA rSm right-click ESdyfjyD; Find references to
import (Enter key) udk a&G;vdkufyg/ yHk(10)twdkif; jrif&ygr,f/ (GetWindowTextA taMumif; tao;pdwf
udk ]Cracker rsm; owdxm;oifhaom Windows API rsm;} tcef;wGif zwf&Iyg/)
yHk(10)
yHk(10)rSm jrif&wJhtwdkif; right-click ESdyfjyD; Set breakpoint on every command udk a&G;vdkuf
yg/
yHk(11)
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 123 -
yHk(11)twdkif; GetWindowTextA udk breakpoint rowfrSwfcif pro.exe udk yHk(12)twdkif; Olly rSm
register vkyfaewm aocsmygap/ (qdkvdkwmu Teleport Pro udk Olly eJUzGifhjyD; register vkyfcdkif;wmyg/
yHk(12)rSm OK udkrESdyfcif yHk(9^10^11)rSm jrif&wJhtwdkif; breakpoint owfrSwfwm jzpfygw,f/)
yHk(12)
yHk(11)twdkif; breakpoint owfrSwfjyD;oGm;&ifawmh yHk(12)u OK udkESdyfvdkufyg/ yHk(13)twdkif; Get
WindowTextA() API &Sd&m breakpoint qD wef;a&mufoGm;ygvdrfhr,f/
yHk(13)
yHk(13)twdkif;jrif&wJhtcg yHk(14)udk jrif&wJhtxd F8 (step over) udkESdyfyg/
yHk(14)
yHk(14)udkMunfhyg/ CALL 0042EC7B rSm registration key wGufcsufjcif;udk vkyfaqmifygw,f/
'DhaemufrSmawmh EAX xJrSm&SdwJhwefzdk;wpfckeJU ESI xJrSm&SdwJhwefzdk;wpfckwdkUudk nD?rnD ppfygw,f/ wu,fvdkU
wefzdk;ESpfckrnDcJh&if BadBoy message qDa&mufoGm;rSmjzpfygw,f/ 'gaMumifh "JNZ 0042E2E1" qdkwJhae&m
a&muf&if F8 ESdyfvmwm &yfvdkufyg/ jyD;awmh Registers (FPU) window udkMunfhvdkufyg/ yHk(15)/
yHk(15)
yHk(15)&JU EAX register xJrSm uRefawmfwdkUvdkcsifwJh serial a&mufaeygjyD/ rSwfxm;&rSmu 'D serial
[m ECX register xJrSm&SdwJh "Myanmar Cracking Team" qdkwJh user twGufomjzpfygw,f/
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 124 -
yHk(16)
wu,fawmh yHk(14)u EAX register xJrSm&SdwJh serial [m hexadecimal *Pef;omjzpfygw,f/
258680D9 ae&mudk ESpfcsufESdyfvdkufyg/ jyD;&if 629571801 udkul;,lvdkufyg/ yHk(17)/ 629571801 uom
serial tppftrSefjzpfygw,f/
yHk(17)
'gqdk uRefawmfwdkU vdkcsifwJh serial udk &&SdjyDjzpfwJhtwGuf Olly udkydwfvdkU&ygjyD/ Teleport Pro
y&dk*&rfudk jyefzGifhvdkufyg/ jyD;&if Help menu u Register … udka&G;jyD; register vkyfzdkU jyifqifyg/
yHk(18)
yHk(18)twdkif; Name eJU Registration Code udkjznfhjyD;&if OK udkESdyfvdkufyg/ yHk(19)twdkif;
jrif&ygr,f/
yHk(19)
ydkaocsmoGm;atmif Help menu u Register … udkxyfESdyfMunfhyg/ uRefawmfwdkU aemufwpfMudrf
register vkyfp&mrvdkawmhwm jrif&rSmyg/ yHk(20)/
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 125 -
yHk(20)
Help menu u About Teleport Pro … udka&G;jyD; Munfhvdkuf&ifawmh yHk(21)twdkif; jrif&rSmyg/
yHk(21)
'gqdk yxrenf;eJU uRefawmfwdkU&JU serial &Smjcif;tvkyfjyD;oGm;ygjyD/ 'Dvdkenf;eJU serial &Smwmudk
t*Fvdyfvdkawmh serial fishing (Serial zrf;jcif;)vdkUac:ygw,f/ Cracking avmurSmawmh serial fishing
enf;[m tcsdefukefoufomjyD; vG,fulvSwJhtwGuf toHk;rsm;vSygw,f/
(3) 'kwd,enf; (ThunderPwr @ARTeam)
'kwd,enf;uawmh yHk(22)rSmjrif&wJh MessageBox &Sd&mae&mudkt&if&SmjyD; registration routine udk
&SmazGwJhenf;jzpfygw,f/ (rSwfcsuf/ / a&SUydkif;u GetWindowTextA() API rSmowfrSwfxm;wJh breakpoint
awGudk z,f&Sm;jyD;aMumif; aocsmygap/)
Teleport Pro [m register vkyfwm atmifjrifoGm;&if aemufwpfMudrf register xyfvkyfvdkU r&awmh
ygbl;/ 'gaMumifh registry editor (regedit.exe) udkzGifhjyD; HKLM eJU HKCU wkdY&JU Software directory
atmufu Tennyson Maxwell directory key udkzsufypfvkdufyg/
yHk(22)
Olly rSm pro.exe udkzGifhjyD; F9 (Run) udkESdyfyg/ 'gqdk Teleport Pro y&dk*&rfyGifhvmwm jrif&ygr,f/
y&dk*&rf&JU Help menu u Register udkESdyfjyD; register vkyfMunfhyg/ yHk(22)twdkif; BadBoy MessageBox
udkjrif&ygr,f/ 'Dtcg Olly qDjyefoGm;jyD; F12 (Pause) udkESdyfyg/ F12 udkESdyf&wJhtaMumif;&if;uawmh y&dk*&rf
tvkyfvkyfwm cP&yfapcsifvdkUyg/ jyD;&if Olly &JU stack window rSm scroll qGJjyD; Munfhvdkufyg/ yHk(23)
twdkif; jrif&ygr,f/
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 126 -
yHk(23)
yHk(23)udk Munfhyg/ VA 0048F9B0 uawmh "We're sorry! …" pmom;udk odrf;qnf;xm;wJh
virtual address yg/ VA 0045389D uawmh yHk(22)u MessageBox API udkvkyfaqmifjyD;csdef a&muf&Sdr,fh
ae&myg/ ckcsdefrSm uRefawmfhtaeeJU pdwf0ifpm;wJh virtual address [m 0045389D jzpfygw,f/ bmaMumifhvJ
qdkawmh 'Daddress uae registration routine &Sd&mae&mudk ajc&mcHrSmrdkUvdkUyg/
yHk(24)
Registration routine udk ajc&mcHzdkU yHk(24)u highlight jzpfaewJhae&mrSm right-click ESdyfjyD;
Follow in Disassembler udka&G;yg/ yHk(25)twdkif; jrif&ygr,f/
yHk(25)
yHk(25)u 0045389D ae&mrSm breakpoint owfrSwfjyD; F9 udkESdyfr,fqdk&ifawmh aemufwpfcg
register vkyfwJhtcg 'Dae&mudk wef;a&mufvmrSm jzpfygw,f/ yHk(26)/
yHk(26)
'DtcgrSm yHk(25)eJUrwlwmuawmh pro.00453794 [m text string awGeJU jzpfvmygw,f/
yHk(27)
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 127 -
yHk(28)
'Dae&mrSm yHk(28)u CALL 0042EC7B [m serial key udkxkwfay;wJh routine jzpfw,fqdkwm
oifhtaeeJU &dyfrdrSmyg/ bmaMumifhvJqdkawmh 'D CALL udk vkyfaqmifjyD;csdefrSm uRefawmfwdkU &dkufxnfhwJh
serial eJU wGufcsufvdkU&vmwJh serial udk y&dk*&rfu EdIif;,SOfvdkUyg/ 'D CALL ae&mrSm breakpoint
owfrSwfvdkufjyD; y&dk*&rfudk (Ctrl+F2) jyefpwifvdkufyg/ jyD;&if F9 udkESdyfjyD; y&dk*&rfudk run yg/ Register
vkyfyg/ 'gqdk&if breakpoint owfrSwfxm;wJh VA 0042E2C8 ae&mudk a&mufvmygr,f/ VA 0042E2C8
ae&mudk a&mufvm&if F7 (step into) udkESdyfjyD; CALL xJudk 0ifMunfhygr,f/ yHk(29)/
yHk(29)
Serial key udkxkwfay;wJh routine av;uawmh yHk(29)rSm jyxm;oavmufygbJ/ VA 0042EC97
xdu pdwf0ifpm;p&mr&Sdygbl;/ &dkufxnfhvdkufwJh user trnf[m pmvHk;a& 5vHk;xufenf;^renf; ppfaq;wm
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 128 -
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\masm32.lib
; Prototypes
DialogProc PROTO :DWORD,:DWORD,:DWORD,:DWORD
ClipboardCopy PROTO
KeygenProc PROTO
.const
DIALOG_1 equ 1 ;identifier in resource file
IDC_APPNAME equ 1001
IDC_NAME equ 1002
IDC_SERIAL equ 1003
BTN_CLOSE equ 1004
BTN_GENERATE equ 1005
BTN_COPY equ 1006
BTN_ABOUT equ 1007
; may need to edit these constants
MinNameLength equ 5 ; Should be consistent with .data NameTooShort
MaxNameLength equ 30 ; Maximum length of name string
; edit about text as needed
About_Text equ " ",13,10,"Keygenned by Ziggy ",13,10,10,\
"30 July 2008",13,10,13,10
Max_Buffer equ 100 ; set to at least maximum length of name or serial
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
.data
; edit app name as needed
Appname db "Myanmar Cracking Team proudly presents:",0
; following data not required if name not used to derive serial
NoName db 'No Name Entered',0
NameTooLong db 'Name is too long',0
NameTooShort db 'Name must be at least 5 characters',0 ; edit to match MinNameLength
NameOK db 'Press "Generate"',0
namebuffer dd Max_Buffer dup (00) ;buffer for entered name
genedserial dd Max_Buffer dup (00) ;buffer for genedserial
tempbuffer dd Max_Buffer dup (00) ;scratch buffer
fixedstring db " ",0
decimalformat db "%d",0
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
.data?
hInstance dd ? ;Module handle
handle dd ? ;Dialog handle
hIcon dd ? ;caption bar icon handle
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
.code
main :
invoke GetModuleHandleA,NULL
mov hInstance ,eax ; save handle for later use
.ELSEIF message==WM_COMMAND
mov eax,wParam
.IF ax==BTN_GENERATE ; "Generate" button presssed
; check name is ok, not too long & not too short
invoke GetDlgItemTextA,handle,IDC_NAME,ADDR namebuffer,Max_Buffer
.if eax == 0
invoke SetDlgItemTextA,handle,IDC_SERIAL, addr NoName
.elseif eax > MaxNameLength ; max namr length
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 130 -
.endif
.ELSEIF ax==BTN_CLOSE ; "Close" button pressed
jmp @close
.ELSEIF ax==BTN_ABOUT ; "About" button pressed
invoke MessageBox,handle,SADD(About_Text),
SADD(" ",34,"Myanmar Cracking Team",34),
MB_OK or MB_ICONINFORMATION
.ELSEIF ax==IDC_NAME ; name character enetered
; check name ok, not too long & not too short
invoke GetDlgItemTextA,handle,IDC_NAME,ADDR namebuffer,Max_Buffer
.if eax == 0
invoke SetDlgItemTextA,handle,IDC_SERIAL, addr NoName
.elseif eax > MaxNameLength ; max namr length
invoke SetDlgItemTextA,handle,IDC_SERIAL,addr NameTooLong
.elseif eax < MinNameLength ; minimum name length
invoke SetDlgItemTextA,handle,IDC_SERIAL, addr NameTooShort
.elseif
invoke SetDlgItemTextA,handle,IDC_SERIAL, addr NameOK
.endif
.ELSEIF ax==BTN_COPY ; "Copy" button pressed
invoke ClipboardCopy
.ENDIF
DialogProc endp
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
; Copy generated serial to the clipboard
; This function is not really necessary in a simple keygen but code is short
; and does not need any modification.
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
ClipboardCopy proc
pushad
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
; your Key Generator Code goes in this procedure
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
KeygenProc PROC
nop ; these nops make the Keygen procedure easy to find in Olly
nop ; when debugging the keygen.
nop ; comment these out on final assembly
nop
nop
nop
nop
nop
end main
'D assembly uk'fawGudk assemble vkyfvdkuf&if yHk(30)twdkif; awGU&rSmyg/
yHk(30)
Assembly eJU keygen a&;wm tqifajyygovm;/ rajybl;qdk&ifawmh C bmompum;eJU keygen
a&;enf;udk &Sif;jyygr,f/
#include <conio.h>
#include <stdio.h> // C Console Application
#include <string.h> // Compiler - Borland C++ 5.02
#include <memory.h> // Copyright © by Myo Myint Htike, September 14 2009
unsigned long StringtoHex(const char *string);
int main()
{
char User_Name[30] = {0};
char Read_4_Bytes[4] = {0};
unsigned long index = 0, ESI = 0x5DFEE4A4, EAX;
unsigned long string_length;
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 132 -
yHk(31)
tcef;(9) - Teleport Pro 1.54 y&dk*&rfESifh yxrqHk;tMudrf crack vkyfjcif; - 133 -
6.2/ strrev(Read_4_Bytes);
yHk(32)
zwfvdkufwJhpmvHk; n udk *Pef;tjzpfajymif;ygw,f/ hex_value wefzdk;[m 'DtcsdefrSm 6E16(11010)
jzpfvmygr,f/ character_read wefzdk;udk wpfaygif;vdkufwJhtwGuf character_read[1] jzpfvmjyD; a udk
zwfygw,f/ 'Dtcg hex_value = (6E*0x100) + 61 = 6E61 jzpfvmygw,f/ 'DvdkeJU 00 (\0) udk rawGUrcsif;
aemufxyfpmvHk;awGzwfaerSmjzpfygw,f/ aemufqHk;rSmawmh hex_value [m 6E61794D jzpfvmygw,f/
6E61794D wefzdk;udk EAX qD jyefydkUygw,f/
6.4/ ESI = ESI ^ EAX;
EAX (6E61794D) eJU ESI (5DFEE4A4) wdkUudk XOR vkyfygw,f/ &&SdvmwJh 339F9DE9
wefzdk;udk ESI rSmodrf;ygw,f/
6.5/ index++;
yHk(1)
'Dtcef;rSmawmh patch vkyfjcif;udk tydkif;(3)ydkif;cGJjyD; aqG;aEG;rSmjzpfygw,f/ yxrydkif;uawmh vlopf
wef; cracker awG vkyfavhvkyfx&SdwJh patch vkyfenf;jzpfjyD; tydkif;(2)uawmh tv,ftvwftqifh? tydkif;(3)
uawmh tqifhjrifh cracker awG vkyfavhvkyfx&SdwJh patch vkyfenf;jzpfygw,f/
(1) Beginner tqifh patch vkyfjcif; (Plain Stupid Method)
'Dacgif;pOfatmufrSmawmh vlopfwef;awG vkyfavhvkyfx&SdwJh patch vkyfenf;awGudk toHk;jyKjyD; crack
vkyfMunfhrSm jzpfygw,f/ Patch vkyfMunfhzdkUa&G;xm;wJh y&dk*&rfuawmh Exe password aqmhzf0Jvfudk
toHk;jyKjyD; protect vkyfxm;wJh calculator (calc.exe) y&dk*&rfjzpfygw,f/ Calculator y&dk*&rfudk Microsoft
Windows &JU system32 folder atmufrSm tvG,fwulawGUEdkifygw,f/ Exe password aqmhzf0Jvfudkawmh
www.salfeld.com rSm download vkyf,lEdkifygw,f/ Exe password aqmhzf0Jvf[m udk,froHk;apcsifwJh
y&dk*&rfawGudk tjcm;olawG rzGifhEdkifatmif password eJU umuG,frIay;EdkifwJh aqmhzf0Jvfwpfckjzpfygw,f/
oifhtaeeJU 'Dy&dk*&rfudkzGifhcsif&if rSefuefwJh password udk &dkufxnfhEdkif&ygr,f/ aumif;jyD? patch rvkyfcif
yxrqHk;vkyf&rSmuawmh Exe password udkzGifhjyD; calculator (calc.exe) y&dk*&rfudk password ay;zdkUyg/
yHk(2)/
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 135 -
yHk(2)
yHk(2)rSm jrif&wJhtwdkif; uRefawmfwdkU&JU calc.exe y&dk*&rfudk "DEADBEEF" qdkwJh password ay;jyD;
umuG,fvdkufygr,f/ 'gqdk icon &kyfav;ajymif;oGm;wm awGU&ygr,f/ yHk(3)/
yHk(3)
Password eJU umuG,fxm;wJh calc.exe zdkifudk zGifhMunfhygr,f/ 'gqdk yHk(4)twdkif; password
awmif;wJh dialog box wpfckay:vmrSmyg/
yHk(4)
Password udk rSefuefpGmr&dkufxnhfEdkif&ifawmh yHk(5)twdkif; jrif&rSmyg/
yHk(5)
'gqdk uRefawmfwdkUtaeeJU 'Dzdkifudk password rodbJzGifhvdkUr&wmawmh aocsmoGm;ygjyD/ yHkrSeftm;jzifh
awmh 'D password udkod&Sd&atmif vkyf&rSmjzpfayr,fh 'Dtcef;u patch vkyfenf;udkom aqG;aEG;rSmjzpfwJh
twGuf patch vkyfzdkU MudK;pm;MunfhMu&atmif/ yHk(5)rSm jrif&wJh "Password is incorrect…" pmom;udk
pm&GufvGwfwpfckrSm rSwfxm;yg/ Olly rSm calc.exe zdkifudkzGifhyg/ yHk(6)twdkif; jrif&ygr,f/
yHk(6)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 136 -
yHk(6)rSm right-click ESdyfjyD; Search for u All referenced text strings udk a&G;yg/ Window
topfwpfck ay:vmygvdrfhr,f/ 'D window rSm right-click ESdyfjyD; Search for text udka&G;yg/ yHk(7)twdkif;
jrif&ygr,f/
yHk(7)
yHk(7)rSm uRefawmfwdkU&SmcsifwJh "Password is incorrect…" pmom;udk &dkufxnfhjyD; OK udka&G;vdkuf
yg/ yHk(8)twdkif; jrif&ygr,f/
yHk(8)
yHk(8)u hightlight jzpfaewJhae&mudk mouse eJU ESpfcsufESdyfvdkufyg/ yHk(9)twdkif; awGUygr,f/
yHk(9)
yHk(9)udk aocsmMunfhyg/ yHk(5)u error message udkjywJh routine (VA 0054C8AC) udk awGU&yg
r,f/ wu,fawmh error message routine udkvkyfaqmifwm[m CALL calc.00435C4C udkrausmfEdkifwm
aMumifhyg/ VA 0054C87C u JNZ instruction uvJ CALL calc.00435C4C udkausmfEdkifjcif; r&Sdygbl;/
yHk(10)/
yHk(10)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 137 -
yHk(11)
yHk(11)u textbox xJrSm "Cracker" vdkU&dkufxnfhvdkufyg/ uRefawmfwdkU breakpoint owfrSwfxm;wJh
ae&mudk wef;a&mufvmygr,f/ yHk(12)/
yHk(12)
yHk(12)u VA 0054C86E ae&mudka&muf&if register windows udkwpfcsufMunfhygr,f/ yHk(13)/
yHk(13)
yHk(13)udk Munfhvdkuf&if EAX register xJrSm "pFTZ^UC" pmom;&SdjyD; EDX register xJrSm "wqt}
wutt" pmom;&Sdaewm awGU&ygr,f/ wu,fawmh "wqt}wutt" qdkwm yHk(2)rSm uRefawmfwdkU&dkufxnhfcJhwJh
password udk encrypt vkyfxm;wJhpmom;jzpfygw,f/ "pFTZ^UC" uawmh "Cracker" udk encrypt vkyfxm;
wmyg/ yHk(12)rSmjrif&wJh VA 0054C86E u CALL routine uawmh "pFTZ^UC" eJU "wqt}wutt" udk
nDrnDppfwmyg/ wu,fvdkUnD&if error message udkausmfoGm;rSmyg/ 'gqdk uRefawmfwdkU patch
vkyfMunfhMuygr,f/ trSefuawmh CALL calc.004046A0 ae&mrSm NOP instruction eJUtpm;xdk;jyD; JE
SHORT calc.0054C8D7 ae&mrSmawmh JMP SHORT calc.0054C8D7 eJUtpm;xdk;&rSmyg/ 'gayr,fh
'Dae&mrSmawmh uRefawmfhtaeeJU JE udk JMP vdkUjyifwmwpfckyJ vkyfygr,f/ (rSwfcsuf/ / NOP (No
operation) vdkUjyifwmuawmh password ESpfckudk rppfapwmjzpfygw,f/ JMP instruction uawmh error
message udk twif;ausmfcdkif;wmjzpfygw,f/) jyifvdkuf&ifawmh yHk(14)twdkif; jrif&ygr,f/
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 138 -
yHk(14)
yHk(14)twdkif; jyifjyD;&ifawmh right-click ESdyfjyD; Copy to executable u All modification udkESdyfjyD;
zdkifudk odrf;vdkufyg/ Patch vkyfxm;jyD;om;zdkifudk tvkyfvkyf^rvkyfod&atmif zdkifudkzGifhMunfhvdkufyg/ ay:vmwJh
password dialogbox rSm MudKufwJh password udk&dkufxnfhvdkufyg/ y&dk*&rfyGifhvmygvdrfhr,f/
(2) Intermediate tqifh patch vkyfjcif;
'DwpfcgrSmawmh cracking eJU ywfoufjyD; tv,ftvwftqifh patch vkyfjcif;udk prf;oyfMunfhyg
r,f/ b,folUudkrS xdcdkufrIr&SdapbJ avhvmprf;oyfzdkU a&G;cs,fxm;wJh y&dk*&rfuawmh MrBills yJjzpfygw,f/
'Dy&dk*&rfudk tifwmeufrSm vHk;0rawGUEdkifawmhygbl;/ ukrÜPDudka&mif;csjyD;jzpfovdk y&dk*&rf[mvJ qufxGufvm
jcif; r&Sdawmhygbl;/ aemufjyD; 'Daqmhzf0JvfudkvJ tjcm;olawG crack vkyfjyD;oGm;Muwm awGU&ygw,f/
MrBills udk SND Team &JU download section rSm tcrJh download &,lEdkifygw,f/ Lena &JU reversing
tutorial (7) rSm MrBills udkwpfcgwnf; xnfhoGif;ay;xm;wm awGU&rSmyg/
y&dk*&rftaMumif;udk odapzdkU y&dk*&rfudk Olly eJU PEiD wdkUrSm zGifhMunfhMuygr,f/ yHk(15)^yHk(16)/
yHk(15)
yHk(16)
PEiD uawmh PE zdkifawGrSmtoHk;rsm;vSwJh packer? cryptor eJU compiler trsdK;tpm;awGudk
pHkprf;ay;wJh tool wpfckjzpfygw,f/ PEiD &JU plugin wpfckjzpfwJh Krypto Analyser udk avhvmMunfhygr,f/
'D plugin av;[m module awGtwGif;rSm&SdwJh odjyD;om; crypto algorithm awGudk plugin u Krypto
oauFwawGeJU EdIif;,SOfjcif;tm;jzifh &SmazGygw,f/
yHk(1)udk Munfhr,fqdk&if MrBills qdkwJh aqmhzf0Jvf[m pack vkyfxm;jcif;r&SdbJ olUudk Visual C++
7.0 eJU a&;om;xm;wmudk awGU&ygr,f/ MrBills &JU version uawmh 2.1.0.1 jzpfygw,f/
yHk(17)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 139 -
yHk(18)
yHk(18)udk Munfhr,fqdk&if toHk;jyKxm;wJh crypto algorithm awGudkawGU&ygw,f/ CRC check
taMumif;udk aemufydkif;oifcef;pmawGrSm aqG;aEG;rSm jzpfygw,f/ aumif;ygjyD? PEiD udk ydwfvdkufygr,f/
yHk(16)udk Munfhvdkufyg/ uRefawmfwdkU y&dk*&rfudk run (F9) Munfhygr,f/ 'gqdk yHk(19)twdkif; awGU&yg
r,f/
yHk(19)
yHk(19)rSm jrif&wJhtwdkif; uRefawmfwdkU register rvkyf&ao;ygbl;/ About udk ESdyfvdkufyg/
yHk(20)
About udkESdyfvdkuf&if yHk(20)twdkif; jrif&ygr,f/ 'DrmS awmh uRefawmfwdkU vkyfp&mbmrSr&Sdbl;vdkU xifyg
w,f/ Register... udk a&G;vdkufyg/ yHk(21)twdkif; jrif&ygr,f/
yHk(21)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 140 -
yHk(22)
uRefawmfwdkU uHraumif;ygbl;/ yHk(23)udkyJ jrif&ygw,f/
yHk(23)
yHk(9)[m uRefawmfwdkU patch vkyf&r,fhae&myg/ uRefawmfhtaeeJU t&iftcef;awGrSm text string
awGudk b,fvdk&Sm&rvJqdkwm &Sif;jycJhjyD;ygjyD/ 'DaeUtzdkUrSmvJ uRefawmfwdkUvdkcsifwm&zdkU 'Denf;vrf;udk toHk;jyK&
OD;rSmyg/ 'gaMumifh 'D text string awGxJu ta&;MuD;r,fxifwJhpum;vHk;udk rSwfom;vdkufyg/ aumif;ygjyD?
uRefawmfwdkUuk'fawGudk avhvmvdkufMu&atmif/ Olly qD jyefoGm;vdkufyg/ yHk(10)/
yHk(24)
Text string awGudk &SmzdkU yHk(24)rSm right-click ESdyfvdkufyg/ jyD;&if Search for rS All referenced
text strings udk a&G;vdkufyg/ 'gqdk text string window ay:vmygvdrfhr,f/ Text string window rSm
right-click ESdyfjyD; uRefawmfwdkU&SmcsifwJh text udk &Smygr,f/ yHk(25)/ r&SmcifrSm owday;vdkwmuawmh text
string window &JU tay:qHk;xda&mufatmif scroll vkyfjyD;rS right-click ESdyfzdkUyg/
yHk(25)
'gqdk uRefawmfwdkU &SmaewJh text udk &SmawGUygjyD/ yHk(26)/
yHk(26)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 141 -
yHk(27)
yHk(13)u VA 004299BD [m "You have entered an ..." udk messagebox rSma&;zdkU
jyifqifaewmyg/ atmufudk scroll enf;enf;qGJjyD;Munfhvdkuf&if yHk(28)twdkif; jrif&rSmyg/
yHk(28)
uRefawmfwdkUvdkcsifwJhtajzu VA 004299F3 rSmyg/ VA 004299BD u BadBoy message jzpfjyD;
FVA 004299F3 uawmh GoodBoy message jzpfygw,f/ yHk(27)u JNZ [m VA 004299F1 qD jump
jzpfapwmawGU&ygw,f/ vufawGUrSmawmh JNZ [m VA 004299F1 qD jump rjzpfygbl;/ 'gaMumifhvJ
"You have entered an invalid email ..." qdkwJh BadBoy message udk jrif&wmyg/ wu,fvdkU JNZ
ae&mrSm JMP vdkU ajymif;cJhr,fqdk&if .........
yHk(29)
yHk(29)u TEST AL, AL udk Munfhvdkufyg/ AL [m GoodBoy vm;? BadBoy vm;qdkwm qHk;jzwf
ygw,f/ AL udk VA 004299AD u CALL function xJrSm owfrSwfxm;wm jzpfEdkifygw,f/ bmaMumifhvJ
qdkawmh wpfckckudkrEdIif;,SOfcif CALL function xJrSmEdIif;,SOfzdkUtwGuf owfrSwfwm[m ydkjyD;aumif;EdkifvdkUyg/
'g[m registration ppfaq;csuf jzpfygw,f/ 'Dae&mrSm rSwfcsufjyKvdkwmuawmh ... uRefawmfwdkUtaeeJU 'D
CALL function xJrSm AL udk b,fvdkowfrSwfxm;ovJqdkwmudk ppfaq;zdkUvdkvmjyDqdkwmudkyg/
'gaMumifh VA 004299AD ae&mudk breakpoint owfrSwfvdkufygr,f/ qufvdkufMu&atmif/
uRefawmfwdkUtaeeJU serial [m rSefuefjcif; &Sd^r&Sd ppfaq;wJh&v'fudk awGU&Sdxm;ygw,f/ TEST AL, AL
txufu CALL xJrSm&v'fudk owfrSwfxm;csdefrSm AL [m 'Dwefzdk;udk odrf;xm;ygw,f/ &v'fu taygif;
oabmaqmifcJh&if y&dk*&rfudk register vkyfzdkU Goodboy message &Sd&m VA 004299F1 udk a&mufvmrSmyg/
'grSr[kwf&ifawmh jump rjzpfEdkifovdk Badboy message vJ&&SdrSmyg/
tESpfcsKyf/ / JNZ aMumifh register vkyfzdkUtwGuf AL [m okneJUnDaevdkU r&ygbl;/
VA 004299AD &JU tay:udk scroll enf;enf;avmuf qGJMunfhvdkufMu&atmif/ yHk(30)/
yHk(30)
yHk(30)u text awG[m uRefawmfwdkUtwGuf bmrSta&;rygygbl;/ About box rSm ay:wJhpmawGyg/
Registration udk jyef run MunfhvdkufMu&atmif/ CALL xJrSm bmawG&SdovJqdkwm odEdkifzdkU VA
004299AD rSm breakpoint owfrSwfxm;ygw,f/
rSwfcsuf/ / Plain stupid method onf BadBoy udk ausmfvTm;Edkif&ef conditional jump rsm;tm; patch
vkyfjcif;omjzpfygonf/ rsm;aomtm;jzifh xdkenf;onf aqmhzf0Jvfrsm;udk register vkyf&eftwGuf vHkavmufjcif;
r&Sday/
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 142 -
yHk(31)
"Register Now" button udk ESdyfvdkufwJhtcgrSm ckeu uRefawmfwdkU breakpoint owfrSwfvdkufwJh
VA 004299AD ae&mudk a&mufvmygw,f/ yHk(32)/
yHk(32)
F7 udk ESdyfjyD; CALL xJ 0ifMunfhMu&atmif/ 'gqdk uRefawmfwdkU CALL xJ a&mufvmygjyD/ yHk(33)/
yHk(33)
aemufxyf bmqufjzpfrvJqdkwm od&atmifawmh F8 udkyJ ESdyfMuygr,f/ 'Dae&mrSm AL wefzdk;ajymif;
oGm;wmawGudk apmifhMunfhzdkUvdkwJhtaMumif; ajymyg&ap/ yHk(34)/
yHk(34)
rMumcifrSm ta&;MuD;wmawGudk awGU&awmhrSmyg/ yHk(35)u VA 0040715A ae&mrSm TEST AL, AL
udkawGUygovm;/
yHk(35)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 143 -
yHk(36)
VA 00407155 u CALL ae&mrSm Enter key udk ESdyfvkdufwJhtcg yHk(37)twdkif; jrif&ygw,f/
yHk(37)
MunfhvdkufMu&atmif/ VA 00407007 u MOV BL, AL/ VA 00407011 u MOV AL, BL/
AL xJudk BL xJuwefzdk;awGjyefa&TUw,f/ yxrqHk; AL xJuwefzdk;udk BL xJrSmxm;w,f/ VA 00407009
u CALL [m BL (& AL) tay: bmrStusdK;oufa&mufrIr&Sdwm oifhtaeeJU em;vnfrSmyg/ 'gayr,fh AL
&JUwefzdk;udk VA 00406FF9 u CALL rSm qHk;jzwfxm;ygw,f/ aumif;jyD/ AL udk VA 00406FF9 u
CALL 00406F4B xJrSm owfrSwfxm;wmrdkU 'D CALL ae&mudk breakpoint owfrSwfvdkufMu&atmif/
owdjyK&rSmu ckcsdefrSm uRefawmfwdkU[m CALL awG trsm;MuD;awGUae&wmudkyg/ tvm;wl trSwf
xm;&rSmu uRefawmfwdkU[m CALL xJrSm bm&Sdw,fqdkwmodEdkifzdkU CALL ae&mrSm Enter key udk ESdyfcJhw,f
qdkwmudkyg/ AL udk VA 00406FF9 u CALL xJrSm owfrSwfxm;^rxm; ppfaq;zdkU uRefawmfwdkU break-
point owfrSwfxm;wJh ae&mqDa&mufatmif F9 udkESdyfygr,f/ 'gqdk uRefawmfwdkU breakpoint owfrSwfxm;wJh
ae&mudk a&mufvmygjyD/ yHk(38)/
yHk(38)
aemuftqifhudk em;vnfzdkU oifhtwGuf t&rf;ta&;MuD;ygw,f/
(1) AL &JU wefzdk;udk rSwfom;yg/
(2) AL &JU wefzdk;udk owfrSwfw,fvdkU oHo,&SdwJh CALL udk execute vkyf&rSmjzpfygw,f/
(3) 'D CALL udk F7 ESdyfyg/
(4) AL eJU ywfoufwJh tcsuftvufawGudk xyf&Smyg/
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 144 -
yHk(39)
yHk(39)rSm jrif&wJhtwdkif;qdk&ifawmh AL [m oknrjzpfygbl;/ 'gaMumifhvJ TEST AL, AL u
wefzdk;wpfck jyefydkUwJhtcsdefrSm AL [m oknrjzpfEdkifwmyg/ tck CALL udk run zdkU F8 udkESdyfyg/ AL wefzdk;
ajymif;oGm;wmudk awGU&ygr,f/ yHk(40)/
yHk(40)
'gaMumifh VA 00406FF9 u CALL xJrSm AL wefzdk;udk oknvdkU owfrSwfvdkufygw,f/
Registration atmifjrifjcif; r&Sdygbl;/ bmawG qufjzpfrvJod&atmif F8 udk ESdyfyg/
aemufxyfxyfrSwf&rSmu aemuftqifhawGrSm AL eJU BL &JUwefzdk;awG b,fvdkajymif;oGm;rvJqdkwm
udkyg/
yHk(41)
yHk(41)u MOV BL, AL udk execute vkyfvdkuf&if BL &JUwefzdk;[mvnf; oknjzpfoGm;rSmyg/ bmvdkY
vJqdkawmh AL u oknjzpfaevdkUyg/ yHk(42)/
yHk(42)
yHk(43)
yHk(43)u VA 00407009 rSm&SdwJh CALL udk execute vkyfjyD;csdefrSmawmh AL &JU wefzdk;[m 1 vdkU
ajymif;oGm;wm awGU&ygw,f/ VA 00407011 u MOV AL, BL udk Munfhyg/ BL xJu[mudk bmvdkU AL
rSm vmxm;&wmvJ/
INFO: : wu,fvdkU y&dk*&rf[m EAX register eJUtwl tvkyfvkyfzkdUvdkr,fqdk&if olUwefzdk;udk tjcm;
register xJrSm ,m,DoGm;xm;ygvdrfhr,f/
uRefawmf aemufwpfMudrf&Sif;jyygOD;r,f/ 'grSom oifhtaeeJU y&dk*&rf b,fvdktvkyfvkyfw,fqkdwJh
t&omudk cHpm;&rSmjzpfw,f/
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 145 -
yHk(44)
yHk(44)rSmawmh AL &JU wefzdk;[m BL aMumifh oknjyefjzpfoGm;ygw,f/ 'gaMumifh VA 00407009 u
CALL [m AL eJU BL tay: bmoufa&mufrIrS r&Sdbl;vdkUajymcJhwJh uRefawmhf&JU aumufcsufawG[m rSefaejyD
aygh/ AL &JU tajctaeudk owfrSwfwm[m VA 00406FF9 u CALL rSmyg/ aemufqHk;taeeJU uRefawmf
wdkU&JU t&if CALL (Enter key udkrESdyfcif CALL udk qdkvdkwmyg/)qDoGm;EdkifzdkU F8 (odkU) F7 udkESdyfvdkufyg/
yHk(45) twdkif; jrif&ygvdrfhr,f/
yHk(45)
TEST AL, AL u jyefvmcsdefrSm AL &JU wefzdk;[m oknrjzpfwm trSwf&rSmyg/ (JNZ onf
register vkyfjcif;jzpf^rjzpf)
'Dae&mrSm AL [mbmjzpfrvJqdkwm avhvmvdkufMu&atmif/ F8 udkESdyfvdkufwJhtcg AL &JU wefzdk;[m
oknyJ jzpfaewkef;yg/ yHk(32)/
AL udk pointer ([5076A0]) xJ xm;wJhtcgrSmawmh ....
