Information security technology experiment: dynamic analysis and cracking of software
1. Purpose of the experiment
1. Understand the basic functions of dynamic analysis software;
2. Understand the basic method of dynamic analysis software cracking program;
3. Familiar with OllyDbg usage.
2. Experimental content and design ideas
This experiment provides a simple way to crack the program. For different software protection methods, there will be many more complex analysis
methods, and these can only be realized when you are familiar with the use of OllyDbg. During the experiment, it is also important to be familiar with
the functions and usage of OllyDbg. It is recommended that the experimental class be 2 credit hours.
3. Experimental use environment
Pentium Ⅲ, CPU above 600 MHz, memory above 128M, hard disk above 10G, operating system above Windows XP installed
, dynamic analysis software OllyDbg1.09 debugger.
4. Experimental steps and debugging process
A．Cracking of modern Chinese dictionary software
1. Install the modern Chinese dictionary software in the experiment directory.
2. Use the tool software PEid to find the shell, programming language, entry and other information of the software. Then peel off.
3. Execute the OllyDbg.exe file, select "File" | "Open" on the OllyDbg window, and
enter the main program for debugging.
4. Use OllyDbg to find the error message that appears during registration, and find
the location of key Call and key jump instructions according to the prompt information.
5. Single-step execution to find the registration code and other information stored in the memory. Or modify the instruction code of the program; or use
Keymake to make a registration machine.
B．Cracking of ordinary registered software
Use the tools mentioned above to track and crack the Cycle in this directory.
4.1 Method 1
First, open the Chinese dictionary for the first time and register, but it fails.
Then use PEid to search for the software's shell, programming language, entry and other information. Perform unpacking
and restart the dictionary, but the registration is still not successful
Then open the OllyDbg software, click the file to open the application (Modern Chinese Dictionary), click Run
Click the plug-in, click Superstring Search, click Search ASCll, and search for "Registration Failed", the result is shown in the figure below
Click to set a breakpoint and run again
Get the ASCLL value shown in the figure below
0018FBC4 00259840 ASCII “050”
0018FBC8 0025AAD4 ASCII “73056354”
0018FBCC 0025AB24 ASCII “36m5w125}f3989”
0018FBD0 00259820 ASCII “050” 0018FBD4
0025AB40 ASCII “836m5w125}f3989” 0018FBD8 0025980C ASCII “123456” 0018FBDC
002597FC ASCII “
050” 0018FBE0 002350D8
ASCII “ 123456"
Substituting these values one by one, the correct registration code is finally cracked:
836m5w125}f3989
successfully cracked
4.2 Method 2
is the same as the method, first search for "registration failed" and get the following assembly language code
Find the corresponding "JNZ" code, double-click to delete the "N"
Copy to all modifications, then save the file, save it as Unpacked050
run the software
Click the software registration, enter any registration code can be used directly, the cracking is successful
5. Experimental summary
通过这次实验，对网络安全的重要性有了更进一步的了解，通过破解注册码意识到了软件也是有缺陷的，需要我们时刻做好软件的安全保护工作。在实验过程中也遇到过一些问题，但在后续的学习中通过互相讨论与通过互联网工具查询相关知识，不断的学习解决该问题，这为我们后续的信息安全技术的学习打下了很好的基础。