破解Demo

需要破解的程序界面如下：

需要破解的程序的主要代码如下：

void CEasyCrackMeDlg::OnBnClickedButtonOk()
{
    // TODO: 在此添加控件通知处理程序代码
    TCHAR szID[MAXBYTE] = {0};
    TCHAR szPassword[MAXBYTE] = {0};
    TCHAR szTempPassword[MAXBYTE] = {0};

    GetDlgItemText(IDC_EDIT_ID, szID, MAXBYTE);
    GetDlgItemText(IDC_EDIT_PASSWORD, szPassword, MAXBYTE);

    if (lstrlen(szID) == 0)
    {
        return;
    }

    if (lstrlen(szPassword) == 0)
    {
        return;
    }

    if (lstrlen(szID) < 7)
    {
        return;
    }

    for (int i = 0; i < lstrlen(szID); i++)
    {
        if (szID[i] == _T('Z') || szID[i] == _T('z') || szID[i] == _T('9'))
        {
            szTempPassword[i] = szID[i];
        }
        else
        {
            szTempPassword[i] = szID[i] + 1;
        }
    }

    if (lstrcmp(szTempPassword, szPassword) == 0)
    {
        AfxMessageBox(_T("密码正确"));
    }
    else
    {
        AfxMessageBox(_T("密码错误"));
    }
}

void CEasyCrackMeDlg::OnBnClickedButtonCancel()
{
    // TODO: 在此添加控件通知处理程序代码
    OnCancel();
}

需要破解的程序的下载地址：
http://pan.baidu.com/s/1jG2ZV06

一、文件补丁

用OD打开上面的程序，下断点：bp lstrcmpW，运行到断点处后跳出该程序，会看到判断的地方JNZ（代码为75h），把它修改为JZ（代码为74h）即可，该行对应的地址为内存中的虚拟地址VA，转换成FileOffset后修改75h为74h即可。

文件补丁的具体代码如下：

#include <Windows.h>
#include <iostream>

using namespace std;

int main(int argc, char **argv)
{
    DWORD dwFileOffset = 0;

#ifdef _DEBUG
    dwFileOffset = 0x00001FED;
#else
    dwFileOffset = 0x00000828;
#endif

    BYTE bCode = 0;
    DWORD dwReadNum = 0;

    if (argc != 2)
    {
        cout << "Please input two argument!" << endl;
        return -1;
    }

    DWORD dwErr = 0;

    //打开文件
    HANDLE hFile = CreateFile(argv[1], GENERIC_WRITE | GENERIC_READ, FILE_SHARE_WRITE | FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (INVALID_HANDLE_VALUE == hFile)
    {
        dwErr = GetLastError();
        cout << __LINE__ << " : CreateFile error ( " << dwErr << " )" <<endl;
        return -1;
    }

    if (INVALID_SET_FILE_POINTER == SetFilePointer(hFile, dwFileOffset, NULL, FILE_BEGIN))
    {
        dwErr = GetLastError();
        cout << __LINE__ << " : SetFilePointer error ( " << dwErr << " )" <<endl;
        return -1;
    }
    
    if (0 == ReadFile(hFile, (LPVOID)&bCode, sizeof(BYTE), &dwReadNum, NULL))
    {
        dwErr = GetLastError();
        cout << __LINE__ << " : ReadFile error ( " << dwErr << " )" <<endl;
        return -1;
    }

    //比较当前位置是否为JNZ
    if (TEXT('x75') != bCode)
    {
        cout << bCode << endl;
        CloseHandle(hFile);
        return -1;
    }

    //修改为JZ
    bCode = TEXT('x74');
    if (INVALID_SET_FILE_POINTER == SetFilePointer(hFile, dwFileOffset, 0, FILE_BEGIN))
    {
        dwErr = GetLastError();
        cout << __LINE__ << " : SetFilePointer error ( " << dwErr << " )" <<endl;
        CloseHandle(hFile);
        return -1;
    }

    if (0 == WriteFile(hFile, (LPVOID)&bCode, sizeof(BYTE), &dwReadNum, NULL))
    {
        dwErr = GetLastError();
        cout << __LINE__ << " : WriteFile error ( " << dwErr << " )" <<endl;
        CloseHandle(hFile);
        return -1;
    }

    cout << "Write JZ is Successfully !" << endl;

    CloseHandle(hFile);

    //运行修改后的程序
    //int iLen = WideCharToMultiByte(CP_ACP, 0, argv[1], -1, NULL, 0, NULL, NULL);
    //char *pszFileName = new char[iLen];
    //WideCharToMultiByte(CP_ACP, 0, argv[1], -1, pszFileName, iLen, NULL, NULL);
    //WinExec(pszFileName, SW_SHOW);
    //delete[] pszFileName;
    WinExec(argv[1], SW_SHOW);

    return 0;
}

这里把上面需要破解的程序拖到文件补丁上打开即可破解。

二、内存补丁

具体方法同上面的文件补丁，只是不需要做VA到FileOffset的转换。

具体代码如下：

#include <Windows.h>
#include <iostream>

using namespace std;

int main(int argc, char **argv)
{
    DWORD dwVAddress = 0;
#ifdef _DEBUG
    dwVAddress = 0x01262BED;
#else
    dwVAddress = 0x01011428;
#endif
    BYTE bCode = 0;
    DWORD dwReadNum = 0;
    DWORD dwErr = 0;

    if (argc != 2)
    {
        cout << "Please input two argument!" <<endl;
        return -1;
    }

    STARTUPINFO si = {0};
    si.cb = sizeof(STARTUPINFO);
    si.wShowWindow = SW_SHOW;
    si.dwFlags = STARTF_USESHOWWINDOW;

    PROCESS_INFORMATION pi = {0};

    BOOL bRet = CreateProcess(argv[1], NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
    if (FALSE == bRet)
    {
        dwErr = GetLastError();
        cout << __LINE__ << " : CreateProcess Error ( " << dwErr << " )" << endl;
        return -1;
    }

    ReadProcessMemory(pi.hProcess, (LPVOID)dwVAddress, (LPVOID)&bCode, sizeof(BYTE), &dwReadNum);

    //判断是否为JNZ
    if (TEXT('x75') != bCode)
    {
        dwErr = GetLastError();
        cout << bCode << endl;
        CloseHandle(pi.hThread);
        CloseHandle(pi.hProcess);
        return -1;
    }

    //将JNZ修改为JZ
    bCode = TEXT('x74');
    WriteProcessMemory(pi.hProcess, (LPVOID)dwVAddress, (LPVOID)&bCode, sizeof(BYTE), &dwReadNum);

    ResumeThread(pi.hThread);

    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);

    cout << "Write JZ is Successfully !" << endl;

    return 0;
}