yHk(46)
Pointer &JU wefzdk;[m oknjzpfaeygao;w,f/ yHk(46)/ Register rvkyfxm;csdefrSmawmh jump rjzpf
Edkifygbl;/
aumif;jyD/ Register vkyfxm;jcif;&Sd^r&Sdukd VA 0040715E u pointer ([5076A0]) xJrSm xdef;
odrf;xm;w,fqdkwm em;vnfygovm;/ tvm;wl VA 00407174 u pointer ([5076A0]) rSma&myg/
yHk(45)/
VA 0040716B u CALL [m uRefawmfwdkU register rvkyfxm;csdefrSmom tvkyfvkyfEdkifygw,f/
ol[m unregistered string awGudkjyowJh CALL jzpfEdkifygw,f/ F8 udk qufESdyfMunfhygr,f/ VA 0040
715E u AL eJU ywfoufwJhtvkyfawGudk aemufydkif;usrS qufvkyfMuygr,f/ tvm;wl VA 00407174 u
AL udka&myg/
tck&Sif;jyaewm[m oifhtwGuf t&rf;aES;ae&ifawmh aqm&D;yg/ 'gawGtm;vHk;[m cracking eJU
tenf;i,fom ywfoufzl;MuwJh vlopfwef;awGtwGuf &IyfaxG;aevdrfhr,fvdkU xifxm;vdkYyg/ 'gaMumifh 'gawG
tm;vHk;udk uRefawmfhtaeeJU tao;pdwfaqG;aEG;ay;aewmyg/ 'gayr,fh 'gawGtm;vHk;udk cifAsm;taeeJU em;vnf
jyDvdkU ,lqwJhaemufrSmawmh aemufvmr,fhoifcef;pmawGrSm uRefawmfhtaeeJU tjrefoGm;zdkU uwdjyKygw,f/
F8 ukd ESdyfvmcJhyg/
yHk(47)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 146 -
yHk(48)
VA 00407076 rSm aemufxyf pointer ([5076A1]) wpfckawGU&ygw,f/ Pointer awGtaMumif;
&Sif;r,fvdkUxifygw,f/ VA 0040707D u JNZ [m uRefawmfwdkU register rvkyfxm;&if jump jzpfygr,f/
aumif;jyD/ F8 udkomESdyfvmcJhyg/ uRefawmfwdkU atmifjrifpGm register vkyfEdkifcJhjcif; &Sd^r&Sd yHk(49)rSmawGU&yg
w,f/
yHk(49)
aumif;jyD? uRefawmfwdkU[m bmvdkU BadBoy qDa&mufvm&ovJqdkwm &Sif;rSmyg/ yHk(49)/ VA
004299B9 u JNZ [m jump rjzpfygbl;/ yHk(50)/
yHk(50)
'gaMumifh register rjzpfygbl;/ bmqufjzpfrvJqdkwm qufMunfhMu&atmif/
yHk(51)
'gqdk yHk(51)twdkif; jrif&ygw,f/ ckcsdefrSm uRefawmfwdkU &SmaewJh CALL udk odygjyD/
aumif;jyD/ yHk(51)rSm OK udka&G;jyD; Olly udk aemufwpfMudrf jyefpvdkufyg/ owdjyK&rSmu breakpoint
window rSm VA 004299AD u breakpoint wpfckwnf;om &Sdygap/ y&dk*&rfudk run (F9) vdkufyg/ jyD;&if
yHk(31) twdkif; register xyfvkyfyg/ 'gqdk yHk(52)twdkif; uRefawmfwdkU owfrSwfxm;wJhae&mudk wef;a&mufvm
ygr,f/
yHk(52)
uRefawmfwdkUtaeeJU rSefuefwJh CALL udk &SmEdkifzdkU F7 udkESdyfjyD; VA 004299AD u CALL xJudk
0ifygr,f/
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 147 -
yHk(53)
VA 00407155 u CALL udk t&ifu uRefawmfwdkU 0ifa&mufcJhwm trSwf&rSmyg/ VA 00407155
a&muf&if F7 udk ESdyfyg/ yHk(54)twdkif; jrif&ygr,f/
yHk(54)
VA 00406FF9 u CALL a&mufonftxd F8 udk ESdyfvmcJhyg/
yHk(55)
yHk(55)u MOV BL, AL udk rSwfrdr,fxifygw,f/ ckcsdefrSmawmh VA 00406FF9 u CALL [m
uRefawmfwdkU oGm;&r,fh CALL vdkU qHk;jzwfxm;ygw,f/ 'gaMumifh F7 udkESdyfjyD; CALL xJ0ifygr,f/
yHk(56)twdkif; jrif&ygr,f/
yHk(56)
AL udk b,frSm owfrSwfxm;ovJqdkwm &SmMunfhygr,f/ atmufudk scroll qGJvmcJhyg/ uk'fawG
awmfawmfrsm;rsm;udk awGUygw,f/ yxrqHk;tMudrfjzpfvdkU xJxJ0if0if&SmzdkU rpOf;pm;awmhygbl;/ uRefawmfhtaeeJU
serial rSef^rSefppfaq;wJhae&mwpfckudk oHo,0ifrdygw,f/ 'gayr,fh 'gudkaemufydkif;usrSyJ ajymygr,f/ ckawmh
AL udk patch vkyfzdkUyJ MudK;pm;ygr,f/ wu,fawmh uRefawmfhtaeeJU uk'fawGudk wpfckrusef vdkufvHppfaq;
&rSmyg/ 'gudk Advanced Level Patching vdkU ac:ygw,f/
yHk(57)
ckawmh VA 00406FC5 u BL udk ajymif;zdkUMudK;pm;ygr,f/ yHk(58)/
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 148 -
yHk(58)
oifuawmh tjcm;wpfckckjzpfr,fvdkU xifaeygvdrfhr,f/ VA 00406FC5 ae&mrSm uRefawmfu MOV
AL, 1 (odkU) INC AL vdkU ajymif;ypfvdkufvdrfhr,fvdkU oifhtaeeJU xifxm;ygvdrfhr,f/
'Dae&mrSm uRefawmf &Sif;jyyg&ap/ y&dk*&rf pwifcsdefwdkif;rSm 'Dae&muuk'fudk execute vkyfygw,f/
'gayr,fh y&dk*&rf[m AL == 1 eJU pwifygw,f/ (register vkyfxm;&if)/ twdtusajym&&ifawmh y&dk*&rfudk
wu,f register vkyfxm;jcif;r&Sd&if y&dk*&rf[m unregister jzpfapygw,f/ 'gaMumifhvJ uRefawmfwdkU t&if
wkef;uvkyfcJhovdk VA 004299AD u JNZ ae&mrSm JMP vdkUajymif;cJhcsdefrSm y&dk*&rf[m cPwmom
register jzpfoGm;jyD; aemufwpfcsdef y&dk*&rfudk jyefpcsdefrSm unregister jzpfoGm;jcif; jzpfygw,f/
atmufazmfjyyguk'fawGudk oifudk,fwdkif prf;oyfapcsifygw,f/
MOV AL, 1 (odkU)
MOV BL, 1 (odkU) NOP
tm;vkH;uawmh y&dk*&rfudk register jzpfapygvdrfhr,f/ bmyJjzpfjzpf 'gawGtm;vHk;udk em;rvnfao;vJ
ta&;rMuD;ao;ygbl;/ aemufydkif;tcef;awGMu&if &Sif;oGm;rSmyg/ ckcsdefrSmawmh uRefawmfu MOV BL, 1 udk
assemble vkyfw,fvdkUyJ ,lqvdkufMu&atmif/
uRefawmfwdkUtaeeJU BL udk b,fae&mrSm owfrSwfxm;ovJqdkwm od&atmif VA 00406FBC u
CALL xJukd 0ifjyD;avhvmzdkU vdktyfygw,f/ 'gayr,fh avmavmq,fawmh 'DavmufeJUyJ awmfMuygawmh/
yHk(59)/
yHk(59)
F9 udk ESdyfjyD; bmqufjzpfrvJqdkwm Munfhygr,f/ yHk(60)/
yHk(60)
yHk(60)u OK udk ESdyfvkduf&if yHk(61)u [Unregistered] qdkwJhpmom; aysmufoGm;wm awGU&rSmyg/
yHk(61)
yHk(61)udkMunfh&if aemufwpfMudrf register vkyfp&mrvdkawmhwm awGU&rSmyg/
yHk(62)
'gqdk&ifawmh intermediate tqifh patch vkyfjcif;uawmh atmifjrifpGm jyD;qHk;oGm;ygjyD/ Patch
vkyfjyD;om;zdkifudk ESpfouf&mtrnfeJU odrf;vdkufyg/ ☻☻☻
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 149 -
yHk(63)
yHk(64)
yHk(65)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 150 -
yHk(66)
yHk(68)
yHk(69)
yHk(70)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 151 -
yHk(71)
yHk(72)
yHk(73)
yHk(74)
yHk(75)
yHk(76)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 152 -
yHk(77)
yHk(78)
yHk(79)
yHk(80)
yHk(81)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 153 -
yHk(82)
yHk(83)
yHk(84)
yHk(85)
tcef;(10) – Patch vkyfjcif; (Beginner/Intermediate/Advanced) - 154 -
tcef;(11) - Cracker rsm; owdxm;oifhaom Windows API rsm; - 155 -
MultiByteToWideChar
WideCharToMultiByte
wsprintf
tcsdef?&ufpGJwdkUESifhywfoufonfhtcg
GetFileTime
GetLocalTime
GetSystemTime
GetSystemTimeAsFileTime
SetTimer
SystemTimeToFileTime
NAG-window udk&Smvdkonfhtcg
CreateWindowEx
ShowWindow
UpdateWindow
MessageBox rSpmom;rsm;udk&Smvdkaomtcg
SendDlgItemMessage
SendMessage
SetDlgItemText
SetWindowText
Registration eJUywfoufwJh routine awGudkppfaq;wJhtcgrSmawmh atmufyg API rsm;udk t"duxm;
&SmazGzdkUvdkygw,f -
GetdlgItemText
GetWindowText
lstrcmp
GetPrivateProfileString
GetPrivateProfileInt
RegQueryValueEx
WritePrivateProfileString
WritePrivateProfileInt
(1) CreateProcess
(FOR ONLY FULL VERSION)
BOOL CreateProcess(
LPCTSTR lpApplicationName, // pointer to name of executable module
LPTSTR lpCommandLine, // pointer to command line string
LPSECURITY_ATTRIBUTES lpProcessAttributes, // pointer to process security attributes
LPSECURITY_ATTRIBUTES lpThreadAttributes, // pointer to thread security attributes
BOOL bInheritHandles, // handle inheritance flag
DWORD dwCreationFlags, // creation flags
LPVOID lpEnvironment, // pointer to new environment block
LPCTSTR lpCurrentDirectory, // pointer to current directory name
LPSTARTUPINFO lpStartupInfo, // pointer to STARTUPINFO
LPPROCESS_INFORMATION lpProcessInformation // pointer to PROCESS_INFORMATION
);
(2) GetWindowText
int GetWindowText(
HWND hWnd, // handle of window or control with text
LPTSTR Buffer, // address of buffer for text
int Count // maximum number of characters to copy
);
(3) GetdlgItemText
UINT GetDlgItemText(
HWND hDlg, // handle of dialog box
int ControlID, // identifier of control
LPTSTR Buffer, // address of buffer for text
int Count // maximum size of string
);
tcef;(11) - Cracker rsm; owdxm;oifhaom Windows API rsm; - 157 -
yHk(1)
yHk(2)
DLG_REGIS DIALOG 20, 20, 142, 81
STYLE DS_MODALFRAME | WS_VISIBLE | WS_CAPTION | WS_SYSMENU
CAPTION "Enter Password"
LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL
FONT 10, "Book Antiqua"
{
CONTROL "Textbox", 1000, EDIT, ES_LEFT | ES_AUTOHSCROLL | WS_CHILD | WS_VISIBLE |
WS_BORDER | WS_TABSTOP, 45, 22, 66, 11
CONTROL "OK", 1002, BUTTON, BS_PUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP,
18, 55, 42, 15
CONTROL "Cancel", 1003, BUTTON, BS_PUSHBUTTON | WS_CHILD | WS_VISIBLE |
WS_TABSTOP, 80, 55, 42, 15
CONTROL "Password:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 23, 34,
10
}
yHk(3)
(4) GetDlgItem
HWND GetDlgItem(
HWND hDlg, // handle of dialog box
int ControlID // identifier of control
);
(5) lstrcmp
int lstrcmp(
LPCTSTR lpString1, // address of first string
LPCTSTR lpString2 // address of second string
);
yHk(4)
(6) GetPrivateProfileString
DWORD GetPrivateProfileString(
LPCTSTR lpAppName, // points to section name
LPCTSTR lpKeyName, // points to key name
LPCTSTR lpDefault, // points to default string
LPTSTR lpReturnedString, // points to destination buffer
DWORD nSize, // size of destination buffer
LPCTSTR lpFileName // points to initialization filename
);
[section]
key = string
.
.
/
(7) GetPrivateProfileInt
tcef;(11) - Cracker rsm; owdxm;oifhaom Windows API rsm; - 158 -
UINT GetPrivateProfileInt(
LPCTSTR lpAppName, // address of section name
LPCTSTR lpKeyName, // address of key name
INT nDefault, // return value if key name is not found
LPCTSTR lpFileName // address of initialization filename
);
(8) RegQueryValueEx
LONG RegQueryValueEx(
HKEY hKey, // handle of key to query
LPTSTR lpValueName, // address of name of value to query
LPDWORD lpReserved, // reserved
LPDWORD lpType, // address of buffer for value type
LPBYTE lpData, // address of data buffer
LPDWORD lpcbData // address of data buffer size
);
(9) WritePrivateProfileString
BOOL WritePrivateProfileString(
LPCTSTR lpAppName, // pointer to section name
LPCTSTR lpKeyName, // pointer to key name
LPCTSTR lpString, // pointer to string to add
LPCTSTR lpFileName // pointer to initialization filename
);
tcef;(11) - Cracker rsm; owdxm;oifhaom Windows API rsm; - 159 -
int main()
{
TCHAR inBuf[80];
HKEY hKey1, hKey2;
DWORD dwDisposition;
LONG lRetCode;
TCHAR szData[] = TEXT("USR:App Name\\Section1");
// Test
GetPrivateProfileString (TEXT("Section1"), TEXT("FirstKey"), TEXT("Error: GPPS failed"),
inBuf, 80, TEXT("appname.ini"));
tcef;(11) - Cracker rsm; owdxm;oifhaom Windows API rsm; - 160 -
yHk(5)
(10) CreateWindowEx
HWND CreateWindowEx(
DWORD ExtStyle, // extended window style
LPCTSTR ClassName, // pointer to registered class name
LPCTSTR WindowName, // pointer to window name
DWORD WindowStyle, // window style
int x, // horizontal position of window
int y, // vertical position of window
int Width, // window width
int Height, // window height
HWND hWndParent, // handle to parent or owner window
HMENU hMenu, // handle to menu, or child-window identifier
HINSTANCE hInstance, // handle to application instance
LPVOID lParam // pointer to window-creation data
);
(11) CreateFile
HANDLE CreateFile(
LPCTSTR FileName, // pointer to name of the file
DWORD DesiredAccess, // access (read-write) mode
DWORD Mode, // share mode
LPSECURITY_ATTRIBUTES pSecurity, // pointer to security attributes
DWORD dwCreationDistribution, // how to create
DWORD Attributes, // file attributes
HANDLE hTemplateFile // handle to file with attributes to copy
);
yHk(6)
int DialogBoxParamA(
HINSTANCE hInst, // handle to application instance
LPCTSTR pTemplate, // identifies dialog box template
HWND hOwner, // handle to owner window
DLGPROC DlgPro, // pointer to dialog box procedure
LPARAM lParam // initialization value
);
tcef;(11) - Cracker rsm; owdxm;oifhaom Windows API rsm; - 161 -
yHk(7)
(13) ShowWindow
BOOL ShowWindow(
HWND hWnd, // handle of window
int nCmdShow // show state of window
);
(14) MessageBox
int MessageBoxA(
HWND hOwner // handle of owner window
LPCTSTR Text, // address of text in message box
LPCTSTR Title, // address of title of message box
UINT Style // style of message box
);
yHk(8)
(15) SendMessage
LRESULT SendMessage(
HWND hWnd, // handle of destination window
UINT Msg, // message to send
WPARAM wParam, // first message parameter
LPARAM lParam // second message parameter
);
tcef;(11) - Cracker rsm; owdxm;oifhaom Windows API rsm; - 162 -
(16) SendDlgItemMessage
LONG SendDlgItemMessage(
HWND hDlg, // handle of dialog box
int nIDDlgItem, // identifier of control
UINT Msg, // message to send
WPARAM wParam, // first message parameter
LPARAM lParam // second message parameter
);
(17) ReadFile
BOOL ReadFile(
HANDLE hFile, // handle of file to read
LPVOID Buffer, // address of buffer that receives data
DWORD BytesToRead, // number of bytes to read
LPDWORD pBytesRead, // address of number of bytes read
LPOVERLAPPED pOverlapped // address of structure for data
);
yHk(9)
(18) WriteFile
BOOL WriteFile(
HANDLE hFile, // handle to file to write to
LPCVOID Buffer, // pointer to data to write to file
DWORD BytesToWrite, // number of bytes to write
LPDWORD pBytesWritten, // pointer to number of bytes written
LPOVERLAPPED pOverlapped // pointer to structure needed for overlapped I/O
);
(19) GetSystemTime
VOID GetSystemTime(
LPSYSTEMTIME lpSystemTime // address of system time structure
);
(20) GetFileTime
BOOL GetFileTime(
HANDLE hFile, // identifies the file
LPFILETIME lpCreationTime, // address of creation time
LPFILETIME lpLastAccessTime, // address of last access time
LPFILETIME lpLastWriteTime // address of last write time
);
(21) SetTimer
UINT SetTimer(
HWND hWnd, // handle of window for timer messages
UINT TimerID, // timer identifier
UINT Timeout, // time-out value
TIMERPROC Timerproc // address of timer procedure
);
yHk(9)
tcef;(11) - Cracker rsm; owdxm;oifhaom Windows API rsm; - 163 -
tcef;(11) - Cracker rsm; owdxm;oifhaom Windows API rsm; - 164 -
tcef;(11) - Cracker rsm; owdxm;oifhaom Windows API rsm; - 165 -
tcef;(12) - y&dk*&rf\ resource rsm; toHk;jyKí crack vkyfjcif; - 166 -
yHk(1)
Active Desktop Calendar udk www.xemico.com uae download vkyfjyD; install vkyfvdkufyg/
yHk(2)
ADC udk zGifhvdkufwJhtcgrSmawmh yHk(2)twdkif; register rvkyf&ao;aMumif; awGU&rSmyg/ Help menu
u About Active Desktop Calendarudk a&G;Munfhvdkuf&ifawmh yHk(3)twdkif; awGU&rSmyg/
yHk(3)
tcef;(12) - y&dk*&rf\ resource rsm; toHk;jyKí crack vkyfjcif; - 167 -
yHk(4)
yHk(4)u Register button udka&G;vdkuf&ifawmh yHk(5)twdkif;jrif&rSmyg/
yHk(5)
'Davmufqdk&ifawmh &ygjyD/ y&dk*&rfudk patch vkyfMunfhMuygr,f/ Patch rvkyfcifrSm ADC y&dk*&rfudk
Resource Hacker aqmzhf0JvfeJU t&ifMunfhygr,f/ yHk(6)/
yHk(6)
Resource Hacker y&dk*&rf[m yHk(6)twdkif; y&dk*&rfwpfcku toHk;jyKwJh resource awGudk jyoay;yg
w,f/ y&dk*&rfwdkif;rSm .rscr section &Sdw,fqdkwm jyeftrSwf&yg/ omreftm;jzifhawmh Resource Hacker
aqmhzf0Jvf[m y&dk*&rfawG&JU resource udk MudKufESpfoufovdk jyifay;Edkifygw,f/ yHk(7)/
yHk(7)
tcef;(12) - y&dk*&rf\ resource rsm; toHk;jyKí crack vkyfjcif; - 168 -
yHk(8)
yHk(8)u 100 qdkwJhpmom;udk aocsmMunfhyg/ ol[m dialog trnfjzpfygw,f/ y&dk*&rf[m dialog
function udkac:roHk;cif dialog trnfudk stack ay:ul;wifygw,f/
yHk(9)
yHk(9)u 207 qdkwJhpmom;uawmh yHk(4)u registration box udkay:apwJh dialog jzpfygw,f/
yHk(10)
yHk(10)u 208 qdkwJhpmom;uawmh yHk(5)u BadBoy MessageBox udk ay:apwJh dialog yg/
aumif;jyD/ ADC y&dk*&rfudk Olly rSm zGifhygr,f/ yHk(11)/
yHk(11)
yHk(11)twdkif; jrif&wJhtcgrSm ckeu uRefawmfwdkUMunfhcJhwJh dialog trnfawGudk Olly rSm &SmMunfhvdkuf
Mu&atmif/ Olly rSm right-click ESdyfjyD; Search for u All commands udk a&G;vdkufyg/ yxrqHk;
registration vkyfwJh dialog (2007d = 00CFh)udk t&if&SmMunfhvdkufMu&atmif/ yHk(12)/
tcef;(12) - y&dk*&rf\ resource rsm; toHk;jyKí crack vkyfjcif; - 169 -
yHk(12)
yHk(12)rSm Find button udka&G;vdkuf&if yHk(13)twdkif; jrif&rSmyg/
yHk(13)
yHk(13)rSmjrif&wJh command wdkif;udk breakpoint owfrSwfygr,f/ Breakpoint owfrSwfjyD;&if F9
udkESdyfjyD; y&dk*&rfudk run vdkufyg/ jyD;&if Help menu u Registration udka&G;vdkufyg/ yHk(14)twdkif; awGUyg
r,f/
yHk(14)
yHk(14)u uRefawmfwdkUa&mufaewJh VA 0045EEC0 ae&muawmh registration dialog &Sd&m CALL
yg/ VA 0045EEA0 uawmh registration dialog &Sd&m CALL tpyg/ 'D CALL ukd b,f virtual
address uaeac:oHk;w,fqdkwm odcsif&if stack window rSm oGm;Munfhvdkufyg/ yHk(15)/
yHk(15)
yHk(15)t&qdk&ifawmh VA 0045EEA0 udkvkyfaqmifjyD;&if VA 00434E86 qDudkjyefoGm;r,fvdkU
ajymxm;ygw,f/ [kwf^r[kwfod&atmif right-click ESdyfjyD; Follow in Disassembler udka&G;vdkufyg/ yHk(16)
twdkif; jrif&ygr,f/
yHk(16)
wu,fawmh VA 0045EEA0 u CALL udk VA 00434E81 u ac:oHk;xm;wmyg/ 'Davmufqdk
em;vnfavmufjyDxifygw,f/ yHk(14)udk jyefMunfhvdkufyg/ yHk(14)twdkif;qdk&ifawmh dialog trnfudk stack
ay:pul;wifygjyD/ bmqufjzpfrvJqdkwmod&atmif F9 udkESdyfvdkufyg/ yHk(17)twdkif; jrif&ygr,f/
yHk(17)
tcef;(12) - y&dk*&rf\ resource rsm; toHk;jyKí crack vkyfjcif; - 170 -
yHk(18)
yHk(18)&JU VA0045F0D3 ae&mu JE [m register vkyfwmatmifjrif^ratmifjrifudk qHk;jzwfjyD;
ratmifjrifcJh&if VA 0045F239 qDa&mufvmrSmyg/ 'gaMumifhvJ BadBoy DialogBox ay:vmwmyg/
'Duk'fudk JE tpm; NOP vkdUjyifvdkuf&ifawmh oifbmuk'f&dkufxnfhxnfh register vkyfwmatmifjrifygjyD/
yHk(19)/ 'gqdk uRefawmfwdkU jyifvdkufwJhuk'fawGudk ESpfouf&mzdkiftrnfeJU odrf;qnf;vdkufyg/
yHk(19)
ydkjyD;aocsmapcsif&ifawmh yHk(20)twdkif; registry editor (regedit.exe) rSmMunfhvdkufyg/
yHk(20)
odrf;vdkufwJhzdkifudk jyefzGifhjyD; Help menu u About Active Desktop Calendar udkMunfhvdkuf&if
awmh yHk(21)twdkif; jyaewkef;yg/
yHk(21)
'ghaMumifh 'D dialog (2007d = 0064h) &Sd&m virtual address rSmvJ breakpoint owfrSwfjyD; run
(F9) Munfhygr,f/ y&dk*&rf run aepOfwavQmufrSm PUSH 64 &Sd&m breakpoint wdkif;rSm cP&yfygvdrfhr,f/
rqdkifbl;qdk&if breakpoint udkjyefjzKwfyg/ (About Dialog udkac:oHk;wJh PUSH 64 breakpoint rSwyg;)
tcef;(12) - y&dk*&rf\ resource rsm; toHk;jyKí crack vkyfjcif; - 171 -
'DvdkeJU rqdkifwJh breakpoint awGjzKwfvmwm y&kd*&rf menu ay:vm&if Help menu u About ADC udk
a&G;yg/ 'Dwpfcg uRefawmfwdkU&SmaewJh About Dialog breakpoint &Sd&ma&mufvmygjyD/ yHk(22)/
yHk(22)
yHk(22)u VA 00401C60 uawmh routine &JUtp jzpfygw,f/ olUudkb,fu ac:oHk;ovJqdkwm
odcsif&ifawmh stack window rSm right-click ESdyfjyD; Follow in disassmeble udka&G;vdkufyg/ yHk(23)twdkif;
jrif&ygr,f/
yHk(23)
yHk(23)rSmjyxm;wJhtwdkif; VA 00401C60 udk VA 00401D48 u ac:oHk;wmyg/ F9 udk ESdyfvdkuf&if
awmh yHk(21)twdkif; awGU&ygr,f/ bmaMumifh "This is an unlicensed copy" qdkwJhpmom;ay:wmvJqdkwm
od&atmif About DialogBox (100d) udk Resource Hacker eJU jyefMunfhvdkufyg/ yHk(24)/
yHk(24)
yHk(24)udk Munfhvdkuf&ifvJ olUrSmvJ stack ay:ul;wifwJh *Pef; (1044d = 414h) &Sdwm awGU&rSmyg/
'Dae&mudk ausmfEdkif&if bmjzpfrvJqdkwm qufMunfhygr,f/ PUSH 414h udk&SmjyD; breakpoint owfrSwfyg
r,f/ jyD;&if Olly rSm y&dk*&rfudk jyefpjyD; Help menu u About ADC udk a&G;vdkufyg/ jyD;&if PUSH 414h
&Sd&m breakpoint qDa&mufatmif F9 ESdyfvmcJhyg/ aemufqHk;awmh yHk(25)twdkif; breakpoint &Sd&mudk a&mufvm
ygr,f/
yHk(25)
&Sif;vif;csuf/
tcef;(12) - y&dk*&rf\ resource rsm; toHk;jyKí crack vkyfjcif; - 172 -
yHk(26)
yHk(25)u VA 00401DE2 uae yHk(26)u VA 00401EAC xd F8 ESdyfvmcJhyg/ uRefawmfwdkUtaeeJU
VA 00401EAC u JE rSm NOP vdkUajymif;vdkufyg/ jyD;&if ESpfouf&mtrnfeJU zdkifudkodrf;vdkufyg/ odrf;vdkuf
wJhzdkifudk zGifhjyD; Help menu u About ADC udka&G;vdkufyg/ yHk(27)twdkif; awGU&ygr,f/
yHk(27)
aemufwpfqifhuawmh splash screen rSmay:vmwJh "unregistered" qdkwJhpmom;udk aysmufapzdkUyg/
VA 004013E4 u JNZ ae&mrSm JMP vdkUjyifvdkufjyD; zdkifudkodrf;vdkufyg/ yHk(28)/
yHk(28)
yHk(28)&JU VA 004013DD u CALL [m register jzpf^rjzpfppfwJh routine qdkwm oifhtaeeJU
em;vnfr,fxifygw,f/ aumif;jyD/ y&dk*&rfudk jyefzGifhMunfhvdkufyg/ yHk(29)twdkif; awGU&ygr,f/
tcef;(12) - y&dk*&rf\ resource rsm; toHk;jyKí crack vkyfjcif; - 173 -
yHk(29)
yHk(1)
Start menu u Run .. ae&mrSm cmd vdkU&dkufxnhfjyD; Command prompt ukd zGifhyg/ bmaMumifh
command prompt udk toHk;jyK&ovJqdkawmh UPX aqmhzf0Jvf[m command-line utility jzpfaevdkUyg/
yHk(2)
yHk(2)rSmjrif&wJhtwdkif; command prompt rSm upx calc.exe vdkU&dkufxnfhjyD; Enter key ESdyfvdkuf&if
uRefawmfwdkU&JU y&dk*&rfav;udk UPX eJU pack vkyfjyD;oGm;ygjyD/ 'DwpfcgrSm pack vkyfxm;wJh calc.exe zdik u
f kd
PEiD eJU jyefjyD;ppfMunfhygr,f/ yHk(3)/
tcef;(13) - Packer (Protector) rsm; - 176 -
yHk(3)
yHk(3)t&awmh calc.exe udk UPX 0.89-2.9 eJU pack vkyfxm;ygw,fvkdU ajymygw,f/ Version
twdtusudkawmh ajymEdkifjcif; r&Sdygbl;/
yHk(4)
yHk(4)udkMunfhvdkuf&if .rsrc section om olU&JUrlvtrnfrajymif;bJusef&pfjyD; usefwJh section awGtm;
vHk; trnfajymif;ukefygw,f/ Pack rvkyfcif calc.exe udk PEiD &JU section viewer eJU Munfhxm;wmt&
awhm yHk(5)twdkif;jrif&ygw,f/ Pack vkyfjyD;csdefrSmawmh .text section? .data section? .rsrc section awGt
pm; UPX0? UPX1 eJU .rsrc section awGjzpfvmygw,f/ Section trnfawGtm;vHk;ajymif;oGm;jyD; .rsrc
section u bmvdkUtrnfrajymif;vJbJ usef&pfwmygvJ/ 'Dtcsufu pdwf0ifpm;zdkUaumif;ygw,f/ tjzpfrSefu
'Dvdkyg/ Windows 95 acwfwkef;u oleaut32.dll zdkif&JU LoadTypeLibEx function rSm bug wpfck&SdcJhyg
w,f/ 'guawmh rsrc qdkwJhpmom;udk&SmjyD; resource section udk tvkyfvkyfapzdkUjzpfygw,f/ 'gaMumifhrdkU
wu,fvdkU 'D section udktrnfajymif;vJcJhr,fqdk&if error wufvmrSmyg/ 'D bug udk jyifqifxm;jyD;jzpfayr,fh
vJ Windows eJU jyoemwufrSmpdk;&drfwJhtwGuf packer awmfawmfrsm;rsm;[m rsrc section udk trnfajymif;
jcif; odyfrvkyfMuygbl;/
tcef;(13) - Packer (Protector) rsm; - 177 -
yHk(5)
ckeu pack vkyfxm;wJhzdkifudk LordPE eJUzGifhjyD; pack rvkyfxm;ao;wJhzdkifeJU EdIif;,SOfMunfhr,fqdk&if
PE header twGif;ajymif;vJrIawGudk yHk(6) twdkif; awGU&rSmyg/ (LordPE u compare button udkESdyfyg/)
yHk(6)
(2) UPX jzifh pack vkyfxm;aomzdkiftm; unpack vkyfjcif;
'DwpfcgrSmawmh pack vkyfxm;wJhzdkifudk unpack vkyfMunfhygr,f/ Pack vkyfxm;wJhzdkifudk Olly
rSmzGifhr,fqdk&if yHk(7)twdkif; Olly u compress vkyfxm;wJhzdkifvm;vdkU ar;ygvdrfhr,f/
yHk(7)
yHk(7)rSm Yes vdkU ay;vdkuf&if yHk(8)twdkif; entry point &Sd&mudk a&mufvmygvdrfhr,f/
tcef;(13) - Packer (Protector) rsm; - 178 -
yHk(8)
UPX u uRefawmfwdkU application udk compress vkyfvdkufjyD; decompression algorithm yg0ifwJh
stub eJU uk'fawGudk tpm;xdk;csJUxGifvdkufwmyg/ Application &JU entry point ae&m[mvJ stub &JU tpae&m
taeeJU ajymif;vJjcif;cH&jyD; stub u olUtvkyfudkvkyfjyD;csdefrSmawmh execution u tck (UPX u olUbmomol
unpack vkyfjcif;) unpacked vkyfvdkufwJhy&dk*&rfudkpwifzdkU rlv entry point(OEP) &Sd&mudk jump vkyfyg
w,f/ rSwfxm;zdkUu stub u uRefawmfwdkU application udk decompress vkyfwm[m rSwfOmPfxJrSmjzpfjyD;
pack vkyfxm;wJh application &JY unpacked copy udk&zdkU rSwfOmPfae&mudk zdkiftjzpf dump vkyfwmjzpfyg
w,f/ bmyJjzpfjzpf application uawmh csufcsif; run rSm r[kwfao;ygbl;/ bmaMumifhvJqdkawmh dump
vkyfxm;wJhzdkifrSmvJ olU&JU section awG[m file alignment wefzdk;xuf rSwfOmPf&JU page boundary awGudk
align vkyfxm;&rSmrdkUvdkUyg/ Entry point uvJ decompression stub udk point vkyfaewkef;&SdaerSmjzpfjyD;
import directory uvJ rSm;aewmjzpfwJhtwGuf jyifqifzdkU vdktyfaevdkUyg/
rSwfxm;&rSmuawmh Olly xJu uRefawmfwdkU&JU entry point [m yxrqHk; instruction jzpfwJh
PUSHAD rSm&Sdygw,f/ PUSHAD qdkwmuawmh "PUSH all Double" udk qdkvdkwmjzpfjyD; CPU udk stack
ay:rSm&SdwJh EAX uaetpcsDjyD; EDI rSmtqHk;owfwJh 32bit (DOWRD) register tm;vHk;xJrSmygwJht&m
tm;vHk;udk odrf;xm;ay;zdkU nTefMum;ygw,f/ taotcsmMunfhr,fqdk&if stub [m OEP qDroGm;cifrSm
PUSHAD instruction eJU POPAD instruction Mum;uuk'fawGudk vkyfaqmifoGm;wm awGU&ygvdrfhr,f/
POPAD [m stack uae register xJrSm&SdwJht&mtm;vHk;udk ul;ygw,f/ qdkvdkwmuawmh stub u t&mtm;
vHk;udk jyef restore vkyfjyD; application u run wmrwdkifcif trace rvkyfbJ xGufoGm;ygw,f/
avmavmq,fawmh yxrqHk; instruction jzpfwJh PUSHAD taetxm;rSm&Sdaewkef;rSm aemufqHk;
POPAD instruction udk access rvkyfao;oa&GU stack xJrSm&SdwJh t&mtm;vHk;udk rxdbJxm;oifhygw,f/
wu,fvdkU uRefawmfwdkUu PUSHAD taetxm;rSm&Sdaewkef; stack &JU yxrqHk; 4bytes ae&mrSm
Hardware breakpoint udkxm;r,fqdk&if Olly u wlnDwJh 4bytes udk POPAD u access vkyfcsdefrSm
&yfoGm;rSmjzpfygw,f/ 'gqdk&if uRefawmfwdkU&JU entry point qDudk a&mufr,fh jmp instruction &Sd&m virtual
address udkawGUrSm jzpfygw,f/
'gaMumifhrdkU yHk(8)&JU PUSHAD instruction &Sd&mudkoGm;jyD; F7 udkESdyfygr,f/ jyD;&if brakpoint
owfrSwfzdkUvkyfygr,f/ ESP (stack pointer) xJrSm stack &JUxdyfydkif;wnfae&m tjrJyg0ifavh&Sdygw,f/ ESP
ae&mrSm right-click ESdyfjyD; Follow in Dump udka&G;yg/
yHk(9)
jyD;&if stack &JU yxrqHk; DWORD (pmvHk;4vHk;)udk a&G;yg/ jyD;&if right-click ESdyfjyD; Breakpoint u
Hardware, on access &JU Dword udka&G;yg/ yHk(10)/
tcef;(13) - Packer (Protector) rsm; - 179 -
yHk(10)
owfrSwfjyD;oGm;&ifawmh F9 udkESdyfyg/ 'gqdk breakpoint &Sd&mwef;a&mufvmygr,f/ yHk(11)/
yHk(11)
yHk(11)udk Munfhvdkuf&if PUSHAD uae POPAD xduk'fawGudk vkyfaqmifjyD;wm awGU&rSmyg/
yHk(11)u VA 01020E5B u JMP ae&m[m uRefawmfwdkU &SmaewJh^vdkcsifwJh entry point ae&mjzpfygw,f/
JMP xxx.xxxxxxxx udka&mufatmif VA 01020E5B ae&mrSm breakpoint owfrSwfjyD; F9 udkESdyfvdkufyg/
yHk(12)twdkif; entry point &Sd&mae&mudk a&mufvmrSmjzpfygw,f/ OEP xJuae ImageBase wefzdk;
1000000h udk EIwfvdkuf&if RVA wefzdk; 20E5Bh &ygw,f/ 'Dwefzdk;udk rSwfxm;yg/ aemufydkif;rSm toHk;0if
vmygvdrfhr,f/
yHk(12)
UPX eJU ywfoufwJh vQdKU0Sufcsufav;wpfckuawmh Olly &JU CPU window atmufqHk;udkoGm;yg/
yHk(13)twdkif; 00 awGeJU jynfhaewJh DB uk'fawGudk awGU&ygvdrfhr,f/
yHk(13)
jyD;&if yHk(14)twdkif; JMP instruction &Sd&mtxd tay:udk scroll qGJvmcJhyg/ jyD;&if 'D virtual
address udk breakpoint taeeJUowfrSwfjyD; F9 udk ESdyfvdkufr,fqdk&if JMP instruction &Sd&mudk
a&mufvmygr,f/ 'DhaemufrSmawmh F8/F7 udk ESdyfr,fqdk&if uRefawmfwdkU &SmaewJh EP ae&mudk a&mufvmrSmyg/
yHk(14)
tcef;(13) - Packer (Protector) rsm; - 180 -
INFO: : &dk;&Sif;jyD; wlnDwJh PUSHAD/POPAD mechanism udkoHk;wJh tjcm; packer awGuvJ OEP
&JUwefzdk;udk RET instruction vdkufwJh stack &JUxdyfqHk;ay:xm;zdkU PUSH instruction udktoHk;jyKjcif;jzifh
OEP qD jump vkyfEdkifygw,f/ CPU uawmh 'g[m function call wpfckuae jyefvmwmvdkUxifjyD; return
address udk stack &JUxdyfqHk;ay:rSm csefxm;ygw,f/
uRefawmfwdkUtaeeJU OEP udk&SmawGUwJhtcg Olly &JU plug-in wpfckjzpfwJh OllyDump udk toHk;jyKjyD;
dump vkyfMunfhygr,f/ Olly &JU Plugins uae OllyDump udka&G;vdkufjyD; Dump debugged process udk
ESdyfvdkufyg/ yHk(15)twdkif; jrif&ygr,f/
yHk(15)
pdwf0ifpm;p&maumif;wJht&mav;awGudk jyocsifvdkU yHk(15)u Fix Raw Size … eJU Rebuild Import
wdkUudk ra&G;bJ jzKwfxm;vdkufyg/ jyD;&if Dump button udkESdyfjyD; packed_dumped.exe trnfeJU zdkifudk
odrf;vdkufyg/ yHk(16)/
yHk(16)
yHk(16)u uRefawmfwdkU dump vkyfjyD; odrf;xm;cJhwJhzdkifudk jyefzGifhMunfh&if yHk(17)twdkif; error wufae
wm jrif&rSmyg/
yHk(17)
bmvdkU error wufae&wmvJqdkawmh uRefawmfwdkU&JU dump vkyfxm;wJhzdkifu olU&JU icon aysmufaewm
twGufaMumifhyg/ 'g[m zdkif&JUt&G,ftpm;MuD;vmvdkUyg/ Application udk LordPE rSmzGifhjyD; section awG
ae&mrSm Munfhvdkufyg/ yHk(18)/
yHk(18)
tcef;(13) - Packer (Protector) rsm; - 181 -
yHk(19)
'gayr,fh 0rf;enf;p&maumif;wmuawmh packed_dumped.exe zdkifudk zGifhvdkufwJhtcgrSm zdkifu
tvkyfrvkyfbJ yHk(20)twdkif; jrif&wmygyJ/
yHk(20)
rpdk;&drfygeJU/ 'gubmaMumifhvJqdkawmh import awGudk reconstruct (rebuild) vkyfzdkUvdkvdkUyg/ ]PE
header} tcef;rSm&Sif;jycJhovdk process wpfckudktoHk;jyKjyD; import awGudk udk,fwdkifvkyfvdkU &ygw,f/ bmyJ
jzpfjzpf udk,fwdkifjyKvkyfr,fqdk&ifawmh import vkyfxm;wJh function awGtrsm;MuD;&SdjyD;? import data awG
b,fvdkysufpD;oGm;wJhenf;vrf;awGay:rlwnfjyD; tcsdeftrsm;MuD;ukefrSmjzpfygw,f/ 'gudk tvkdtavsmufajz&Sif;
EdkifzdkU uRefawmfwdkUtaeeJU MackT &JU ImpRec 1.6 udk toHk;jyK&ygvdrfhr,f/
ImpRec 1.6 udk toHk;jyKawmhr,fqdk&if import awGudk&SmEdkifzdkU pack vkyfxm;wJhzdkifudk process
taeeJU attach vkyfxm;&ygr,f/ atmufygtwdkif; vkyfaqmifyg/
1/ yHk(21)twdkif; pack vkyfxm;wJh y&dk*&rfudk (packed.exe [m Olly rSm yGifhaewmaocsmygap)a&G;yg/
2/ OEP ae&mrSm virtual address 12475 udk &dkufxnhfyg/
yHk(21)
tcef;(13) - Packer (Protector) rsm; - 182 -
yHk(22)
4/ yHk(21)u Get Imports button udkESdyfyg/ yHk(23)twdkif; jrif&ygr,f/
yHk(23)
5/ Show Invalid button udk a&G;jyD; import awG rSef^rrSef ppfMunhfyg/ tm;vHk;rSefuefaeygw,f/
6/ Fix Dump button udk ESdyfjyD; uRefawmfwdkU aemufqHk;odrf;xm;wJh packed_dumped.exe zdkifudkzGifhyg/
yHk(24)twdkif; jrif&ygr,f/ wu,fvdkU jyóem&Sd&ifawmh section udk aygif;xnfhvdkUr&ygbl;vdkU error wufvm
ygr,f/
yHk(24)
7/ y&dk*&rfudkydwfjyD; aemufqHk;odrf;qnf;vdkufwJh packed_dumped_.exe udkzGifhMunfhyg/ aumif;aumif;tvkyf
vkyfwmudk awGU&rSmyg/
ImpRec u uRefawmfwdkU dump vkyfxm;wJh exe zdkifudk jyifqifjyD; odrf;qnf;vdkufwmyg/ wu,fvdkU
'Dzdkifudk PEiD rSmzGifhjyD;Munfhvdkuf&if unpack vkyfxm;jyD;om;zdkif(packed_dumped_.exe) &JUt&G,ftpm;[m
pack rvkyfcif rlvzdkif(calc.exe)xuf MuD;aewmawGU&jyD; "makct" eJU "newIID"vdkUac:wJh section ESpfck
ydkvmwmawGU&ygw,f/ "makct" section rSm ImpRec u import vkyfxm;wJh a'wmtopfawGudk xm;&Sdwm
jzpfygw,f/
yHk(25)
PEiD eJU packed_dumped_.exe zdkifudk jyefppfMunfh&if yHk(26)twdkif; awGU&rSmyg/
tcef;(13) - Packer (Protector) rsm; - 183 -
yHk(26)
tck &Sif;jycJhwmuawmh &dk;&Sif;vSwJh packer eJU pack vkyfxm;wmudk unpack jyefvkyfwmjzpfygw,f/
tqifhjrifh packer awGuawmh pack vkyfcsdefrSm zdkifxJudk protection enf;vrf;rsdK;pHkxnfhvdkufygw,f/ erlem
taeeJU ajym&&if anti-debugging eJU anti-tampering vSnfhpm;rIawG? uk'feJU IAT wdkUudk encrypt vkyfjcif;?
