编程语言
首页 > 编程语言> > Master PDF Editor 5.7.40 64位程序分析爆破

Master PDF Editor 5.7.40 64位程序分析爆破

作者:互联网

【文章标题】: Master PDF Editor 5.7.40 64位程序分析爆破
【文章作者】: speedboy
【软件名称】: Master PDF Editor
【下载地址】: https://code-industry.net/public/MasterPDFEditor-setup.exe
【加壳方式】: 无
【编写语言】: Microsoft Visual C++
【使用工具】: x64dbg
【操作平台】: win7
【软件介绍】: 强大的多功能PDF编辑器,轻松查看,创建,修改,批注,签名,扫描,OCR和打印PDF文档。高级注释工具,可以添加任意便笺指示对象突出显示,加下划线和删除,而无需更改源PDF文件。
【作者声明】: 只做学习、交流


【详细过程】
1、 用x64dbg加载程序并运行,搜索“NOT REGISTERED”,并上溯到代码段首
短首

000000013FA984F5 | 57                    | push rdi                                                                               |
000000013FA984F6 | 48:83EC 30            | sub rsp,30                                                                             |
000000013FA984FA | 48:C74424 28 FEFFFFFF | mov qword ptr ss:[rsp+28],FFFFFFFFFFFFFFFE                                             |
000000013FA98503 | 48:895C24 40          | mov qword ptr ss:[rsp+40],rbx                                                          |
000000013FA98508 | 48:8BFA               | mov rdi,rdx                                                                            | rdx:EntryPoint
000000013FA9850B | 48:8BD9               | mov rbx,rcx                                                                            |
000000013FA9850E | C74424 20 00000000    | mov dword ptr ss:[rsp+20],0                                                            |
000000013FA98516 | 48:8D15 A3AABD00      | lea rdx,qword ptr ds:[140672FC0]                                                       | rdx:EntryPoint, 0000000140672FC0:"ru_ru"==L"畲牟u"
000000013FA9851D | 48:8BCF               | mov rcx,rdi                                                                            |
000000013FA98520 | FF15 4AF9BC00         | call qword ptr ds:[<&??8QString@@QEBA_NPEBD@Z>]                                        |
000000013FA98526 | 84C0                  | test al,al                                                                             |
000000013FA98528 | 74 16                 | je masterpdfeditor.13FA98540                                                           |
000000013FA9852A | 41:83C8 FF            | or r8d,FFFFFFFF                                                                        |
000000013FA9852E | 48:8D15 9307C100      | lea rdx,qword ptr ds:[1406A8CC8]                                                       | rdx:EntryPoint
000000013FA98535 | 48:8BCB               | mov rcx,rbx                                                                            |
000000013FA98538 | FF15 4AF9BC00         | call qword ptr ds:[<&?fromUtf8@QString@@SA?AV1@PEBDH@Z>]                               |
000000013FA9853E | EB 15                 | jmp masterpdfeditor.13FA98555                                                          |
000000013FA98540 | BA 11000000           | mov edx,11                                                                             |
000000013FA98545 | 48:8D0D BC07C100      | lea rcx,qword ptr ds:[1406A8D08]                                                       | 00000001406A8D08:" (NOT REGISTERED)"
000000013FA9854C | FF15 06F9BC00         | call qword ptr ds:[<&?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z>]   |
000000013FA98552 | 48:8903               | mov qword ptr ds:[rbx],rax                                                             |
000000013FA98555 | 48:8BCF               | mov rcx,rdi                                                                            |
000000013FA98558 | FF15 7AF9BC00         | call qword ptr ds:[<&??1QString@@QEAA@XZ>]                                             |
000000013FA9855E | 48:8BC3               | mov rax,rbx                                                                            |
000000013FA98561 | 48:8B5C24 40          | mov rbx,qword ptr ss:[rsp+40]                                                          |
000000013FA98566 | 48:83C4 30            | add rsp,30                                                                             |
000000013FA9856A | 5F                    | pop rdi                                                                                |
000000013FA9856B | C3                    | ret

4、经过分析“cmp byte ptr ds:[r14+49],bl”为关键比较(未注册时,经过运行分析此时bl=0,ds:[r14+49]=0,如果ds:[r14+49]=1,其下一行跳转实现,就会跳过调用未注册处理函数),在此语句上右键——查找引用——常数

000000013FFD53EC mov byte ptr ds:[r14+49],al
000000013FFD5569 movzx r8d,byte ptr ds:[r14+49]
000000013FFD5AC3 movzx edx,byte ptr ds:[r14+49]
000000013FFD5B58 cmp byte ptr ds:[r14+49],bl
000000013FFDEF42 movzx r8d,byte ptr ds:[rdi+49]
000000013FFDF97F cmp byte ptr ds:[rsi+49],r15b

5、双击“000000013FFD53EC mov byte ptr ds:[r14+49],al”来到反汇编区

000000013F9253E7 | E8 D4730000               | call masterpdfeditor.13F92C7C0                                  | 》关键Call,使返回的al=1
000000013F9253EC | 41:8846 49                | mov byte ptr ds:[r14+49],al                                     |
000000013F9253F0 | 8D4B 30                   | lea ecx,qword ptr ds:[rbx+30]                                   |

