看雪学院OD使用教程清晰中文版_od教程-专业指导文档类资源-CSDN文库

共1个文件

pdf：1个

OLLYDBG

OLLYICE

使用教程

看雪学院

5星 · 超过95%的资源需积分: 50 361 浏览量 2010-03-16 12:38:08 上传评论 2 收藏 2.53MB RAR 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

资源推荐

资源详情

资源评论

收起资源包目录

看雪OD教程.rar （1个子文件）

ARTeam站上的10篇OD入门教程.pdf 3.14MB

ARTeam 的 10 篇 OllyDBG 入门教程（中文版）

看雪学院荣誉出品

zoomcad 整理

二○○六年四月二十一日

原文链接：

http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Beginner_Olly_Tutorial_Part1_by_Gabri3l.rar 翻译：thinkSJ

http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Beginner_Olly_Tutorial_Part2_by_Gabri3l.rar 翻译：thinkSJ

http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Beginner_Olly_Tutorial_Part3_by_Gabri3l.rar 翻译：thinkSJ

http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Beginner_Olly_Tutorial_Part4_by_Shub-Nigurrath_v11.rar 翻译：aalloverred

http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Beginner_Olly_Tutorial_Part5_by_Gabri3l.rar 翻译：aalloverred

http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Beginner_Olly_Tutorial_Part6_by_Shub-Nigurrath_v11.rar 翻译：aalloverred

http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Beginner_Olly_Tutorial_Part7_by_MaDMAn_H3rCuL3s.rar 翻译：springkang[DFCG]

http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Beginner_Olly_Tutorial_Part8_by_Shub_Nigurrath_v141.rar 翻译：zhaoocn

http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Beginner_Olly_Tutorial_Part9_by_Gabri3l.rar 翻译：zhaoocn

http://omega.intechhosting.com/~access/ARTeam/tutorials/file_info/download1.php?file=Beginner_Olly_Tutorial_Part10_by_Shub_Nigurrath_v10.rar 翻译：roxhaiy

PDF 文件使用 "pdfFactory Pro" 试用版本创建 www.fineprint.cn

Gabri3l Tutorial #1

Beginner Tutorial: Serial fishing

目标软件：

WorldTV7.1

http://www.netfor2.com/WorldTV.html

(TSJ：由于我下载不了这个程序，所以后面的翻译可能会不太准确)

工具：

OD1.09d 、PEID0.92 、W32dasm 、HexWorkshop 4.1

保护方式：

序列号方式

其它信息：

This is a tutorial to introduce the new crackers to serial fishing with Olly , I will take

You through the steps that I took in cracking this program , This may help you get a

Better idea of how to approach new targets .

这是一篇介绍用 OD 来进行破解得到序列号的教程，我将让你知道我在破解这个程序时的一些思路，这或许能帮

你在破解时想出一些好的主意。

Intro

介绍

所有的工具都能在线得到：

http://home.t-online.de/home/Ollydbg/odbg109d.zip

http://peid.has.it/

http://protools.cjb.net/

Let us first get set up and ready to crack, I like to open the folder with my target in it .In this case c:\program files\worldtv\

and make a quick backup that we can work on without fear of screwing up the file. I named mine worldtv2.exe and I will refer to

it as such through the tutorial

先做一些预备工作并准备破解，打开目标软件所在的文件夹，我的是在 c:\program files\worldtv\ ，并做一个备份，命名

为 worldtv2.exe, 同样在这篇教程中我也会用到它。

It has become habit to first examine a target with PEiD to determine the packer or protector .Open up PEiD and drag

worldtv2.exe into it , The result:”Microsoft Visual C++5.0”.Surprisingly, the target is not packed or protected, That will make it

all the easier to crack.

首先用 PEiD 检测目标软件以确定它是否有 packer 或 protector。打开 PEiD 并拖拉 worldtv2.exe(TSJ：也就先前备份的那

个)到它的界面，结果为:”Microsoft Visual 5.0”。让人惊讶的是，该软件没有 packed 或 protected，这将使它更易于破解。

Body

PDF 文件使用 "pdfFactory Pro" 试用版本创建 www.fineprint.cn

Knowing that we will not need to unpack the executable lets us do a little examination of the protection scheme. Open up worldtv.

It goes directly into the nag screen letting us know that it is not registered. That is important to note because it lets us know that it

is checking for a registration key (maybe a keyfile or registry key) before the program even loads. Try putting in a random key.