stolen bytes? API redirection ponfjzifhjzpfygw,f/
(3) Inline-patch enf;jzifh patch vkyfjcif;
wu,fvdkU pack vkyfxm;wJh zdkifudk patch vkyfzdkUrjzpfraevdktyfcJhr,fqdk&if inline-patch enf;vrf;udk
toHk;jyKjyD; 'Dzdkifudk unpack rvkyfbJ patch vkyfvdkU&ygw,f/ 'guawmh loader u decompression stub udk
aqmif&GufjyD;csdef rSwfOmPfxJrSm uk'fudk0ifjyifjyD; aemufqHk;rSmawmh application udk tvkyfvkyfEdkifapzdkU OEP
qD qufoGm;apjcif;jzpfygw,f/ aemufwpfrsdK;ajym&&if rSwfOmPfxJrSm application udk unpack rvkyf&ao;cif
jyifxm;wJh (patch) vkyfxm;wJhuk'fqD ausmfvTm;a&muf&Sdjcif;jzpfjyD;? aemufqHk;rSmawmh OEP qD jyefvnfausmf
vTm;a&muf&Sdvmwm jzpfygw,f/
'gudk &Sif;&Sif;vif;vif;odEdkifatmifvdkU uRefawmfwdkUtaeeJU pack vkyfxm;wJh exe zdkifxJudk Message
Box wpfckeJUywfoufwJhuk'fawGudk xnfhoGif;rSmjzpfygw,f/ jyD;&if rSwfOmPfxJrSm application [m b,ft
csdefrSm unpack vkyfjyD;jzpfrvJqdkwm od&atmifvkyfjyD; MessageBox u OK udkESdyfvdkuf&if OEP udk a&muf&Sd
aprSmjzpfjyD; application [mvJyHkrSeftwdkif; tvkyfvkyfrSm jzpfygw,f/
yxrqHk; vkyf&rSmuawmh pack vkyfxm;wJhzdkifxJ uRefawmfwdkU xnfhoGif;r,fhuk'ftwGuf ae&mvGwfudk
&SmazGzdkU hexeditor wpfckudk zGifh&rSmjzpfygw,f/ Section wpfck&JUtqHk;u ae&mvGwfawG[m uk'fxnfhoGif;zdkU
taumif;qHk;jzpfjyD; wu,fvdkU ae&mvGwfawGvdktyfcJhOD;r,fqdk&ifawmif uRefawmfwdkUtaeeJU ]PE zdkiftwGif;odkU
uk'frsm;aygif;xnhfjcif;} tcef;uenf;vrf;twdkif; section udk xyfcsJUvdkU&ygw,f/ UPX eJU pack vkyfxm;wJh
zdkifawGrSm ae&mvGwf&Sm&wm awmfawmfav;cufcJvSygw,f/ 'ghaMumifhvJ UPX eJU pack vkyfxm;wJh zdkifawG&JU
t&G,ftpm;[m awmfawmfav; i,faewmjzpfygw,f/ yHk(27)/
yHk(27)
yHk(27)twdkif; WinHex rSmjyifjyD; codeinject.exe qdkwJhtrnfeJU zdkifudkodrf;vdkufygr,f/ jyD;&if Olly
rSm codeinject.exe zdkifudk zGifhygr,f/ uRefawmfwdkU &dkufcJhwJh Unpacked… qdkwJhpmom;udk &SmzdkU Olly &JU Hex
window rSm right-click ESdyfjyD; Search for u Binary sting udka&G;yg/
yHk(28)
tcef;(13) - Packer (Protector) rsm; - 184 -
yHk(29)
'gqdk&if uRefawmfwdkU&SmaewJhpmom;awGudk yHk(30)twdkif; awGU&rSmyg/
yHk(30)
Unpacked… pmom;&Sd&m virtual address uawmh 010233C0 jzpfjyD; Myanmar Crackers …
pmom;&Sd&m virtual address uawmh 010233D0 jzpfygw,f/ 'D virtual address awGudk rSwfxm;&rSmjzpf
ygw,f/ jyD;&if Olly u udkESdyfjyD; VA 010233C0 &Sd&mudk wef;oGm;Munfhygr,f/ yHk(31)/
yHk(31)
yHk(31)u highlight vkyfxm;wJh uk'fawG[m uRefawmfwdkU &dkufxnfhxm;wJh pmom;awGjzpfygw,f/ VA
010233E0 upjyD; MessageBox eJUywfoufwJh tjcm;uk'fawGudk &dkufxnfhMuygr,f/
yHk(32)uawmh MessageBox eJUywfoufwJhuk'fawGudk &dkufxnfhtjyD; jrif&wJhyHkyg/
yHk(32)
jyD;&if Olly &JU plugin wpfckjzpfwJh Analyze This! udkESdyfjyD; uk'fawGudk analyze vkyfvdkufyg/ yHk(33)
twdkif; ajymif;vJoGm;wm jrif&ygr,f/
tcef;(13) - Packer (Protector) rsm; - 185 -
yHk(33)
yHk(32)udk Analyze This! eJU analyze vkyfwJhtcgrSm yHk(33)rSm highlight jc,fxm;wJhtwdkif;
rjrif&&ifawmh oif patch vkyfvdkufwJh y&kd*&rf[m error jyygvdrfhr,f/
yHk(34)
aumif;jyD? uRefawmfwdkUjyifxm;cJhwJh uk'fawGudk zdkiftaeeJU odrf;qnf;Muygr,f/ yHk(34)twdkif; jyifxm;
wJh uk'fawGygatmif highlight jc,fvdkufyg/ jyD;&if right-click ESdyfjyD; Copy to executable file udk a&G;vdkuf
yg/ yHk(35)twdkif; jrif&ygvdrfhr,f/
yHk(35)
yHk(35)rSm right-click ESdyfjyD; Save file udk a&G;vdkufyg/ rdrdpdwfMudKuftrnfeJU zdkifudkodrf;qnf;vdkuf
yg/ jyD;&if Olly udkydwfvdkufjyD; uRefawmfwdkU odrf;qnf;vdkufwJhzdkifudk zGifhvdkufyg/ t&ifutwdkif;yJ bmrS
xl;jcm;rIr&Sdygbl;/ bmaMumifhvJqdkawmh uRefawmfwdkUtaeeJU MessageBox &Sd&mudk nTefjyrIray;vdkufcJhvdkUyg/
Olly rSm aemufqHk;odrf;xm;wJhzdkifudk xyfzGifhvdkufyg/ udkESdyfjyD; VA 01020E5B &Sd&mudk wef;oGm;Munfhyg
r,f/ yHk(36)/
yHk(36)
yHk(36)u JMP 01012475 ae&mrSm uRefawmfwdkU&JU MessageBox &Sd&m virtual address jzpfwJh
010233E0 udk &dkufxnfhay;&ygr,f/ yHk(37)/
yHk(37)
tcef;(13) - Packer (Protector) rsm; - 186 -
jyD;&if MudKufwJhtrnfeJU zdkifudkodrf;vdkufyg/ Olly udk ydwfvdkufjyD; zdkifudk run Munfhyg/ yHk(37)twdkif;
jrif&ygvdrfhr,f/ OK ukdESdyfvdkuf&ifawmh calculator y&dk*&rfqD a&mufoGm;rSm jzpfygw,f/
yHk(38)
tckuRefawmf&Sif;jycJhwmuawmh unpack rvkyfbJ pack vkyfxm;wJhzdkifxJrSm uk'fawGudk 0ifjyifjcif;
(inline-patching) taMumif;yJjzpfygw,f/ 'D MessageBox av;udkxnhfzdkU bmaMumifh 'Davmufcuf&ovJvdkU
oifhtaeeJUxifaeygvdrfhr,f/ rSefygw,f/ Pack rvkyfxm;wJhzdkifawGrSm 'Dudpöu t&rf;vG,fygw,f/ Message
Box &Sd&mae&mudk entry point address ajymif;ay;vdkuf&HkygyJ/ jyD;&if olUrSmu ae&mvGwfawGtrsm;MuD; &Sdyg
w,f/ qdkvdkcsifwm MessageBox rajymeJU? textbox uae password awGppfwJh txda&;ay;vdkU&atmif ae&m
vGwfawGu aygvGef;ygw,f/ Inline-patching eJU xnhfoGif;wJh MessageBox &Sd&mudk wef;a&mufatmif zdkif&JU
entrypoint udk VA 01020CD0 tpm; VA 010233E0 vdkU ajymif;Munfhvdkufyg/ yHk(38)u MessageBox
awmh ay:vmEdkifayr,fh calculator y&dk*&rfudk tvkyfvkyfrSmr[kwfygbl;/ bmaMumifhygvJ? UPX &JU decom-
pression stub udk ausmfvTm;xm;vdkU jzpfygw,f/
UPX eJUywfoufwJh oifcef;pmuawmh 'DavmufygyJ/ oifhtaeeJU unpacking eJUywfoufwJh oDtdk&D
awG tenf;i,fem;vnfavmufjyDvdkU xifygw,f/ uRefawmfhtaeeJU unpacking eJUywfoufjyD; 'DrSmyJ&yfxm;
csifayr,fh tqifhjrifh packer awGtaMumif; ydkem;vnfEdkifapzdkU ActiveMARK taMumif;udk jznfhpGufaqG;aEG;
ygr,f/
(4) ActiveMark 5.0 jzifh pack vkyfxm;aomzdkiftm; unpack vkyjf cif;
Trymedia [m RealNetworks &JU tpdwftydkif;wpfckjzpfjyD; ActiveMark qdkwmuawmh Trymedia
&JU pack/protect vkyfwJhenf;ynmwpf&yfjzpfygw,f/ Trygames uawmh Trymedia &JU wpfpdwfwpfydkif;jzpfjyD;
Trymedia &JU *drf;awGudk download ydkif;qdkif&mudpö? trial qdkif&mudpöeJU a&mif;csjcif;udpöwdkUudk vkyfaqmifyg
w,f/
PopCap Games (www.popcap.com) u a&mif;cswJh*drf;rsm;? Infogrames (www.infogrames.
com) u a&mif;cswJh*drf;awmfawmfrsm;rsm;[m ActiveMARK eJU protect vkyfxm;Muwmjzpfygw,f/ Active
MARK eJU protect vkyfxm;wJh *drf;awGrSm registration r&Sdygbl;/ bmaMumifhvJqdkawmh 'D*drf;awG[m olwdkU&JU
owfrSwfxm;wJhtcsdeftwGif;rSm full version taeeJU upm;EdkifwJh demo *drf;awGjzpfaevdkUyg/ owfrSwfcsdefukef
oGm;&ifawmh upm;vdkU&awmhrSmr[kwfygbl;/ upm;cGifhjyKwJhtcsdefuvJ rsm;aomtm;jzifhawmh rdepf60yJ jzpfyg
w,f/ 'Doifcef;pmtwGuf Monopoly 3 udk unpack vkyfzdkU yxrqHk;pOf;pm;rdygw,f/ bmaMumifhvJqdkawmh
Monopoly 3 eJU ywfoufwJh crack zdkifudk tifwmeufrSm rawGUrdvdkUyg/ Share ay;xm;wJh crack zdkifawGuvJ
tvkyfrvkyfMuygbl;/ 'gayr,fh olU&JUzdkift&G,ftpm;u 258Mbytes jzpfaeawmh oifhtaeeJU tifwmeufuae
download vkyfzdkUtcuftcJ&SdEdkifygw,f/ 'ghaMumifhrdkU PopCap Games ua&mif;cswJh Zuma deluxe udkyJ
unpack vkyfzdkU a&G;cs,fvdkufygawmhw,f/ Zuma udk www.popcap.com uae download vkyf,ljyD; install
vkyfyg/
jyD;&if zuma.exe udk PEiD eJU ppfaq;Munfhyg/ yHk(39)/
yHk(39)
tcef;(13) - Packer (Protector) rsm; - 187 -
yHk(40)
aumif;jyD? uRefawmfwdkU Zuma udk unpack vkyfMunfhMuygr,f/
(4) ActiveMark 5.0 jzifh pack vkyfxm;aomzdkiftm; dump vkyfjcif;
yxrqHk; zuma.exe udk zGifhxm;yg/ Olly udk zGifhyg/ Open menu u Attach udk a&G;cs,fyg/
yHk(41)
'Dhaemuf yHk(42)rSm jrif&wJhtwdkif; zuma.exe udk Attach vkyfyg/
yHk(42)
Attach vkyfjyD; zGifhwJhtcgrSm yHk(43)rSm jrif&wJhtwdkif; VA 7C901231 rSm &yfoGm;rSmyg/ wu,fawmh
ntdll.dll zdkif&JU DbgBreakPoint API function aMumifh &yfoGm;&wmyg/ Win32 Programmer's reference
rSmawmh DbgBreakPoint function taMumif;eJU ywfoufjyD; bmrS&Sif;jyxm;wmh rawGU&ygbl;/
tcef;(13) - Packer (Protector) rsm; - 188 -
yHk(43)
Olly rSm Alt+M udkESdyfjyD; memory map udk Munfhygr,f/ yHk(44)/
yHk(44)
yHk(44)u highlight jzpfaewJhae&muawmh second layer entry point &Sd&mae&myg/'Dae&mrSm right-
click ESdyfjyD; View in disassembler udk a&G;vdkufyg/ (odkU) Enter key udkESdyfyg/ yHk(45)twdkif; jrif&ygr,f/
yHk(45)
yHk(45)u highlight jzpfaewJhae&m (VA 005AE000)rSm right-click ESdyfjyD; Search for u All
intermodular calls udk a&G;cs,fyg/ yHk(46)twdkif; jrif&ygr,f/
yHk(46)
yHk(46)twdkif; jrif&wJhtcgrSm getversion vdkU &dkufxnfhyg/ GetVersion function udk &Smcsifwmyg/
GetVersion API udk awGUwJhtcg right-click ESdyfjyD; Follow in disassembler udka&G;yg/ yHk(47)twdkif; jrif&
ygr,f/
yHk(47)
tcef;(13) - Packer (Protector) rsm; - 189 -
yHk(48)
yHk(48)rSm jrif&wJhtwdkif; Break on new module (DLL) udk a&G;ay;yg/ jyD;&if OK udkESdyfyg/
'DwpfcgrSmawmh zuma.exe udk attach rvkyfawmhygbl;/ Olly uae wpfcgwnf; zGifhygr,f/ yHk(49)/
yHk(49)
yHk(49)uawmh zuma.exe &JU entry point ae&myg/ 'gjyD;&ifawmh uRefawmfwdkU owfrSwfxm;wJh
hardware breakpoint ae&mxda&mufatmif F9 udk ESdyfvmcJhyg/ b,f awGudk tvkyfvkyfaewmvJqdkwm
yHk(50)twdkif; jrifae&ygvdrfhr,f/
yHk(50)
F9 udkqufwdkuf ESdyfvmwm aemufqHk;awmh yHk(51)twdkif; uRefawmfwdkU owfrSwfxm;wJh breakpoint
ae&mudk a&mufvmygw,f/ MudKajymcsifwmuawmh uk'fawGudk analyze rvkyfxm;ygeJU/ Analyze vkyfxm;r,f
qdk&if VA 00696E58 u PUSH EBP ae&mrSm DB 00 vdkUyJ ay:aerSmyg/
yHk(51)
yHk(51)u VA 00696E58 [m uRefawmfwdkU&SmaewJh OEP yJjzpfygw,f/ tckuRefawmfwdkU debug
vkyfxm;wJh process udk dump vkyfzdkU MudK;pm;Muygr,f/ Olly &JU plug-in wpfckjzpfwJh OllyDump udk
a&G;vdkufyg/ yHk(52)/
tcef;(13) - Packer (Protector) rsm; - 190 -
yHk(52)
yHk(52)u dump button udka&G;jyD; zdkifudk dumped.exe qdkwJhtrnfeJU odrf;vdkufyg/ UPX rSm dump
vkyfwkef;uvdkyJ dumped.exe zdkifudkzGifhvdkuf&if tvkyfvkyfrSm r[kwfygbl;/ 'ghaMumifh ImpREC udk zGifhjyD;
import awGudk jyif&ygr,f/ ImpREC (Import Reconstruction) udk oHk;&wJhtaMumif;&if;uawmh dumped
zdkifxJrSm&SdwJh aysmufaewJh function awGudk &SmzdkU^jyifzdkU^topfaygif;xnhfzdkU jzpfygw,f/ 'gawGudk rjyKjyifbJeJU
awmh oifh&JU dump zdkif[m rSefuefwJh PE zdkifjzpfvmrSm r[kwfygbl;/
yHk(53)
yHk(53)t& vkyfaqmif&rJh vkyfaqmifcsufawGuawmh ...
1/ Olly eJU zGifhxm;wJh zuma.exe udk active process taeeJU attach vkyfyg/
2/ Olly rSm zGifhMunfhwkef;u awGU&SdcJhwJh OEP (VA 00696E58) wefzdk;xJuae ImpREC rSmawGU&wJh
imagebase (VA 00400000) udk EIwfjyD;&&SdvmwJh (296E58) wefzdk;udk OEP tuGufrSm &dkufxnfhyg/
tcef;(13) - Packer (Protector) rsm; - 191 -
yHk(54)
4/ yHk(54)udk OK ay;jyD; Get Imports button udkESdyfyg/
5/ Import function awG rSef^rrSef odEdkifatmif Show Invalid button udk ESdyfjyD;Munfhyg/ 'Dae&mrSmawmh
tm;vHk;rSefaewm awGU&ygw,f/
6/ 'gaMumifhrdkU uRefawmfwdkU dump vkyfxm;wJh dumped.exe zdkifeJU zuma.exe zdkifudkEdIif;,SOfjyD; import
awGudk EdIif;,SOfEdkifatmifvdkU Fix Dump button udk a&G;yg/ yHk(55)twdkif; bmtrSm;rSr&SdbJ dumped_.exe
qdkwJhtrnfeJU zdkifudk odrf;qnf;oGm;wm awGU&rSmyg/
yHk(55)
'gqdk uRefawmfwdkU&JU dump zdkifudk jyifqifwmjyD;oGm;jyD jzpfwJhtwGuf ImpREC udkydwfvdkufjyD;
dumped_.exe zdkifudk zGifhMunfhyg/ bm error rSrjyawmhovdk dumped_.exe uvJ tvkyfvkyfwm rawGU&yg
bl;/ UPX udk unpack vkyfwkef;u 'DtqifhjyD;wJhtcsdefrSm unpack vkyfwJhudpö jyD;oGm;ygjyD/ ActiveMARK
rSmawmh tckrSprSmyg/ 'ghaMumifh WinHex udkzGifhjyD;uk'fawGudk jyifMuygr,f/
WinHex rSm dump vkyfjyD;jyifxm;wJh dumped_.exe zdkifeJU pack vkyfxm;wJh rlv zuma.exe zdkifudk
zGifhyg/ csJUxGifxm;wJh overlay data awG&JU yxrqHk; byte twGuf rlvzdkif&JUuk'fawGuae bmudk uRefawmfwdkU
&SmoifhygovJ/ TMSAMVOH qdkwJh ASCII string udk&SmwJhenf;uawmh tvG,fqHk;ygyJ/ r&SmcifrSm
'Dxufydk&Sif;atmifvdkU zuma.exe udk LordPE rSmzGifhjyD; section awGudk MunfhvdkufMu&atmif/ yHk(56)/
yHk(56)
yHk(56)u highlight jc,fxm;wJh *Pef;awGudk Munfhvdkufyg/ 'g[m uRefawmfwdkU executable zdkif&JU
aemufqHk; section xJu *Pef;awG jzpfygw,f/ olwdkUudk Raw offset eJU Raw size vdkU odxm;Muygw,f/
Windows loader u exe zdkifudk rSwfOmPfxJ ul;wifwm[m RawOffset (0012BA00) eJU RawSize
(00000200) aygif;vdkU&wJhwefzdk;jzpfwJh 0012BC00h xdomjzpfygw,f/ Zuma.exe zdkif&JU 'D address tpu
ae csJUxGifxm;wJh data block wpfckvHk;udkul;,ljyD; dumped_.exe zdkif&JUtqHk;rSm paste oGm;vkyf&rSmjzpfyg
w,f/ 'grSom dumped_.exe [m yHkrSeftvkyfvkyfrSm jzpfygw,f/
WinHex &JU Position menu u Go To Offset udka&G;jyD; uRefawmfwdkU oGm;csifwJh offset
0012BC00 udk &dkufxnfhygr,f/ yHk(57)/
tcef;(13) - Packer (Protector) rsm; - 192 -
yHk(57)
0012BC00 udk &dkufxnfhjyD; OK udkESdyfvdkuf&if yHk(58)twdkif; jrif&rSmyg/
yHk(58)
yHk(58)rSm jrif&wJh yxrqHk;pmvHk;rSm right-click ESdyfjyD; Beginning of block udk a&G;yg/ yHk(59)/
yHk(59)
jyD;&if zdkif&JU atmufqHk;xda&mufatmif scroll qGJyg/ jyD;&if yHk(60)rSmawGU&wJhtwdkif; aemufqHk;pmvHk;rSm
right-click ESdyfjyD; End of block udk a&G;cs,fyg/
yHk(60)
'gqdk&if yHk(61)twdkif; Hex wefzdk;tm;vHk;udk a&G;cs,fjyD;oGm;ygjyD/
yHk(61)
tcef;(13) - Packer (Protector) rsm; - 193 -
a&G;cs,fxm;wJh Hex wefzdk;awGudkul;zdkU vkyfMuygr,f/ Right-click ESdyfjyD; Edit udk a&G;cs,fyg/ jyD;&if
yHk(62)rSm jrif&wJhtwdkif; Copy Block u Hex Values udk a&G;cs,fyg/
yHk(62)
tckvkyf&rSmuawmh ul;xm;wJh Hex wefzdk;awGudk paste vkyfzdkUjzpfygw,f/ WinHex &JU dumped_
.exe tab udka&G;jyD; zdkif&JUtqHk;udkoGm;yg/ aemufqHk;pmvHk;&JUae&mrSm right-click ESdyfjyD; Edit udk a&G;cs,fyg/
jyD;&if yHk(63)rSm jyxm;wJhtwdkif; Clipboard Data u Paste udk a&G;cs,fyg/
yHk(63)
'DtcgrSm yHk(64)twdkif; paste vkyfrSmvm;vdkU ar;ygvdrfhr,f/
yHk(64)
Yes button udk a&G;vdkufwJhtcgrSm zuma.exe u Hex wefzdk;awG dumped_.exe zdkifxJudk
a&mufvmygvdrfhr,f/ dumped_.exe zdkifudkodrf;jyD; WinHex uaexGufvdkufyg/
'Dtcg dumped_.exe udk zGifhvdkuf&if yHk(40)twdkif; jrif&rSmyg/ (ae&mtcuftcJaMumifh yHkudk xyfrHr
azmfjyawmhygbl;/) 'gqdk&ifawmh uRefawmfwdkU&JU dump vkyfwJhvkyfief;pOf atmifjrifpGmjyD;qHk;oGm;ygjyD/ ☻☻
'gayr,fh tcsdefuefUowfcsufudkawmh z,f&Sm;Edkifjcif; r&Sdao;ygbl;/ 'ghaMumifh patch vkyfzdkU MudK;pm;&
ygOD;r,f/
(5) Dump vkyfxm;aomzdkiftm; patch vkyfjcif;
Dump vkyfxm;wJhzdkifudk patch vkyfzdkUtwGuf dumped_.exe udk Olly rSm zGifhyg/ yHk(65)/
yHk(65)
yHk(65)twdkif;jrif&wJhtcg right-click ESdyfjyD; Search for u All referenced text string udk a&G;yg/
'DhaemufrSmawmh yHk(66)rSm jyxm;wJhtwdkif; browser qdkwJh pmom;udk &Smygr,f/
tcef;(13) - Packer (Protector) rsm; - 194 -
yHk(66)
yHk(66)udk OK ay;wJhtcg yHk(67)twdkif; awGY&rSmyg/
yHk(67)
yHk(67)&JU highlight jc,fxm;wJhae&mrSm right-click ESdyfjyD; Follow in disassembler udk a&G;vdkuf&if
yHk(68)twdkif; jrif&rSmyg/ 'g[m browser pmvHk;ygwJh routine &JUtpeJU tqHk;jzpfygw,f/
yHk(68)
yHk(68)u VA 005F41A8 rSm right-click ESdyfjyD; Copy u To clipboard udk a&G;jyD; notepad
zdkifwpfckrSm paste vkyfyg/ 005F41A8 MOV EAX,dumped_.006A691C tpm; 005F41A8 browser
retn4 vdkU ajymif;yg/ jyD;&if yHk(66)uae dialog? timer? timeout pmom;awGudk&SmjyD; browse pmom;wkef;u
vkyfcJhovdkyJ routine &JU tp virtual address awGudk rSwfom;xm;ay;yg/ (rSwfcsuf/ / yHk(68)rSm teDawG
jyxm;wmu breakpoint owfrSwfzdkU r[kwfygbl;/ jrifomatmif jyxm;wmyg/)
xl;jcm;wmuawmh LoadStatePool pmom;yg/ pmom;udk &Smwmuawmh rxl;ygbl;/ 'gayr,fh 'Dpm
om;&Sd&mae&mudk breakpoint owfrSwfjyD; y&dk*&rfudk jyefpwm&wmu xl;ygw,f/ dumped_.exe udk Olly eJU
jyefzGifhwJhtcgrSm uRefawmfwdkU owfrSwfxm;wJh breakpoint ae&ma&muf&if yHk(69)twdkif; jrif&ygw,f/
yHk(69)
'Dwpfcgvkyf&rSmu yHk(70)twdkif; stack window udkoGm;jyD; highlight jzpfaewJhae&mrSm right-click
eSdyfyg/ jyD;&if Follow in disassembler udk a&G;ay;yg/ yHk(71)twdkif; jrif&ygr,f/
yHk(70)
yHk(71)u highlight jzpfaewJhae&m&JU virtual address udk rSwfxm;yg/
yHk(71)
tcef;(13) - Packer (Protector) rsm; - 195 -
'gqdk browser? dialog? timer? timeout eJU LoadStatePool wdkUeJU ywfoufwJh virtual address
tm;vHk;udk&ygjyD/ 'D virtual address awGrSm bmawGjyif&rvJqdkwmuawmh yHk(72)twdkif; jzpfygw,f/
yHk(72)
yHk(72)u virtual address awGrSm retn 4? retn 0c eJU retn toD;oD;udk tpm;xdk;yg/ jyD;&if patch
vkyfxm;wJhzdkifudk MudKufwJhtrnfeJU odr;f vdkufyg/ 'gqdk&if uRefawmfwdkU&JU Zuma Deluxe 1.0 udk MudKufESpfouf
ovdkupm;vdkU&ygjyD/
(6) Pack vkyfxm;aom trnfrodzdkiftm; unpack vkyfjcif;
'DwpfcgrSmawmh Fish Packer 1.04 eJU pack vkyfxm;wJh zdkifwpfckudk unpack vkyfMunfhygr,f/
uRefawmfwdkU&JUzdkifudk bmeJU pack vkyfxm;ovJqdkwm PEiD eJU ppfMunfhygr,f/ yHk(73)/
yHk(73)
yHk(73)rSmjrif&wJhtwdkif; PEiD u tajzay;Edkifjcif; r&Sdygbl;/ CFF Explorer eJUppfawmhvJ 'Dtwdkif;
ygyJ/ uRefawmfudk,fwdkif Fish Packer 1.04 eJU pack vkyfxm;vdkUom Fish Packer eJU pack vkyfxm;wJh
zdkifrSef;odwmyg/ aumif;jyD? 'Dzkdifudk unpack vkyfMunfhygr,f/ Unpack vkyfr,fh NFO Viewer.exe zdkifudk
Olly rSmzGifhvdkufyg/ (Protection ID eJUqdk&ifawmh Fish Packer 1.04 eJU pack vkyfxm;aMumif;jyrSmjzpfjyD;
Protection ID eJUppfaq;xm;wJh &v'fawG[m rSm;cJygw,f/ 'gayr,fh Protection ID [m protect/pack
vkyfxm;wJhzdkifawGudkom ppfaq;ay;EdkifwJh tm;enf;csuf&Sdygw,f/)
yHk(74)
Olly u yHk(74)rSmjrif&wJhtwdkif; PE zdkifr[kwfbl;vdkUajymaeygw,f/
yHk(75)
tcef;(13) - Packer (Protector) rsm; - 196 -
yHk(76)
yHk(76)u highlight jzpfaewJh PE header pmom;ae&mrSm ESpfcsufEdSyfvdkufjyD; PE signature &Sd&mudk
oGm;Munfhvdkufyg/ yHk(77)/
yHk(77)
yHk(77)rSm uRefawmfwdkUpdwf0ifpm;wmuawmh entry point &Sd&m address (40D6C8) yg/ 'D address
udk&wJhtcg Olly &JU Disassembler window rSm Ctrl+G ESdyfjyD; entry point(40D6C8) &Sd&mudkoGm;vdkufyg/
yHk(78)/
yHk(78)
yHk(78)u VA 0040D6C8 ae&mrSm breakpoint owfrSwfjyD; F9 (Run) udkESdyfvdkufyg/ 'Dtcg
breakpoint &Sd&mudkwef;a&mufvmygvdrfhr,f/ jyD;&if breakpoint udkjyefjzKwfjyD; aemufwpfaMumif;udkqif;EdkifzdkU
F8 (Step over) udkESdyfvdkufyg/ yHk(79)/
yHk(79)
yHk(79)rSmjrif&wJh VA 0040D6C9 udka&muf&ifawmh register window udkMunfhzdkUvdkvmygjyD/
bmaMumifhvJqdkawmh unpack vkyfawmhr,fqdk&if ESP register udk apmifhMunfhzdkUvdkvdkUyg/ yHk(80)/
yHk(80)
yHk(80)u ESP register ae&mrSm right-click ESdyfjyD; Follow in Dump udka&G;vdkuf&ifawmh yHk(81)
twdkif;jrif&rSmyg/
yHk(81)
tcef;(13) - Packer (Protector) rsm; - 197 -
yHk(82)
yHk(82)u JMP [m entry point &Sd&mae&mudk nTef;aeygw,f/ wu,fawmh PUSH + RETN [m
JMP eJUwlygw,f/ ☺☺☺☺ 'gaMumifhrdkU tJ'Dae&mrSm JMP 00401000 jzpfvmjyD; 'D address [m OEP
&Sd&mqDudk nTef;aeygw,f/ yHk(83)twdkif; OEP &Sd&mudk jrif&wJhtxd F8 (Step over) udkESdyfvmcJhyg/
yHk(83)
yHk(83)twdkif;jrif&wJhtcgrSmawmh right-click ESdyfjyD; Dump debugged process udka&G;yg/ yHk(84)/
yHk(84)
yHk(84)twdkif;jrif&wJhtcgrSm dump vkyfzdkU Dump button udka&G;vdkufyg/ jyD;&ifawmhMudKufESpfouf&m
trnfeJU zdkifudkodrf;vdkufyg/ (rSwcf suf/ / Dump vkyfxm;wJhzdkif[m aumif;aumif;tvkyfvkyfrvkyf&ifawmh
ImpRec udkoHk;jyD; IAT udkjyifzdkUvdkygvdrfhr,f/) Dump vkyfxm;wJhzdkifudk PEiD eJUppfwJhtcgrSmawmh yHk(85)
twdkif; jrif&ygvdrfhr,f/
yHk(85)
tcef;(14) - IAT ESifh API Redirection - 198 -
yHk(1)
tcef;(14) - IAT ESifh API Redirection - 199 -
yHk(2)
yHk(2)udkMunfhvdkuf&if tvm;wl CALL awGawGUrSmyg/ VA 0040104D uvJ kernel32.dll xJu
ExitProcess function udkac:oHk;wJh CALL jzpfygw,f/
yHk(3)
ExitProcess function &Sd&mae&mrSm ESpfcsufESdyfvdkuf&ifawmh yHk(3)twdkif;awGU&rSmyg/ olUudkMunfh&wm
uvJ tjcm; CALL awGvdkygyJ/ Olly uawmh 'g[m API wpfckudk ac:oHk;rSef;odygw,f/ ydkjyD;oJoJuGJuGJ
odEdkifatmifvdkU VA 0040104D ae&mudka&G;jyD; Enter key (Follow Call) udkESdyfvdkufyg/ yHk(4)twdkif;
jrif&ygr,f/
yHk(4)
'gqdk yHk(4)twdkif; jump (thunk) table &Sd&mqDa&mufvmygjyD/ 'gaMumifhrdkUvJ Olly u VA
0040104D [m API CALL wpfckudkac:roHk;cif tMudK CALL wpfckjzpfaMumif; odwmyg/ Application &JU
b,fae&mrSmrqdk ExitProcess API udkac:oHk;csifw,fqdk&if 'D address (0040104D) udkyJ toHk;jyK&rSm
jzpfygw,f/ 'grSom Windows loader u rSefuefwJh address udk&Smwm vG,fulaprSmyg/ 'gqdk VA
0040120E uaum b,f instruction udktvkyfvkyfapwmvJqdkwmodEdkifatmifvdkU tJ'Dae&mrSm Enter key
udkESdyfvdkufyg/ yHk(5)twdkif;jrif&ygr,f/
yHk(5)
wu,fawmh loader u data segment xJu DWORD wefzdk;wpfckqDudk jump vkyfoGm;wm
jzpfygw,f/ 'gaMumifhrdkU 'Dwefzdk;udkodEdkifatmifvdkU DWORD wefzdk;udkajc&mcHMunfhygr,f/ Dump window
rSm Ctrl+G ESdyfjyD; ay:vmwJhtuGufae&mrSm VA 402004 vdkU&dkufxnfhjyD; OK udka&G;vdkuf&ifawmh yHk(6)
twdkif; jrif&rSmyg/
yHk(6)
tcef;(14) - IAT ESifh API Redirection - 200 -
yHk(6)uawmh oufqdkif&m DLL xJrSm&SdaewJh API awG&JU address awGeJUtwl&SdaewJh IAT awG&Sd&m
ae&myg/ uRefawmfwdkU erlemxm;wmuawmh ExitProcess API udkyg/
yHk(7)
'gaMumifhrdkUvJ VA 00402004 udkMunfhvdkuf&if yHk(7)twdkif;jrifae&ygw,f/ Highlight vkyfxm;wJh
ae&muawmh uRefawmfwdkU API &Sd&mae&myg/ 7C81CAA2 uawmh API &Sd&m address yg/ (Endian enf;eJU
pDwmtrSwf&yg/) olUaemufrSmawmh DWORD wefzdk;wpfck(oknawG) uyfvdkufaewmawGUrSmyg/ 'DoknawG
aemufu DWORD wefzdk;awGuawmh aemuf DLL xJu API awGudk&nfnTef;ygw,f/ 'D DLL [m
user32.dll jzpfygw,f/ DWORD wefzdk;awGudkMunfhvdkuf&if 7xxxxxxx awGeJUpwm owdxm;rdrSmyg/ ydkjyD;
&Sif;vif;atmifvdkU 'gawGudk IAT xJrSmMunfhvdkufMu&atmif/ yHk(4)udkxyfMunfhvdkufyg/ kernel32.dll zdkifxJu
API ESpfckudk import vkyfxm;wmawGUrSmyg/ rSwfxm;&rSmuawmh IAT eJU imports table wdkU[m rwlbl;
qdkwmudkyg/
Info: : Imports table rSm oifhy&dk*&rftwGuf API awGudk link csdwfEdkifatmif Windows u vdktyfwJhtcsuf
tvufawGtm;vHk;&Sdygw,f/ Imports table rSm tvGef&dk;&Sif;vSwJh structure wpfck&Sdygw,f/ Import
vkyfxm;wJh DLL toD;oD;twGuf header wpfckpD&Sdygw,f/ olwdkU&JUtqHk;udk rSwfom;EdkifatmifvdkU vHk;vHk;MuD;
udk bmrSr&SdwJh tydkwpfckvJ&Sdygao;w,f/ Header toD;oD;rSmawmh DLL twGuftcsuftvufawGtm;vHk;
yg0ifygw,f/ ReverseMe.exe y&kd*&rftwGufqdk&ifawmh user32.dll eJU kernel32.dll u API awGudk
import vkyfr,fqdk&if oifhtaeeJU header 3ckudk&SmawGUrSmyg/ wpfckuawmh kernel32.dll twGufjzpfjyD; wpfck
uawmh user32.dll twGufjzpfygw,f/ tydkwpfckuawmh imports table &JUtqHk;udk rSwfom;zdkUjzpfygw,f/
Windows loader [m header toD;oD;uae tcsuftvufawGudkzwfjyD; 'DtcsuftvufawGudk IAT
jznfhpGuf&mrSmtoHk;jyKygw,f/ IAT qdkwmuawmh DLL toD;oD;twGuf IAT awGzGJUpnf;xm;wmudk ajymwm
yg/ DLL toD;oD;twGuf header udkawmh IMPORT_IMAGE_DIRECTORY vdkY ac:ygw,f/ IMAGE
qdkwJhpum;vHk;uawmh rSwfOmPfxJrSmvkyfwJhudpö&yfawGudk &nfnTef;wmjzpfjyD; offset awGtm;vHk;[m RVA awG
jzpfygw,f/ olUrSm atmufyg structure &Sdygw,f/
IMAGE_IMPORT_DESCRIPTOR:
OriginalFirstThunk
TimeDateStamp
ForwarderChain
Name
FirstThunk
Info: : Windows loader u IMPORT_IMAGE_DESCRIPTOR udkzwfcsdefrSm ol[m DLL udk t&if
ppfaq;ygw,f/ aemufrSom loader [m 'D DLL udk ul;wifwmjzpfjyD; IAT udkwnfaqmufzdkU pwifygw,f/
udkwnfaqmuf&wm[m enf;enf;av; vuf0ifygw,f/ Loader u yxrqHk; OriginalFirstThunk udk
ppfaq;wmjzpfayr,fh 'DtcsuftvufawGudk jyóemMuHKrSom toHk;jyKwmjzpfygw,f/ aemufwpfckuawmh
FirstThunk unTefjywJh trnftoD;oD;twGuf ol[m pointer udk API &JU address eJUtpm;xdk;wm jzpfyg
w,f/ wu,fvdkU tcsdKUaomtaMumif;awGt& API udk&SmrawGUcJh&ifawmh OriginalFirstThunk qDoGm;jyD; tJ'D
uae tcsuftvufawG&,lzdkU MudK;pm;ygw,f/ 'DaemufqHk;jzpfEdkifajcu tvkyfrvkyfcJh&ifawmh crash jzpfyg
w,f/ 'gaMumifh rSwfOmPfxJrSm FirstThunk xJu pointer awGtm;vHk;rSm API awG&JUtrnfawGeJUqdkifwJh
RVA awGtpm; vuf&Sd DLL uae API awGudknTef;wJh address awGyg0ifae&wmyg/ rSwfxm;&rSmuawmh
rSwfOmPfxJrSm exe udk ae&mcsxm;jyD;wJhaemufrSmawmh IAT wnfaqmufjcif;[m jyD;pD;ygjyD/
Info: : Loader [m FirstThunk xJu API trnftoD;oD;udkzwfjyD; olU&JU address udk&SmazGygw,f/
wu,fvdkU address udk&SmawGUcJh&if trnfae&mrSm address eJUtpm;xdk;vdkufjyD; 'DvdkrSr[kwf&ifawmh
OriginalFirstThunk qDoGm;jyD; xyfMudK;pm;ygw,f/ 'gaMumifhrdkU OriginalFirstThunk [m FirstThunk &JU
backup wpfckjzpfjyD; jyoemMuHKwJhtcgrSm toHk;jyKygw,f/ FirstThunk uawmh uRefawmfwdkU import vkyfzdkU
vdktyfwJh API awG&JUtrnfeJU ywfoufwJh pointer awGyg0ifwJh array wpfckjzpfygw,f/ wu,fvdkU ul;wif
vdkufwJh process [m rSefuefpGm tvkyfvkyfEdkifjyDqdk&ifawmh FirstThunk eJUqdkifwJh pointer awGtm;vHk;[m
tcef;(14) - IAT ESifh API Redirection - 201 -
API awG&JU address awGeJU overwrite vkyfwmcH&jyD; 'D address awGudkawmh IAT vdkUac:ygw,f/ y&dk*&rfu
CALL awGtm;vHk;[m IAT &Sd&mqD redirect vkyfjcif;cH&ygw,f/ Loader u IAT tjzpfa&;om;xm;wJh
address awGjzpfEdkifwmuawmh -
(1) API &JU wu,fh address?
