TDMD软件狗破解方带(杀狗)(6千字)_安全中国_全球最大网络安全培训门户

TDMD软件狗破解方法（带狗杀狗）

工具：TRW2000
Hview

这次杀狗还是用带狗杀狗方法，破解狗的常用断点：bpio 378，bpx deviceiocontrol,bpx environmentstringa(听说对HASP狗有效，我没有试过），今天我们用bpx deviceiocontrol这个断点来破它。

一般TDMD狗的调用形式是:

:0057C054 53 push ebx
:0057C055 56 push esi
:0057C056 57 push edi
:0057C057 56 push esi
:0057C058 57 push edi
:0057C059 52 push edx
:0057C05A 51 push ecx
:0057C05B 53 push ebx
:0057C05C 50 push eax
:0057C05D E82C020000 call 0057C28E <=====判断狗的CALL
:0057C062 85C0 test eax, eax <=====有狗就返回0
:0057C064 7405 je 0057C06B <=====有狗就跳到正常的程序,否则就退出程序
:0057C066 E989000000 jmp 0057C0F4

好了，下断点后程序会被中断在狗驱动中，从TRW2000中我们知道这个狗是金天地的TDMD，中断后我们用F10和F12返回到主程序中，如下：

:0057C7B0 50 push eax
:0057C7B1 FF15AC815D00 call dword ptr [005D81AC] <====第一次读狗,在TRW2000中应该是call KERNEL32!Deviceiocontrol,这个CALL是判断端口上有没有活动的打印机和加密狗
:0057C7B7 8945F8 mov dword ptr [ebp-08], eax <=====返回到这里
:0057C7BA 837DF800 cmp dword ptr [ebp-08], 00000000
:0057C7BE 7421 je 0057C7E1 <=====不跳
:0057C7C0 83BD20FFFFFF00 cmp dword ptr [ebp+FFFFFF20], 00000000
:0057C7C7 7416 je 0057C7DF <=====不跳
:0057C7C9 81BD20FFFFFF00300000 cmp dword ptr [ebp+FFFFFF20], 00003000
:0057C7D3 740A je 0057C7DF <======不跳
:0057C7D5 818520FFFFFF00005000 add dword ptr [ebp+FFFFFF20], 00500000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0057C7C7(C), :0057C7D3(C)
|
:0057C7DF EB0A jmp 0057C7EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0057C7BE(C)
|
:0057C7E1 C78520FFFFFF00005200 mov dword ptr [ebp+FFFFFF20], 00520000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0057C7DF(U)
|
:0057C7EB EB01 jmp 0057C7EE
:0057C7ED E8 BYTE E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0057C7EB(U)
|
:0057C7EE 83BD20FFFFFF00 cmp dword ptr [ebp+FFFFFF20], 00000000 <====第一次判断狗
:0057C7F5 7427 je 0057C81E <====没有狗就不跳,所以我们这里要把它改为Jmps 0057C81E
:0057C7F7 EB01 jmp 0057C7FA
:0057C7F9 E8 BYTE E8

看一下0057C81E的代码:

:0057C81E 8B8530FEFFFF mov eax, dword ptr [ebp+FFFFFE30]
:0057C824 A3A0705D00 mov dword ptr [005D70A0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0057C77F(C)
|
:0057C829 EB01 jmp 0057C82C
:0057C82B E8 BYTE E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0057C829(U)
|
:0057C82C E8C8F8FFFF call 0057C0F9 <=====计算密码的CALL
:0057C831 0FB7D8 movzx ebx, ax
:0057C834 C1E310 shl ebx, 10
:0057C837 E8BDF8FFFF call 0057C0F9 <=====计算密码的CALL
:0057C83C 0FB7C0 movzx eax, ax
:0057C83F 0BD8 or ebx, eax
:0057C841 899D38FEFFFF mov dword ptr [ebp+FFFFFE38], ebx
:0057C847 EB01 jmp 0057C84A
:0057C849 E8 BYTE E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0057C847(U)
|
:0057C84A A168705D00 mov eax, dword ptr [005D7068]
:0057C84F 50 push eax
:0057C850 E883FAFFFF call 0057C2D8
:0057C855 83C404 add esp, 00000004
:0057C858 898540FEFFFF mov dword ptr [ebp+FFFFFE40], eax
:0057C85E EB01 jmp 0057C861

然后就是按F10一直向下走了,直到出现第二个CALL KERNEL32!Deviceiocontrol时:

:0057C8E1 50 push eax
:0057C8E2 FF15AC815D00 call dword ptr [005D81AC] <=====第二次读狗(Call KERNEL32!Deviceiocontrol)
:0057C8E8 8945F8 mov dword ptr [ebp-08], eax
:0057C8EB 8B45FC mov eax, dword ptr [ebp-04]
:0057C8EE 50 push eax
:0057C8EF FF1558815D00 call dword ptr [005D8158]
:0057C8F5 8B8528FEFFFF mov eax, dword ptr [ebp+FFFFFE28]
:0057C8FB 50 push eax
:0057C8FC E85DFBFFFF call 0057C45E
:0057C901 83C404 add esp, 00000004
:0057C904 837DF800 cmp dword ptr [ebp-08], 00000000
:0057C908 7434 je 0057C93E
:0057C90A 83BD20FFFFFF00 cmp dword ptr [ebp+FFFFFF20], 00000000 <=====第二次判断狗,如果没有狗,这里的内存地址[81FD08]是一个非0的数,同时这个内存地址也是加密狗的重要内存地址,所以我们要把这个地址的内容改为0,我的改法是:and dword prt [ebp+ffffff20],00000000,刚好是一样的代码长度
:0057C911 7513 jne 0057C926
:0057C913 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] <====取从狗中读出的数据
:0057C919 338538FEFFFF xor eax, dword ptr [ebp+FFFFFE38] <====与另外的一个数据异或,将结果赋给EAX
:0057C91F A3D8705D00 mov dword ptr [005D70D8], eax <=====将结果赋给内存地址[005D70D8],我们先带狗运行程序,可知运行到这里的时候,EAX的值是5CCAB580,所以我们必须把这个内存地址的内容赋为5CCAB580
:0057C924 EB16 jmp 0057C93C

我的改法是:

:0057C90A 83A520FFFFFF00 and dword ptr [ebp+FFFFFF20], 00000000
:0057C911 7513 jne 0057C926
:0057C913 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24]
:0057C919 B880B5CA5C mov eax, 5CCAB580 <=====将EAX赋予5CCAB580
:0057C91E 90 nop
:0057C91F A3D8705D00 mov dword ptr [005D70D8], eax <======将5CCAB580赋给内存地址[005D70D8]
:0057C924 EB16 jmp 0057C93C

至此,TDMD狗就被我们破掉了