Ah, we get a nice little messagebox telling us “Invalid Registration Code”, Let’s write that little message down and save it. If you

have read any previous tutorials you know that it may come in handy. Press Okay and the program quits.

已经知道了，我们不需要对可执行文件脱壳。要想知道它的保护方案，还需要进一步检查，运行 worldtv，它直接进入了

nag 窗口以让我们知道这是未经过注册的，这个信息非常重要，因为它让我们了解到程序在刚加载时会检查注册码（有

可能是注册文件也有可能是注册码），随便输入一个注册码，Ah, 我们会看到一个信息框以告诉我们“Invalid Registration

Code”（无效的注册码）,现在先把这个提示信息给记下来，如果你已经看过以前的教程你就会知道这些信息迟早会派得

上用场，最后按 Okay 程序退出。

Finding the Bytes:

First we are going to try the easy way. We are going to patch the jump that returns the invalid registration box. Run w32dasm

and use it to open up WorldTv.exe. We are opening the original WorldTv.exe file so we can work on the copy that we made. After

the file has been disassembled ,we will look for the string from the messagebox. To do this click on the String References button

at the top of w32dasm, A new window opens up with a list of all strings found in the file. Scroll down until you find “Invalid

Registration Code ” and double click it. You should now be at the following lines:

首先我们要试一下最简单的方法，就是 patch(暴破 )跳转指令让它跳过无效的注册框。运行 w32dasm 并打开

WorldTv.exe，这里使用原始的目标软件，因此可以对副本进行修改。在反汇编完成之后，就要开始寻找信息框中的字符

串了（TSJ：就是刚才记下来的东西），点击 w32dasm 工具栏上的 “串式数据参考” 按钮，就会弹出一个窗口并列出了所

有用在文件中被找到的字符串，向下滚动列表直到你发现”Invalid Registration Code”为止，并双击字符串，就会来到如下

位置：

Looking at the code we see a test eax, eax followed by a jne 0041b51c

从下面这段代码中能看到在 test eax, eax 后面的一条指令是 jne 0041b51c

PDF 文件使用 "pdfFactory Pro" 试用版本创建 www.fineprint.cn

We want to change the jne(jump if not equal) to jmp(jump) that way the program will register when you use any serial. To do this

we will need to find where the jne instruction is located in WorldTv.exe. That information is found at the bottom of the w32dasm

window. You should see:

Line:52558 Pg 657 and 658 of 1734 Code Data @:0041B521 @:Offset 0001A915h in File WorldTv.exe

We are interested in the Offset value of 0001A915h , Write this number down; ignore the h at the end it just means that the value

is hexadecimal.

我们想要将 jne（注：0041b515 处）改为 jmp 就可以使用任何序列号来对程序进行注册了，那么首先我们需要得 jne 指令

在 WorldTv.exe 中的位置，你会在 w32dasm 下面的窗口发现这些信息，如下：

Line:52558 Pg 657 and 658 of 1734 Code Data @:0041B521 @Offset 0001A915h in File WorldTv.exe

让我们感兴趣的是 0001A915h 的偏移值，将它记下来，要忽略末尾的 h，它仅仅只是表示这是一个十六进制的值。

Patching the Bytes:

Begin by opening up WorldTV2.exe in HexWorkshop. Next press CTRL+G to bring up the Goto dialog box, Goto can also be

found under Edit. We now want to type in the offset value that we wrote down, in this case 0001A915. Make sure the Hex option

is checked and the Beginning of File option is checked. When you are ready press the Go button.

先用 HexWorkshop 将 WorldTv2.exe 打开，再按 CTRL+G 弹出 Goto 对话框，也可以 Edit 菜单的下拉选项中找到，现在输

入刚才记下来的偏移值 0001A915，确定 Hex 和 Beginning of File 选项都选中之后，再点击 Go 按钮。

This will take us to the location of our jne 0041B54C .Now hopefully from previous tutorials you know that 75 is the opcode for

the instruction JNE and 74 is the opcode for instruction JE .In this case rather then jumping bad serials we want the program to

jump on ANY serial. We will replace 75 with EB which is the instruction for JMP .