(2) API qD jump vkyfrI?
(3) push RVA API
Info: : Import table udk tjynfht0rSefuefapEdkifzdkUtwGuf -
(1) RVA eJU import table wdkU&JUt&G,ftpm;[m import awGtwGuf data directory twGif; owfrSwf
xnfhoGif;zdkUvdkygw,f/ 'grSr[kwf&ifawmh Windows [m olUudkr&SmEdkifjzpfjyD; IAT udk taMumif;Mum;EdkifrSm
r[kwfygbl;/
(2) DLL toD;oD;udk IMAGE_IMPORT_DESCRIPTOR wpfckeJUaMunmyg/ Import table udk
vHk;0bmrSr&SdwJhwpfckeJUtqHk;owfyg/
(3) IMAGE_IMPORT_DESCRIPTOR rSm OriginalFirstThunk? FirstThunk eJU Name wdkUaumif;pGm
&Sdygap/ TimeDateStamp eJU ForwarderChain wdkUuawmh okntjzpfxm;vJ&ygw,f/ OriginalFirst
Thunk udkvJ okntjzpfxm;Edkifygw,f/
oDtkd&DawGudk qufwdkuf&Sif;jyvmwJhtwGuf oifhtaeeJU &IyfaxG;aeavmufjyDvdkU xifygw,f/ 'gaMumifh
ydkjyD;em;vnfEdkifapzdkU ReverseMe.exe eJUwGJMunfhvdkufMu&atmif/ ReverseMe.exe udk Olly rSm zGifhxm;yg/
Windows loader u yxrqHk;zwfwmuawmh y&dk*&rf&JU header udkyg/ IAT udkwnfaqmufzdkU
twGuf RVA 3C (400000 +3C = 40003C) ae&mrSmzwfwmyg/ yHk(8)/
yHk(8)
yHk(8)t&qdk&ifawmh PE header &Sd&mae&m[m VA 004000C0 jzpfygw,f/ VA 004000C0 &Sd&mudk
oGm;vdkuf&ifawmh yHk(9)twdkif; jrif&rSmjzpfygw,f/
yHk(9)
IAT &JU RVA wefzdk;udkawmh PE header &Sd&m&JU address wefzdk;rSm 80h aygif;jyD; &&SdvmwJhwefzdk;
VA 400140 ae&mrSm odrf;xm;jcif;jzpfygw,f/ (exe wdkif;twGuf 'Dae&mrSmtjrJ &Sdygw,f/) yHk(10)/
yHk(10)
yHk(10)t&qdk&ifawmh import table &Sdwmuawmh RVA 2050 rSmyg/
Info: : Import Table Address qdkwmuawmh import table &Sd&mae&mudk &Sm&r,fh address yg/ 'gudk IAT
eJU ra&maxG;apygeJU/ olwdkUESpcf k[m vHk;0uGJjym;jcm;em;ygw,f/
tcef;(14) - IAT ESifh API Redirection - 202 -
rSwf&ef/ / Import Table Address udk Olly rSm&Smwmuawmh bmjyóemrSr&Sdygbl;/ Olly [m header
eJUywfoufjyD;tcsuftvuf tjynfhtpHkudkay;ygw,f/ wu,fwrf; oifhtaeeJU vkyf&rSmuvJ Import Table
Address udk&SmzdkUyg/ bmyJjzpfjzpf tajccHudkodxm;jyD; udk,fbmvkyfaew,fqdkwmudk odxm;wm taumif;qHk;
vdkU uRefawmfhtaeeJUjrifwJhtwGuf tao;pdwf&Sif;jyae&wmyg/
aumif;jyD; Import Table Address &Sd&mudkMunfhvdkufMu&atmif/ yHk(11)/
yHk(11)
uRefawmfwdkUtapmydkif;u &SmawGUxm;wJh IAT awG&Sd&maemufrSm Import Table Address &Sad ewm
awGY&ygw,f/ Disassembler window &JU VA 00402050 udkoGm;vdkufyg/ yHk(12)/
yHk(12)
yHk(12)rSmjrif&wmuawmh uRefawmfwdkUtwGuf bmrSxl;jcm;rIrjzpfapygbl;/ Analyze This! udka&G;jyD;
analyze vkyfvdkufyg/ yHk(13)/
yHk(13)
yHk(13)rSmjrif&wmuawmh IMAGE_IMPORT_DESCRIPTOR array &Sd&mtydkif;jzpfygw,f/ yxr
eJU 'kwd,uawmh DLL toD;oD;twGuf IMAGE_IMPORT_DESCRIPTOR awGjzpfygw,f/ wwd,
ajrmufuawmh tqHk;owf IMAGE_IMPORT_DESCRIPTOR jzpfygw,f/ IMAGE_IMPORT_
DESCRIPTOR wdkif;rSm DWORD wefzdk; 5ckpD&SdMuygw,f/
yHk(13)rSmawGU&wJh yxrqHk; DWORD (00002098) uawmh OriginalFirstThunk jzpfygw,f/
ol[m loader udk vuf&Sd DLL uae import vkyfcH&r,fh API awG&JUtrnfawGudk b,fae&mrSm&Smr,fqdkwJh
tcsuftvufawGay;ygw,f/ wu,fvdkU IMAGE_BASE + 2098 &Sd&mudkoGm;cJhr,fqdk&if uRefawmfwdkU
taeeJU import vkyfr,fh API trnfawGudk awGUrSmyg/ (aemufydkif;wGifMunfhyg/)
'kwd, DWORD (00000000) uawmh TimeDateStamp jzpfjyD; uRefawmfwdkUtwGuf vHk;0toHk;
r0ifygbl;/ rsm;aomtm;jzifhawmh tm;vHk;[m oknawGjzpfaewwfygw,f/
wwd, DWORD (00000000) uawmh ForwarderChain jzpfjyD; uRefawmfwdkUtwGuf vHk;0toHk;
r0ifygbl;/ rsm;aomtm;jzifhawmh tm;vHk;[m oknawGjzpfaewwfygw,f/
pwkw¬ DWORD (000021D8) uawmh IMAGE_IMPORT_DESCRIPTOR eJUoufqdkifwJh
DLL &JUtrnf&Sd&m RVA jzpfygw,f/ uRefawmfwdkU&JU erlemy&dk*&rfrSmawmh 4021D8 rSm user32.dll
&SdwmawGUrSmyg/ (rMumcifawGUrSmyg/)
aemufqHk; DWORD (0000200C) uawmh FirstThunk jzpfygw,f/ Import vkyfxm;wJh function
awGtm;vHk;twGuf address awGtm;vHk;udk &SmEdkifzdkUtwGuf IAT &Sd&mudk nTefjyygw,f/ (Disk ay:rSm
r[kwfayr,fh wpfMudrfrSm exe zdkifudk rSwfOmPfxJ ul;wifjyD;csdefrSmawmh [kwfygw,f/)
uRefawmfwdkU&JU erlemy&dk*&rfrSmawmh oifhtaeeJU user32.dll uae import vkyfxm;wJh API awGt
wGuf IAT xJrSm&SdwJh address awGtm;vHk;udk vG,fulpGm&SmEdkifygw,f/ yHk(14)udkMunfhyg/ 40200C uaepwm
awGU&ygr,f/
tcef;(14) - IAT ESifh API Redirection - 203 -
yHk(14)
yHk(14)t&qdk&ifawmh API function 16ckudk vkyfxm;aMumif; awGU&ygw,f/ bmaMumifhajymEdkifwmvJ
qdkawmh 7xxxxxxx eJUpwJh address 16ckawGU&vdkUyg/ 'kwd,ajrmuf DLL (kernel32.dll) twGufvJ 'Denf;
twdkif;ygyJ/
yHk(15)
IAT xJrSm&SdwJh address awG[m yHk(16)twdkif; 402000 uaepwm awGU&ygr,f/
yHk(16)
aemufqHk;wpfck&JU DWORD wefzdk;5ckvHk;uawmh oknawGcsnf;jzpfaewm owdjyKrdrSmyg/ yHk(17)/
yHk(17)
Dump window rSmMunfhvdkuf&ifawmh yHk(18)twdkif; awGU&ygr,f/
yHk(18)
Import table &JU 'kwd,ydkif;uawmh DWORD awG&JU array awGjzpfygw,f/ yHk(19)/
yHk(19)
DWORD awG&JU array awGudkawmh IMAGE_IMPORT_DESCRIPTOR awG&JU OriginalFirst
Thunk awGu point vkyfwmjzpfygw,f/ 'D array awG&JU DWORD toD;oD;[m import vkyfxm;wJh
function wpfckeJU oufqdkifygw,f/ DWORD awG&JU array awGudk ydkif;jcm;xm;wm? tqHk;owfxm;wm
uawmh oknawGeJUjynfhaewJh DWORD wpfckujzpfygw,f/
yHk(20)rSmjrif&wmuawmh import table &JU wwd,ydkif;(aemufqHk;ydkif;)jzpfygw,f/
yHk(20)
tcef;(14) - IAT ESifh API Redirection - 204 -
yHk(21)
wu,fawmh uk'fxJrSmvJ oyf&yfaumif;rGefpGmwnfaqmufxm;wJh IAT udkawGUEdkifygw,f/ yHk(22)/
yHk(22)
yHk(22)udkMunfhvdkufr,fqdk&if kernel32.dll uae import vkyfxm;wJh API ESpfckeJU user32.dll uae
import vkyfxm;wJh API awGMum;rSm DWORD wefzdk;wpfckeJU ydkif;jcm;xm;jyD; tqHk;rSmawmh oknawGeJU
DWORD wefzdk;wpfcku ydkif;jcm;xm;wmawGU&ygw,f/
yHk(23)
yHk(23)udkMunfhyg/ Import vkyfxm;wJh function awGtm;vHk;&JUtrnfaemufrSm DLL trnfawGeJU
tqHk;owfxm;wm awGU&rSmyg/
'Davmufqdk&if import awGudk udk,fwdkifjyefwnfaqmufzdkU todynmvHkavmufjyDvdkU xifygw,f/
bmyJjzpfjzpf owif;aumif;wpfckuawmh import awGudk tvdktavsmufjyefwnfaqmufay;EdkifwJh tool aumif;
awG&Sdw,fqdkwJhtcsufyg/ wu,fawmh aqmhzf0JvfawGu DLL ajrmufjrm;pGmuae API awG tajrmuftjrm;ukd
import vkyfxm;cJhr,fqdk&if import awGudk udk,fwdkifjyefvnfwnfaqmuf&wm[m tcsdeftawmfMum,l&jyD;
pdwf&Iyfp&mvJaumif;vSygw,f/ Tool awGudk toHk;jyKr,fqdk&ifawmh uRefawmfwdkUtaeeJU API tm;vHk;eD;yg;udk
jyef recover vkyfEdkifrSmyg/ ckodxm;wJhtodeJU unpack vkyfxm;wJhzdkiftcsdKUudk b,fvdkjyifMurvJqdkwm
MunfhvdkufMu&atmif/
aumif;jyD FSG2.0 eJU pack vkyfxm;wJhzdkifwpfckudk unpack vkyfMunfhygr,f/ (oifhtaeeJU 'Dzdkifudk
unpack vkyfcsifw,fqdk&ifawmh Lena151 &JU oifcef;pm(21)udk download vkyf,lyg/ 'grSr[kwf&ifawmh
ESpfouf&m zdkifwpfckudk FSG eJU pack vkyfMunfhvdkufyg/ oabmw&m;csif;uawmh twlwlygyJ/)
yHk(24)
tcef;(14) - IAT ESifh API Redirection - 205 -
yHk(25)
yHk(25)twdkif; VA 004001D1 ae&mrSm breakpoint owfrSwfMunfhvdkuf&atmif/ jyD;&if F9 (Run)
udkESdyfvdkufyg/ Breakpoint &Sd&ma&mufvmygvdrfhr,f/ yHk(26)/
yHk(26)
yHk(26)rSmjrif&wJhtwdkif; JMP [m y&dk*&rf&JU OEP (VA 00404000) &Sd&mqD jump vkyfrSmjzpfygw,f/
yHk(27)/
yHk(27)
yHk(27)rSm right-click ESdyfjyD; Analysis u Remove analysis from module udka&G;vdkuf&if
yHk(28)twdkif; awGU&rSmyg/
yHk(28)
yHk(28)twdkif;jrif&&ifawmh uRefawmfwdkU&JU zdkifudk dump vkyfygr,f/ Right-click ESdyfjyD; Dump
debugged process udka&G;vdkufyg/ yHk(29)twdkif; jrif&ygr,f/
uRefawmfwdkUtaeeJU yHkrSefenf;vrf;twdkif; dump vkyfvdkU&ygw,f/ bmyJjzpfjzpf yHk(29)rSmawmh
"Rebuild Import" udk uncheck vkyfzdkUawmh vdkygvdrfhr,f/ bmaMumifhygvJ/ FSG [m import awGudk
zsufypfvdkufwmjzpfjyD; Ollydump plugin u vHk;vHk;MuD; wvGJwacsmfvkyfrSmrdkUvdkUyg/ 'gaMumifh uRefawmfwdkU
taeeJU jyefjyifwmtcsdKUawmh vkyf&ygvdrfhr,f/ oifhtaeeJU checkbox udka&G;ay;vdkUawmh &ygw,f/ 'gayr,fh
dump zdkifu tvkyfvkyfrSmawmh r[kwfygbl;/ wu,fvdkU xJxJ0if0ifavhvmjyD;wJhaemufrSmawmh 'gudk&Sif;oGm;
rSmyg/
tcef;(14) - IAT ESifh API Redirection - 206 -
yHk(29)
yHk(29)u "Rebuild Import" checkbox udkjzKwfvdkufjyD; Dump button udka&G;yg/ jyD;&if dump.exe
trnfeJU zdkifudkodrf;qnf;vdkufyg/
wu,fawmh tjcm; tool awGeJUvJ dump vkyfvdkU&ygw,f/ Oyrm - LordPE? PE Tools/ yHk(30)/
yHk(30)
bmyJjzpfjzpf dump vkyfxm;wJhzdkifESpfckpvHk;uawmh tvkyfvkyfrSmr[kwfygbl;/ bmaMumifhvJqdkawmh
FSG u import awGudk zsufxm;vdkUyg/ 'gaMumifhrdkU import awGjyefwnfaqmufzdkU vdkvmygjyD/ Import
awGudk jyefwnfaqmufEdkifwJh tool awGtrsm;MuD;&Sdayr,fh uRefawmfhtaeeJU ImpRec 1.7 udkyJ oHk;ygr,f/
ImpRec udkzGifhjyD; process (UnpackMe_FSG2.0.exe) udk attach vkyfyg/
yHk(31)
UnpackMe_FSG2.0.exe zdkifudk attach vkyfjyD;csdefrSmawmh OEP wefzdk;udkjyifzdkUvdkygw,f/ ImpRec
u vuf&Sd process &JU EP udkyJodxm;ygw,f/ 'gaMumifh OEP ae&mrSm 4000 vdkUjyifvdkufyg/ jyD;&ifawmh
AutoSearch button ukda&G;vdkufyg/
yHk(32)
IAT &dS&mudk&Smwmawmh tqifajyygjyD/ yHk(31)u RVA ae&mrSm 11E8 udkxm;jyD; dump vkyfr,f
qdk&ifawmh oihf&JUjyifxm;wJh dump zdkif[m tvkyfvkyfrSmr[kwfygbl;/ uRefawmf'gudkb,fvdkodvJvdkU oifhtae
eJUxifaumif;xifygvdrfhr,f/ wu,fawmh prf;oyfjyD;oGm;vdkUyg/ RVA udk tao;pdwfavhvmMunfhvdkufMu
&atmif/ Olly &JU dump window rSm 4011E8 vdkU&dkufxnfhjyD; bmawGU&rvJqdkwmMunfhvdkufMu&atmif/
yHk(33)/
tcef;(14) - IAT ESifh API Redirection - 207 -
yHk(33)
wu,fawmh VA 4011E8 rSm&SdwmawGuawmh DLL wpfck&JU import awGyg/ tay:udk scroll
enf;enf;qGJjyD;Munfhvdkuf&if aemufxyf import awGudkawGU&OD;rSmyg/ yHk(34)/
yHk(34)
uRefawmfwdkUtaeeJU DLL (user32.dll/kernel32.dll) zdkifESpfck&JU import awGudk&Sd&m&SmzdkUyJvkdwmyg/
VA 4011E8 qdk&if DLL (kernel32.dll) zdkifwpfck&JU import (API) awGudkyJ ImpRec u&SmawGUrSmyg/ ☺☺
wu,fawmh ImpRec [m tvSnfhpm;cHvdkuf&wmyg/ 'gaMumifhrdkU VA 4011E8 ae&mrSm VA 401198 vdkU
jyifzdkUvdktyfygw,f/ 'grSom ImpRec u user32.dll zdkif&JU import awGudk &SmawGUrSmyg/
yHk(35)
yHk(35)twdkif; RVA udkjyifvdkufjyD; Get Imports button udkESdyfvdkuf&if yHk(36)twdkif; awGU&ygr,f/
(Size udkvJ 100 vdkUjyifvdkuf&if ydkaumif;ygr,f/ 'grSom ImpRec uydkjyD;pdppfEdkifrSmyg/)
yHk(36)
ImpRec u Thunk ESpfckudk awGUygw,f/ bmyJjzpfjzpf ESpfckpvHk;[m rSm;aeygw,f/ bmawGrSm;ae
w,fqdkwmod&atmif taygif;oauFwav;udka&G;vdkufyg/ rSm;aewJhae&mawGuawmh RVA 2118 rSmyg/
yHk(34)udkjyefMunfhvdkuf&if RVA 2118 rSm FFFFFFFF udkawGUrSmyg/ aemufwpfckuawmh RVA 11B8 rSmyg/
yHk(37)/
yHk(37)
tcef;(14) - IAT ESifh API Redirection - 208 -
yHk(38)
yHk(38)twdkif; rvdkwJh thunk awGrSm right-click ESdyfjyD; Cut thunk(s) udka&G;vdkufyg/ jyD;&if
aemufqHk;vkyf&rSmuawmh dump vkyfxm;wJhzdkifudk jyifzdkUyg/
yHk(39)
yHk(39)u Fix Dump button udkESdyfjyD; Olly rSm dump vkyfjyD;odrf;xm;wJh dump.exe zdkifudka&G;ay;yg/
ImpRec u dump_.exe qdkwJhtrnfeJUzdkifudk odrf;ay;ygvdrfhr,f/ yHk(40)/
yHk(40)
dump_.exe zdkifudkzGifhvdkuf&ifawmh yHk(41)twdkif; awGU&rSmyg/
yHk(41)
dump_.exe zdkifudk Olly rSmzGifhjyD;Munfhvdkuf&if yHk(42)twdkif; jrif&ygvdrfhr,f/
yHk(42)
tcef;(14) - IAT ESifh API Redirection - 209 -
yHk(43)
yHk(44)
yHk(45)
yHk(46)
yHk(47)
yHk(48)
tcef;(14) - IAT ESifh API Redirection - 210 -
yHk(49)
yHk(50)
yHk(51)
yHk(52)
tcef;(14) - IAT ESifh API Redirection - 211 -
yHk(53)
yHk(54)
yHk(55)
INFO: : wu,fawmh y&dk*&rf run aecsdefrSom unpacking stub u
yHk(56)
yHk(57)
INFO: : y&dk*&rfwpfck[m exe xJu import awGtm;vHk;udk&,lEdkifzdkUtwGuf
HINSTANCE LoadLibrary (
LPCTSTR lpLibFileName
);
FARPROC GetProcAddress(
HMODULE hModule,
LPCSTR lpProcName
);
tcef;(14) - IAT ESifh API Redirection - 212 -
yHk(58)
yHk(59)
yHk(60)
yHk(61)
☺☺☺
yHk(62)
INFO: : yHk(60)udkMunfh&if VA 0043803C rSm
yHk(63)
tcef;(14) - IAT ESifh API Redirection - 213 -
yHk(64)
yHk(65)
yHk(66)
yHk(67)
INFO: : VirtualProtect() function [m ac:,ltoHk;jyKaewJh
yHk(68)
tcef;(14) - IAT ESifh API Redirection - 214 -
yHk(69)
yHk(70)
yHk(71)
yHk(72)
yHk(73)
tcef;(14) - IAT ESifh API Redirection - 215 -
yHk(74)
yHk(75)
yHk(76)
☺☺☺
yHk(77)
tcef;(14) - IAT ESifh API Redirection - 216 -
yHk(78)
yHk(79)
yHk(80)
yHk(81)
tcef;(14) - IAT ESifh API Redirection - 217 -
yHk(82)
yHk(83)
tcef;(14) - IAT ESifh API Redirection - 218 -
tcef;(14) - IAT ESifh API Redirection - 219 -
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 220 -
yHk(1)
yHk(2)
xyfajym&&if uRefawmfhtaeeJU y&dk*&rfawGudkzGifh&if 'Dy&dk*&rfukd bmeJUa&;xm;ovJ^bmeJU pack vkyf
xm;ovJqdkwmod&atmif PEiD eJU yxrqHk; zGifhavh&Sdygw,f/ (oifhtaeeJU RDG Packer (odkU) CFF
Explorer wdkUeJUvJ zGifhEdkifygw,f/)
yHk(1)rSm highlight taeeJUjrif&wmuawmh y&dk*&rf&JU EP yg/ yHk(2)uawmh 'Dy&dk*&rfudk Visual Basic
eJU a&;xm;aMumif;jywmyg/ tck uRefawmfajymcsifwmuawmh Visual Basic taMumif;yg/
INFO: : Visual Basic qdkwm DOS acwfpm;wkef;u ay:cJhwJh BASIC bmompum;uae ay:xGufvmwJh
high-level languagewpfckyg/ BASIC &JU t&Snfaumufuawmh Beginners' All-purpose Symbolic
Instruction Code jzpfygw,f/ Visual Basic [m visual jzpfjyD; events driven y&dk*&rfbmompum;vJ
jzpfygw,f/ y&dk*&rfa&;om;jcif;udkvJ visual environment rSmwif vkyfEdkifygw,f/ y&dk*&rfrmawG[m object
awGudk MudKufovdk click Edkifygw,f/ vkyfaqmifcsuf(event)awGudk wkefUjyefUzdkU&mtwGuf object toD;oD;udk
oyfoyfa&;om;&ygw,f/ 'gaMumifhrdkUvJ Visual Basic y&dk*&rf[m subprogram ajrmufjrm;pGmeJU zGJUpnf;xm;
jcif; jzpfygw,f/ Subprogram wpfckpDrSm olwdkU&JU udk,fydkifuk'fawG &Sdygw,f/ Subprogram awG[m oD;jcm;pD
tvkyfvkyfEdkifygw,f/ jyD;&if wpfcsdefwnf;rSmyJ olwdkUawG[m tcsif;csif; csdwfquftoHk;jyKEdkifygw,f/
INFO: : Visual Basic application awG[m jynfhpHkpGm compiled vkyfxm;wJh application awG jzpfayr,fhvJ
olwdkU&JU tjyKtrlawGu OllyDbg &JU tvkyfawGudk &IyfaxG;apygw,f/ OllyDbg [m compiled language
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 221 -
yHk(3)
INFO: : DLL (dynamic link library) [m y&dk*&rfi,fav;awGudk pkpnf;xm;jcif; jzpfygw,f/ olwdkUudk
y&dk*&rfwpfck tvkyfvkyfaecsdefrSm tJ'Dy&dk*&rfu vdktyfwJhtcsdefrSm ac:oHk;ygw,f/ rsm;aomtm;jzifhawmh exe
zdkifawGudk device awGeJU csdwfqufEdkifapygw,f/ (Oyrm - print xkwfcsifwJhtcsdefrSm printer eJU csdwfqufay;
ygw,f/)
INFO: : Oyrmwpfckjy&if oifh&JU harddisk rSm ae&mvGwfvdktyfwJhtcsdefrSmyg/ y&dk*&rfawG[m parameter
awGtjynfhyg&SdwJh function eJU call function yg0ifwJh DLL zdkifudk ac:,loHk;pGJEdkifygw,f/ DLL zdkifxJrSmyg
0ifwJh function awGudk xyfa&;p&mrvdktyfawmhwJhtwGuf exe zdkifawG[m zdkift&G,ftpm; ao;i,faewmyg/
INFO: : DLL zdkifawG[m exe zdkifawGeJU twl RAM xJudk ul;wifp&mrvdkwJhtwGuf RAM rSm ae&macR
wmEdkifygw,f/ DLL udkvdktyfvdkU ac:oHk;rSom RAM ay:a&mufvmrSm jzpfygw,f/ Oyrmjy&r,fqdk&if
oifhtaeeJU Microsoft Word rSm pmpDpm&dkuf vkyfaewJhtcsdefrSm printer eJU ywfoufwJh DLL zdkif[m tvkyf
vkyfrSm r[kwfygbl;/ Print xkwfwJhtcsdefrSom printer eJU ywfoufwJh DLL zdkifudk ac:,loHk;pGJrSmyg/
INFO: : jcHKMunhf&&ifawmh DLL qdkwm executable zdkifwpfckjzpfygw,f/ 'gayr,fh olUwpfzdkifwnf;qdk&if
awmh bmtvkyfrS rvkyfygbl;/ EXE zdkifawGu ac:oHk;rSom tvkyfvkyfygw,f/ 'gaMumifh exe zdkifawGrSm b,f
DLL udk oHk;pGJrvJqdkwm parameter awGeJU aMunmay;zdkU vdktyfygw,f/
ckcsdefrSmawmh oifhtaeeJU VB [m udkifwG,fzdkU&m tvGefcufcJvSr,fh bmompum;vdkU xifaumif;xif
aeygvdrfhr,f/ wu,fawmh oifxifaewm vGJaeygw,f/ uRefawmfwdkUrSm tvGeftoHk;0ifvSwJh tool awG&Sdyg
w,f/ aemufydkif;rSm 'gudk&Sif;jyygr,f/ bmyJjzpfjzpf Olly udk VB eJU ywfoufjyD; bmrS toHk;r0ifbl;vdkUawmh
rxifvdkufygeJU/ wu,fwrf;rSmawmh bmompum;toD;oD;[m assembly tjzpf translate tvkyfcH&wmygyJ/
tck y&dk*&rf&JU oabmobm0udk aqG;aEG;ygr,f/ uRefawmfhtaeeJU y&dk*&rfeJUywfoufjyD; rSwfcsufjyK
xm;wmuawmh ... y&dk*&rfudk install vkyfjyD; yxrqHk;tMudrf y&dk*&rfpwifcsdefrSm y&dk*&rf[m oifhuGefysLwm
twGuf vdktyfwmawGudkwGufcsufjyD; key wpfckudk twdtusowfrSwfvdkufygw,f/ 'g[m rlrrSefayr,fh
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 222 -
uRefawmfwdkUudk tawmfav;aumif;wJh hint udk ay;ygw,f/ qdkvdkwmu y&dk*&rf[m uk'fudk wpfckckuae owf
rSwfvdkufygw,f/ (Oyrm - harddisk ID) jyD;&if 'Duk'fudk wpfae&m&mrSm odrf;ygvdrfhr,f/ 'grSom y&dk*&rfudk
pwifcsdefrSm register vkyfxm;jcif; &Sd^r&Sd ppfEdkifrSmyg/
(2) Serial udk &SmazGjcif;
y&dk*&rf[m olpwufvmcsif;rSm register vkyfxm;jcif; &Sd^r&Sd ppfaq;zdkU vdkygw,f/ VB rSmawmh
DLL xJu API rSm jyKvkyfMuygw,f/ 'Dae&mrSm ta&;MuD;wmawGuawmh ...