6、在call masterpdfeditor.13F92C7C0处F7跟进,使返回的al=1,这样 ds:[r14+49]就会被赋值为1

000000013F5384F5  | 57                      | push rdi                                                                              |
000000013F5384F6  | 48:83EC 30              | sub rsp,30                                                                            |
……………………
……………………
……………………
000000013FFDCADB | E9 EE000000             | jmp masterpdfeditor.13FFDCBCE                                         |
000000013FFDCAE0 | 49:8B87 30030000        | mov rax,qword ptr ds:[r15+330]                                        |
000000013FFDCAE7 | 8378 04 12              | cmp dword ptr ds:[rax+4],12                                           |
000000013FFDCAEB | 0F8C D2000000           | jl masterpdfeditor.13FFDCBC3                                          | 》【1】不跳
000000013FFDCAF1 | 49:8B87 38030000        | mov rax,qword ptr ds:[r15+338]                                        |
000000013FFDCAF8 | 8378 04 28              | cmp dword ptr ds:[rax+4],28                                           | 28:'('
000000013FFDCAFC | 0F8C C1000000           | jl masterpdfeditor.13FFDCBC3                                          | 》【2】不跳
000000013FFDCB02 | 49:8D97 48030000        | lea rdx,qword ptr ds:[r15+348]                                        | rdx:EntryPoint
000000013FFDCB09 | 48:8D4D 58              | lea rcx,qword ptr ss:[rbp+58]                                         |
000000013FFDCB0D | FF15 CDB3D300           | call qword ptr ds:[<&??0QBitArray@@QEAA@AEBV0@@Z>]                    |
000000013FFDCB13 | 48:8BD8                 | mov rbx,rax                                                           |
000000013FFDCB16 | 49:8D97 30030000        | lea rdx,qword ptr ds:[r15+330]                                        | rdx:EntryPoint
000000013FFDCB1D | 48:8D4D 60              | lea rcx,qword ptr ss:[rbp+60]                                         |
000000013FFDCB21 | FF15 B9B3D300           | call qword ptr ds:[<&??0QBitArray@@QEAA@AEBV0@@Z>]                    |
000000013FFDCB27 | 4C:8BC3                 | mov r8,rbx                                                            |
000000013FFDCB2A | 48:8BD0                 | mov rdx,rax                                                           | rdx:EntryPoint
000000013FFDCB2D | 48:8D4D 50              | lea rcx,qword ptr ss:[rbp+50]                                         |
000000013FFDCB31 | E8 DA250300             | call masterpdfeditor.14000F110                                        |
000000013FFDCB36 | 90                      | nop                                                                   |
000000013FFDCB37 | 41:B9 01000000          | mov r9d,1                                                             |
000000013FFDCB3D | 45:33C0                 | xor r8d,r8d                                                           |
000000013FFDCB40 | 48:8D55 50              | lea rdx,qword ptr ss:[rbp+50]                                         | rdx:EntryPoint
000000013FFDCB44 | 49:8D8F 38030000        | lea rcx,qword ptr ds:[r15+338]                                        |
000000013FFDCB4B | FF15 0FADD300           | call qword ptr ds:[<&?indexOf@QString@@QEBAHAEBV1@HW4CaseSensitivity@ |
000000013FFDCB51 | 85C0                    | test eax,eax                                                          |
000000013FFDCB53 | 78 04                   | js masterpdfeditor.13FFDCB59                                          | 》【3】不跳(eax不是负数就不跳)
000000013FFDCB55 | B3 01                   | mov bl,1                                                              | 》此处bl被赋值为1,是为下一步的参数传递做准备
000000013FFDCB57 | EB 60                   | jmp masterpdfeditor.13FFDCBB9                                         |
………………
………………
………………
000000013FFDCBB9 | 48:8D4D 50              | lea rcx,qword ptr ss:[rbp+50]                                         |
000000013FFDCBBD | FF15 15B3D300           | call qword ptr ds:[<&??1QString@@QEAA@XZ>]                            |
000000013FFDCBC3 | 48:8D4D C0              | lea rcx,qword ptr ss:[rbp-40]                                         |
000000013FFDCBC7 | FF15 FBAAD300           | call qword ptr ds:[<&?sync@QSettings@@QEAAXXZ>]                       |
000000013FFDCBCD | 90                      | nop                                                                   |
000000013FFDCBCE | 48:8D4D C0              | lea rcx,qword ptr ss:[rbp-40]                                         |
000000013FFDCBD2 | FF15 B8B1D300           | call qword ptr ds:[<&??1QSettings@@UEAA@XZ>]                          |
000000013FFDCBD8 | 0FB6C3                  | movzx eax,bl                                                          | 》注册标志为eax=bl=1

7、在【1】、【2】、【3】处手术即可实现破解。
破解前
破解后

标签:48,5.7,49,mov,40,ptr,qword,Master,ds
来源: https://blog.csdn.net/qq_36427523/article/details/115031723