"Yenilsen de yensen de, taraftarin seninle. Iyi gunde, kotu gunde, seninle birlikte."

User name “amois” ve sallama serial “1907” -> [bpx hmemcpy] ->

0167:1000147F CALL EDI
0167:10001481 TEST ESI,ESI                 <- buradayiz
0167:10001483 JNZ 10001489
0167:10001485 XOR EAX,EAX
0167:10001487 JMP 10001496
0167:10001489 MOV EDX,[ESI+14]
0167:1000148C PUSH EDX
0167:1000148D CALL EBX                     <- hata

[bpx 1000148D] -> [F8] -> birazcik [F10]

...
0167:100014A5 PUSH EAX
0167:100014A6 CALL EDI                     <- hata

Bu sekilde hatayi veren cagriyi bulmak yerine, memory’de “amois” in bulundugu bolgeye breakpoint koyarak sonuca gidebiliriz.

...
0167:100014A8 MOV AL,[ESP+0000010C]        <- a
0167:100014AF TEST AL,AL
0167:100014B1 JZ 100014EE
0167:100014B3 MOV AL,[ESP+0C]              <- 1
0167:100014B7 TEST AL,AL
0167:100014B9 JZ 100014EE
0167:100014BB MOV ECX,[ESI+14]
0167:100014BE LEA EDX,[ESP+0C]
0167:100014C2 LEA EAX,[ESP+0000010C]
0167:100014C9 PUSH EDX                     <- 1907
0167:100014CA PUSH EAX                     <- amois
0167:100014CB PUSH ECX
0167:100014CC CALL 10025D00                <- ??

[bpx 100014CC] -> [F8]

...
0167:10025D19 PUSH ESI                     <- 1907
0167:10025D1A PUSH EBP                     <- amois
0167:10025D1B CALL 10026120                <- ??

[bpx 10025D1B] -> [F8]

...
0167:1002612F PUSH EAX
0167:10026130 MOV EAX,[ESP+14]             <- 1907
0167:10026134 PUSH ECX
0167:10026135 PUSH EDX
0167:10026136 PUSH 10045A90                <- %d-%d-%d
0167:1002613B PUSH EAX
0167:1002613C CALL 1002E474
0167:10026141 ADD ESP,14
0167:10026144 CMP EAX,03                   <- 3 bolum mu ?
0167:10026147 JGE 1002614F

Girmemiz gereken serial, decimal olarak 3 bolumden olusacak ve “-“ ile ayrilmis olacak. Sallama serialimiz “1907-1908-1909” olsun. ->

0167:1002614F MOV EAX,[ESP+10]             <- 1908
0167:10026153 MOV ECX,[ESP+0C]             <- amois
0167:10026157 MOV EDX,[ESP+00]             <- 1907
0167:1002615B AND EAX,000000FF             <- eax=74h oldu
0167:10026160 PUSH ECX
0167:10026161 PUSH EAX
0167:10026162 PUSH EDX
0167:10026163 PUSH 100459C0
0167:10026168 MOV [ESP+20],EAX
0167:1002616C CALL 10025E30                <- ??
0167:10026171 MOV ECX,[ESP+14]             <- ecx=1909
0167:10026175 ADD ESP,10
0167:10026178 CMP EAX,ECX                  <- bu da ne ?
0167:1002617A SETZ AL

“1909” yerine 1002616C cagrisi sonucu eax’e atanan degeri girmemiz gerekiyor. Boylece gecerli serial bulunmus oldu. KeyGen algoritmasi nasil acaba ?

[bpx 1002616C] -> [F8]

Buradaki algoritma biraz dolambacli ve uzunca. Ayrica, bazi dallanma bolumlerini de ASM koduna cevirmek zor.

JMP DWORD PTR [EDX*4+0100260A0h] <- degisken adres

En bastan itibaren, QuickRun.Dll dosyasinin icerisindeyiz. DLL dosyasindan Export fonksiyonlari cagirmak kolay. Peki, Export olmayan CALL 10025E30 gibi bolumleri cagirabilir miyiz ? En azindan deneyebiliriz. Orjinal programdaki cagri oncesi sartlari aynen saglayabilirsek, neden olmasin ki ?

.data
dll_adi    db "c:\program files\quickrun\quickrun.dll",0     ; DLL adi ve adresi
fonk_of    dd 025e30h                                        ; cagiracagimiz bolum
isim       db "amois",0                                      ; user name
serial     db "1907-1908-1909",0                             ; sallama serial
serial_1   dd 0773h                                          ; 1.serial Hex degeri
serial_2   dd 0774h                                          ; 2.serial Hex degeri
cop        dd 0459c0h                                        ; 10026163 den geliyor

.code
start:
invoke LoadLibraryA, addr dll_adi                            ; DLL dosyasini yukle
                                                             ; DLL’nin handle degeri eax’de
add fonk_of, eax                                             ; fonksiyonun yerini bul
add cop, eax                                                 ; 10026163 deki degerin yerini bul
lea esi, serial                                              ; orjinal programdan
mov eax, serial_2                                            ;
lea ecx, isim                                                ;
mov edx, serial_1                                            ;
and eax, 0ffh                                                ;
push ecx                                                     ;
push eax                                                     ;
push edx                                                     ;
push cop                                                     ;
mov [esp+20], eax                                            ;
call fonk_of                                                 ; cagri sonucu eax’de serial3 degeri

Normal sartlarda, LoadLibraryA sonrasi eax, DLL’nin image base degerini icermesi gerekir. Fakat DLL dosyalari, birden fazla programdan ayni anda cagirilabilecegi icin, her seferinde bu deger degisir. Bu nedenle direkt olarak CALL 10025E30 yazamiyoruz. Fonksiyon offset degerimiz 25E30 ve bunu LoadLibraryA sonrasi eax’deki degere ekleyerek, memory’deki yeni adresini buluyoruz. Ayni sekilde, PUSH 100459C0 yazamayacagimiz icin, 459C0 offset degerine, LoadLibraryA sonrasi degeri ekliyoruz.

Bir programı kullanarak para kazanıyorsanız, programı satın alın.