(1) __vbaVarTstEq
(2) __vbaVarTstNe
(3) __vbaVarCmpEq
(4) __vbaStrCmp
(5) __vbaStrComp
(6) __vbaStCompVar
trSwfpOf(1?2?3)udkawmh ydkjyD; toHk;rsm;ygw,f/ 'gaMumifh yxrqHk; API jzpfwJh __vbaVarTstEq udk
prf;MunfhvdkufMu&atmif/
yHk(4)
ck yHk(4)rSm jrifae&wmuawmh entry point ae&myg/ Name module udk jrif&zdkU Ctrl+N udk
ESdyfvdkufyg/ yHk(5)/ jyD;&if &Sm&wmydkjrefatmifvdkU keyboard uae vbavartst vdkU &dkufvdkufyg/ vbaVarTstEq
&Sd&mqD wef;a&mufvmygvdrfhr,f/
yHk(5)
yHk(5)udk Munfhr,fqdk&if uRefawmfwdkU&SmaewJh API awG[m MSVBVM60.dll zdkifxJrSm&Sdaewm
owdjyKrdrSmyg/ vbaVarTstEq udk BP owfrSwfMuygr,f/ vbaVarTstEq udk right-click ESdyfjyD; Set
breakpoint on every reference udk a&G;vdkufyg/ Olly u breakpoint 88 ckawmif owfrSwfvdkufygw,f/
yHk(6)
jyD;&if run (F9) udk ESdyfyg/
yHk(7)
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 223 -
yHk(8)
VA 005BBD58 u CMP DI,SI [m pdwf0ifpm;zdkU aumif;ygw,f/ 'gayr,fh bmqufjzpfrvJqdkwm
od&atmif jump vkyfMunfhygr,f/
yHk(9)
yHk(9)u VA 005BBFC0 rSm jrif&wJh oeiu-564-oqei-97 [m uRefawmfwdkU &SmaewJh serial vm;vdkU
oHo,&Sdygw,f/ enf;enf;avmuf qufMunfhygr,f/ yHk(10)/
yHk(10)
oeiu-564-oqei-97 udk prf;MunfhvdkufMu&atmif/ Breakpoint awGtm;vHk;udk yxrqHk; z,f&Sm;vdkuf
yg/ (Ctrl + N udkESdyfjyD; Remove all breakpoints udk a&G;yg/)
(3) Register jyKvkyfjcif;
Breakpoint tm;vHk;udk z,f&Sm;jyD; y&dk*&rfudk run (F9) vdkufyg/ yHk(11)twdkif; jrif&ygr,f/
yHk(11)
yHk(11)rSm register vkyfzdkUtwGuf trnfrawmif;ygbl;/ wduswJh key wpfckom vkdygw,f/ 'D key udk
y&dk*&rf install pvkyfwkef;uwnf;u wGufcsufowfrSwfjyD; jzpfygw,f/ Register vkyfMunfhygr,f/
yHk(12)
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 224 -
yHk(13)
yHk(13)twdkif; registration atmifjrifaMumif; jrif&ygw,f/ 'gudkb,fvdkxifygovJ/ y&dk*&rfudkydwfjyD;
jyefpMunfhvdkufMu&atmif/
(4) Registration tm; prf;oyfjcif;
y&dk*&rfudk jyefpzdkU Olly rSm Ctrl+F2 udk ESdyfvdkufyg/ jyD;&if F9 udk ESdyfyg/ 'Dwpfcg y&dk*&rfwufvm
csdefrSm bm nagscreen udkrS rjrif&awmhygbl;/ Help menu u About udk a&G;vdkufawmhvJ tqifajyoGm;
ygjyD/ yHk(14)/
yHk(14)
'gaMumifh 'Dy&dk*&rfudk SmartCheck rSm ppfaq;MunfhMu&atmif/
(5) SmartCheck \ setting tm; jyifjcif;
'Dwpfcgawmh Numega &JU SmartCheck udk prf;MunfhMuygr,f/ SmartCheck udk VB y&dk*&rfawG
crack vkyfzdkUeJU debug vkyfzdkU txl;jyKvkyfxm;wmyg/ 'gayr,fh olU&JU setting tcsdKUudkawmh tenf;i,f jyif
ay;&ygr,f/ SmartCheck rSm PC to Answering Machine 2.0.8.2 udk zGifhvdkufyg/ zGifhjyD;oGm;&if
Program menu u Settings ... udk a&G;vdkufyg/ yHk(15)/
yHk(15)
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 225 -
yHk(15)u Leaks udk uncheck vkyfvdkufyg/ Save these settings ... udk a&G;yg/ jyD;&if Advanced
udk a&G;vdkufyg/
yHk(16)
yHk(16)rSm jrif&wJhtwdkif; a&G;ay;yg/
yHk(17)
aemufqHk;a&G;ay;&rSmu yHk(17)twdkif; jzpfygw,f/ 'gqdk setting udk jyifqifwJhtydkif; jyD;ygjyD/ PC to
Answering Machine 2.0.8.2 udk SmartCheck rSm run Munhfygr,f/ Run jyD;oGm;wJhtcg View menu
uae Event Summary udk a&G;vdkufyg/ yHk(18)/
yHk(18)
Event Summary window u uRefawmfwdkUudk toHk;0ifwJh tcsuftvufawG ay;ygw,f/
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 226 -
yHk(19)
View menu u Specific Events u uRefawmfwdkUudk ESpfouf&m events udkyJjyozdkU a&G;cs,fcGifh
ay;xm;ygw,f/
yHk(20)
yHk(20)udk owdxm;rdygovm;/ Sequence Numbers udk uRefawmf a&G;xm;ygw,f/ 'gav;[m
awmfawmfav; toHk;0ifvSygw,f/ aemufydkif;rSm uk'fawG axmifeJUcsDjyD; Munfhp&m rvdkatmif tultnDay;wm
awGU&ygvdrfhr,f/
wu,fvdkU uk'fawGtm;vHk;udk Munfhcsifw,fqdk&ifawmh View menu u Show All Events udk
a&G;vdkufyg/
(6) SmartCheck wGif serial udk &Smjcif;
uRefawmfwdkUtaeeJU SmartCheck &JU setting udkvJ jyifjyD;jyDqdkawmh serial &Smjcif;tvkyfudk pwif
vdkufMu&atmif/ Event awGudk MunfhvdkufwJhtcgrSm uRefawmfwdkUtwGuf toHk;r0ifwJhuk'fawGu rsm;aewm
awGU&ygw,f/ yHk(21)twdkif; atmufudk enf;enf;av; scroll qGJjyD; MunfhvdkufMu&atmif/
yHk(21)
wu,fhuk'f pwifwmuawmh yHk(21)rSmyg/
yHk(22)
yHk(22)udkMunfhvdkuf&if event aygif; 24734 awmif &SdwmawGU&ygw,f/ uawmh end program
yg/ 'gomrESdyfxm;bl;qdk&ifawmh event aygif; 1.5 oef;avmufawmif xGufvmygvdrfhr,f/ avmavmq,f
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 227 -
yHk(23)
yHk(23)u pmaMumif;eHygwfudk Munhfr,fqdk&if pmaMumif;awG tukefrjyao;wm owdxm;rdrSmyg/ 'gu
bmvdkUvJqdkawmh uRefawmfwdkUu Show Errors and Specific Events udkyJ a&G;xm;vdkUyg/
yHk(24)
Show Errors and Specific Events udk a&G;vdkufr,fqdk&if yHk(24)twdkif; jrif&rSmyg/ uRefawmfwdkU
odxm;wmu y&dk*&rf pwifwifjcif;rSm wduswJh key wpfckudk ppfw,fqdkwmudkyg/ 'gudk &dk;&dk;av;yJ API
ae&mrSm &SmMunfhvdkuf&atmif/ yHk(25)/
yHk(25)
yHk(25)twdkif; &Smr,fqdk&if yHk(26)twdkif; awGUrSmyg/
yHk(26)
yHk(26)rSm jrif&wJhtwdkif; yxrqHk;awGUwJh API udk a&mufvmygw,f/ 'Dae&mrSm uRefawmfwdkUtaeeJU
API awGudk tao;pdwfavhvmrSm r[kwfygbl;/ aemufydkif;usrSyJ avhvmygr,f/ oHo,0ifp&maumif;wmu
pmaMumif;a& 3825 rSmyg/
yHk(27)
'gaMumifh tao;pdwf MunfhvdkU&atmif taygif;&kyfav;udk ESdyfjyD; Munfhygw,f/ 'gayr,fh bmrSrxl;
jcm;ygbl;/ pmaMumif;a& 3825 udk ESpfcsufESdyfjyD; Details window rSm MunfhwJhtcgrSmawmh yHk(28)twdkif;
jrif&ygw,f/
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 228 -
yHk(28)
yHk(28)rSm jrif&wmuawmh uRefawmfwdkU &SmaewJh serial yg/ SmartCheck [m omref registration
key udk &SmwJhae&mrSmawmh tvGefvG,fulvSaMumif;awGY&ygw,f/
INFO: : tcsdKU VB y&dk*&rfawGrSm anti-SmartCheck enf;awG xnfhoGif;xm;wmawGU&ygw,f/ olwdkUawG
[m rsm;aomtm;jzifh NuMega SmartCheck qdkwJh pmom;udk ppfaq;wm jzpfygw,f/ uRefawmfhqDrSmawmh
'Djyóemr&Sdygbl;/ bmvdkUvJqdkawmh uRefawmfu Repair 0.6 udkoHk;jyD; SmartCheck udk jyifxm;vdkUyg/
tvm;wl usefwJh tool awGudkvJ jyifEdkifygw,f/
'gqdk&if PC to Answering Machine 2.0.8.2 udk crack vkyfwm[matmifjrifpGmeJU jyD;qHk;oGm;ygjyD/
'Dvdkenf;eJU serial &Smwmudk serial fishing vkdUac:ygw,f/ tck uRefawmf&Si;f jycJhwmudk oifhtaeeJU aumif;
aumif;em;vnfao;rSm r[kwfygbl;/ bmaMumifhvJqdkawmh serial fishing enf;[m y&dk*&rfuk'fudk tMurf;zsif;
omavhvmjyD; debugger uxkwfay;wJh serial udkvdkuf&Sm&wmrdkUvdkUjzpfygw,f/ Serial udk ukd,fhbmomudk,f
wGufcsuf,lwm r[kwfvdkUyg/ 'DwpfcgrSmawmh VB y&kd*&rfawGudk tqifhjrifhjrifh crack vkyfMunfhMuygr,f/
Crack vkyfzdkUa&G;xm;wJh y&dk*&rfawGuawmh ReverseMe y&dk*&rfESpfyk'feJU registration enf;eJU umuG,fxm;
wJh freeware y&dk*&rfwpfyk'fjzpfwJh CrackersConvert 1.0 yg/ oifcef;pmudk rzwfcifrSm 'Dy&dk*&rf 3yk'fudk
SND Team &JU website uae download vkyf,lyg/ SND Team &JU tifwmeufvdyfpmudk aemufqufwGJrSm
azmfjyxm;ygw,f/ SND Team &JU download uP²u Lena's Reversing Tutorial - 10 zdkifudk download
vkyf,lyg/ 'DzdkifxJrSm vuf&SduRefawmf&Sif;jyr,fh oifcef;pmeJUtwl y&dk*&rf 3yk'fygvmrSm jzpfygw,f/ tcktcef;
uawmh Lena151 &JU oifcef;pmudk bmomjyefjcif; jzpfygw,f/ Crack vkyf&mrSm vdktyfwJh tool awGuawmh
OllyDebug? SmartCheck? VB Decompiler eJU Veoveo wdkUjzpfygw,f/ VB Decompiler uawmh
freeware jzpfjyD; www.vb-decompiler.org rSm download vkyf,lEdkifygw,f/
aumif;jyD? uRefawmfwdkU&JU crack vkyfjcif;udk pvdkufMu&atmif/
(7) ReverseMe1
yxrqHk; crack vkyfMunfhrSmu ReverseMe1 y&dk*&rfyJ jzpfygw,f/ SmartCheck rSm Tut.Reverse
Me1.exe zdkifudkzGifhjyD; run vdkufyg/ yHk(29)twdkif; jrif&ygr,f/
yHk(29)
yHk(29)rSm jrif&wmuawmh nag screen jzpfygw,f/ 'gudk b,fvdkz,f&Sm;&r,fqdkwm aemufrS
&Sif;jyyghr,f/ yxrqHk;uawmh ReverseMe y&dk*&rfudk b,fvdk register vkyf&rvJqdkwmyJ prf;Munfhygr,f/
yHk(30)
yHk(30)rSm jrif&wJh Form1_Load [m tvGefta&;MuD;ygw,f/ MessageBox [m yHk(1)u nag
screen udk jzpfapw,fqdkwm owdjyKrdygovm;/ Registration vkyfaqmifcsuf[m 'D Form1_Load jyD;&if
vmawmhrSmyg/ yHk(29)u OK udk ESdyfvdkufyg/ yHk(31)twdkif; jrif&ygr,f/
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 229 -
yHk(31)
yHk(31)u Regcode textbox ae&mrSm 123456 vdkU &dkufxnfhMunfhygr,f/ 'gqdk yHk(32)twdkif; jrif&rSm
yg/
yHk(32)
'ghtjyif yHk(30)ae&mrSm yHk(33)twdkif; event topfxyfwdk;vmygw,f/
yHk(33)
uRefawmfwdkUtaeeJU View u Show All Events udk a&G;vdkuf&if event tm;vHk;udk jrif&rSmyg/
Show All Events udk ra&G;cifrSm udk,fMunfhcsifwJh event udk t&ifa&G;xm;ay;&ygr,f/ 'grSr[kwf&if event
awGrsm;vGef;wJhtwGuf udk,f&SmcsifwJh event udk &SmvdkUawGUEdkifrSm r[kwfygbl;/ rsm;aomtm;jzifhawmh xxxxxx_
click vdkU a&;xm;&if xxxxxx [m button &JU trnfudk qdkvdkwm rsm;ygw,f/ y&dk*&rfrmawGuawmh button
awG&JUtrnfudk ajymif;avhr&Sdygbl;/ commandX vdkUyJ xm;xm;avh&Sdygw,f/ X uawmh eHygwfjzpfjyD; wpfu
ae pwifavh&Sdygw,f/
yHk(33)u Command1_Click ae&mrSm serial rSef^rrSefppfwmudk em;vnfygovm;/ 'gaMumifh 'Dae
&mudk aoaocsmcsmMunhfvdkufMu&atmif/ avmavmq,fawmh Tut.ReverseMe1.exe y&dk*&rfudk rvdkawmhwJh
twGuf cPydwfxm;vdkufMu&atmif/ pum;rpyfajym&&if yHk(33)u uRefawmfwdkUjrifae&wm[m event tusOf;
csKyfrQom jzpfygw,f/
yHk(33)u Command1_Click &JU b,fzufu taygif;t&kyfav;udk ESdyfvdkufyg/ yHk(34)/
yHk(34)
yHk(34)uvJ uRefawmfwdkUudk vHkavmufwJhtcsuftvufawG ray;ygbl;/ MsgBox qdkwJhpmom;udk a&G;
vdkuf&ifawmh yHk(35)twdkif; jrif&rSmyg/
yHk(35)
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 230 -
yHk(36)
wu,fawmh bmrSrcufygbl;/ uRefawmfwdkUtaeeJU tm;vHk;udk jrifae&ygw,f/
__vbaStrCmp udk string awG EdIif;,SOfzdkUtwGuf oHk;ygw,f/
Oyrm/ / __vbaStrCmp(String: "xxxxxx", String: "yyyyyy") returns DWORD:0
'gayr,fh yHk(36)rSmawmh DWORD &JU wefzdk;[m FFFFFFFF jzpfaeygw,f/ bmvdkUvJqdkawmh
string ESpfck[m rwlnDvdkUyg/ yHk(31)u Regcode textbox ae&mrSm uRefawmfu 123456 vdkU &dkufxnfhcJhvdkU
yg/ 'gqdk uRefawmfwdkU&dkufxnfhcJhwJh serial twkudk bmeJU EdIif;,SOfcJhwmygvJ/ yHk(37)/
yHk(37)
aumif;jyD/ 123456 eJU EdIif;,SOfcJhwmuawmh I'mlena151 yg/
ckeu I'mlena151 [m BadBoy Message ray:cifrSm EdIif;,SOfcJhwm jzpfygw,f/ aumif;jyD/ Serial
[m bmvJqdkwm odjyD;oGm;wJhaemufrSm uRefawmfwdkUtaeeJU tJ'D serial udk prf;MunfhvdkufMu&atmif/
yHk(38)
yHk(38)twdkif; I'mlena151 vdkU &dkufxnfhvdkufwJhtcg registration atmifjrifwJhtaMumif; ajymwJh
messagebox ay:vmygw,f/ pum;rpyfajym&&if uRefawmfwdkU &dkufxnfhvdkufwJh serial [m bmwGufcsufrIrS
rygbJ vG,fvifhwul&vmwmyg/
uRefawmfwdkUtaeeJU nag screen udk &Sif;zdkUvdkygao;w,f/ SmartCheck [m VB rSm a&;xm;wJh
serial udk &SmzdkUtwGufawmh aumif;ygw,f/ 'gayr,fh nag udk z,f&Sm;zdkUtwGufawmh uRefawmfwdkUrSm 'Dxuf
aumif;wJh tool awG &Sdygw,f/ VB decompiler tool awG jzpfygw,f/ Oyrmajym&&if VB Decompiler
Lite (odkU) Pro/ uRefawmfuawmh VB Decompiler Pro 5.0 udk oHk;ygw,f/
aumif;jyD/ VB Decompiler udk zGifhvdkufMu&atmif/
yHk(39)
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 231 -
yHk(40)
uRefawmfhtjrifawmh y&dk*&rfbmpum;eJU tuRrf;w0if r&SdwJholawmif em;vnfr,fvdkU xifygw,f/
yHk(40)rSm jrif&wJh mnuabout u About box yg/ mnuexit uawmh Exit yg/ ommand2 uawmh Nag
button udk ESdyfwJhtcgrSmay:wmyg/ Form_Load uawmh nag yg/ Command1 uawmh Register button
udk ESdyfwJhtcgrSm ay:wmyg/ 'gqdk nag udk ay:apwJh routine [m VA b,frSm pay:ovJ MunfhMu&atmif/
Form_Load rSmaum Command2 rSmyg nag [m VA 402C17 rSm pay:w,fvdkU qdkxm;ygw,f/ [kwf^
r[kwf ESpfcsufESdyfjyD; MunfhvdkU&ygw,f/ Form_Load udk double click ESdyfyg/
yHk(41)
yHk(41)t& qdk&ifawmh nag screen udk 'DrSm zefwD;xm;w,fqdkwmuawmh aocsmygjyD/ bmvdkUvJqdk
awmh "Get rid of all Nags and find .." qdkwJU pmom;udk awGU&vdkUyg/
yHk(42)
yHk(42)uawmh nag screen &JU tqHk;yg/ VA 402C17 uawmh nag routine &JU tpyg/ aumif;jyD/
Tut.Reverse Me1.exe udk uRefawmfwdkU debugger rSm zGifhvdkufMu&atmif/ yHk(43)/
yHk(43)
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 232 -
yHk(44)
VA 402C17 udk &dkufvdkufyg/ yHk(45)twdkif; jrif&ygr,f/
yHk(45)
yHk(45)rSm jrif&wmuawmh nag screen &JU tpyg/ VA 402C17 rSm breakpoint owfrSwfvdkufyg/
jyD;&if run (F9) udk EdSyfyg/
yHk(46)
yHk(46)rSm 'D nag screen jyD;&if b,fudka&mufr,fqdkwm jyaeygw,f/ VA 402C17 u PUSH
EBP ae&mrSm RET vdkU jyifvdkufygr,f/ 'gqdk uRefawmfwdkU nag &JU tptpm; tqHk;udk a&mufvmovdk
jzpfoGm;ygr,f/ jyD;&if run (F9) udk EdSyfyg/
yHk(47)
Nag ray:bJ yHk(47)om ay:vmygw,f/ aocsmatmifvdkU yHk(47)u Nag? udk ESdyfMunfhygr,f/ bmrS
ay:rvmygbl;/ Nag screen aysmufoGm;ygjyD/
(8) CrackersConvert
'Dwpfcg avhvmrSmuawmh CrackersConvert y&dk*&rfjzpfygw,f/ 'DwpfMudrfrSmawmh uRefawmfhtaeeJU
y&dk*&rf&JU oabmobm0awGudk avhvmaeawmhrSm r[kwfygbl;/ oifhbmom SmartCheck zGifhjyD; avhvmxm;
&rSmjzpfygw,f/ uRefawmfuawmh About &Sd&m wef;oGm;rSm jzpfygw,f/ About uae register button udk
ESdyf&if yHk(48)twdkif; registration box jrif&rSmyg/
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 233 -
yHk(48)
'ghjyif register button udk ESdyfvdkufwJhtcgrSm yHk(49)twdkif; jrif&ygw,f/
yHk(49)
INFO: : oifhtaeeJU MudKufwJh registration code udk xnfhoGif;Edkifygw,f/ uRefawmf bmvdkU 47806 vdkU
&dkufoGif;w,fqdkwm tHhMoaumif; thHMoaeygvdrfhr,f/ aumif;jyD? rsm;aomtm;jzifh y&dk*&rfawG[m registration
code udk rEdIif;,SOfcifrSm hex code tjzpf ajymif;avh&Sdygw,f/ 47806 udk hex code taeeJU ajymif;vdkuf&if
BABE jzpfoGm;ygw,f/ rSwf&vG,fwmaygh/
yHk(50)
yHk(48)u Validate udk ESdyfvdkuf&if yHk(50)twdkif; jrif&rSmyg/ uRefawmfwdkUtaeeJU uRefawmfwdkU &Smae
wmudk awGUjyDjzpfwJhtwGuf CrackersConvert y&dk*&rfudk ydwfvdkufygr,f/
yHk(51)
avmavmq,fawmh uRefawmfwdkUtaeeJU uk'fawGudk avhvmzdkU Overview window u yHk(51)twdkif;
Munfhvdkuf&atmif/
Len(String: "rhythm") returns LONG:6
&Sif;vif;csuf/ / "rhythm" \ string tvsm;(pmvHk;ta&twGuf)onf 6vHk;jzpfonf/
Mid(VARIANT:String:"abcdefg",long:1,VARIANT:Integer:1)
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 234 -
yHk(52)
yHk(52)udk Munfhyg/ wu,fawmh bmrSrcufygbl;/
__vbaVarMul(VARIANT:String:''114", VARIANT:Integer:20) returns DWORD:13F474
ckeu uRefawmfhemrnf&JU yxrpmvHk;udk 20eJU ajrSmufygw,f/
__vbaVarMul(VARIANT:String:''1", VARIANT: String:''2") returns ..
&Sif;vif;csuf/ / 1 ukd 2 jzifh ajrSmufonf/
__vbaVarMove(VARIANT:Double:2280,VARIANT:Empty) returns DWORD:13F48C
&v'fuawmh 2280 jzpfygw,f/
__vbaVarCat(VARIANT:String:"REG-"VARIANT:Double:2280) returns DWORD:13F474
jyD;&if REG-2280 jzpfapzdkU REG- eJU aygif;ygw,f/
__vbaVarCat(VARIANT:String:"REG-2280"VARIANT:String:"-CODE") returns
DWORD:13F464
jyD;&if REG-2280-CODE jzpfapzdkU CODE eJU aygif;ygw,f/
__vbaVarTstEq(VARIANT:String:"47806",VARIANT:String:"REG-2280-CODE") returns
DWORD:0
jyD;rS uRefawmfwdkU &dkufxnfhvdkufwJh serial eJU EdIif;,SOfygw,f/
__vbaVarTstEq(VARIANT:****,VARIANT:****) returns DWORD:0
&Sif;vif;csuf/ / __vbaVarTstEq ukd variants awG EdIif;,SOfzdkU toHk;jyKygw,f/ wu,fvdkU olwdkUawG[m
nDcJh&if DWORD &JU wefzdk;[m oknjzpfjyD; rnDcJh&ifawmh FFFFFFFF jzpfygr,f/ 'gaMumifh EAX [m
FFFFFFFF jzpfwmyg/ __vbaVarCmpEq eJU qifygw,f/
'gqdk uRefawmfwdkUvdktyfwJh serial udk&ygjyD/ User name u rhythm jzpfjyD; serial uawmh
REG-2280-CODE jzpfygw,f/
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 235 -
yHk(53)
yHk(53)u Validate udk ESdyfvdkufyg/
yHk(54)
'gqdk uRefawmfwdkU register vkyfwm atmifjrifygjyD/ yHk(54)/
INFO: : y&dk*&rf[m registration a'wmawGudk cconv.$$$ zdkifeJU cconv.ccc zdkifrSm a&;ygw,f/ jyD;&if
y&dk*&rfpwifcsdefrSm 'DtcsuftvufawGeJU udkufnD^rnDppfygw,f/
aumif;jyD? aemufxyf ReverseMe y&dk*&rfwpfyk'fudk avhvmMunfh&atmif/
(9) ReverseMe2
yHk(55)
ReverseMe2 udk Olly rSm zGifhxm;wm yHk(55)rSm awGUrSmyg/ oifhtaeeJU SmartCheck rSm rzGifhbJ
Olly rSm bmaMumifhzGifhovJqdkwm ar;csifygvdrfhr,f/ trSefuawmh ReverseMe2 udk SmartCheck rSm t&if
zGifhcJhygw,f/ 'gayr,fh zGifhvdkUr&ygbl;/ SmartCheck y&dk*&rf[m ReverseMe2 udk zGifhvdkufwmeJU tvdkvdk
ydwfoGm;ygw,f/ 'gaMumifh bmjzpfwmvJqdkwm od&atmif Olly rSm vmzGifhwmyg/ ReverseMe2 y&dk*&rfrSm
Anti-SmartCheck vSnfhpm;rIav;rsm; vkyfxm;ovm;vdkU xifrdvdkUyg/ ReverseMe2 [m SmartCheck udk
owdjyKrdvdkufwmeJU SmartCheck udk csufcsif;ydwfzdkU MudK;pm;vdkUyg/ b,fvdk ajz&Sif;rvJqdkwm MunfhvdkufMu&
atmif/
Debugger window rSm right-click ESdyfjyD; Search for rS All reference text strings udk
a&G;vdkufyg/ yHk(56)twdkif; jrif&ygr,f/ ReverseMe2 [m SmartCheck udk&Smwm [kwf^r[kwf Munfhvdkuf
Mu&atmif/
yHk(56)
yHk(56)u VA 00404525 rSm NuMega SmartCheck qdkwJhpmom;udk awGU&ygw,f/ VA
00404525 udk double click ESdyfjyD; uk'fukd avhvmMunfhvdkuf&atmif/ yHk(57)/
yHk(57)
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 236 -
yHk(58)
yHk(58)twdkif; jrif&wJhtcg udk,fajymif;csifwJh pmvHk;udka&G;jyD; keyboard u udk,fMudKufwJh pmom;&dkuf
xnfh&HkygyJ/
yHk(59)
yHk(58)u 4D (M) ae&mudk a&G;xm;jyD; keyboard u B udk ESdyfvdkufwJhtcg yHk(59)twdkif; jrif&ygw,f/
yHk(60)
yHk(59)rSm OK udk ESdyfvdkufwJhtcg yHk(60)twdkif; jrif&ygw,f/ tvm;wlyJ 43(C) qdkwJh pmvHk;ae&mrSm
tjcm;pmvHk;eJU tpm;xkd;ygr,f/
yHk(61)
jyD;&if right-click ESdyfjyD; Copy to executable file udk a&G;yg/ yHk(62)udk jrif&ygr,f/
yHk(62)
yHk(62)rSm right-click ESdyfjyD; Save file udk a&G;vdkufyg/ jyD;awmh udk,fMudKufwJhtrnfeJU zdkifudkodrf;
vdkufyg/ 'Dwpfcgawmh uRefawmfwdkU odrf;vdkufwJhzdkifudk SmartCheck rSm zGifhvdkU&ygjyD/ bmjyóemrS r&Sdygbl;/
yHk(63) twdkif; jrif&ygjyD/
yHk(63)
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 237 -
'D anti-anti enf;ynmudk SmartCheck tjyif tjcm; tool awGjzpfwJh Olly? ImpRec eJU LordPE
wdkUrSmvJ toHk;jyKEdkifygw,f/ ReverseMe2 udk register vkyfMunfhMu&atmif/
yHk(64)
uRefawmfwdkUtaeeJU User name eJU Registration code udk &dkufxnfhayr,fhvJ Register button [m
disable jzpfaeygw,f/ 'gaMumifh uRefawmfwdkU register vkyfr& jzpfaeygw,f/ 'D ReverseMe y&dk*&rf[m
&dkufoGif;wJh pmvHk;wpfvHk;csif;udk rSef^rrSef vdkufppfaq;aeyHk&ygw,f/ yHk(65)/
yHk(65)
'gaMumifh uRefawmfwdkUtaeeJU bmudkMunfhzdkU vdkaeygovJ/ yHk(65)udk tao;pdwf avhvmMunfhygr,f/
yHk(66)
'Dae&mrSm y&dk*&rfu pmvHk;tcsdKUudk vdkufwGufaewm awGU&ygw,f/ 'gayr,fh yHk(66)u Text2.Text
udk xJxJ0if0if avhvmMunhfawmh bmrSrawGY&ygbl;/
yHk(67)
'gqdk yHk(67)udk pOf;pm;MunfhvdkufMu&atmif/ ReverseMe y&dk*&rfu y&dk*&rf pwifcsdefrSm register
rvkyfxm;ao;aMumif; odygw,f/
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 238 -
yHk(68)
yHk(68)u Text3.Text "UNREGISTERED" (String) udk tao;pdwf avhvmMunfh&atmif/
AppActivate(VARIANT:String:"NuSega S...", VARIANT:Missing) fails qdkwJh pmom;u
awmh NuSega S... qdkwJhpmom;udk &SmrawGUygbl;vdkU qdkvdkwmyg/ jyD;&if "Text3.Text "UNREGISTER-
ED" (String) qdkwJh pmom;udk MunfhvdkufMu&atmif/ uRefawmfwdkU&JU &SmazGjcif;vkyfief;pOf[m 'D UNREGIS-
TERED string rwdkifciftxdomjzpfr,fqdkwm oifhtaeeJU em;vnfxm;r,fvdkU xifygw,f/
yHk(69)
yHk(69)udk Munfhvdkufyg/ __vbaVarTstEq(..) u wpfckckudk EdIif;,SOfovdkygyJ/ __vbaVarTstEq(..)
udka&G;vdkufwJhtcg yHk(70)twdkif; jrif&ygr,f/
yHk(70)
odyfr&Sif;ao;ygbl;/ tao;pdwf avhvmMunfhygr,f/
yHk(71)
yHk(71)u Dir(VARIANT:String:"reginfo....",FLAGS:00000000) udk a&G;vdkuf&if yHk(72)twdkif;
jrif&ygr,f/
yHk(72)
ReverseMe [m reginfo.key qdkwJhzdkifudk &SmazGygw,f/ __vbaVarTstEq(..) [m reginfo.key
zdkif&Sd^r&Sdukd prf;oyfwmyg/ r&SdcJh&if UNREGISTERED qdkwJh pmom;udk main window rSmjyjyD; register
vkyfvdkUr&ygbl;/ qdkvdkwmu uRefawmfwdkUtaeeJU reginfo.key zdkifudk vdktyfvmygw,f/ 'gaMumifh reginfo.
key zdkifudkzefwD;vdkufygr,f/ Notepad udkzGifhjyD; zdkifudk reginfo.key trnfeJU odrf;vdkufyg/ jyD;&if Reverse
Me2 zdkifudk SmartCheck rSm jyefvmppfMunfhyg/
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 239 -
yHk(73)
'gqdk yHk(74)twdkif; jrif&ygr,f/ Register vkyfMunfhygr,f/
yHk(74)
aumif;jyD/ ckcsdefxdawmh register vkyfvdkUr&ao;ygbl;/ SmartCheck rSm bmawGrsm;ajymif;vJoGm;
ovJvdkU MunfhMuygr,f/
yHk(75)
yHk(75)u UNREGISTERED qdkwJhpmom;ae&mrSm Key File found qdkwJhpmom;wdk;vmwm awGUrSm
yg/ aumif;jyD/ 'Dwpfcg serial udkppfwJhuk'fawGudk jyefavhvmMunfhygr,f/
yHk(76)
Left(VARIANT:String:"rhythm",long:1)
&Sif;vif;csuf/ / trnf&JU yxrqHk;pmvHk;udk ,lygw,f/
Asc(String:"r") returns Integer:114
&Sif;vif;csuf/ / ASCII "r" udk udef;jynfhwefzdk; 114 tjzpf ajymif;vJygw,f/
Mid(VARIANT:String:"rhythm", long:2, VARIANT:Integer:1)
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 240 -
yHk(77)
yHk(77)rSm ckeu *Pef;awG vmaygif;wmudk awGUae&ygw,f/ ta&;MuD;wmu Mid(VARIANT:
String:"11410412...", long:2, VARIANT:Integer:10) pmaMumif;yg/ y&dk*&rf[m 'kwd,pmvHk;uae 10
vHk;ajrmuf pmvHk;txdom ,lygw,f/ 'gqdk ,l&r,fh*Pef;awGu 1410412111 om jzpfygw,f/
yHk(78)
jyD;&if yHk(78)udk qufMunfhyg/
__vbaVarSub(..) uawmh wpfckckudk EIwfwmyg/ jyD;&if __vbaVarTstEq(..) uwpfckckudk EdIif;,SOfyg
w,f/ 'gaMumifh uRefawmfwdkUtaeeJU tao;pdwfMunfhzdkU vdkvmygjyD/ taygif;&kyfav;udk ESdyfvdkufyg/
yHk(79)
yHk(79)udk Munfhvdkufawmh __vbaVarSub(..) [m __vbaVarTstEq(..) eJU bmrSrqdkifwm awGU&yg
w,f/ ☺☺☺
yHk(80)
'gayr,fh yHk(52)u __vbaVarTstEq(..) rSm wu,fh serial tppfudk EdIif;,SOfzdkUtwGuf double.dbval
tjzpfajymif;vdkufwm awGU&ygw,f/ wu,fawmh 1410412111 ukd EdIif;,SOfzdkUtwGuf ajymif;vdkufwmyg/
'gaMumifh wu,fh serial tppf[m .... ☺
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 241 -
yHk(81)
y&dk*&rf[m uRefawmfwdkU &dkufxnfhvdkufwJhtrnf&JU yxrqHk; 5vHk;udk ASCII tjzpfajymif;ygw,f/
jyD;&if tJ'DpmvHk;awGudk jyefqufygw,f/ 'Dhaemuf serial zefwD;zdkU qufxm;wJhpmvHk;&JU 2vHk;ajrmufuae 10vHk;
ajrmuftxd ,lygw,f/ uJ? serial udk MudK;pm;MunfhvdkufMu&atmif/
yHk(82)
uRefawmfwdkU serial [m rSefzdkUrsm;ygw,f/ bmvdkUvJqdkawmh Register button [m enable jyefjzpf
vmvdkUyg/
yHk(83)
yHk(82)u Register button udk a&G;vdkufwJhtcgrSm yHk(83)twdkif; jrif&ygw,f/ Register vkyfwm
atmifjrifoGm;ygjyD/
'Dwpfcg VB Decompiler udk zGifhvdkufyg/ bmaMumifhvJqdkawmh VB Decompiler &JU decompile
pGrf;&nfudk jycsifvdkUyg/
yHk(84)
yHk(84)twdkif; zGifhjyD;oGm;wJhtcg ReverseMe2 &JU oabmobm0udk odEdkifatmifvdkU Form_Load udk
ESpfcsufEdSyfjyD; scroll vkyfMunfhyg/ yHk(85)twdkif; jrif&ygr,f/
tcef;(15) -Visual Basic jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 242 -
yHk(85)
Command1_Click udk ESpfcsufEdSyfjyD; scroll vkyfMunfhyg/ yHk(86)/
yHk(86)
'Dae&mrSm uRefawmfhtaeeJU Veoveo y&dk*&rfudk rdwfqufcsifygw,f/ 'D tool [m b,f button udkrqdk
enable/disable vkyfEdkifygw,f/ Munfhyg/
yHk(87)
Register button [m disable jzpfaeygw,f/ Veoveo y&dk*&rfudk zGifhvdkufyg/
yHk(88)
yHk(88)twdkif; Veoveo udk right-click ESdyfjyD; Enable Buttons (auto) udk a&G;vdkufyg/
yHk(89)
yHk(89)udk Munfhvdkuf&if Register button [m enable jzpfaeygjyD/ b,favmufvG,fovJqdkwm
awGYrSmyg/ wu,fawmh Register button [m enable jzpfvJ uRefawmfwdkU register vkyfvdkU&rSm r[kwfygbl;/
bmvdkUvJqdkawmh serial rSef^rrSefudk y&dk*&rfu ppfvdkUyg/
tcef;(16) - Delphi jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 243 -
yHk(1)
File Recovery Angel udkzGifhjyD; Help menu u About udka&G;vdkufwJhtcg yHk(1)twdkif; jrif&yg
w,f/ ysufaewJhzdk'gwpfckudk recovery vkyfzdkUMudK;pm;wJhtcg yHk(2)twdkif;jrif&ygw,f/
yHk(2)
zdkifawGtrsm;MuD;udk recovery vkyfzdkUMudK;pm;awmhvJ yHk(3)twdkif; jrif&jyefygw,f/
yHk(3)
'D MessageBox awGuawmh oHk;pGJolawGudk 0,foHk;zdkU zdtm;ay;aewJh MessageBox awGyg/
aumif;jyD? 'Dy&dk*&rfudk bmeJUa&;xm;ovJqdkwm ppfMunfhMu&atmif/ yHk(4)/
yHk(4)
tcef;(16) - Delphi jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 244 -
yHk(4)twdkif; PEiD eJUppfaq;csuft& awGU&Sdwmuawmh 'Dy&dk*&rfudk Delphi 4.0 (odkU) Delphi 5.0
eJUa&;om;xm;w,fqdkwJhtaMumif;yg/ Version twdtusudkawmh Delphi y&dk*&rfrmawGrSyJ linker version
udkMunfhjyD; cGJjcm;odygvdrfhr,f/ uRefawmfwdkUtwGufuawmh tMurf;zsif;od&ifyJ &ygjyD/
FileRecoveryAngel.exe zdkifudk Olly rSmzGifhjyD;Munfh&ifawmh entry point udk yHk(5)twdkif; awGU&yg
r,f/
yHk(5)
tvkyfvkyfyHkudk aocsmodEdkifatmifvdkU F9 (Run) udkESdyfvdkufyg/ jyD;&if Option menu u Register(R)
udka&G;jyD; register vkyfzdkUjyifqifyg/ yHk(6)/
yHk(6)
yHk(6)twdkif; Registration Name eJU Registration Key wdkUudk&dkufxnfhvdkufjyD; Register button
udka&G;vdkufyg/ yHk(7)twdkif; jrif&ygr,f/
yHk(7)
yHk(7)u "Register False" qdkwJhpmom;udkrSwfxm;jyD; Olly rSm text string taeeJU&Smvdkufyg/ jyD;&if 'D
text string &Sd&mudk vmvdkufyg/ yHk(8)/
yHk(8)
yHk(8)udk Munfhvdkuf&if 'D BadBoy message &Sd&m VA 00488FEA qD jump wpfckcku ausmfvTm;
a&muf&Sdvmwm awGYrSmyg/ avmavmq,fawmh 'D jump udk arhxm;vdkufyg/ yHk(7)twdkif; jrif&wJhtcgrSm F12
(Pause) udkESdyfjyD; y&dk*&rftvkyfvkyfwmudk cP&yfcdkif;vdkufyg/ jyD;&if Alt+K (Call Stack) udkESdyfjyD; Call
awGudk b,fuaeac:oHk;aeovJqdkwm Munfhvdkufyg/ yHk(9)/
yHk(9)
tcef;(16) - Delphi jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 245 -
yHk(10)
yHk(10)uawmh yHk(7)udk pause ay;xm;csdefrSm System Stack xJrSm jrif&wJhtaetxm;yg/
INFO: : Delphi uk'fawGudk Olly rSm disassemble vkyfwJhtcg jrif&wJhtaetxm;uawmh enf;enf;av;
xl;qef;aeygw,f/ (Comment eJU info awGu enf;aewmawGU&rSmyg/) bmaMumifhvJqdkawmh Olly udk call
awG backtrace vkyfcGifhrjyKvdkUyg/ Call Stack rSm [mvm[if;vif;jzpfaejyD; tcsuftvuftenf;i,fudkom
ay;Edkifygw,f/ 'gaMumifhrdkU Delphi y&dk*&rfawGrSm routine wpfckudk b,f call uaeac:oHk;wmvJ odcsif&if
System Stack udk toHk;jyK&ygw,f/ System Stack uae return address udkMunfhjyD; call &JUtpudk
vdkuf&Sm&wmuvJ tcsdefawmfawmfMumygw,f/ tvkyfodyfrjzpfygbl;/ tjcm;enf;vrf;wpfckawmh vdkaeygjyD/
bmaMumifhvJqdkawmh Olly u routine &JU wduswJh address tpudk rjyEdkifvdkUyg/
INFO: : Delphi [m pointer tjzpf reference vkyfwJh global variable awGeJU local variable awGudk
toHk;jyKygw,f/ Global variable awGtwGuf [REG+Constant] udkoHk;jyD;? local variable awGtwGuf
[REG-Constant] udktoHk;jyKygw,f/ REG uawmh register udkqdkvdkwmyg/ qdkvdkwmuawmh Olly [m
CALL DWORD PTR DS:[EBX+100] qdk&if backtrace rvkyfEdkifygbl;/ 'gaMumifhrdkU EBX wefzdk;ajymif;
wJhtcsdefrSm pointer twGufwefzdk;[mvJajymif;oGm;jyD; Olly u 'D call udk backtrace rvkyfvdkufEdkifwmyg/
'g[m Delphi y&dk*&rfawGeJUMuHKwJhtcgrSm wu,fhjyóemawGjzpfygw,f/ tjcm;bmompum;awGrSmvJ 'DvdkrsdK;
MuHKawGUEdkifayr,fh Delphi rSmavmuf rawGU&ygbl;/
INFO: : 'g[m tenf;i,fawmh pdk;&drfp&maumif;ygw,f/ uRefawmfwdkU uHaumif;wJhtcsufuawmh Delphi
twGuf tool wpfck &xm;vdkUyg/ 'D tool uawmh DaFixer &JU DeDe yg/ DeDe [m Borland Delphi
y&dk*&rfawGtwGuf zefwD;xm;wJh disassembler wpfckjzpfygw,f/ DeDe [m Delphi^Builder wdkUeJU
compile vkyfxm;wJh exe zdkifawGudk analyze vkyf&mrSm tvGefjrefvSwJh y&dk*&rfwpfckjzpfjyD; 'Dzdkif&JU dfm
zdkifawGtm;vHk;udk jyefay;Edkifygw,f/ 'D dfm zdkifawGudk Delphi rSm zGifhjyD;wnf;jzwfEdkifygw,f/ DeDe [m
string awG? import vkyfxm;wJh function call awG? classes methods call awG? unit xJu component
awG? Try-Except? Try-Finally block awGeJU reference vkyfxm;wJh uk'fawGtm;vHk;udk xkwfay;Edkifygw,f/
oifhtaeeJU dfm zdkif? pas zdkifeJU dpr zdkifawGygwJh Delphi project zdk'gwpfckudkvJ zefwD;Edkifygw,f/ Tool
wdkif;rSm tm;enf;csuf&Sdygw,f/ DeDe [m debugger r[kwfwJhtwGuf DeDe rSm patch vkyfzdkUqdkwm rjzpf
Edkifygbl;/ bmyJjzpfjzpf Olly eJU wGJoHk;&ifawmh&ygw,f/ DeDe 3.50.04 build 1635 udk download vkyf&if
DOI eJU DSF zdkifawGygygap/ DeDe eJUywfoufwJh aqmif;yg;awGuawmh DeDe &JU dede_doc directory
atmufrSm&Sdygw,f/ (DSF = = DeDe Symbol File) (DOI == DeDe Offset Information File)
INFO: : DeDe &JU configuration eJUywfoufjyD; ta&;MuD;wJhtcsufuawmh exe zdkifwpfckudk process
rvkyfcifrSm rSefuefwJh symbol zdkifawGudk load vkyfwmtaumif;qHk;yg/ DOI/DSF zdkifawGrygvJ DeDe [m
tvkyfvkyfEdkifayr,fh call sequence awGudk ajz&Sif;&mrSm rSefuefpGmjzpfEdkifzdkU DOI/DSF zdkifawGu tvGefta&;
MuD;ygw,f/
yHk(11)
tcef;(16) - Delphi jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 246 -
yHk(11)twdkif; DeDe &JU Options menu u Symbols udka&G;jyD; Delphi 5.0 eJUqdkifwJh vcl5.dsf
zdkifudka&G;cs,fvdkufyg/ Delphi 7.0 y&dk*&rfawGudk analyze vkyfr,fqdk&ifawmh vcl7.dsf zdkifudka&G;&rSmyg/
DOI tab udkESdyfjyD; D5.doi zdkifudka&G;cs,fyg/ jyD;&ifawmh yHk(12)u Process button udkESdyfyg/
yHk(12)
yHk(12)u Process button udkESdyfvdkuf&ifawmh yHk(13)twdkif; MessageBox awGay:vmygvdrfhr,f/
yHk(13)
No button oma&G;vdkufyg/ yHk(14)twdkif; jrif&ygr,f/
yHk(14)
yHk(14)u Procedures tab udkESdyfvdkufyg/ 'gqdk&if File Recovery Angel utoHk;jyKwJh procedure
awGudkjrif&ygr,f/ TFrmMain uawmh y&dk*&rf&JU t"dutusqHk; Main menu &Sd&m procedure yg/
TFrmAbout uawmh About menu udkESdyfvdkufwJhtcgjrif&r,fh Form (dialog box) yg/ TFrmRegister
uawmh uRefawmfwdkU&SmaewJh Registration Form yg/ TFrmRegister udka&G;vdkufyg/ nmzufrSmjrif&wm
uawmh Olly rSm b,fvdkrSrjrifEdkifwJh routine &JUtpawGyg/ ImgRegistereClick udka&G;vdkufyg/ yHk(15)
twdkif; awGU&ygr,f/
yHk(15)
VA 00488E34 uawmh Registration routine &JUtpjzpfygw,f/ atmufudkenf;enf;avmuf scroll
qGJMunfhvdkuf&ifawmh yHk(16)twdkif; jrif&rSmyg/
yHk(16)
tcef;(16) - Delphi jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 247 -
yHk(17)
ckqdk&if DeDe udk ydwfvdkU&ygjyD/ yHk(17)twdkif; registration routine &JUtpudka&mufwJhtcgrSm
registration key udkppfwJhae&mudk MunfhvdkufMu&atmif/ VA 00488E34 ae&mrSm breakpoint owfrSwfjyD;
register xyfvkyfMunfhyg/ yHk(18)/
yHk(18)
yHk(18)rSm Register button udka&G;vdkuf&ifawmh uRefawmfwdkU breakpoint owfrSwfxm;wJh VA
00488E34 ae&mudka&mufvmygr,f/ 'Dtcg yHk(19)u VA 00488EFA udka&mufwJhtxd F8 (Step Over)
udkESdyfvmcJhyg/
yHk(19)
yHk(19)u VA 00488EFA [m registration key udkxkwfay;wJh routine wpfckjzpfygw,f/
Registration form &JU Registration name tuGufu "Myanmar Cracking Team" twGuf vdktyfwJh
"CA75FC30F7AD6E7C969032F175560906F79B9EE94E93D2D4302B92" qdkwJh key udkxkwfay;
jyD; EAX rSmodrf;ygw,f/ VA 00488F13 rSm&SdwJh CALL uawmh EAX u key eJU EDX rSmodrf;xm;wJh
"4.10.1979" wdkUudk EdIif;,SOfygw,f/ rSefcJh&ifawmh registry &JU "IsRegister" rSm "On" qdkjyD;odrf;ay;rSm
jzpfygw,f/ rSm;cJh&ifawmh qufoGm;rSmjzpfjyD; VA 00488F3F a&muf&if BadBoy ("Register False!")
