经过两天时间的研究,终于把SourceGear Vault4.0.2的服务器端破解了,直接修改序列号到期时间,用户数限制。明天有时间再把客户端破解了,应该客户端的破解方法和服务器端的差不多,现已有了一些经验,先在这记录一下,等这两天工作不太忙的时候再干革命了。
在这先说一下SourceGear Vault4.0.2的序列号算法(俺看代码所理解的,应该有其它破解方法,高手可以直接写注册机生成工具,不用修改dll文件,我这用的是暴力法),SGV用MD5加密一特殊字符串(具体怎么加密没有做详细的研究,否则俺也可以写个注册码生成出来了)保存到SQL数据库中,读取序列号是从数据库读取再用每5个字符用“-”分开显示出来,经过一段比较复杂的算法从加密码的字符中生成几个数据,有一个是天数,一个是用户数,另一个是是否演示版,另外两个没搞清楚什么作用,不管他。然后拿日期2004-1-1和天数相加,得到一个演示版的使用期限,其他不变,直接输出。反正其他算法俺一时也看不明白,只知道是那个意思。
好了,搞明白这里后可以开始干活了,把相关的dll文件转储导出IL中间代码,这里一定记得把强名去掉,否则修改后会出现dll文件被篡改,程序无法运行,然后修改函数保存后重新编译一次,把生成的dll文件覆盖原文件。
上面就是详细SourceGear Vault4.0.2的破解方法,其它代码没事就不要乱改吧,这是花了我两天时间研究分析出来的结果,写出来可以让大家减少很多时间。
破解关键过程:先转储vs.dll导出IL源代码(中间代码),找到x_unpack函数,直接序列号过期时间、修改用户限制,修改如下:
.method private hidebysig static class vs.ssd
x_unpack(uint8[] b) cil managed
{
// 代码大小 157 (0x9d)
.maxstack 4
.locals init (uint8[] V_0,
uint8[] V_1,
class vs.ssd V_2)
IL_0000: ldc.i4.s 15
IL_0002: newarr [mscorlib]System.Byte
IL_0007: stloc.0
IL_0008: ldarg.0
IL_0009: ldloc.0
IL_000a: ldc.i4.0
IL_000b: callvirt instance void [mscorlib]System.Array::CopyTo(class [mscorlib]System.Array,
int32)
IL_0010: ldloc.0
IL_0011: ldc.i4.0
IL_0012: ldc.i4.0
IL_0013: stelem.i1
IL_0014: ldloc.0
IL_0015: ldc.i4.3
IL_0016: ldc.i4.0
IL_0017: stelem.i1
IL_0018: ldloc.0
IL_0019: ldc.i4.s 11
IL_001b: ldc.i4.0
IL_001c: stelem.i1
IL_001d: ldloc.0
IL_001e: ldc.i4.s 14
IL_0020: ldc.i4.0
IL_0021: stelem.i1
IL_0022: ldloc.0
IL_0023: call uint8[] vs.slic::h(uint8[])
IL_0028: stloc.1
IL_0029: ldarg.0
IL_002a: ldc.i4.0
IL_002b: ldelem.u1
IL_002c: ldloc.1
IL_002d: ldc.i4.0
IL_002e: ldelem.u1
IL_002f: bne.un.s IL_009b
IL_0031: ldarg.0
IL_0032: ldc.i4.3
IL_0033: ldelem.u1
IL_0034: ldloc.1
IL_0035: ldc.i4.1
IL_0036: ldelem.u1
IL_0037: bne.un.s IL_009b
IL_0039: ldarg.0
IL_003a: ldc.i4.s 11
IL_003c: ldelem.u1
IL_003d: ldloc.1
IL_003e: ldc.i4.2
IL_003f: ldelem.u1
IL_0040: bne.un.s IL_009b
IL_0042: ldarg.0
IL_0043: ldc.i4.s 14
IL_0045: ldelem.u1
IL_0046: ldloc.1
IL_0047: ldc.i4.3
IL_0048: ldelem.u1
IL_0049: bne.un.s IL_009b
IL_004b: newobj instance void vs.ssd::.ctor()
//IL_0050: stloc.2
//IL_0051: ldloc.2
//IL_0052: ldarg.0
//IL_0053: ldc.i4.1
//IL_0054: ldelem.u1
//IL_0055: ldc.i4.8
//IL_0056: shl
//IL_0057: ldarg.0
//IL_0058: ldc.i4.2
//IL_0059: ldelem.u1
//IL_005a: or
IL_0050: stloc.2
IL_0051: ldloc.2
IL_0052: ldc.i4 0x1869f //直接加上99999天
IL_005b: stfld int32 vs.ssd::e
IL_0060: ldloc.2
//IL_0061: ldarg.0
//IL_0062: ldc.i4.s 12
//IL_0064: ldelem.u1
IL_0064: ldc.i4 5 //4为演示版
IL_0065: stfld int32 vs.ssd::v
IL_006a: ldloc.2
IL_006b: ldarg.0
IL_006c: ldc.i4.4
IL_006d: ldelem.u1
IL_006e: stfld int32 vs.ssd::t
IL_0073: ldloc.2
//IL_0074: ldarg.0
//IL_0075: ldc.i4.5
//IL_0076: ldelem.u1
//IL_0077: ldc.i4.8
//IL_0078: shl
//IL_0079: ldarg.0
//IL_007a: ldc.i4.6
//IL_007b: ldelem.u1
//IL_007c: or
IL_007c: ldc.i4 999 //用户数量
IL_007d: stfld int32 vs.ssd::n
IL_0082: ldloc.2
IL_0083: ldarg.0
IL_0084: ldc.i4.7
IL_0085: ldelem.u1
IL_0086: ldc.i4.s 16
IL_0088: shl
IL_0089: ldarg.0
IL_008a: ldc.i4.8
IL_008b: ldelem.u1
IL_008c: ldc.i4.8
IL_008d: shl
IL_008e: or
IL_008f: ldarg.0
IL_0090: ldc.i4.s 9
IL_0092: ldelem.u1
IL_0093: or
IL_0094: stfld int32 vs.ssd::u
IL_0099: ldloc.2
IL_009a: ret
IL_009b: ldnull
IL_009c: ret
} // end of method slic::x_unpack
上面还保留原有句子,只是注释掉了,以便以后查看!暂时到这,下一步破解客户端! 应该破解方法差不多。(要是有些朋友只想使用破解好的文件,等俺有点空再发到
www.web3.cn吧反正俺现在就在用,应该破解没什么问题)