现在来到 jne 0041B54C 所在的位置，我们知道 75 是 JNE 指令的机器码，74 是 JE 指令的机器码，在这里，我们想让程

序在输入任何序列号的情况下都能够跳转，所以要用 EB (jmp)来取代 75 。（TSJ：下图中的 0001A915 处是 74，但实际

PDF 文件使用 "pdfFactory Pro" 试用版本创建 www.fineprint.cn

上这里应该是 75，可能有错！）

更改后为：

Save WorldTv2.exe, I have made it a habit of choosing YES when asked if I want to make a backup, Now, find your newly

patched WorldTv2.exe and run it.

It asks for a serial; give it any one you want, I will use 1234567 .Press Validate Registration and ….Success! Registration Code

Accepted. Are we done? No.

Close WorldTv2.exe and open it back up again. It is still asking for a serial, Now, we could just put in a serial every time we use

it but that is annoying. Instead, we are going to find a real serial.

保存 WorldTv2.exe, 并在它询问是否生成备份时选 YES，现在找到最新版的 WorldTv2.exe 并运行它。

它需要序列号，输入任何一个你想得到的，我输入的是 1234567，并点击验证序列号

……成功！Registration Code Accepted. 我们已经完成任务了吗？不！(TSJ：要是结束就奇怪了，OD 还没上场呢！)

关闭 WorldTv2.exe 并重新运行备份，它仍然需要序列号，我们可以在每次使用它的时候给它一个序列号但是这样太

烦了。解决办法是，要找到真正的序列号。

Finding a Serial:

To begin, review what we know about the program so far:

It checks for a serial when starting up.

After registering with a bogus serial it is unregistered the next time you start it up

This means that before the program even completely loads it is checking for the existence of a good serial. We need to find out

where that serial is being stored. There are usually two places a serial is stored; the registry and in a file. We are going to start

with checking the registry. Start up WorldTv2.exe and put in 1324567 as the serial. Validate the serial and then close WorldTv.

Go to your Start menu and find the Run command, A box will open asking you to “Type the name of a program, folder,

etc….”. Type in “regedit”, without the quotes, and press enter. You will now be in the regedit window and see a two pane window

with a list of folders in the left pane. Click on the plus sign in front of HKEY_CURRENT_USER. It will open, you now have

another list of folders.Click the plus sign in front of Software. Scroll down until you find WorldTV and click on the folder. Aha!

In the right pane we have a key called RegCode with our bogus key:1234567 stored in it. We now know that WorldTV checks the

registry for a serial before loading

PDF 文件使用 "pdfFactory Pro" 试用版本创建 www.fineprint.cn

评论收藏

内容反馈

qq_37434795

2019-02-02

看了可以的就是感觉有点难
he1m4n6a

2014-11-17

挺不错，用起来挺舒服
beatifullive

2014-09-02

很清晰，思路也不错
abc11031758

2014-07-02

en ,不过很难懂，要多学习，多实践
nongzhenqin

2013-08-20

正在搞易语言，很有用。

前往

页

doman2009

粉丝: 1
资源: 9

会员权益专享

看雪学院OD使用教程清晰中文版

OllyICE使用教程

OllyDbg(OD)新手入门教程（出自看雪学院）

OD入门系列图文详细教程-破解做辅助起步(二)借鉴.pdf

OllyDBG 原版软件+看雪绿色版软件+看雪插件+教程

看雪学院官方破解教程

看雪学院5年珍藏 1

ARTeam站上的10篇OD入门教程

看雪学院十周年纪念版-论坛精华.part5

看雪学院五周年纪念收藏版(含论坛精华6)

OllyICE反汇编教程及汇编命令详解.rar

看雪教程电子书

OllyICE反汇编教程及汇编命令详解[定义].pdf

看雪汇编教程.zip

看雪软件破解教程及工具使用手册

看雪学院OllyDBG教程.zip(白嫖)

看雪学院软件安全01期.pdf

看雪学院十周年纪念版-论坛精华.part2

看雪学院十周年纪念版-论坛精华.part1

《看雪论坛精华》破解教程 第一部分

ollydbg--tut

冰若° OD-2.02019全中文最新版

OD版本2.0 汉化版本

本人亲测无毒郁金香OD中文版

密界MSDN（工具集合）

看雪学院论坛精华贴五周年纪念收藏版第一部分(chm)

看雪论坛精华合集9 (4/4) 看雪学院建站八周年精华

看雪论坛精华集合9 看雪学院建站八周年精华

看雪论坛的经典教程

一蓑烟雨论坛三年精华集(共42M二分卷)分卷二

会员权益专享

最新资源

《看雪论坛精华》破解教程第一部分