qDoGm;^roGm; xyfEdIif;,SOfrSmjzpfygw,f/ 'Davmufqdk&ifawmh oifhtaeeJU bmqufvkyf&rvJqdkwm odavmufjyD
xifygw,f/
tcef;(16) - Delphi jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 248 -
Olly udkydwfjyD; File Recovery Angel udk oD;oefUzGifhvdkufyg/ jyD;&if Option menu u Register
(R) udka&G;jyD; register vkyfvdkufyg/ yHk(20)/
yHk(20)
yHk(20)u Register button udkESdyfvdkuf&ifawmh yHk(21)twdkif;jrif&rSmyg/
yHk(21)
Help menu u About udka&G;vdkuf&ifawmh yHk(22)twdkif;jrif&rSmyg/ wu,fawmh File Recovery
Angel y&dk*&rf[m registration name ae&mrSm pmvHk;b,favmuf&dkufxnfhxnfh 12vHk;xufydkrppfygbl;/
'gaMumifhrdkUvJ "Myanmar Cracking Team" tpm; "Myanmar Crac"vdkUyJjywmyg/
yHk(22)
rSwfxm;&rSmuawmh rSefuefwJh key udkr&kdufxnhfyJ VA 00488F46 u BadBoy qDoGm;wJh JE udk
NOP vdkUjyifr,fqdk&if register vkyfaqmifjcif; cPwmom atmifjrifygr,f/ bmaMumifhvJqdkawmh y&dk*&rf[m
pwiftvkyfvkyfwJhtcgrSm registry xJu "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Frareg" eJU "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Unicode" ae&mESpfckatmufu Name eJU Unicodekey wdkUudkzwfjyD; rSef^rrSef
wdkufppfvdkUyg/ tao;pdwfodcsif&ifawmh yHk(23)u TFrmMain udkESdyfjyD; Munfh&IEdkifygw,f/
yHk(23)
yHk(23)u FormCreate [m Main menu udkzefwD;csdefrSm vkyfaqmifr,hfvkyfaqmifcsuf&Sd&m Virtual
address (00491A00) tpudkjyygw,f/ udk,fhbmomudk,f avhvmMunfhyg/
tcef;(16) - Delphi jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 249 -
yHk(24)
yHk(24)udk aocsmMunfhyg/ VA 00488EFA rSm oif&dkufxnhfvdkufwJh user trnfudkvdkufjyD; serial
udkxkwfay;vdkufygw,f/ 'D serial udk stack segment xJrSmoGm;xm;wmjzpfygw,f/ jyD;awmh stack xJuae
EAX qDajymif;a&TYvdkufjyD; EDX xJrSm&SdwJh oif&dkufxnhfvdkufwJh serial eJUEdIif;,SOfwmjzpfygw,f/ Serial
ESpfck[m rnDcJh&ifawmh Badboy &Sd&mqD a&mufoGm;rSmjzpfygw,f/ yHk(25)/
yHk(25)
yHk(25)udkMunfhyg/ VA 00489184 u "Register False!" qdkwJhpmom;udk EAX xJul;xnfhvdkufjyD;
serial ESpfckEdIif;,SOfwmrnDcJh&if Badboy message udkjyowmjzpfygw,f/ yHk(26)/
yHk(26)
"Register False!" qdkwJhpmom;tpm; uRefawmfwdkU&dkufxnfhvdkufwJh user name eJUywfoufwJh serial
udkjyEdkifr,fqdk&ifraumif;bl;vm;/ ☺☺☺☺☺☺☺☺☺☺
aumif;jyD? 'DvdkjyoEdkifzdkU enf;enf;MudK;pm;Munfhygr,f/ yHk(25)u VA 488FFB ae&mrSm MOV
EAX, 489184 tpm; MOV EAX, DWORD PTR SS:[EBP-C] vdkUjyifjyD; zdkifudkodrf;qnf;vdkufyg/
(rSwcf suf/ / wu,fh serial tppftrSefudk stack xJrSmcPoGm;xm;wJhtaMumif; ajymcJhwmtrSwf&yg/) uk'fawG
udkjyifjyD;odrf;vdkufwJhzdkifudk zGifhjyD; register vkyfMunfhvdkufyg/ yHk(27)/
yHk(27)
'Dwpfcgawmh rhythm qdkwJhtrnfeJU register vkyfMunfhygr,f/
yHk(28)
tcef;(16) - Delphi jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 250 -
yHk(29)
yHk(29)u register button udkESdyfvdkuf&if yHk(30)twdkif; jrif&rSmyg/
yHk(30)
Help menu u About udka&G;vdkuf&if yHk(31)twdkif; jrif&ygw,f/
yHk(31)
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 251 -
yHk(1)
yHk(2)
(2) Java Cracking Tools
Java y&dk*&rfawGudk crack &mrSm toHk;jyKwJh tool awGuawmh –
(u) CCK
(c) DJ Java Decompiler
(*) JDebugtool
(C) JAD
(i) JODE
yHk(3)
yHk(4)
yHk(5)
yHk(6)
yHk(7)
(4) Java cracking (uk'frsm;udk avhvmjcif;)
uRefawmfwdkUtaeeJU 'D loader zdkifudk external loader wpfckzefwD;jyD; patch vkyfvdkU&ygw,f/
(Oyrmajym&&if uRefawmfwdkUtaeeJU ,m,Dzdk'gudk emrnfaowpfckxm;wnfaqmufjyD; 'DtxJrSm patch vkyf
xm;wJh class awGxm;ygr,f/ 'gayr,fh 'gawG[m tjrift&awmh rvkdtyfygbl;/ aemufydkif;us&if &Sif;oGm;
rSmyg/)
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 253 -
yHk(8)
public jexepackboot( )
{
// Create a new object EP of type Properties
EP = new Properties();
}
yHk(10)
public jexepackboot( )
{
JOptionPane.showMessageDialog(null,"CLASS CONSTRUCTOR","Reversing info (jexepackboot)",
JOptionPane.INFORMATION_MESSAGE);
// Create a new object EP of type Properties
EP = new Properties();
}
public static void main(String args[])
{
JOptionPane.showMessageDialog(null,"MAIN METHOD - START", "Reversing info (jexepackboot)",
JOptionPane.INFORMATION_MESSAGE);
PQ = System.currentTimeMillis();
QQ = args[0].indexOf('D') >= 0;
RQ("Java=" + System.getProperty("java.version"));
jexepackboot jexepackboot1 = new jexepackboot();
int i = jexepackboot1.run(args);
if(i != 0){
JOptionPane.showMessageDialog(null,"MAIN METHOD - SYSTEM EXIT","Reversing info
(jexepackboot)", JOptionPane.INFORMATION_MESSAGE);
System.exit(i);
}
JOptionPane.showMessageDialog(null,"MAIN METHOD - END","Reversing info (jexepackboot)",
JOptionPane.INFORMATION_MESSAGE); }
yHk(11)
yHk(12)
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 254 -
(1) VisualRoute.exe
(2) java -mx256n jexepackboot ER ...
(3) START (jexepackboot.class)
(4) jexepackboot jexepackboot1 = new jexepackboot();
(5) jexepackboot1 (constructor)
(6) int i = jexepackboot1.run(args);
(7) END (jexepackboot.class)
yHk(13)
Args[0] = ER
Args[1] = <root>:\<prog_folder>\VisualRoute\VisualRoute.exe (full path of the main executable)
Args[2] = <root>:\DOCUME~1\<user>\<temp_set>\Temp\XE70DC8 (full path of the temporary folder)
private int run(String as[])
{
// install vkyfxm;aom java pepfudk ppfaq;onf/
if(!SQ())
return 9999;
if(as.length < 3)
return 10010;
// command-line wGif E ygvmjcif; &Sd^r&Sd ppfaq;onf/
boolean flag = as[0].indexOf('E') >= 0;
// command-line wGif R ygvmjcif; &Sd^r&Sd ppfaq;onf/
boolean flag1 = as[0].indexOf('R') >= 0;
// file onf main executable ESifhqdkifaom pointer wpfckjzpfonf/
File file = new File(as[1]);
// ,m,Dzdk'gvrf;aMumif;ukd string s taejzifh odrf;qnf;onf/
String s = as[2];
// "System properties key = jexepack.exe" udk item = <full path for VisualRoute.exe> ESifhtwl push vkyfonf/
UQ("exe", TQ = file.toString());
// "System properties key = jexepack.resdir" udk item = <,m,Dzdk'gvrf;aMumif;> ESifhtwl push vkyfonf/
UQ("resdir", s);
// file1 onf ,m,Dzdk'gESifhqdkifaom pointer wpfckjzpfonf/
File file1 = new File(s);
yHk(14)
private void UQ(String s, String s1)
{
Properties properties = System.getProperties();
properties.put("jexepack." + s, s1);
System.setProperties(properties);
String mybuffer = "key = jexepack." + s + "\nitem=" + s1;
JOption.showMessageDialog(null, mybuffer, "Reversing info (UQ method",
JOptionPane.INFORMATION_MESSAGE);
}
yHk(15)
rSwf&ef/ / System class [m key/value
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 255 -
catch(Exception _ex) { }
}
return null;
}
private byte[] VQ(byte abyte0[], char c)
{
WQ = -1; // WQ udk -1 tjzpfowfrSwfonf/ tu,fí tm;vHk;tqifajycJhvQif þwefzdk;udk rajymif;vJEdkifyg/)
for(int i = 0; i + 28 < abyte0.length; i += 16)
if(BQ(abyte0, i) && abyte0[i + 15] == c)
{
int j = LQ(abyte0, i + 16);
int k = LQ(abyte0, i + 20);
long l = (long)j & 0xffffffffL | (long)k << 32;
int i1 = LQ(abyte0, i + 24);
int j1 = i + 16 + 8 + 4;
if(j1 + i1 <= abyte0.length)
{
if(1L == l * UM(abyte0, j1, j1 + i1))
return FO(new String(abyte0, 0, j1, i1));
WQ = 10092;
}
}
return null;
}
yHk(16)
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 256 -
yHk(17)
yHk(18)
Raw offset + Raw Size
400 + 1A00 = 1E00
1E00 + 800 = 2200
2600 + 600 = 2C00
2C00 + 1A00 = 4600 (Raw Size a'wmaygif;v'f)
yHk(19)
yHk(20)
yHk(21)
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 257 -
yHk(22)
yHk(23)
yHk(24)
yHk(25)
yHk(26)
// VisualRoute.exe udk byte array abyte0[] taejzifh ul;wifonf/
byte abyte0[] = IM(file);
// Image udkatmifjrifpGm ul;wifEdkifjcif;&Sd^r&Sd ppfaq;onf/
if(abyte0 == null)
return 10011;
// JKMNPQSTVWYZ\]_B udk overlay data tjzpf &Sd^r&Sd Munfhonf/
if(VQ(abyte0, 'B') == null)
if(WQ > 0)
return WQ;
else
return 10002;
// JKMNPQSTVWYZ\]_V \ overlay data segment rS byte rsm;udk extract vkyfonf/
// Byte rsm;udk decrypt vkyfjyD; abyte1[] byte array taejzifh tm;vHk;udkjyefxm;onf/
byte abyte1[] = VQ(abyte0, 'V');
if(WQ > 0)
return WQ;
// decrypt vkyfxm;aoma'wmrsm;udk disk ay:&Sd Vdata.dat zdkifxJodkU dump vkyf,lonf/
writeByteArrayToDisk(abyte1, "Vdata.dat", 0, 0, 0);
yHk(27)
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 258 -
private void writeByteArrayToDisk(byte bytebuffer[], String fileName, int start, int numbytes, int mode)
{
// Programmer = ThunderPwr of ARTEeam
File file = new File(fileName);
if (mode == 0)
{
try
{ // 0 rSonf aemufqHk; element xd byte array tm;vHk;udka&;onf/
FileOutputStream file_output = new FileOutputStream (file);
DataOutputStream data_out = new DataOutputStream (file_output);
for (it i = 0; i < bytebuffer.length; i++)
{
data_out.writeByte(bytebuffer[i]);
}
file_output.close();
}
catch(IOException e)
{
System.out.println ("IO exception = " + e);
}
}
else
{
try
{ // start + numbytes elements rS array section wpfckudka&;onf/
FileOutputStream file_output = new FileOutputStream (file);
DataOutputStream data_out = new DataOutputStream (file_output);
for (int i = start; i < start + numbytes; i++)
{
data_out.writeByte (bytebuffer[i]);
}
file_output.close();
catch (IOException e)
{
System.out.println ("IO exception = " + e);
}
}
}
// extract vkyfwm atmifjrifjcif; &Sd^r&Sd ppfaq;ygw,f/ 'DaemufrSmawmh array xJrSm&SdwJh string udk parsing vkyfjyD;awmh parse
vkyfxm;wJh string udk EP properties xJrSm odrf;qnf;EdkifzdkU twGJ(key? item)wpfcktjzpf xm;&Sdygw,f/
// EP propertes [m local database eJUwlwm trSwf&yg/
if(abyte1 != null)
{
for(StringTokenizer stringtokenizer = new StringTokenizer(new String(abyte1, 0), "\n");
stringtokenizer.hasMoreTokens();)
{
String s3 = stringtokenizer.nextToken();
int j = s3.indexOf('=');
if(j > 0)
EP.put(s3.substring(0, j), s3.substring(j+1));
String key = s3.substring(0, j);
String item = s3.substring(j+1);
}
}
packager JexePack 5.5a
main vr
target JM
mx 256
windowed yes
execwd *
yHk(28)
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 259 -
if(obj1 == null)
{
if(!QM(file2, new byte[100]))
return 10013;
String as1[] = new String[as.length - 3];
for(int j1 = 0; j1 < as1.length; j1++)
as1[j1] = as[3 + j1];
// ,cktcsdefwGif jexepackboot udk daemon thread (cyclic) wpfcktaejzifh execute vkyfygvdrfhrnf/
Thread thread = new Thread(this);
thread.setDaemon(true);
thread.start();
// jexepackboot.class zdkifudk ,m,Dzkd'gxJrS zsufypfonf/
(new File(file1, getClass().getName() + ".class")).delete();
try
{ // topfwpfcktwGuf main Method udk execute vkyfonf/
RQ("main=" + s1); // s1 = vr
Method method = class1.getMethod("main", new Class[] {java.lang.String[].class});
method.invoke(null, new Object[] { as1 });
}
// zdkifa&;jcif; jyD;qHk;onf/
if(!flag1)
return 12345;
JoptionPane.showMessageDialog(null,"run Method, FILE WROTE\npatch the vr.class", "Reversing info
(jexepackboot)", JOptionPane.INFORMATION_MESSAGE);
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 261 -
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 262 -
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 263 -
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 264 -
tcef;(17) - Java jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 265 -
yHk(1)
http://www.pmode.com
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 268 -
Beq_S Transfers control to a target instruction (short form) if two values are equal. 2E
Transfers control to a target instruction if the first value is greater than or equal to the
Bge 3C
second value.
Transfers control to a target instruction (short form) if the first value is greater than or
Bge_S 2F
equal to the second value.
Transfers control to a target instruction if the the first value is greater than the second
Bge_Un 41
value, when comparing unsigned integer values or unordered float values.
Transfers control to a target instruction (short form) if if the the first value is greater
Bge_Un_S than the second value, when comparing unsigned integer values or unordered float 34
values.
Transfers control to a target instruction if the first value is greater than the second
Bgt 3D
value.
Transfers control to a target instruction (short form) if the first value is greater than the
Bgt_S 30
second value.
Transfers control to a target instruction if the first value is greater than the second
Bgt_Un 42
value, when comparing unsigned integer values or unordered float values.
Transfers control to a target instruction (short form) if the first value is greater than the
Bgt_Un_S 35
second value, when comparing unsigned integer values or unordered float values.
Transfers control to a target instruction if the first value is less than or equal to the
Ble 3E
second value.
Transfers control to a target instruction (short form) if the first value is less than or
Ble_S 31
equal to the second value.
Transfers control to a target instruction if the first value is less than or equal to the
Ble_Un 43
second value, when comparing unsigned integer values or unordered float values.
Transfers control to a target instruction (short form) if the first value is less than or
Ble_Un_S equal to the second value, when comparing unsigned integer values or unordered float 36
values.
Blt Transfers control to a target instruction if the first value is less than the second value. 3F
Transfers control to a target instruction (short form) if the first value is less than the
Blt_S 32
second value.
Transfers control to a target instruction if the first value is less than the second value,
Blt_Un 44
when comparing unsigned integer values or unordered float values.
Transfers control to a target instruction (short form) if the first value is less than the
Blt_Un_S 37
second value, when comparing unsigned integer values or unordered float values.
Transfers control to a target instruction when two unsigned integer values or unordered
Bne_Un 40
float values are not equal.
Transfers control to a target instruction (short form) when two unsigned integer values
Bne_Un_S 33
or unordered float values are not equal.
Brfalse_S Transfers control to a target instruction if value is false, a null reference, or zero. 2C
Brtrue Transfers control to a target instruction if value is true, not null, or nonzero. 3A
Transfers control to a target instruction (short form) if value is true, not null, or non-
Brtrue_S 2D
zero.
Compares two values. If the first value is less than the second, the integer value 1
Clt (int32) is pushed onto the evaluation stack; otherwise 0 (int32) is pushed onto the FF 04
evaluation stack.
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 270 -
Compares the unsigned or unordered values value1 and value2. If value1 is less than
Clt_Un value2, then the integer value 1 (int32) is pushed onto the evaluation stack; otherwise 0 FE 03
(int32) is pushed onto the evaluation stack.
Ldstr Pushes a new object reference to a string literal stored in the metadata. 72
Leave Exits a protected region of code, unconditionally tranferring control to a specific target DD
instruction.
Leave_S Exits a protected region of code, unconditionally tranferring control to a target DE
instruction (short form).
Mul Multiplies two values and pushes the result on the evaluation stack. 5A
Mul_Ovf Multiplies two integer values, performs an overflow check, and pushes the result onto D8
the evaluation stack.
Mul_Ovf_Un Multiplies two unsigned integer values, performs an overflow check, and pushes the D9
result onto the evaluation stack.
Neg Negates a value and pushes the result onto the evaluation stack. 65
Newobj Creates a new object or a new instance of a value type, pushing an object reference 73
(type O) onto the evaluation stack.
Nop Fills space if opcodes are patched. No meaningful operation is performed although a 00
processing cycle can be consumed.
Not Computes the bitwise complement of the integer value on top of the stack and pushes 66
the result onto the evaluation stack as the same type.
Or Compute the bitwise complement of the two integer values on top of the stack and 60
pushes the result onto the evaluation stack.
Pop Removes the value currently on top of the evaluation stack. 26
Rem Divides two values and pushes the remainder onto the evaluation stack. 5D
Rem_Un Divides two unsigned values and pushes the remainder onto the evaluation stack. 5E
Ret Returns from the current method, pushing a return value (if present) from the caller's 2A
evaluation stack onto the callee's evaluation stack.
Rethrow Rethrows the current exception. FE 1A
Stind_I1 Stores a value of type int8 at a supplied address. 52
Stind_I2 Stores a value of type int16 at a supplied address. 53
Stind_I4 Stores a value of type int32 at a supplied address. 54
Stloc Pops the current value from the top of the evaluation stack and stores it in a the local FE 0E
variable list at a specified index.
Sub Subtracts one value from another and pushes the result onto the evaluation stack. 59
Sub_Ovf Subtracts one integer value from another, performs an overflow check, and pushes the DA
result onto the evaluation stack.
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 271 -
Subtracts one unsigned integer value from another, performs an overflow check, and DB
Sub_Ovf_Un
pushes the result onto the evaluation stack.
Switch Implements a jump table. 45
yHk(2)
Method table udk expand vkyfjyD; index 40 (28h) udk&Smygr,f/ 'gqdk yHk(3)twdkif; awGU&ygr,f/
yHk(3)
yHk(3)u ae&mudka&G;cs,fjyD; 'D method eJUqdkifwJhtcsuftvufawGudk Munfh&IvdkU&yg
w,f/ 'Dae&mrSm uRefawmfwdkUpdwft0ifpm;qHk;uawmh yxrqHk; row jzpfjyD; 'D method &JU RVA udkazmfjyyg
w,f/ aemufqHk; column uwefzdk;udk zwfvdkuf&ifawmh 0x4974 jzpfygw,f/
(5) EPM twGuf zdkif offset udk CFF explorer jzifh&Smjcif;
.net PE zdkifwpfckrSmawmh .text? .reloc? .rsrc pwJh section 3ck&Sdygw,f/ .text section rSmawmh
Import Table? Import Address Table eJU .Net Section wdkYyg0ifygw,f/ .net PE zdkifwpfckudk atmufyg
tcsuftvufrsm;yg0ifw,fvdkU ,lqMunfhvdkufMu&atmif/
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 273 -
yHk(4)
t&Sif;qHk;yHkpHeJUjy&&ifawmh –
EPM File Offset = [EntryPoint VA] – [Section.txt VA] + [Section.txt RawAddress]
'Dwefzdk; 3ckvHk;udk CFF Explorer uae&&SdEkdifygw,f/ CFF Explorer rSm Address converter
yg&SdjyD; oifhrSm RVA wefzdk;&Sdxm;jyDqdk&if b,f Method &JU file offset udkrqdkwGufcsufEdkifygw,f/
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 274 -
yHk(5)
'gqdk&ifawmh wu,fh byte &Sd&m yxrqHk; offset udka&mufoGm;ygvdrfhr,f/ jyD;cJhwJhenf;vrf;wkef;u
oifa&muf&SdcJhwm[m Code byte rwdkifcifrSm&SdwJh Method Header byte udkyg/ .net Method wnfaqmuf
xm;yHkuawmh yHk(6)twdkif; jzpfygw,f/
yHk(6)
yxrenf;vrf;uawmh oifhudk > &Sd&mae&mqD a&mufapwmjzpfjyD; uk'fawG&Sd&m yxrqHk; byte qD
a&mufapcsif&ifawmh header t&G,ftpm;wefzdk; 1 (tjrJwrf; 1 jzpfaerSm r[kwfygbl;/) udkaygif;ay;&rSm
jzpfygw,f/ 'gaMumifh uRefawmfwdkU wGufcsufvdkU&wJhtajz[m 2B75 tpm; 2B74 jzpfae&wmyg/
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 275 -
(6) rSefuefwJh node udkawGU&ifawmh tJ'Dae&mrSm right-click ESdyfjyD; "Add Breakpoint" menu udka&G;vdkuf&Hk
ygyJ/
yHk(7)
(9) Patch vkyfjcif;tajccH
'DwpfcgrSmawmh .net application awGudk patch vkyfjcif;eJUywfoufjyD; avhvmMunfhvdkuf&atmif/
'Dwpfcg patch vkyfzdkUa&G;cs,fxm;wJh y&dk*&rfuawmh Dot_Net_ReverseMe_2.exe jzpfygw,f/ 'Dy&dk*&rfudk
www.tuts4you.com &JU download section uae download vkyf,lEdkifygw,f/ (oifhtaeeJU 'Dy&dk*&rfav;
udk &Sdrxm;vJ ta&;rMuD;ygbl;/ &Sif;jywmudk em;vnfatmifMunfhzdkUom ta&;MuD;ygw,f/) yxrqHk; patch
vkyfr,fh y&dk*&rfudk PEiD eJUppfMunfhygr,f/ yHk(8)/
yHk(8)
y&dk*&rfudk .net bmompum;eJU a&;xm;wmaocsmygw,f/ aumif;jyD? y&dk*&rfudkzGifhvdkufwJhtcg yHk(9)
twdkif;awGU&ygw,f/
yHk(9)
yHk(9)t&qdk&ifawmh uRefawmfwdkUtwGuf bmrSvkyfp&mr&Sdygbl;/ bmaMumifhvJqdkawmh serial &dkufxnfh
p&m textbox wdkU? serial rSef^rrSefppfwJh button wdkU rawGUvdkUyg/ 'gaMumifh a&;xm;wJhuk'fudkMunfhEdkifzdkU
y&dk*&rfudk Reflector eJUzGifhvdkufyg/ yHk(10)/
yHk(10)
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 277 -
yHk(11)
'DwpfcgrSmawmh .ctor() taMumif;&Sif;jyrSmjzpfygw,f/ C++? Java? C# (odkU) b,f OOP (Object
Oriented Programming) bmompum;rSmrqdk olUrSmyg0ifwJh class member awG&JUwefzdk;udk initialize
vkyfzdkU constructor wpfckyg0ifwJh class awG&Sdygw,f/ .net rSmawmh class constructor udkemrnfay;avh
r&Sdygbl;/ Constructor &JUtwdkaumufjzpfwJh .ctor() qdkwJhtrnfomxm;ygw,f/ IsRegistered qdkwJh
member variable [m y&dk*&rfudk register vkyfxm;jcif;&Sd^r&Sd qHk;jzwfygw,f/ uRefawmfwdkUtwGuf
tcGifhta&;&&Sdapwmuawmh register jzpf^rjzpfudk constructor xJrSm initialize vkyfvdkUyg/ aumif;jyD? .ctor()
udkzGifhjyD; MunfhvdkufMu&atmif/ yHk(12)/
yHk(12)
wu,fawmh uRefawmfwdkUy&dk*&rfu unregistered jzpfaewm[m .ctor() xJu this.IsRegistered =
false; qdkwJh statement aMumifhjzpfygw,f/ 'Dae&mrSm false tpm; true vdkUjyifay;Edkifr,fqdk&ifawmh ... ☺☺
tckuRefawmfwdkU MunfhaewJh decompile vkyfxm;wJhuk'f[m C# bmompum;eJUjzpfygw,f/ yHk(12)udk
MSIL bmompum;eJU MunfhvdkufMu&atmif/ yHk(13)/
yHk(13)
yHk(13)uawmh bytecode taeeJU wdkuf&dkufbmomjyefwmyg/ .net y&dk*&rfawGudk patch vkyfzdkUqdk&if
awmh IL bmompum;taeeJUom Munfh&rSmjzpfygw,f/ wu,fawmh .net udk stack machine vdkUac:vdkU&yg
w,f/ bmaMumifhvJqdkawmh olUtvkyfawGudk register rSmxuf stack rSmvkyfvdkUyg/ Oyrmjy&&if A u
wefzdk;wpfckudk B udka&TUcsifw,fqdk&if A uwefzdk;udk stack ay: PUSH vkyfvdkufjyD; stack uaerSwqifh B
ay:jyef POP vkyfay;wmjzpfygw,f/ tjcm;pepfawGrSmqdk&ifawmh A uae B udkwdkuf&dkufa&TYajymif;jcif; (odkU)
,m,Dxm;&SdzdkUtwGuf register wpfckudk toHk;jyKjcif;rsdK; jyKvkyfygw,f/
yHk(13)udk taotcsmem;vnfEdkifzdkU IL opcode awGtaMumif; em;vnfaezdkUvdkygw,f/ yHk(13)udk
Munfhr,fqdk&if 'Duk'fESpfaMumif;twGuf stack udk tvGeftrif;toHk;jyKxm;wm awGU&rSmyg/this.IsRegistered
= false; pmaMumif;twGufudkyJ atmufrSmjyxm;wJhtwdkif; stack eJUywfoufwJhpmaMumif; 3aMumif;avmuf
bmomjyefxm;wmawGU&ygw,f/
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 278 -
L_0000: ldarg.0
L_0001: ldc.i4.0
L_0002: stfld bool Dot_Net_ReverseMe_2.frmMain::IsRegistered
'D IL instruction awGudk IL reference toHk;jyKjyD; bmomjyef&r,fqdk&if ...
ldarg.0 Argument 0 udk stack ay: ul;wifonf/
ldc.i4.0 0 udk stack ay: I4 tjzpf PUSH vkyfonf/
stfld Object obj \ field wefzdk;udk val ESifhtpm;xdk;onf/
'gudk Object-Oriented &JU pseudo uk'ftaeeJUjyefa&;jy&&ifawmh (arg0).IsRegistered = 0;
eJUwlygw,f/ Register tajctaejzpfapzdkU jyefjyifa&;oifhwmuawmh (arg0).IsRegistered = 1; jzpfygw,f/
t"dyÜm,fuawmh 'kwd, instruction udk ldc.i4.1 vkdUajymif;oifhw,fvdkU qdkvdkjcif;jzpfygw,f/
'guawmh tajccHuswJh cracking jzpfygw,f/ ldc.i4.0 &JU bytecode udkMunfhyg/ 0x16 jzpfygw,f/
ldc.i4.1 &JU bytecode uawmh 0x17 jzpfygw,f/ 'gqdk uRefawmfwdkU bmudktpm;xdk;&rvJqdkwm odygjyD/
Reflector u uRefawmfwdkUudk uk'fawGomjyygw,f/ uRefawmfwdkUajymif;csifwJh byte &Sd&m address udkrjyyg
bl;/ 'Dvdk byte/instruction awG&JU virtual address udkjyEdkifwJh tool udkawmh rawGUbl;ao;ygbl;/ 'gaMumifh
.ctor() udk Reflector rSmMunfhr,fhtpm; ILDasm eJUajymif; Munfhvdkufygr,f/ yHk(14)/
yHk(14)
wu,fawmh Method &Sd&m offset udk&Smenf;taMumif; uRefawmfwdkU avhvmjyD;ygjyD/ 'Dae&mrSmawmh
offset wefzdk;udk yHkaoenf;eJU rwGufcsufawmhbJ 02 16 7D 06 00 00 04 02 28 0E 00 00 0A qdkwJh hex
byte twGJudkyJ hex editor wpfckckrSm &dkufxnhfjyD; &SmMunfhygr,f/ yHk(15)/
yHk(15)
oifhtaeeJU MudKufwJh hex editor wpfckckudk toHk;jyKEdkifygw,f/ tckuRefawmftoHk;jyKxm;wmuawmh
WinHex 15.2 yg/ yHk(15)twdkif; &dkufxnhfjyD;&Smvdkuf&if yHk(16)twdkif;jrif&ygr,f/
yHk(16)
yHk(16)t&qdk&ifawmh .ctor() &Sd&m&JU offset tp[m 0x105C jzpfygw,f/ ydkjyD;aocsmapcsif&ifawmh
CFF explorer rSmMunfhEdkifygw,f/ yHk(16)u 16 ae&mrSm 17 vdkUjyifvdkufjyD; zdkifudkodrf;vdkufyg/ odrf;vdkufwJh
zkdifudk jyefzGifhMunhfvdkuf&ifawmh yHk(17)twdkif;awGU&rSmyg/
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 279 -
yHk(17)
'gqdk&ifawmh uRefawmfwdkU register vkyfwm atmifjrifoGm;ygjyD/ CheckReg() function udk b,fu
aeac:oHk;ovJqdkwm odcsif&ifawmh Reflector &JU CheckReg() function rSm right-click ESdyfjyD; Callee
Graph (Ctrl+E) udka&G;jyD;MunfhvdkU&ygw,f/ yHk(18)/
yHk(18)
Patch vkyfjyD; odrf;vdkufwJhzdkif&JU .ctor() udk Reflector rSmMunfhvdkuf&ifawmh yHk(19)twdkif;jrif&yg
w,f/
yHk(19)
(10) NsPack jzifh pack vkyfxm;aom .net zdkiftm; unpack vkyfjcif;
yHkrSeftm;jzifhawmh omref pack vkyfxm;wJh 32-bit PE zdkifawGrSmyJ unpack vkyfzdkU Olly udktoHk;jyKMu
wmjzpfygw,f/ 'DtcgrSmawmh .net zdkifawGudk Olly toHk;jyKjyD; unpack vkyfjyrSmjzpfygw,f/ Unpack vkyfzdkU
a&G;cs,fxm;wJhy&dk*&rfuawmh NsPack eJU pack vkyfxm;wJh UnPackMe_NsPack3.6.exe zdkifjzpfygw,f/
y&dk*&rfudk zGifhMunfhvdkufyg/ yHk(20)/
yHk(20)
PEiD eJUppfaq;Munhfvdkuf&ifawmh yHk(21)twdkif;awGU&ygw,f/
yHk(21)
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 280 -
yHk(22)
yHk(22)rSmjrif&wJhtwdkif; exe zdkif[m OEP rSm&yfwefUjcif;r&Sdovdk y&dk*&rf[m tvdktavsmuf run
aeygw,f/ uRefawmfwdkU bmvkyfoifhygovJ/ uRefawmfhtaeeJU tMuHjyKvdkwmuawmh unpack vkyfxm;wJhuk'f
awGudk rSwfOmPfxJrSm&SmzdkUyg/ 'gaMumifh owfrSwfxm;wJh string wpfckudk y&dk*&rf&JU resource xJrSm&Sm
Munfhyg/
&SmoifhwJh trnfawGuawmh button trnf? window caption eJU messagebox wdkUeJUqdkifwJh
tcsufawGjzpfygw,f/ 'Dae&mrSm uRefawmfwdkU&SmMunfhrSmuawmh yHk(20)rSmjrif&wJh button1 yg/ Resource
awGudk exe/DLL zdkifawGxJrSm unicode toGifeJU odrf;MuwmjzpfwJhtwGuf Alt+M udkESdyfjyD; button1
qdkwJhpmom;udk unicode taeeJU &SmMunfhMu&atmif/ yHk(23)/
yHk(23)
yHk(23)twdkif;&dkufxnfhjyD;&Smvdkuf&if yHk(24)twdkif; awGU&ygr,f/
yHk(24)
yHk(24)udk Text Unicode (64 chars) eJUMunfhvdkuf&ifawmh yHk(25)twdkif;awGU&rSmyg/
yHk(25)
'Dae&mrSmajymvdkwmuawmh yHk(24?25)rSmjrifae&wJh virtual address awG[m oifuGefysLwmrSmjrif&wJh
*Pef;awGeJU wlrSmr[kwfygbl;/ aemufjyD; ckuRefawmfwdkUa&muf&SdaewJhae&m[m resource section xJrSmr[kwf
ygbl;/ 'gaMumifhrdkU Alt+M ESdyfjyD; Ctrl+L eJU xyf&SmMunfhygr,f/ yHk(26)/
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 281 -
yHk(26)
yHk(26)rSm aemufxyf button1 wpfckudkawGU&jyefygjyD/ _CorExeMain udkawGUrdygovm;/ 'guawmh
.net application awGrSmom&SdwJh wpfckwnf;aom API yg/ Unicode view taeeJUMunfhvdkuf&if
yHk(27)twdkif; awGYygw,f/
yHk(27)
yHk(27)twdkif;qdk&ifawmh uRefawmfwdkU resource section xJajccsrdjyDqdkwm aocsmygw,f/
yHk(28)
aumif;jyD? yHk(27)udk HEX view taeeJUjyefMunfhjyD; tay:udk scroll enf;enf;qGJjyD;Munfhvdkuf&I fawmh
yHk(28)rSm jrif&wJhtwdkif; PE header &Sd&mudk awGU&rSmyg/
yHk(29)
yHk(28)u MZ &Sd&m virtual address (00CD0000) udkrSwfom;jyD; LordPE u Dump Region
udka&G;cs,fjyD; Dump button udka&G;cs,fyg/ 'gqdk unpack vkyfwmatmifjrifoGm;jyDjzpfygw,f/ Dump
vkyfxm;wJh Region00CD0000-00CD2000.exe zdkifudk PEiD eJUppfMunfh&ifawmh Microsoft .net bmom
pum;eJUa&;om;xm;aMumif;jyrSmyg/
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 282 -
yHk(30)
yHk(31)
yHk(32)
yHk(33)
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 283 -
yHk(34)
yHk(35)
yHk(36)
yHk(37)
yHk(38)
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 284 -
yHk(39)
yHk(40)
yHk(41)
yHk(42)
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 285 -
yHk(43)
yHk(44)
yHk(45)
yHk(46)
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 286 -
yHk(47)
yHk(48)
yHk(49)
yHk(50)
public Registration()
{
this.components = null;
this.InitializeComponent();
this.pictureReg.Image = Image.FromFile("Picture/nag_close.png");
StringBuilder volumeName = new StringBuilder(0x100);
StringBuilder fs = new StringBuilder(0x100);
bool flag = false;
Environment.GetLogicalDrives();
flag = GetVolumeInformation("c:", volumeName, (uint) (volumeName.Capacity - 1), out this.serialNum, out
this.serialNumLength, out this.flags, fs, (uint) (fs.Capacity - 1));
for (int i = 0; i <= 13; i++)
{
this.serialNum = (((((2 * this.serialNum) / 7) - (12 * this.serialNum)) + (11 * this.serialNum)) - 0x239875) ^
this.serialNum;
}
this.textcode.Text = this.serialNum.ToString();
}
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 287 -
yHk(51)
private void butOK_Click(object sender, EventArgs e)
{
string text;
FileStream stream;
BinaryWriter writer;
long num2 = Convert.ToInt64(this.serialNum);
long num4 = 0x1fca055L;
for (int i = 0; i <= 30; i++)
{
num2 = (7L * num2) ^ (num4 + 0x23c1bcL);
}
string strB = Convert.ToString(num2);
if (string.Compare(this.textregcode.Text, strB) == 0)
{
MessageBox.Show("Registered successfully!\r\nThank you for buying our product!", "Registration Successful!",
MessageBoxButtons.OK, MessageBoxIcon.Asterisk);
if (this.passControl != null)
{
this.passControl(this.textname);
}
base.Hide();
text = this.textname.Text;
stream = new FileStream("reg.key", FileMode.Create);
writer = new BinaryWriter(stream);
try
{
writer.Write(this.serialNum);
writer.Write(text);
}
finally
{
writer.Close();
stream.Close();
}
Registry.SetValue(@"HKEY_CURRENT_USER\Software\Myanmar Cracking Team\Windows Repair",
"UserName", text, RegistryValueKind.String);
}
yHk(52)
(12) .net y&dk*&rfrS Strong Name Signature tm;z,f&Sm;jcif;
yHk(53)
yHk(54)
yHk(55)
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 288 -
yHk(56)
yHk(57)
yHk(58)
yHk(59)
yHk(60)
yHk(61)
Offset 1018 – Flags – 01
Offset 1028 – StrongNameSignature RVA – 00
Offset 102C – StrongNameSignature Size – 00
Offset 1554 – Flags – 00
Offset 1558 – PublicKey – 00
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 289 -
yHk(62)
yHk(63)
yHk(64)
yHk(65)
yHk(66)
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 290 -
yHk(67)
.method public static hidebysig bool '() // CODE XREF: sub_2840+72_p
// sub_33A0+77_p ...
