破解Demo

需要破解的程序界面如下：

需要破解的程序的主要代码如下：

 void CEasyCrackMeDlg::OnBnClickedButtonOk()
 {
     // TODO: 在此添加控件通知处理程序代码
     TCHAR szID[MAXBYTE] = {};
     TCHAR szPassword[MAXBYTE] = {};
     TCHAR szTempPassword[MAXBYTE] = {};

     GetDlgItemText(IDC_EDIT_ID, szID, MAXBYTE);
     GetDlgItemText(IDC_EDIT_PASSWORD, szPassword, MAXBYTE);

     if (lstrlen(szID) == )
     {
         return;
     }

     if (lstrlen(szPassword) == )
     {
         return;
     }

     if (lstrlen(szID) < )
     {
         return;
     }

     for (int i = ; i < lstrlen(szID); i++)
     {
         if (szID[i] == _T('Z') || szID[i] == _T('z') || szID[i] == _T(''))
         {
             szTempPassword[i] = szID[i];
         }
         else
         {
             szTempPassword[i] = szID[i] + ;
         }
     }

     if (lstrcmp(szTempPassword, szPassword) == )
     {
         AfxMessageBox(_T("密码正确"));
     }
     else
     {
         AfxMessageBox(_T("密码错误"));
     }
 }

 void CEasyCrackMeDlg::OnBnClickedButtonCancel()
 {
     // TODO: 在此添加控件通知处理程序代码
     OnCancel();
 }

需要破解的程序的下载地址：
http://pan.baidu.com/s/1jG2ZV06

一、文件补丁

用OD打开上面的程序，下断点：bp lstrcmpW，运行到断点处后跳出该程序，会看到判断的地方JNZ（代码为75h），把它修改为JZ（代码为74h）即可，该行对应的地址为内存中的虚拟地址VA，转换成FileOffset后修改75h为74h即可。

文件补丁的具体代码如下：

 #include <Windows.h>
 #include <iostream>

 using namespace std;

 int main(int argc, char **argv)
 {
     DWORD dwFileOffset = ;

 #ifdef _DEBUG
     dwFileOffset = 0x00001FED;
 #else
     dwFileOffset = 0x00000828;
 #endif

     BYTE bCode = ;
     DWORD dwReadNum = ;

     if (argc != )
     {
         cout << "Please input two argument!" << endl;
         return -;
     }

     DWORD dwErr = ;

     //打开文件
     HANDLE hFile = CreateFile(argv[], GENERIC_WRITE | GENERIC_READ, FILE_SHARE_WRITE | FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
     if (INVALID_HANDLE_VALUE == hFile)
     {
         dwErr = GetLastError();
         cout << __LINE__ << " : CreateFile error ( " << dwErr << " )" <<endl;
         return -;
     }

     if (INVALID_SET_FILE_POINTER == SetFilePointer(hFile, dwFileOffset, NULL, FILE_BEGIN))
     {
         dwErr = GetLastError();
         cout << __LINE__ << " : SetFilePointer error ( " << dwErr << " )" <<endl;
         return -;
     }

     if ( == ReadFile(hFile, (LPVOID)&bCode, sizeof(BYTE), &dwReadNum, NULL))
     {
         dwErr = GetLastError();
         cout << __LINE__ << " : ReadFile error ( " << dwErr << " )" <<endl;
         return -;
     }

     //比较当前位置是否为JNZ
     if (TEXT('\x75') != bCode)
     {
         cout << bCode << endl;
         CloseHandle(hFile);
         return -;
     }

     //修改为JZ
     bCode = TEXT('\x74');
     if (INVALID_SET_FILE_POINTER == SetFilePointer(hFile, dwFileOffset, , FILE_BEGIN))
     {
         dwErr = GetLastError();
         cout << __LINE__ << " : SetFilePointer error ( " << dwErr << " )" <<endl;
         CloseHandle(hFile);
         return -;
     }

     if ( == WriteFile(hFile, (LPVOID)&bCode, sizeof(BYTE), &dwReadNum, NULL))
     {
         dwErr = GetLastError();
         cout << __LINE__ << " : WriteFile error ( " << dwErr << " )" <<endl;
         CloseHandle(hFile);
         return -;
     }

     cout << "Write JZ is Successfully !" << endl;

     CloseHandle(hFile);

     //运行修改后的程序
     //int iLen = WideCharToMultiByte(CP_ACP, 0, argv[1], -1, NULL, 0, NULL, NULL);
     //char *pszFileName = new char[iLen];
     //WideCharToMultiByte(CP_ACP, 0, argv[1], -1, pszFileName, iLen, NULL, NULL);
     //WinExec(pszFileName, SW_SHOW);
     //delete[] pszFileName;
     WinExec(argv[], SW_SHOW);

     return ;
 }

这里把上面需要破解的程序拖到文件补丁上打开即可破解。

二、内存补丁

具体方法同上面的文件补丁，只是不需要做VA到FileOffset的转换。

具体代码如下：

 #include <Windows.h>
 #include <iostream>

 using namespace std;

 int main(int argc, char **argv)
 {
     DWORD dwVAddress = ;
 #ifdef _DEBUG
     dwVAddress = 0x01262BED;
 #else
     dwVAddress = 0x01011428;
 #endif
     BYTE bCode = ;
     DWORD dwReadNum = ;
     DWORD dwErr = ;

     if (argc != )
     {
         cout << "Please input two argument!" <<endl;
         return -;
     }

     STARTUPINFO si = {};
     si.cb = sizeof(STARTUPINFO);
     si.wShowWindow = SW_SHOW;
     si.dwFlags = STARTF_USESHOWWINDOW;

     PROCESS_INFORMATION pi = {};

     BOOL bRet = CreateProcess(argv[], NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
     if (FALSE == bRet)
     {
         dwErr = GetLastError();
         cout << __LINE__ << " : CreateProcess Error ( " << dwErr << " )" << endl;
         return -;
     }

     ReadProcessMemory(pi.hProcess, (LPVOID)dwVAddress, (LPVOID)&bCode, sizeof(BYTE), &dwReadNum);

     //判断是否为JNZ
     if (TEXT('\x75') != bCode)
     {
         dwErr = GetLastError();
         cout << bCode << endl;
         CloseHandle(pi.hThread);
         CloseHandle(pi.hProcess);
         return -;
     }

     //将JNZ修改为JZ
     bCode = TEXT('\x74');
     WriteProcessMemory(pi.hProcess, (LPVOID)dwVAddress, (LPVOID)&bCode, sizeof(BYTE), &dwReadNum);

     ResumeThread(pi.hThread);

     CloseHandle(pi.hThread);
     CloseHandle(pi.hProcess);

     cout << "Write JZ is Successfully !" << endl;

     return ;
 }