{
.locals init (bool V0,
class System.String V1,
class System.String V2,
class System.String[] V3)
call bool '::'()
stloc.0
ldloc.0
brfalse.s loc_3272
call class [mscorlib]System.Reflection.Assembly
[mscorlib]System.Reflection.Assembly::GetExecutingAssembly()
callvirt class [mscorlib]System.Reflection.AssemblyName
[mscorlib]System.Reflection.Assembly::GetName()
callvirt class System.String [mscorlib]System.Reflection.AssemblyName::get_Name()
stloc.1
ldc.i4.5
newarr [mscorlib]System.String
stloc.3
ldloc.3
ldc.i4.0
ldstr "Your evaluation period for "
stelem.ref
ldloc.3
ldc.i4.1
ldloc.1
stelem.ref
ldloc.3
ldc.i4.2
ldstr " has expired. Product functionality will be limited."
yHk(68) IDA Pro jzifh zGifhxm;yHk
yHk(69)
yHk(70)
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 291 -
yHk(71)
IDA View opcode (CFF Explorer) Instruction (CFF Explorer)
call class [mscorlib]System.Reflection.Assembly 28 E7 00 00 0A call 0x0A0000E7
callvirt class [mscorlib]System.Reflection 6F E8 00 00 0A callvirt 0x0A0000E8
yHk(72)
IDA View opcode (CFF Explorer) Instruction (CFF Explorer)
ldc.i4.0 16 ldc.i4.0
ret 2A ret
yHk(73)
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 292 -
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 293 -
tcef;(18) – Visual Dot.net jzifh a&;om;xm;aom y&dk*&rfrsm;udk crack vkyfjcif; - 294 -
tcef;(19) – rdkbdkif;zkef; application rsm;udk crack vkyfjcif; - 295 -
225 relocs
... // here the dump of the relocation section
Idata Size=00000240
Offset of import address table (relative to code section): 00000d08
yHk(4)
class E32ImportSection
{
public:
TInt iSize; // size of this section
// E32ImportBlock[iDllRefTableCount];
};
class E32RelocSection
{
public:
TInt iSize; // size of this relocation section
TInt iNumberOfRelocs; // number of relocations in this section
};
yHk(1)
tcef;(20) - Loader oDtdk&DESifh patch zdkifzefwD;jcif; - 302 -
yHk(2)
yHk(2)u ESpfouf&mar;cGef;udk a&G;vdkufyg/ yHk(3)twdkif; password awmif;ygvdrfhr,f/
yHk(3)
yHk(3)twdkif; password &dkufxnhfvkdufjyD; OK button udkESdyfvdkuf&if bm MessageBox (Message)
rSray:bJ yHk(1)udk jyefa&mufoGm;ygw,f/ 'guawmh y&kd*&rftvkyfvkyfyHkyg/ aumif;jyD? y&dk*&rfudk PEiD eJU
ppfMunfhvdkufMu&atmif/ yHk(4)/
yHk(4)
PEiD eJU ppfaq;csuft&awmh PEtite 2.x vdkUjyygw,f/ Protection ID 6.2.3 uawmh PEtite 2.2
eJU protect vkyfxm;w,fvdkUajymygw,f/ Protection ID uawmh protector awGeJUywfoufjyD; ydkjyD;wduswJh
tajzudk ay;Edkifygw,f/ 'gqdk&ifawmh y&dk*&rfudk unpack vkyfzdkUvdkvmygjyD/ y&dk*&rfudk Olly rSmzGifhyg/
yHk(5)
tcef;(20) - Loader oDtdk&DESifh patch zdkifzefwD;jcif; - 303 -
yHk(6)
yHk(6)twdkif; Follow in Dump udka&G;vdkuf&ifawmh yHk(7)twdkif;jrif&rSmyg/
yHk(7)
yHk(7)u highlight jzpfaewJh 38 07 91 7C rSm right-click ESdyfjyD; Breakpoint u Hardware, on
access Æ WORD udka&G;vdkufyg/ jyD;&ifawmh F9 (Run) udkESdyfvdkufyg/ yHk(8)twdkif; jrif&ygr,f/
yHk(8)
F9 (Run) udkESdyfvdkufwJhtcgrSmawmh hardware breakpoint &Sd&m VA 004BA03D rSm &yfoGm;wm
awGU&ygr,f/ xl;qef;wmu uRefawmfwdkU entry point &Sd&m VA 004BA042 rSm MOV EAX, XXX tpm;
JMP 00484724 vdkUjzpfaewmawGY&ygw,f/ 'gaMumifhvJ 'D virtual address ae&mudk apmifhMunfh cdkif;xm;wm
jzpfygw,f/ ☺☺/ wu,fawmh PEtite u entry point ae&mem;rSmyJ uk'fawGudk decompress vkyfwmjzpf
ygw,f/ VA 004BA042 &Sd&mqDa&mufvmatmif F8 udkESdyfvmyg/ JMP 00484724 [m y&dk*&rf&JU OEP
&Sd&mudk jump vkyfygw,f/ yHk(9)/
yHk(9)
yHk(9)u OEP &Sd&mudka&mufjyDqdk&if dump vkyfygr,f/ Right-click ESdyfjyD; Dump debugged
process udka&G;vdkufyg/ yHk(10)twdkif; jrif&ygr,f/
yHk(10)
tcef;(20) - Loader oDtdk&DESifh patch zdkifzefwD;jcif; - 304 -
yHk(11)
yHk(11)[m uRefawmfwdkU tapmydkif;ujrifcJhwJh yHk(1)eJUawmh vHk;vHk;MuD;jcm;em;aeygw,f/ zdkif&JUt&G,f
tpm;udk Munfhvdkufjyef&ifvJ yHk(12)twdkif; jrif&ygw,f/
yHk(12)
'DyHkpHtwdkif;qdk&ifawmh uRefawmfwdkU unpack vkyfvdkufwm tukefygrvmrSef;aocsmygw,f/ usefcJhwJh
tydkif;uawmh HTML zdkifawGygwJhtydkif;jzpfygw,f/ Dump vkyfvdkufwJhzdkifudk PEiD eJUppfMunfhyg/ Borland
Delphi 3.0 eJUa&;om;xm;w,fvdkUjyygw,f/ wu,fawmh uRefawmfwdkU dump vkyfvkdufwJhzdkif[m Web
Compiler aqmhzf0Jvfoufoufomjzpfygw,f/ dump.exe &JU File menu u Compiler Option udka&G;vdkuf
yg/ yHk(13)twdkif; jrif&ygr,f/ (Jsittarh.exe &JU File menu rSmawmh Compiler Option ygrvmygbl;/)
yHk(13)
yHk(13)udk taotcsmMunfhyg/ yHk(3^14)rSmjrif&wJh dialogbox [m yHk(13)aMumifhjzpfwmem;vnfyg
ovm;/ aqmhzf0Jvfu password udkxkwfay;zdkUtwGuf yxrqHk; master key wpfckudkzefwD;ygw,f/ jyD;awmhrS
tcef;(20) - Loader oDtdk&DESifh patch zdkifzefwD;jcif; - 305 -
user key ay:vdkufjyD; password udkzefwD;ygw,f/ 'DvkdrsdK; password routine uae password udkcefUrSef;zdkU
qdkwm enf;enf;av;awmh vuf0ifrSmyg/ TEAM LAXiTY uawmh key udkwGufcsufzl;ygw,f/ uRefawmf
cracking e,fy,fudk r0ifcifwkef;uawmh 'D key av;ukdyJtoHk;jyKcJhwmyg/ Key uawmh 15416??? jzpfyg
w,f/ 'Dae&mrSmawmh uRefawmfhtaeeJU key udkajymjyrSmr[kwfygbl;/ wu,fvdkU key udkodcsif&ifawmh oif
udk,fwdkif &SmazGwGufcsuf&rSmjzpfygw,f/ 'grSom cracker yDorSmjzpfygw,f/ ☺☺☺☺☺☺☺☺☺
yHk(14)
Dump.exe rSm tcsuftvuftcsdKUudk &SmazGod&SdjyD;wJhaemuf Jsittarh.exe udkjyefMunfhvdkufMu&atmif/
yHk(15)
yHk(15)rSm dump vkyfjyD; cP&yfxm;cJhwmudk jyefqufMu&atmif/ OEP ae&mudkodjyD;jyDrdkU hardware
breakpoint awGudk zsufvdkU&ygjyD/ zsufjyD;oGm;&ifawmh F9 (Run) udkESdyfvkdufyg/ yHk(1)twdkif;awGU&ygr,f/
'Dtaetxm;a&muf&if 79nn u 7900 » DNS problems in .. udkzGifhjyD; register vkyfzdkU MudK;pm;Munfhygr,f/
yHk(16)/
yHk(16)
yHk(16)twdkif;jrif&wJhtcgrSm Olly rSm F12 udkESdyfjyD; y&dk*&rfudk cP&yfvdkufyg/ yHk(17)twdkif; jrif&yg
r,f/
yHk(17)
Alt + K udkESdyfjyD; Call Stack udkMunfh&if yHk(18)twdkif;jrif&ygw,f/
yHk(18)
tcef;(20) - Loader oDtdk&DESifh patch zdkifzefwD;jcif; - 306 -
yHk(19)
yHk(19)&JU VA 0047E52D u CALL 00403AFC udk ppfaq;Munfhvkdufyg/ EAX &JUwefzdk;awG
ajymif;vJaewm awGU&rSmyg/ 'Dae&mrSm pdwft0ifpm;qHk;uawmh VA 0047E53C ae&myg/ 'Dae&mrSm JE
0047E5E0 (0F,84,9E,00,00,00) tpm; JMP 0047E5E0 (E9,9F,00,00,00,90)vdkUjyifjyD; y&dk*&rfudk run
Munfhvdkufyg/ Breakpoint awGtm;vHk;udk rvkdawmhwJhtwGuf jyefjzKwfvkdufyg/ (rSwcf suf/ / Hex *Pef;awG
udkawmhh pm&GufvGwfwpf&GufrSmcsa&;xm;yg/ toHk;0ifvmygvdrfhr,f/)
yHk(20)
yHk(20)twdkif; uk'fudkjyifjyD; y&dk*&rfudk run MunfhvdkufwJhtcg yHk(21)twdkif; jrif&ygw,f/
yHk(21)
'gqdk uRefawmfwdkUzwfcsifaewJh taMumif;t&mudk key rodbJzwfvdkU&ygjyD/ 'gayr,fh 0rf;enf;p&m
aumif;wmuawmh y&dk*&rfudk Olly rSmzGifhxm;wkef;yJ 'DvdkzwfvdkU&wmyg/ uRefawmfwdkUtaeeJU MudKufwJhtcsdefrSm
MudKufovdkzwfvdkU&Edkifatmif patch vkyfzdkUawmhvdkygjyD/ aumif;jyD? uRefawmfwdkU uk'fawGjyifxm;wJhzdkifudk Olly
rSm odrf;qnf;vdkufyg/ yHk(22)rSm jrif&wJhtwdkif; zdkifudk odrf;qnf;vdkUr&ygbl;/
tcef;(20) - Loader oDtdk&DESifh patch zdkifzefwD;jcif; - 307 -
yHk(22)
bmaMumifh 'Dvdk error wuf&wmvJqdkwm tajz&Sm&atmif/ y&dk*&rf (Jsittarh.exe) udk Olly eJUjyefzGifh
vdkufyg/ Entry point (004BA042) udkatmufygtwdkif; awGU&ygw,f/
yHk(23)
'DtcsdefrSm uRefawmfwdkU patch vkyfr,fhae&mjzpfwJh VA 0047E53C qDoGm;MunfhvdkufMu&atmif/
yHk(23)/
yHk(24)
/// bmqdkbmuk'frS rawGUygbl;/ oknawGyJ&Sdygw,f/ ckeujrifcJhwJhuk'fawG[m decompression
stub u unpack vkyfjyD;ae&mvmcsay;xm;vdkUjzpfygw,f/ wu,fawmh unpack vkyfjyD;om;zdkifawGrSmqdk 'Dvdk
jyóemrsdK; MuHK&rSmr[kwfygbl;/ 'gayr,fh PEtite udk uRefawmfwdkU unpack vkyfwm ratmifjrifcJhygbl;/
'gaMumifh 'Djyóemudkajz&Sif;Edkifatmif loader zdkifudkzefwD;ay;zdkUvdkygjyD/ Loader &JUtvkyfuawmh PEtite u
y&dk*&rfudk rSwfOmPfrSm process tjzpfae&mcsxm;jyD; unpack vkyfcsdefrSm patch vkyfr,fh byte (uk'f)
udkvdkuf&SmjyD; udk,fESpfouf&m byte (uk'f) eJUtpm;xdk;zdkUjzpfygw,f/
Loader/Patch zdkifudkzefwD;zdkU ABEL Loader Generator 2.31 udkzGifhvdkufyg/ yHk(25)/
yHk(25)
tcef;(20) - Loader oDtdk&DESifh patch zdkifzefwD;jcif; - 308 -
yHk(26)
Loader zdkifudkzefwD;jyD;wJhaemufrSmawmh loader zdkif (Jsittarh_Loader.exe) udk Jsittarh.exe eJU
directory wpfckwnf;atmufrSmxm;jyD;zGifhMunfhvdkufyg/ yHk(27)twdkif;awGU&jyD; bm key rS&dkufxnfhp&mrvdkbJ^
rawmif;bJ tm;vHk;tqifajyoGm;ygvdrfhr,f/
yHk(27)
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 309 -
(1) Transposition
- Yusceiyupioelyyonyueoeypioiorertsorrsnreigadobcmisrsnr
(2) Substitution
(2.1) Monoalphabetic substitution
rlvpmom;
- abcdefghijklmnopqrstuvwxyz
Crypt vkyfxm;aompmom;
- DEFGHIJKLMNOPQRSTUVWXYZABC ('DOyrmrSmawmh nmzufudk rotate vSnfhxm;
(2.2) Key ygaom Monoalphabetic substitution
(3) Frequency Analysis
(4) Le Chiffre Indéchiffrable
rlvpmom;
abcdefghijklmnopqrstuvwxyz
Crypt vkyf&efqGJxm;aomZ,m;
1 BCDEFGHIJKLMNOPQRSTUVWXYZA
2 CDEFGHIJKLMNOPQRSTUVWXYZAB
3 DEFGHIJKLMNOPQRSTUVWXYZABC
4 EFGHIJKLMNOPQRSTUVWXYZABCD
5 FGHIJKLMNOPQRSTUVWXYZABCDE
6 GHIJKLMNOPQRSTUVWXYZABCDEF
7 HIJKLMNOPQRSTUVWXYZABCDEFG
8 IJKLMNOPQRSTUVWXYZABCDEFGH
9 JKLMNOPQRSTUVWXYZABCDEFGHI
10 KLMNOPQRSTUVWXYZABCDEFGHIJ
11 LMNOPQRSTUVWXYZABCDEFGHIJK
12 MNOPQRSTUVWXYZABCDEFGHIJKL
13 NOPQRSTUVWXYZABCDEFGHIJKLM
14 OPQRSTUVWXYZABCDEFGHIJKLMN
15 PQRSTUVWXYZABCDEFGHIJKLMNO
16 QRSTUVWXYZABCDEFGHIJKLMNOP
17 RSTUVWXYZABCDEFGHIJKLMNOPQ
18 STUVWXYZABCDEFGHIJKLMNOPQR
19 TUVWXYZABCDEFGHIJKLMNOPQRS
20 UVWXYZABCDEFGHIJKLMNOPQRST
21 VWXYZABCDEFGHIJKLMNOPQRSTU
22 WXYZABCDEFGHIJKLMNOPQRSTUV
23 XYZABCDEFGHIJKLMNOPQRSTUVW
24 YZABCDEFGHIJKLMNOPQRSTUVWX
25 ZABCDEFGHIJKLMNOPQRSTUVWXY
26 ABCDEFGHIJKLMNOPQRSTUVWXYZ
(5) Charles Babbage & Vigenére
Vigenére udka&Smif&Sm;jcif;
Vigenére crypto tpGrf;xufjcif;u
a b c d e f g h i j k l m n o p q r s t u v w x y z
09 48 13 01 14 10 06 23 32 15 04 26 22 18 00 38 94 29 11 17 08 34 60 28 21 02
12 81 41 03 16 31 25 39 70 37 27 58 05 95 35 19 20 61 89 52
33 62 45 24 50 73 51 59 07 40 36 30 63
47 79 44 56 83 84 66 54 42 76 43
53 46 65 88 71 72 77 86 49
67 55 68 93 91 90 80 96 69
78 57 99 75
92 64 85
74 97
82
87
98
HNE 0IQWtG OY98CKÂ5u YfTBÅ7| pA vÏÃ2ä] éJ 1W[UZÂjweh3 XÈ i
åÅçgÄvâ ìqmV-sSkboDÁÏI6 }dcaäYz xÉÆÊÇÎË ÍL åét2Wë ãSáÌèDíæT
2.2, 9u ï]HÂ0|Cà X13-5Ã ëZ7gycK. Ulî Ëpx8MEçeikÅÄI ÏtDQw1GB o
äJÁ æA 3éVAObfuch[ jqÇvsz| åWÃ2Â] ÈÆmV-ÎSád}xíïÉ 2.2 Êçg
vÅI2Ïë âãàA-îSHÌèDK0T ]EZì5t9Q GËäUé7u, årWc{ ÂB Å|xy1O3 vÏeÀ
kNäJ Dpën ÄV åéÃ2W].
(6) Playfair
C H A R L
E S B D F
G I/J K M N
O P Q T U
V W X Y Z
rlvpmom;
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 311 -
rlvpmom;
Attack at 2230
Crypt vkyfxm;aompmom;
DV DD DD DV FG FD DV DD VX VX AF XG
M A R K A K M R
D V D D V D D D
D D D V D V D D
F G F D G D F F
D V D D V D D D
V X V X X X V V
A F X G F G A X
aemufqHk; crypt vkyfvdkufaompmom;
VD DD DV DD GD FF VD DD XX VV FG AX
bmaMumifh A? D? F? G? V eJU X udk toHk;jyK&ovJqdk&ifawmh
toHk;trsm;qHk; crypto algorithm awGuawmh ADELR32? AES?
yHk(1)
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 312 -
yHk(2)
yHk(3)
yHk(4)
yHk(5)
yHk(6)
yHk(7)
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 313 -
yHk(8)
yHk(9)
yHk(10)
yHk(11)
yHk(12)
'D loop udk vkyfaqmifjyD;csdefrSmawmh MyanmarCrackingTeam-1234-5678-9012-3456 [m BF A7
26 FF 5B A1 AD CF 43 A7 94 F1 82 16 6F 9C 6E 2C 4C DB 51 20 47 4A F5 B0 45 D3 CC 20 47
3D DF FD 19 53 D7 B7 jzpfoGm;ygw,f/ yHk(13)/
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 314 -
yHk(13)
yHk(14)
yHk(15)
yHk(16)
1/
yHk(17)
2/
yHk(18)
3/ MFC71.781 function uawmh
yHk(19)
4/ MFC71.4085 function udk
yHk(20)
5/ CALL UILib71.0034217
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 315 -
yHk(21)
6/ CALL UILib71.0035
yHk(22)
6.1/ CALL
yHk(23)
yHk(23
6.1.1/
yHk(24)
yHk(25)
6.1.2/
yHk(26)
yHk(27)
6.1.2.1/ yHk(27)u C
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 316 -
yHk(28)
yHk(28)eJU yHk(
yHk(29)
y
yHk(30)
yHk(31)
yHk(32)
6.1.3/
yHk(33)
yHk(34)
6.1.3.1/ CALL U
6.1.3.1.1/
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 317 -
yHk(35)
7/
yHk(36)
8/
yHk(37)
9/ yHk(36)rSm
yHk(38)
yHk(39)
9/ yHk(38)
yHk(40)
10/ yHk(41)u CALL MFC71.1916
yHk(41)
11/ yHk(42)u CALL MFC71.
yHk(42)
12/ yHk(42)u CALL
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 318 -
yHk(43)
,f/
yHk(44)
Xilisoft application awGeJUywfoufjyD; rSwfcsufjyK&r,fqdk&ifawmh ...
1/ Xilisoft application awG[
2/ Serial awG[m
5/ -1a□d□o□o□v.r□e.u□i□c□n□e.t.r00MYANMARCRACKINGTEAM-audioconverte)
6/ (Oyrm - ab6801efdd311d00c7a5a08b983315 d0)
7/
yHk(45)
yHk(46)
yHk(47)
yHk(48)
(10) Exe Password 2004 jzifh protect vkyfxm;aom password tm; jyefazmfjcif;
'DwpfcgrSmawmh ]Patch vkyfjcif;} oifcef;pmu ]Beginner tqifh patch vkyfjcif;} tcef;rSm protect
vkyfcJhwJh password udk jyefazmfMunfhygr,f/
'DwpfcgrSmawmh tajymif;tvJav;jzpfatmif calc.exe udk protect rvkyfbJ notepad.exe udkom
protect vkyfMunfhygr,f/ yHk(49)/
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 319 -
yHk(49)
yHk(50)
yHk(51)
yHk(52)
yHk(53)
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 320 -
yHk(54)
yHk(55)
yHk(56)
yHk(57)
yHk(58)
yHk(59)
1/ MOV EDX, [LOCAL.1]
2/ MOV DL, BYTE PTR DS:[EDX+ESI-1]
3/ MOV ECX, [LOCAL.2]
4/ MOV CL, BYTE PTR DS:[ECX+EBX-1]
5/ XOR DL, CL; DL = DL ^ CL = a ^ 3 = R
6/ MOV BYTE PTR DS:[EAX+ESI-1], DL
7/ INC EBX
8/ INC ESI
EDX xJrSm&SdwJh aemufxyfpmvHk;awGudk zwfEdkifzdkUtwGuf ESI wefzdk;udk wpfaygif;ygw,f/
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 321 -
yHk(60)
yHk(61)
yHk(62)
yHk(63)
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 322 -
yHk(64)
yHk(65)
yHk(66)
#include<stdio.h> // Copyright © Myo Myint Htike, September 20 2009
#include<conio.h> // Compiler - Borland C++ 5.02
int main()
{
int index = 0;
int encrypted_password[7] = {2, 6, 6, 0xD, 0, 6, 6};
char decrypted_password[30] = {0};
char hash_value[20] = "3459501211xSSSFDb345";
while(index < 7) {
decrypted_password[index] = encrypted_password[index] ^ hash_value[index];
index++;
}
printf("Serial is = %s", &decrypted_password[0]);
getch();
return 0;
}
yHk(67)
yHk(68)
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 323 -
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 324 -
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 325 -
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 326 -
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 327 -
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 328 -
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 329 -
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 330 -
tcef;(21) - Crypto uk'frsm;udk avhvmjcif; - 331 -
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 332 -
yHk(1)
yHk(2)
yHk(3)
yHk(4)
yHk(5)
yHk(6)
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 333 -
yHk(7)
yHk(8)
yHk(9)
INFO: : Olly u 'Duk'fawGudk
yHk(10)
yHk(11)
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 334 -
yHk(12)
yHk(13)
yHk(14)
yHk(15)
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 335 -
The GetModuleHandle function returns a module handle for the specified module if the file has been
mapped into the address space of the calling process.
HMODULE GetModuleHandle(
LPCTSTR lpModuleName // address of module name to return handle for
);
Parameters
lpModuleName
Points to a null-terminated string that names a Win32 module (either a .DLL or .EXE file). If the filename
extension is omitted, the default library extension .DLL is appended. The filename string can include a trailing point
character (.) to indicate that the module name has no extension. The string does not have to specify a path. The name
is compared (case independently) to the names of modules currently mapped into the address space of the calling
process.
If this parameter is NULL, GetModuleHandle returns a handle of the file used to create the calling process.
Return Values
If the function succeeds, the return value is a handle to the specified module.
If the function fails, the return value is NULL. To get extended error information, call GetLastError.
yHk(16)
MOV EDI, 00401011; // EDI xJrSm
yHk(17)
yHk(18)
yHk(19)
yHk(20)
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 336 -
yHk(21)
yHk(22)
yHk(23)
yHk(24)
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 337 -
yHk(25)
INFO: : 'Dae&mrSm uk'fawG[m
yHk(26)
INFO: : Code section [m
yHk(27)
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 338 -
yHk(28)
yHk(29)
yHk(30)
yHk(31)
yHk(32)
yHk(33)
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 339 -
yHk(34)
yHk(34)udkMunfhr,fqdk&if self-modifying code u
yHk(35)
yHk(36)
E1 wefzdk;udk
yHk(37)
F8 udkESdyfjyD;
yHk(38)
yHk(38)udkMunfhr,fqdk&if
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 340 -
yHk(39)
VA 0040101F a&mufwJhtxd
int MessageBox(
HWND hWnd, // handle of owner window
LPCTSTR lpText, // address of text in message box
LPCTSTR lpCaption, // address of title of message box
UINT uType // style of message box
);
Parameters
hWnd
Identifies the owner window of the message box to be created. If this parameter is NULL, the message box
has no owner window.
yHk(40)
yHk(41)
'gaMumifh VA 40106A qD jump vkyfay;Edkifr,fh
INFO: : wu,fawmh nag udkz,f&Sm;wJh
yHk(42)
yHk(43)
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 341 -
yHk(44)
yHk(45)
yHk(46)
yHk(47)
INFO: : Self-modifying code &JU 'kwd,tpdwftydkif;uawmh
yHk(48)
yHk(49)
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 342 -
yHk(50)
yHk(51)
yHk(51)rSmjrif&wJhtwdkif; 'Dy&dk*&rfudka&;om;wJh y&dk*&rfrmu uRefawmfwdkUudk tcufawGUatmifvkyfwm
yg/ ajc&mcH&r,fh oufaoawGtm;vHk;udk olr(Lena151)u zsufqD;vdkufygw,f/
rSwfcsuf/ / wu,fawmh 'Dy&kd*&rfu oifhudk tajccHtawG;tac:&&HktwGuf jyowmjzpfygw,f/ vufawGYrSm
awmh
INFO: : Polymorphic uk'fqdkwmuawmh
INFO: : Encryption uawmh polymorphism udk
INFO: : Metamorphic uk'fqdkwmuawmh oludk,fwdkifjyefjyD;
INFO: : Alphanumeric uk'fuawmh
INFO: : Shell uk'fqdkwmuawmh aqmhzf0Jvf bug uae tcGifhaumif;,ljyD;
INFO: : Machine uk'f (odkU) machine bmompum; qdkwmuawmh
instruction set awGrSmvJ operand wpfckwav csdKUwJhEdkifygw,f/ (Oyrm - NOSC)
yHk(52)
yHk(53)
tusOf;csKyfjyef&Sif;jy&r,fqdk&ifawmh 'Dy&dk*&rfav;[m
yHk(54)
VA 401016 eJU
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 343 -
yHk(55)
yHk(56)
INFO: :
XOR A, B; // C
XOR A,
yHk(57)
yHk(58)
yHk(59)
yHk(60)
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 344 -
yHk(61)
yHk(62)
yHk(63)
yHk(64)
INFO: : uRefawmfhtaeeJU 1 byte
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 345 -
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 346 -
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 347 -
tcef;(22) - Polymorphic uk'frsm;udk avhvmjcif; - 348 -
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 349 -
yHk(1)
'Dy&dk*&rfudk SVK Protector eJU protect vkyfxm;wmjzpfygw,f/ omreftm;jzifhawmh uRefawmfhtaeeJU
pack vkyfxm;wmudk unpack vkyfjyzdkU wm0efr&Sdygbl;/ bmaMumifhvJqkdawmh unpack vkyfenf;udk ]Packer
(Protector) rsm;} tcef;rSm aqG;aEG;jyD;jzpfvdkUyg/ 'gayr,fh uRefawmfhtaeeJU 'Dtcef;rSm SVKP eJU pack
vkyfxm;wmudk b,fvdk unpack vkyf&rvJqdkwmudk wcgwnf;&Sif;jyrSmjzpfygw,f/ SVKP udk a&;om;ol
uawmh Pavol Cerven yg/ 'Demrnfudk aemufwpfcgxyfawGU&jyefygjyD/ SVKP eJUywfoufwJh unpacker
awGudkrawGU&wmuwaMumif;? SVKP eJUywfoufwJh unpacking oifcef;pmtcsdKU[mvJ tvkyfrjzpfwmu
waMumif;rdkU oihftaeeJU unpack vkyf&wmtcuftcJjzpfrSmpdk;&drfwJhtwGuf unpack vkyfenf;udkyg wcgwnf;
&Sif;jy&jcif;jzpfygw,f/ (AHTeam ua&;om;xm;wJh Quick Unpack 2.1 [m packer awmfawmfrsm;rsm;udk
unpack vkyfay;Edkifayr,fh SVKP eJU protect vkyfxm;wJhzdkifawGtwGuf jyóem tenf;i,f&Sdaeygw,f/)
SVKP [m zdkifudk protect vkyfzdkUtwGuf rwlnDwJh enf;vrf;4&yfudk toHk;jyKygw,f/ 'gawGuawmh (1) RSA
algorithm udk toHk;jyKjcif;? (2) API function rsm;udkvSnfhpm;rIjyKvkyfxm;jcif;? (3) anti-debug vSnfhpm;rI
rsm;xnfhoGif;xm;jcif;? (4) rSwfOmPfESifh tracer awGrS dump rvkyfEdkifatmifumuG,fxm;jcif; wdkUjzpfygw,f/
(1) SVKP jzifh protect vkyfxm;aomzdkiftm; unpack vkyjf cif;
'Doifcef;pmudk ydkjyD;em;vnfatmifvdkU uRefawmfhtaeeJU atmufygtwdkif; tydkif;(5)ydkif; cGJjyD;aqG;aEG;rSm
jzpfygw,f -
(1.1) OEP udk &Smjcif;
(1.2) Stolen byte rsm;udk &Smjcif;
(1.3) zdkifudk dump vkyfjcif;
(1.4) IAT udkjyifjcif;
(1.5) zdkifudkjyifjcif;
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 350 -
yHk(2)
yHk(2)rSm jrif&wJhtwdkif; Trace real entry blockwise radio button udk a&G;cs,fyg/ 'ghtjyif Pass
exceptions to SFX extractor checkbox udkvJ check vkyfvdkufyg/ 'gawGudk bmaMumifh a&G;cs,f&ovJ
qdkwmawmh &Sif;jyawmhrSm r[kwfygbl;/ bmaMumifhvJqdkawmh Olly &JU Help zdkifrSm tao;pdwf &Sif;jyxm;vdkUyg/
Trace real entry blockwise (inaccurate)
OllyDbg uses 4-K blocks to step through the packed code. This method may cause detection of false real
entry.
Pass exceptions to SFX extractor
This option tells OllyDbg to pass some kinds of software exceptions that occur while tracing for real SFX
entry (memory access violation, INT3 breakpoint, division by 0, privileged or illegal instruction) directly to self-
extractor.
yHk(3)
yHk(3)rSm jrif&wJhtwdkif; VA 0053F432 rSm Olly [m &yfoGm;rSmyg/ ckqdk&if uRefawmfwdkU[m stolen
byte awGaemufu code section xJu yxrqHk; instruction &Sd&ma&mufaeygjyD/ 'gudk uRefawmfwdkU b,fvdk
odovJqdkwm odEdkifatmifvdkU VA 0053F432 &JU tay:zufudk scroll enf;enf;avmufqGJjyD; Munfh&atmif/
yHk(4)/
yHk(4)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 351 -
yHk(5)
yHk(5)u No button udk a&G;vdkufyg/ Entry point udka&mufwJhtcg Alt+O udkESdyfjyD; yHk(6)twdkif;
Exception tab udkjyifvdkufyg/
yHk(6)
yHk(6)rSm Memory access violation eJU Ignore aslo following … udk jzKwfvdkufygw,f/
'gjyD;&ifawmh yHk(7)twdkif; entry point &Sd&mudk jyefoGm;vdkufyg/
yHk(7)
yHk(7)rSm F7 udk wpfcgESdyfjyD; CALL function &Sd&m VA 00731001 udkoGm;yg/ CALL function
&Sd&mudk a&mufjyDqdk&if Registers window udk Munfhvdkufyg/ yHk(8)/
yHk(8)
yHk(8)udkMunfhvdkuf&if ESP register ae&mrSm eDaewmudk awGU&rSmyg/ bmaMumifhvJqdkawmh ESP
wefzdk;ajymif;vJoGm;vdkUyg/ 'Dae&mrSm right-click ESdyfjyD; Follow in Dump udka&G;vdkufyg/ yHk(9)twdkif;
awGU&ygr,f/
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 352 -
yHk(9)
yHk(9)u 38 07 91 70 ae&mrSm right-click ESdyfjyD; hardware, on access u Dword udka&G;vdkufyg/
jyD;&if F9 (Run) udk ESdyfvdkufyg/
yHk(10)
yHk(10)twdkif; exception udkjrif&wJhtcg Shift+F9 udkESdyfyg/ Exception error wufwdkif; Shift+F9
udkESdyfyg/ yHk(11)udkawGU&ygr,f/ SVKP version ay:rlwnfjyD; Shift+F9 udkESdyfwJhta&twGuf[m 4Mudrf (odkU)
4Mudrfxufydkygvdrfhr,f/
yHk(11)
yHk(11)twdkif;awGUwJhtcg Alt + M udkESdyfjyD; memory map window udkac:yg/ yHk(12)/
yHk(12)
yHk(12)u highlight jzpfaewJhae&mrSm right-click ESdyfjyD; set memory breakpoint on access udk
a&G;cs,fyg/ jyD;&if Shift+F9 udkESdyfyg/ yHk(13)twdkif; jrif&ygr,f/
yHk(13)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 353 -
yHk(13)uawmh SVKP &JU decompression code jzpfygw,f/ 'Dtcg Alt+M udka&G;jyD; PE header
ay:rSm right-click ESdyfyg/ jyD;&if Remove memory breakpoint udka&G;cs,fyg/ 'Dvdk memory breakpoint
udkz,f&Sm;jyD;&ifawmh Shift+F9 udkESdyfyg/ aemufxyf PUSHAD instruction &Sd&mrSm &yfwefUygvdrfhr,f/
yHk(14)/
yHk(14)
yHk(14)twdkif;jrif&wJhtcg uRefawmftapmydkif;u pm&GufvGwfwpf&GufrSm rSwfcdkif;xm;wJh OEP (VA
0053F432) qDukdoGm;zdkU jyifygr,f/ Ctrl+G ukdESdyfjyD; OEP wefzdk;udk&dkufxnfhyg/ yHk(15)/
yHk(15)
yHk(15)u OK button udka&G;vdkuf&if yHk(16)twdkif; jrif&rSmyg/
yHk(16)
VA 0053F432 ae&mrSm omref breakpoint wpfckowfrSwfvdkuf&if yHk(16)twdkif;jrif&rSmyg/
aumif;jyD? 'DtcsdefrSm hardware breakpoint awGudkrvdkawmhwJhtwGuf Debug menu u Hadrware
breakpoints udka&G;jyD; breakpoint awGudkzsufvdkufyg/ jyD;&ifawmh trace vdkufEdkifzdkU Ctrl+F11 (Trace into)
udka&G;vdkufyg/ 'Dtcg uRefawmfwdkU omref breakpoint owfrSwfvdkufwJh OEP ae&mudk ESpfpuúefUtwGif;
a&mufvmygw,f/ 'DhaemufrSmawmh uRefawmfwdkU stolen bytes udk&SmzdkU trace vdkufcJhwJhae&mawGudk jyefMunfhzdkU
vdkvmygjyD/ Olly &JU View menu u Run trace udka&G;vdkufyg/ yHk(17)/
yHk(17)
yHk(17)uawmh Olly u PUSHAD uae CALL 0042B5E4 xd trace vkyfoGm;wmudk jywmyg/
Highlight jzpfaewJhae&muawmh uRefawmfwdkU&SmaewJh stolen bytes ygyJ/ ààà
INFO: : Stolen bytes qdkwmuawmh rlv exe zdkifuae ,lvmcJhwJh? rlv exe zdkifuaezsuf,lvmcJhwJh
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 354 -
pmvHk;awGjzpfjyD; packer &JU uk'fxJrSm vmxm;ygw,f/ 'DpmvHk;awG[m OEP rSm&SdwJh rSwfOmPfuae dump
vkyfjyD;wJhaemufrSmawmh dump vkyfxm;jyD;om; exe zdkifxJrSmawmif r&Sdawmhygbl;/ (&Sdr,fvdkU arQmfvifhxm;wJh
ae&mrSmawmif r&Sdawmhygbl;/) 'ghaMumifhrdkUvJ y&dk*&rfawG[m crash jzpfMuwmyg/ qdkvdkwmuawmh 'g[m
y&dk*&rfudk crack rvkyfEdkifatmif umuG,frw I pfckyg/ y&dk*&rfawGudk pack vkyfxm;wJhtcsdefrSmawmh crash
rjzpfygbl;/ bmaMumifhvJqdkawmh 'D stolen bytes awG[m OEP ra&mufciftwGif;rSm protector xJ run
aeMuvdkUyg/
(1.3) zdkifudk dump vkyjf cif;
'DwpfcgrSmawmh OEP udkawGUjyDjzpfwJhtwGuf process (Task ManagerrSmtvkyfvkyfaewJh DAP.exe)
udk dump vkyfMuygr,f/ Olly rSm right-click ESdyfjyD; make dump of process udka&G;vdkufyg/ yHk(18)twdkif;
awGU&ygr,f/
yHk(18)
yHk(18)u Get MAP button udka&G;vdkufyg/ yHk(19)/
yHk(19)
yHk(17)wkef;u uRefawmfwdkU&JU stolen byte awG&Sd&mudk rSwfrdygao;vm;/ 'Dae&mem;a&mufwJhtxd
scroll qGJjyD;Munfhvdkufr,fqdk&if yHk(19)twdkif; jrif&rSmyg/ 00E60000 ae&mudka&G;jyD; Add button udkESdyfyg/
yHk(20)twdkif; jrif&ygr,f/
yHk(20)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 355 -
yHk(21)
aemufxyfvkyf&rSmuawmh yHk(19)u 00E90000 ae&mudka&G;jyD; Add button udkESdyfyg/
yHk(22)
'DwpfcgrSmvJ yHk(22)u Name qdkwJhtuGufrSm oifESpfouf&mtrnfwpfck &dkufxnhfvdkufjyD; Apply
button udka&G;vdkufyg/ jyD;&ifawmh yHk(19)u Close button udka&G;vdkufyg/ yHk(23)twdkif; jrif&ygr,f/
yHk(23)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 356 -
yHk(24)
yHk(24)twdkif; OEP ae&mrSm 0013F432 udk&dkufxnfhjyD; AutoSearch button udka&G;cs,fyg/ Found
something! qdkwJh MessagBox ay:vmygvdrfhr,f/ 'Dtcg Get Import button udkESdyfjyD; import function
awGudk Munfhyg/ yHk(24)t&qdk function awmfawmfrsm;rsm;udk import vkyf&mrSm rSm;,Gif;aewm awGU&ygw,f/
tao;pdwfod&atmif Show Invalid button udka&G;cs,fyg/
yHk(25)
jyD;&ifawmh yHk(25)twdkif; 'D invalid jzpfaewJh address awGay: right-click ESdyfjyD; Trace Level1
(Disasm) udk a&G;cs,fyg/ yHk(26)twdkif; jrif&ygr,f/
yHk(26)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 357 -
yHk(27)
yHk(27)twdkif;jrif&jyD;&ifawmh ImpREC u IAT jyifjyD;om;zdkifudk dumped_.exe trnfeJU tvdk
tavsmufodrf;qnf;ay;ygw,f/
(1.5) zdkifudkjyifjcif;
dumped_.exe tvkyfvkyf^rvkyfod&atmif zGifhMunfhygr,f/ yHk(28)/
yHk(28)
uRefawmfwdkU uHraumif;ygbl;/ Windows u uRefawmfwdkUzdkif[m PE zdkifr[kwfbl;vdkU ajymaeyg
w,f/ uRefawmfwdkU OEP udkjyifMunfhygr,f/ dumped_.exe udk PE Editor 1.7 rSm zGifhvdkufjyD; OEP udk
A805B3 vdkUajymif;vdkufyg/ yHk(29)/
yHk(29)
'Dae&mrSm owday;vdkwmuawmh OEP udkjyif&mrSm LordPE eJUrjyifygeJU/ LordPE eJUjyifwJh y&dk*&rf
awG[m trSm;rsm;vSygw,f/ (OEP ae&mrSm A805B3 vdkU&dkufcdkif;&wJhtaMumif;&if;uawmh yHk(17)u
uRefawmfwdkU&JU stolen bytes &Sd&m virtual address [m OEP [E805B3-400000 = A805B3h] tppftrSef
jzpfygw,f/) jyifjyD;&if zdkifudkodrf;vdkufyg/ 'gayr,fhvJ zdkifudkzGifhvdkuf&if yHk(28)twdkif; jyaewkef;ygyJ/
yHk(30)
wu,fawmh dumped_.exe rSm PE header jyóem&SdaevdkUyg/ 'gaMumifh CFF explorer rSm PE
header udkjyefjyifjyD; zdkifudkodrf;vdkufyg/ 'gqdk bmjyóemrSr&SdawmhbJ SVKP eJU protect vkyfxm;wJh
DAP.exe zdkifudk atmifjrifpGm unpack vkyfjyD;oGm;jyDjzpfygw,f/
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 358 -
yHk(31)
yHk(32)
yHk(33)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 359 -
yHk(34)
yHk(35)
yHk(36)
yHk(37)
yHk(38)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 360 -
yHk(39)
yHk(40)
yHk(41)
yHk(42)
yHk(43)
yHk(44)
PUSH 0F2BF = 62143,
"Your registration could not be completed due to unknown result from the activation server. \n\n Please try
again in a few minutes, or email sales@speedbit.com for more help.\n"
PUSH 0F2C0 = 62144,
"Your registration could not be completed due to submission of incorrect request to the Activation Server
\n\nPlease re-check the details you have entered or contact sales@speedbit.com \n"
PUSH 0F2BE = 62142,
"Your registration could not be completed due to lack of Internet connection with SpeedBit activation
server.\n\nPlease try again in a few minutes, or email sales@speedbit.com for more help.\n"
PUSH 0F2BD = 62141,
"Your registration could not be completed due to lack of Internet connection.\n\nPlease make sure you are
connected to the Internet.\n"
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 361 -
yHk(45)
yHk(46)
yHk(47)
yHk(48)
yHk(49)
yHk(50)
yHk(51)
yHk(51)rSm OK ESdyfjyD;&Smawmh uRefawmfwdkUvdkcsifwJh pmom;udk rawGUygbl;/ ̈ˋ
Resource Hacker udk toHk;jyKjyD; 'Dpmom;awGudk &SmMunfhygr,f/
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 362 -
yHk(52)
yHk(53)
yHk(54)
yHk(55)
yHk(56)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 363 -
yHk(57)
yHk(58)
yHk(59)
yHk(60)
yHk(61)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 364 -
yHk(62)
yHk(63)
yHk(64)
yHk(65)
yHk(66)
yHk(67)
yHk(68)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 365 -
yHk(69)
yHk(70)
yHk(71)
yHk(72)
yHk(73)
yHk(74)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 366 -
yHk(75)
yHk(76)
yHk(77)
yHk(78)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 367 -
yHk(79)
yHk(80)
yHk(81)
yHk(82)
yHk(83)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 368 -
yHk(84)
pum;rpyfajym&r,fqkd&ifawmh BetaMaster uawmh 004ADF16 rSm breakpoint &yfoGm;jyD;aemufrSm
yHk(85)
yHk(85)rSmjrif&wJhtwkdif; ? eJU
yHk(86)
tESpfcsKyfajymjy&r,fqdk&ifawmh uRefawmfwdkUtaeeJU DAP y&dk*&rfudk vsifjrefpGm patch vkyfEdkifwm[m
aemufqHk;taeeJU owday;vdkwmuawmh DAP 9.2 udk Armadillo 5.40 eJU protect vkyfxm;wmjzpfjyD;
registration scheme [mvJ ydkjyD;tqifhjrifhvmwm awGU&ygw,f/ DAP 9.2 udk 2009? Mo*kwfv? 3&ufrSm
download vkyfxm;wmjzpfygw,f/
yHk(87)
yHk(88)
yHk(89)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 369 -
yHk(90)
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 370 -
tcef;(23) - Registration number udk tGefvdkif;wGif ppfaq;jcif;tm; z,f&Sm;jcif; - 371 -
tcef;(24) - Themida tm;avhvmjcif; - 372 -
yHk(1)
Advanced Anti-Debugger –
Anti Dumpers –
Entrypoint Obfuscation –
Resources Encryption –
VMWare/ Virtual PC –
Advance API-Wrapping –
Anti-Patching –
Metamorph Security –
Advanced Debugger Monitors –
Compression – SecureEngine
Monitor Blockers – oifh application
Delphi/BCB form protection –
(2) SecureEngine qdkonfrSm ...
SecureEngine qdkwmuawmh
SecureEngine u toHk;jyKwJhenf;ynmawGuawmh atmufygtwdkif;jzpfygw,f –
AntiAPISpyer –
tcef;(24) - Themida tm;avhvmjcif; - 373 -
yHk(2) rSwfOmPfrS
yHk(3)
ClearCode –
CodeEncrypt –
yHk(4
yHk(5)
xor [esi], bh
sub [esi+1], bl
xor [esi+2], ah
xor [esi+3], al
add esi, 4
loop EncodeData
xor [esi], bh
push ebx
sub ebx, eax
xor edi, ebx
pop ebx
sub [esi+1], bl
dec edi
xor edi, eax
xor [esi+2], ah
jmp short $+2
pusha
mov ecx, eax
xor ebx, edx
rdtsc
popa
xor [esi+3], al
rol edx, cl
sub edi, edx
push eax
xor eax, edi
mov edi, eax
pop eax
add esi, 4
dec edx
imul edx, eax, 3
loop EncodeData
yHk(7)
yHk(12)
tcef;(24) - Themida tm;avhvmjcif; - 375 -
yHk(13)
yHk(15)
yHk(16)
yHk(17)
yHk(18)
yHk(19)
yHk(20)
☺☺☺
yHk(21)
tcef;(24) - Themida tm;avhvmjcif; - 377 -
yHk(22)
yHk(23)
yHk(24)
tcef;(24) - Themida tm;avhvmjcif; - 378 -
yHk(25)
(4) Themida (Anti-Debugger? Anti-File/Registry Monitor) zdkiftm; unpack vkyfjcif;
Protection Options for Unpackm_lvl2.exe
---------------------------------
Macros Information
---------------------------------
VM Macros: 0
CodeReplace Macros: 0
ENCRYPT Macros: 0
CLEAR Macros: 0
XBundler files
---------------------------------
No files to bundle
Protection Options
---------------------------------
Anti-Debugger: ENABLED
Anti-Dumpers: DISABLED
API-Wrapping Level: 0
Virtual Machine: ENABLED
Entry Point Ofuscation: DISABLED
Memory Guard: DISABLED
Anti-File Monitor: ENABLED
Anti-Registry Monitor: ENABLED
Resource Encryption: DISABLED
VMWare compatible: DISABLED
Delphi/BCB form protection: DISABLED
Advanced Protection Options
---------------------------------
Encrypt Application: DISABLED
.NET assemblies: DISABLED
DLL plugin: DISABLED
Active Context: DISABLED
Last Section Name: hacnho
Compression
---------------------------------
Application compression: ENABLED
Resources compression: ENABLED
SecureEngine compression: ENABLED
Virtual Machine Settings
---------------------------------
Number of Virtual APIs wrapped: 0
Entry Point Virtualization: 0 instructions
Virtual Machine Processor: Mutable CISC processor
Number of CPUs: 1
Opcode Type: Static opcodes
Dynamic Opcode: DISABLED
yHk(26)
yHk(27)
yHk(28)
yHk(29)
tcef;(24) - Themida tm;avhvmjcif; - 379 -
yHk(30)
y
yHk(31)
w,f/
yHk(32)
(5) Themida (Anti-Debugger? Anti-Dumpers ...) zdkiftm; unpack vkyfjcif;
tcef;(24) - Themida tm;avhvmjcif; - 380 -
yHk(34)
yHk(35)
yHk(36)
tcef;(24) - Themida tm;avhvmjcif; - 381 -
yHk(37)
w,f/
yHk(38)
yHk(39)
☺☺☺
(6) Themida (Anti-Dumpers? Memory Guard ...) zdkiftm; unpack vkyfjcif;
tcef;(24) - Themida tm;avhvmjcif; - 382 -
yHk(40)
yHk(41)
tcef;(24) - Themida tm;avhvmjcif; - 383 -
yHk(42)
yHk(43)
yHk(43)u code section rSm right-click ESdyfjyD; Set memory breakpoint on write udka&G;yg/ jyD;&if
F9 (Run) udkESdyfyg/
yHk(44)
yHk(44)twdkif;jrif&wJhtcg F8 (Step Over) udkwpfcgESdyfjyD; F9 (Run) udkxyfESdyfyg/
yHk(45)
yHk(46)
yHk(47)
yHk(48)
JMP 0052764C;
tcef;(24) - Themida tm;avhvmjcif; - 384 -
yHk(50)
yHk(51)
yHk(52)
yHk(53)
yHk(53)twdkif; breakpoint owfrSwfjyD;&ifawmh F9 udkESdyfyg/ Breakpoint &Sd&mqD a&mufvmygr,f/
yHk(54)/
tcef;(24) - Themida tm;avhvmjcif; - 385 -
yHk(55)
yHk(56)
(7) Default option a&G;cs,fjyD; pack vkyfxm;aom Themida zdkiftm; unpack vkyfjcif;
(u) OEP udk&SmazGjcif;
(u) OEP udk&SmazGjcif;
yHk(58)
2/ Breakpoint owfrSwfjyD;wJhtcg Shift+F9 udkESdyfjyD; EDI register udkapmifhMunfhyg/
yHk(59)
yHk(60)
yHk(61)
tcef;(24) - Themida tm;avhvmjcif; - 386 -
yHk(62)
yHk(63)
(c) IAT udkwnfaqmufjcif;
1/ y&dk*&rfudk jyefpvdkufyg/ (Ctrl+F2)
2/
yHk(64)
yHk(65)
yHk(66)
tcef;(24) - Themida tm;avhvmjcif; - 387 -
yHk(67)
'gqdk yHk(68)rSmjrif&wJhtwdkif;
yHk(68)
4/ 'Dhaemuf CRC
yHk(69)
yHk(70)
5/
yHk(71)
yHk(72)
tcef;(24) - Themida tm;avhvmjcif; - 388 -
yHk(73)
7/ 'DtcgrSmawmh
yHk(74)
8/ 'Dtcg
yHk(75)
rSwf&ef/ / wu,fawmh OEP tppf&JU
yHk(76)
55 8B EC 6A FF 68 60 0E 45 00 68 C8 92 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83
C4 A8 53 56 57 89 65 E8 FF 15 DC 0A 46 00
yHk(77)
VA 004271D6 ae&mrSm CALL kernel32.GetVersion vdkUjyifygr,f/ (rjyifvJ &ygw,f/)
tcef;(24) - Themida tm;avhvmjcif; - 389 -
yHk(78)
jyD;&if
yHk(79)
yHk(80)
(*) Dump vkyfjcif;
yHk(81)
tcef;(24) - Themida tm;avhvmjcif; - 390 -
yHk(82)
yHk(83)
yHk(84)
ed*Hk;csKyftaeeJU ajymMum;vdkwmuawmh Themida [m version topfawGajymif;vJoGm;wdkif;
tcef;(24) - Themida tm;avhvmjcif; - 391 -
tcef;(24) - Themida tm;avhvmjcif; - 392 -
tcef;(24) - Themida tm;avhvmjcif; - 393 -
tcef;(24) - Themida tm;avhvmjcif; - 394 -
tcef;(24) - Themida tm;avhvmjcif; - 395 -
tcef;(24) - Themida tm;avhvmjcif; - 396 -
tcef;(24) - Themida tm;avhvmjcif; - 397 -
tcef;(24) - Themida tm;avhvmjcif; - 398 -
Cracking qdkif&ma0g[m&rsm; - 399 -
Cracking qdkif&ma0g[m&rsm;
ActiveMARK – Trymedia onf RealNetworks \ tpdwftydkif;wpfckjzpfjyD; ActiveMark rSm
Trymedia \ pack/protect vkyfonfhenf;ynmwpf&yfjzpfonf/ Trygames rSm Trymedia \ wpfpdwf
wpfydkif;jzpfjyD; Trymedia \*drf;rsm;udk download vkyfjcif;udpö? trial qdkif&mudpöESifh a&mif;csjcif;udpöwdkUudk
jyKvkyfonf/
alphanumeric code – Alphanumeric uk'fqdkonfrSm pmvHk;rsm;? *Pef;rsm;aygif;pyfxm;jcif;jzpfjyD;
¤if;wdkUudk uGefysLwmuom process vkyfEkdifonfh em;rvnfEdkifaomyHkpHwpfcktoGifjzifh a&;xm;jcif;jzpfonf/
erlem alphanumeric uk'fwpfckrSm ASCII jzpfonf/ xdkxufydkjyD;ajym&vQif alphanumeric uk'fqdkonfrSm
machine uk'fjzpfjyD; ¤if;wdkUudk vHk;0zwfr&Edkifaom ASCII pmvHk;tjzpf assemble vkyfjyD;a&;xm;jcif;jzpf
onf/
API – API [lonf OS ujznfhpGrf;ay;Edkifaom function rsm;tm; pkpnf;xm;jcif;omjzpfonf/ Windows
y&dk*&rftm;vHk;onf API unction rsm;udk toHk;jyKMuonf/ xdk function rsm;onf Windows pepf\ dll
zdkifrsm;jzpfaom kernel? user? gdi? shell? advapi ponfhzdkifrsm;xJwGif &Sdonf/ API udk native API ESifh
Win32 API [lí ESpfrsdK;cGJxm;onf/
API redirection – API redirection [lonf packer^protector trsm;pku IAT (okdUr[kwf import
table) tm; (wpfpdwfwpfa'o odkUr[kwf vHk;0)zsufqD;ypfvdkufaom vkyfaqmifcsufwpfckjzpfaomfvnf; IAT
xJwGif redirect tvkyfcH&aom API toD;oD;\ oufqdkif&muk'fESifhqdkifaom pointer wpfckudk a&;vdkufonf/
qdkvdkonfrSm packer onf pack^protect vkyfxm;aomy&dk*&rftwGuf system \ DLL rsm;xJrS API \
address udkay;Edkif&ef owdxm;&rnfjzpfonf/ API redirection vkyfxm;onfh y&dk*&rfawmfawmfrsm;rsm;onf
anti-virus aqmhzf0Jvfrsm;ESifh jyóemwufavh&Sdonf/
array – y&dk*&rfa&;om;jcif;wGif array onf wlnDaom a'wmtrsdK;tpm;udk pkpnf;ay;jyD; array xJwGif
yg0ifonfht&mrsm;udk ac:,loHk;pGJvdkvQif index (odkU) element jzifh ac:,loHk;pGJ&onf/ Array rsm;onf
y&dk*&rfa&;om;jcif;wGif tc&musvSonf/
ASCII – American Standard Code for Information Interchange \ twdkaumufjzpfjyD; pmvHk;rsm;?
*Pef;rsm;? oauFwrsm;yg0ifaom tu©&m 256vHk;&Sdonf/ ASCII udk 1968 ckESpfwGif hardware ESifh aqmhzf
0Jvfrsm;Mum; a'wmrsm;tm; ydkUaqmif&eftwGuf &nf&G,fjcif;jzpfonf/ ASCII udk pH ASCII ESifh xyfjznfh
ASCII [lí tpkESpfckcGJxm;onf/
assembler – Assembly bmompum;jzifh a&;om;xm;onfhy&dk*&rfrsm;tm; exe y&dk*&rfzdkiftjzpf ajymif;vJ
ay;aom y&dk*&rfjzpfonf/
Assembly language – Low-level y&kd*&rfbmompum;wpfckjzpfjyD; mnemonic uk'frsm;udk toHk;jyKonf/
Assembler udktoHk;jyKí machine bmompum;tjzpf ajymif;Edkifonf/ toHk;jyKonfh y&dkqufqmay:rlwnf
jyD; instruction rsm;uGJjym;rI&Sdonf/ Assembly bmompum;udk toHk;jyKjcif;\ tusdK;aus;Zl;um; tvkyf
vkyfonfh EIef;jrefqefvmjcif;? hardware ESifh y&dk*&rfrmMum; wdkuf&dkufqufoG,fEdkifjcif;wdkUjzpfonf/
BadBoy – Trial version aqmhzf0JvfwpfckwGif oHk;pGJoltm; 0,f,l&efzdtm;ay;aom message rsm;? aMumfjim
rsm;/ (odkU) Disassemble vkyfxm;aom y&dk*&rfwpfckwGif ¤if;wdkU&Sd&mae&m/
base address – tydkif;ESpfck&Sdaom rSwfOmPf address wpfck\ wpfpdwfwpfa'o/ ¤if;onf rajymif;vJbJ
&SdaejyD; wGufcsufrnfh a'wm byte wpfck\ ae&mnTef;rSwfwpfckudk jznfhpGrf;ay;onf/ Base address wpfck\
aemufwGif offset wefzdk;wpfckuyfvdkufjyD; tcsuftvufrsm;\ wdusaomae&mudk &SmEdkif&eftwGuf base wGif
¤if;wefzdk;udk vmaygif;&onf/ tapmydkif; OS rsm;wGif toHk;jyKonf/
base relocation – .reloc section rSm&Sdaom entry rsm;udk base relocation [kac:onf/ tb,fhaMumifh
qdkaomf ¤if;wdkUudk toHk;jyKrIonf loaded image \ base address ay:rlwnfíjzpfonf/ Base relocation
onf image xJrS wnfae&mrsm;udkpkpnf;xm;jcif;jzpfjyD; ¤if;wdkUxJ aygif;xnfh&ef wefzdk;wpfck vdkygvdrfhrnf/
Base relocation entry rsm;tm; chunk wGJrsm;taejzifh package vkyfxm;jcif;jzpfonf/ Chunk toD;oD;
onf image xJrS 4KB page wpfcktwGuf relocation [k azmfjyjcif;jzpfonf/
binary – udef;*Pef;pepfrsm;rS 0 ESifh 1 udkom azmfjyEdkifaom ESpfvDpepf/ xdk*Pef;rsm;udk logical wefzdk;
jzpfaom TRUE (okdU) FALSE taejzifh azmfjyEdkifonf/ ESpfvD*Pef;rsm;onf vlom;rsm;em;vnfEdkif&ef
cufcJaomaMumifh 8vDpepfESifh 16vDpepfudk toHk;rsm;Muonf/
bit – Binary digit \ twdkaumuf/ uGefysLwmu udkifwG,faomtcsuftvufrsm;wGif tao;qHk;,lepf/
Bitwpfckonf ESpfvD*Pef;wpfckrS 1 (odkU) 0 udkom azmfjyEdkifonf/ 8 bits onf pmvHk;wpfvHk;ESifhnDaom
aMumifh tu©&m? q,fvD*Pef;ESifh tjcm;pmvHk;rsm;udk azmfjyEdkifayonf/
breakpoint – y&kd*&rftvkyfvkyfjcif;udk &kwfw&uf &yfwefUEdkif&efESifh xdktcsdefwGif y&dk*&rfrnfodkUvkyfaqmif
aeonfudk Munfh&Ippfaq;Edkif&ef y&dk*&rfwGif;ü owfrSwfxm;onhf ae&mwpfck/ Breakpoint rsm;udk debugger
rsm;twGif; owfrSwfMujyD; rsm;aomtm;jzifh jump rsm;? call rsm;wGif toHk;jyKMuonf/ Breakpoint udk
aqmhzf0Jvf breakpoint? hardware breakpoint ESifh memory breakpoint [lí 3rsdK;cGJjcm;Edkifonf/
Cracking qdkif&ma0g[m&rsm; - 400 -
entrypoint Method – .net application pwifcsdefrSm ac:,loHk;onfh yxrqHk; Method jzpfjyD;? Method
\ ta&;ygyHkrSm y&dk*&rf\vkyfaqmifcsufrsm;udk y&dk*&rfpwifonfhtcsdefrSpjyD; register vkyfonfh routine
&Sd&ma&mufonftxd ajc&mcHEdkifjcif;jzpfonf/
enxor – XOR instruction udktoHk;jyKí encrypt vkyfjcif;/
ES – AGD'D,dkudpö&yfrsm;twGuf toHk;rsm;onf/ Extra segment \twdkaumuf/
ESI – String/array \ source udk owfrSwf&mwGifoHk;onf/ Source index \ twdkaumuf/
ESP – Stack rS wdusaom ae&mwpfckudk nTefjyonf/ Stack pointer \ twdkaumuf/
exe – rnfonfhzdkiftultnDrS rvdkbJ oD;oefU&yfwnfEdkifaom y&dk*&rf/
EXE Password 2004 – Salfeld computer rSxkwfvkyfjyD; exe zdkifrsm;udk olwyg; rzGifhapvdkaomtcg
password toHk;jyKí umuG,fEdkifaomy&dk*&rf/ Password udk exe twGif;wGifyif odrf;qnf;jyD; vdktyfrSmom
decrypt jyefvkyfygonf/
executable – tvkyfvkyfEdkifaom y&dk*&rf/ Oyrm - file0.bat? file1.exe? or file2.com/
exploit – OS (odkU) aqmhzf0Jvfwpfckck\ vHkjcHKa&;qdkif&mtm;enf;csufudk &SmazGjyD; tcGifhaumif;,lonf/
file alignment – zdkifxJwGif section rsm;udk alignment csxm;rI/ þ field xJrS wefzdk;onf 512 (200h)
jzpfvQif section wdkif;onf 512bytes \ ajrSmufazmfudef;*Pef;rsm;jzifh pwif&rnf/ tu,fí yxrqHk;
section onf offset 200h ü&SdjyD; ¤if;\t&G,ftpm;onf 10bytes om&SdcJhvQifyif aemuf section onf
400h wGifpwifrnfjzpfonf/ 512 eJU 1024 Mum;rS vGwfaeaom offset ae&mrsm;udkrl toHk;jyKrnf r[kwfay/
Fish Packer – UPX? UPack uJhodkU zdkif\t&G,ftpm;udk tao;i,fqHk;jzpfatmif compress vkyfay;aom
packer jzpfjyD; unpack vkyf&mwGif tenf;i,fcufcJrI&Sdygonf/
flag – tajctaeESpfckteufrS wpfckudk owfrSwfonfh register/ Zero flag onf wefzdk;ESpfckudk EdIif;,SOfaom
tcg nDcJhvQif flag wefzdk;udk 1 [kowfrSwfygonf/ Carry flag? parity flag? auxiliary flag? zero flag?
sign flag ponfjzifh flag rsm;pGm&Sdygonf/
flat memory – Windows OS rsm;wGif toHk;jyKonf/ Memory segment \ t&G,ftpm;onf 4GB &Sd
onf/
float – 'órudef;rsm;udk aMunm&eftwGuf toHk;jyKaom keyword/ 3.4 x 10 -38 rS 1.7 x 10 +38 xd wefzdk;
rsm;udk udkifwG,fEdkifonf/
freeware – tifwmeufwGif tcrJhay;aom y&dk*&rf/ Freeware aqmhzf0Jvfrsm;wGif register vkyfp&mrvdkyg/
FS – taxGaxGoHk; segment/ 80286 ESifhtxuf y&dkqufqmrsm;wGif toHk;jyKonf/
FSG – Fast Small Good \twdkaumuf/ exe zdkifrsm;udk compress vkyfay;aom packer y&dk*&rf/
full version – rnfonfhuefUowfcsufrSr&Sdaom? aqmhzf0Jvf\ pGrf;aqmifEdkifrItm;vHk;udk toHk;jyKEdkifaom
version/
function – owfrSwfxm;aomtvkyfudk vkyfaqmifEdkif&ef instruction rsm;udkpkpnf;xm;aom? statement
rsm;udkpkpnf;xm;aom y&dk*&rf\ routine wpfck/ udk ESifh [kESpfrsdK;cGJEdkifonf/ API? routine? subroutine?
call rsm;[kvnf;ac:onf/
GoodBoy – 0,f,lonfhtwGufaus;Zl;wifaMumif;? register vkyfjcif;atmifjrifaMumif;ponfh messagebox?
dialogbox rsm;ESifh ¤if;wdkUudkac:oHk;onfh routine rsm;? API rsm;/
GS – taxGaxGoHk; segment/ 80386 ESifhtxuf y&dkqufqmrsm;wGif toHk;jyKonf/
handle – Pointer wpfck\ pointer/ qdkvdkonfrSm tjcm; variable wpfck\ address yg0ifaom variable
wpfck/ ¤if;wGif vdkcsifaom object \ address yg0ifonf/ OS wpfckwGif pointer rsm;u ajymif;vG,faom
block wpfckudk nTef;aepOfwGif handle u rSwfOmPf\ rajymif;vJEdkifaomae&mwGif odrf;xm;onfh pointer
wpfckudk nTef;onf/ tu,fí y&dk*&rfrsm;onf handle rSompwifcJhvQif ¤if;wdkUu block udk&,lcsdefwdkif;wGif
OS rS y&dk*&rfrsm;tm;xdcdkufrI r&SdapbJ rSwfOmPfpDrHcefUcGJrIrsm;udk aqmif&GufEdkifrnfjzpfonf/
hardware breakpoint – omref breakpoint rsm;onf uk'frsm;ajymif;vJoGm;aomtcg breakpoint
ysufoGm;avh&Sdygonf/ owfrSwfxm;onhfae&m&Sd uk'fudk ac:,loHk;jcif;&Sd^r&Sd apmifhMunfhvdkaomtcgwGifvnf;
aumif;? dump window (data window) rS a'wmrsm;udk a&;jcif;? zwfjcif; &Sd^r&Sdudk apmifhMunfhvdkaomtcg
wGifvnf;aumif; hardware breakpoint udktoHk;jyKygonf/
hardware key – aqmhzf0Jvf(odkU)uGefysLwmudk w&m;r0ifoHk;pGJjcif;rS umuG,f&ef toHk;jyKaom printer port
connector uJhokdUaom device/ Dongle [kvnf;ac:onf/
HASP key – Aladdin Knowledge Systems rS xkwfvkyfonfh dongle key/
hexadecimal – *Pef;rsm;udk azmfjy&eftwGuf toHk;jyKonfh 16vDpepf/ pepfwGif q,fvDpepf*Pef;rsm;
jzpfaom 0-15 udkazmfjy&eftwGuf 0-9? A-F wdkUyg0ifonf/ 16vDpepf *Pef;wpfvHk;onf 4 bits ESifh nDrQ
onf/ Oyrm – ESpfvDpepf*Pef;jzpfaom 0101 0011 onf 16vDpepfwGif 53 ESihfwlnDonf/ ESpfvDpepfjzifh
azmfjyjcif;onf zwf&I&cufcJonfhtwGuf 16vDpepfjzpfaom hexadecimal pepfudk xGifMujcif;jzpfonf/ Intel
xkwf CPU awG\ mnemonic rSmygaom opcode rsm;ESifh shellcode rsm;udk HEX uk'frsm;ESifh azmfjyMu
onf/
Cracking qdkif&ma0g[m&rsm; - 403 -
Crraacckkiinngg q
C qdkidkif&f&mm t
tiifw
fwmmeeu
uf0f0u
ufb
fbfq
fqdku
dkufrfrssmm;;
(1) ARTeam
http://www.accessroot.com
(2) SND Team (Seek and Destroy)
http://www.tuts4you.com
(3) AoRE (Art of Reverse Engineering)
http://www.aoreteam.com
(4) BiW Reversing
http://www.reversing.be
(5) Unpack Team (Chinese)
http://unpack.cn
http://www.cracktool.com
(6) Team ICU
http://www.teamicu.org
(7) AHTeam (Alien Hack)
http://www.ahteam.org
(8) RETeam (Reverse Engineering Team)
http://www.reteam.org
(9) True Team
http://www.lastepidemic.net/
(10) Reverse Engineering Association (Vietnamse)
http://www.reaonline.net/
(11) Cracking Tools (Russian)
http://www.cracklab.ru
(12) Cracking Tools (Chinese)
http://www.pediy.com
(13) Disassmebling Tools (Russian)
http://www.wasm.ru
(14) Arab Team 4 Reverse Engineering
http://www.at4re.com
(15) tjcm; Cracking qkdif&m0ufbfqdkufrsm;
http://board.anticrack.de
http://www.secretashell.com/PEid/
http://www.alame.com/vb/
http://www.woodmann.com
http://reng.ru/board/
http://www.absolutelock.de
http://www.ibsensoftware.com
http://pro-hack.ru
http://azmoaore.reversedcode.com
http://www.securitylab.ru/tools/
http://ap0x.jezgra.net/
Cracking qdkif&m tifwmeuf0ufbfqdkufrsm; - 408 -
http://www.openrce.org/
http://www.encryptpe.com/
http://www.chinadfcg.com/
http://www.cracking.com.cn/
http://www.debugman.com/
http://club.myarc.cn/
http://www.ccgcn.com/
http://forum.exetools.com/
http://crackmes.de/
http://petools.org.ru/
http://www.pearmor.com/
http://www.chinadcm.com/
http://bbs.wmzhe.com/
http://ocn.e5v.com/bbs/index.php
http://bbs.chinapyg.com/
http://bbs.vxer.cn/
http://bbs.thulu.com/
http://bbs.crsky.com/
http://bbs.cniso.org/
http://www.cracktool.com/
http://bbs.crkcn.com/
http://bbs.hanzify.org/index.php
(16) Cracked Version jzefUcsDaeaom0ufbfqdkufrsm;
http://www.appzworld.com
http://soft-best.net
http://0daycn.net
http://www.directdl.com
http://www.enfull.com
http://www.lugarus.com
http://www.megauploaded.com
http://www.rapidshared.org
http://www.9iv.com
http://www.ddlcentral.com
http://www.inethouse.com
http://www.freeserials.com
http://www.phazeddl.com
http://www.appzplanet.com
(17) Cracked Version jzefUcsDaeaomzdk&rfrsm;
http://www.projectxwarez.com
http://www.projectw.org
http://www.projectws.org
http://forumw.org
http://forum.ru
Cracking qdkif&m tifwmeuf0ufbfqdkufrsm; - 409 -
(18) y&dk*&rfa&;om;jcif;qdkif&m0ufbfqdkufrsm;
http://www.codeproject.com
http://www.functionx.com
http://www.ucancode.com
http://www.dreamincode.net
(19) Cracks? Serials ESifh Keygens jzefUcsDaeaom0ufbfqdkufrsm;
http://www.crackteam.ws
http://keygen.us
http://www.allseek.info
http://www.anycracks.com
http://www.bestserials.com
http://www.crack-cd.com
http://www.crackspider.net
http://www.cracksportal.com
http://www.freeserials.com
http://www.icracks.net
http://www.mscracks.com
http://www.thebugs.ws
References - 410 -
References
(01) Basic Rules of Cracking – ParaBytes
(02) Cracker Definition – Invoker
(03) A Little Guide for Wannabe Reverser – Zephyrous
(04) The C Programming Language – Brian W. Kernighan & Dennis M. Ritchie
(05) PC Assembly Language – Paul A. Carter
(06) Win32asm Tutorial – Thomax Bleeker
(07) Assembly for Beginners – The Cyborg
(08) Assembly Tutorials – Ralph
(09) Win32 Assembler Coding for Crackers 1.1 – Goppit
(10) Assembler : The Basics in Reversing – Lena151
(11) The Wikibook of Reverse Engineering
(12) CrackProof Your Software – Pavol Cerven
(13) Disassembling Code: IDA Pro and SoftICE – Vlad Pirogov
(14) RCE Emphasizing On Breaking Software Protection – tHE mUTABLE
(15) Portable Executable File Format – Goppit
(16) Basic Nag Removal + Header Problems – Lena151
(17) Indept Unpacking & Anti-Anti-Debugging, A Combination Packer & Protector – Lena151
(18) Serial Fishing Teleport Pro – nick123b
(19) Serial Fishing CD to MP3 Maker 1.15 – ThunderPwr
(20) KeygenMe Tutorial 1 – Ziggy
(21) Basic + Aesthetic Patching – Lena151
(22) Intermediate Level Patching, Kanal in PEiD – Lena151
(23) tElock + Advanced Patching – Lena151
(24) Win32 Programmer Reference – Microsoft
(25) Often Used APIs in Registration Schemes and Other – Lena151
(26) Reversing - Secrets of Reverse Engineering – Eldad Eilam
(27) Reversing Using the Program's Resources – Lena151
(28) ActiveMARK 5.xx (Dumping and Rebuilding) – SSIEvIN
(29) Unpacking Protections – Lena151
(30) Unpacking Advanced Packers – Lena151
(31) API Redirection – Lena151
(32) VB - Introduction to SmartCheck and Configuration – Lena151
(33) VB - Use of Decompilers and a Basic Anti-Anti-Trick – Lena151
(34) Delphi in Olly & DeDe – Lena151
(35) Insights and Practice in Basic (self) Keygenning – Lena151
(36) Java Target – ThunderPwr
(37) Reversing .Net – Kwazy Webbit
(38) .Net Reversing Tips – tKC
(39) Manul Unpacking .NET Applications – Newbie_Cracker
(40) Serial Fishing in .NET (Live Debugging) – zyzygy
(41) Removing StrongName Signature in .NET Applications – Newbie_Cracker
(42) Symbian Exploitation and Shellcode Development – Collin Mulliner
(43) Symbian Executable File Format – Antony Pranata
(44) Primer in Reversing Engineering Symbian 3rd Applications – argv
(45) Reversing Symbian S60 Applications 1.4 – Shub-Nigurrath
(46) Patching Packed Executables at Runtime Using Loaders – Lena151
(47) Basic Crypto Techniques – detten
(48) Keygenning MD5 – Nieylana
(49) Encryption Decryption Polymorphic Code – Lena151
(50) SVKP1.4x (Finding-The-OEP-Dumping) – Teddy Rogers
(51) Bypassing & Killing Server Checks – Lena151
(52) Themida 1.9.1.0 – UnpackMe – hacnho
(53) Themida Unpacking – Joker_Italy
(54) Unpacking Themida 1.x – SubZero
(55) Themida 1.9.1.0 Help
(56) Microsoft Computer Dictionary