Setup IDBE Ribbon Creator2022_x64_V1.1001汇编分析IL代码-吾爱汇编-防破解,反调试,反汇编,软件安全,逆向分析-52hb.com

zyyujq 发表于 2022-5-27 01:13

Setup IDBE Ribbon Creator2022_x64_V1.1001汇编分析IL代码

运行环境：WIN10、WIN11
涉及工具：ExeinfoPe，de4dot，dnSpy，x64dbg
教程类型：汇编取消限制，算法分析等
是否讲解思路和原理：是

以下为图文内容：
Ribbon Creator是所见所得的 Office 功能区编辑器工具
   RibbonCreator是用于开发功能区的WYSIWYG接口。RibbonCreator是在VB2005中开发的，需要.NET Framework 2.0版 .
   对于Microsoft Access 2007、Microsoft Excel 2007、Microsoft Word 2007
   RibbonCreator 2010 对于 Microsoft Access 2010、Excel 2010、PowerPoint 2010、Word 2010
   RibbonCreator 2016 对于 Microsoft Access 2013 & 2016、Microsoft Excel 2013 & 2016、Microsoft Word 2013 & 2016、Microsoft PowerPoint 2013 & 2016
   RibbonCreator 2019 对于 Microsoft Access 2019、Excel 2019、PowerPoint 2019、Word 2019
   RibbonCreator 2021 对于 Microsoft Access 2021、Excel 2021、PowerPoint 2021、Word 2021
它支持为以下控件创建自定义功能区：
         标签，组，对话框启动器，标签，按钮（大或小），切换按钮（大或小），编辑框，复选框，下拉控件，组合框控件，按钮组按钮和切换按钮，拆分按钮（大或小），
         画廊（大或小），菜单（大或小），动态菜单（大或小）和分隔符（在带有文本的菜单中）
   您可以使用适当的对话框（Office IdMso内部图像）为控件选择图像。此外，还可以选择功能区控件的用户定义图像并将其写入Access数据库中的表中。
   您可以为支持此功能的控件创建屏幕提示、超级提示和按键提示。

   共享版本限制了Office自定义 2个 TAB菜单、5个组合框、10个控件。

官方下载：
RibbonCreator 2021:
https://www.ribboncreator2021.de/downloads/Setup IDBE Ribbon Creator2021_V1.1001.zip

https://www.ribboncreator2021.de/downloads/Setup IDBE Ribbon Creator2021_x64_V1.1001.zip

RibbonCreator 2019:
https://www.ribboncreator2019.de/downloads/Setup IDBE Ribbon Creator2019_V1.1006.zip

https://www.ribboncreator2019.de/downloads/Setup IDBE Ribbon Creator2019_x64_V1.1006.zip

RibbonCreator 2016:
https://www.ribboncreator2016.de/downloads/Setup IDBE Ribbon Creator2016_V1.1006.zip

https://www.ribboncreator2016.de/downloads/Setup IDBE Ribbon Creator2016_x64_V1.1006.zip

RibbonCreator 2010:
https://www.ribboncreator2010.de/downloads/SetupRC2010_1.1017.zip

RibbonCreator 2007:
https://www.ribboncreator.de/downloads/SetupRC1.1041.zip

汇编分析：
下载安装 RibbonCreator 2021 X64，主程序为 Ribbon2021.exe，
使用 ExeinfoPe 侦测为 .net 程序。使用 dnSpy 打开程序发现程序混淆处理。

使用 de4dot 脱壳，

按数字/字符串搜索 SHAREWARE 后，在其中查找 2、5、10关键字，匹配特征

搜索到 Ribbon2021.Form1.AddMRU 过程和Ribbon2021.Form1.CheckControls 函数中有 SHAREWARE 内容:

在 Form1.AddMRU 过程中有下面代码，如果修改Not Class22.smethod_19(True) 为 Class22.smethod_19(True)，则不显示共享字符 SHAREWARE，即Class22.smethod_19(True)是关键布尔值函数。

         If Not Class22.smethod_19(True) Then
            Me.Text = strCaption + " - SHAREWARE - " + strNewFile
            Return
         End If
         Me.Text = strCaption + " - " + strNewFile

在Ribbon2021.Form1.CheckControls 函数中，分析Class10.bool_19 应为 True 才不是共享软件的限制。 False为限制。查找该布尔开关Class10.bool_19的函数过程
Public Function CheckControls() As Boolean
Dim result As Boolean
If Class10.bool_19 Then
result = True
Else
Dim str As String = Class7.smethod_41()
Dim str2 As String = Class7.smethod_43()
If Class10.int_6 <= 9 Then
result = True
Else
Interaction.MsgBox("SHAREWARE: " + str + " 10 " + str2, MsgBoxStyle.Information, Class10.string_20)
result = False
End If
End If
Return result
End Function

初步断定，Class22.smethod_19(True) 和 Class10.bool_19 是关键布尔值，为 True 就破除了共享软件的限制。

在 dnSpy 程序中，点击Form1.AddMRU 过程中的 Class22.smethod_19(True)，进入此过程。
Public Function smethod_19(Optional bool_0 As Boolean = False) As Boolean
Dim num As Integer = Class13.smethod_17()
Dim num2 As Integer = Class13.smethod_18()
Dim text As String = Application.StartupPath
If Not text.EndsWith("\") Then
text += "\"
End If
Dim text2 As String = Class17.smethod_2()
If Operators.CompareString(text2, "", False) <> 0 Then
text2 = Class17.smethod_1(text2)
If num = 1 Then
Interaction.MsgBox(text2, MsgBoxStyle.OkOnly, Nothing)
End If
Else
text2 = ""
End If
Dim result As Boolean
If Strings.InStr(text2, "joshtewalt@msn.com", CompareMethod.Binary) > 0 Then
result = False
ElseIf Strings.InStr(text2, "kondorosy.csanad@gmail.com", CompareMethod.Binary) > 0 Then
result = False
ElseIf Strings.InStr(text2, "dimitriska@gmail.com", CompareMethod.Binary) > 0 Then
result = False
ElseIf Strings.InStr(text2, "ednardo.mail@gmail.com", CompareMethod.Binary) > 0 Then
result = False
ElseIf Operators.CompareString(text2, "", False) <> 0 Then
Dim value As String = Strings.Left(text2, 1)
Dim num3 As Integer
Try
' The following expression was wrapped in a checked-expression
num3 = CInt(Conversions.ToLong(value))
If num = 1 Then
Interaction.MsgBox(text + Class10.string_19, MsgBoxStyle.OkOnly, Nothing)
End If
If Operators.CompareString(FileSystem.Dir(text + Class10.string_19, FileAttribute.Normal), "", False) = 0 Then
If Not bool_0 Then
Using frmLicFehlt As frmLicFehlt = New frmLicFehlt()
frmLicFehlt.ShowDialog()
End Using
End If
Return False
End If
If num = 1 Then
Interaction.MsgBox("Lig.ga is available", MsgBoxStyle.OkOnly, Nothing)
End If
Catch ex As Exception
Return False
End Try
Dim num4 As Integer = Conversions.ToInteger(Class10.CkTaiTnuSv)
If num3 >= num4 Then
result = True
result = (Strings.InStr(text2, "HeLL 2008", CompareMethod.Binary) = 0 And Strings.InStr(text2, "=", CompareMethod.Binary) = 0)
If num2 = 0 Then
If Class10.bool_18 Then
If Operators.CompareString(FileSystem.Dir(text + Class10.string_19, FileAttribute.Normal), "", False) <> 0 Then
If num = 1 Then
Interaction.MsgBox("Lig.ga = " + Class22.smethod_60(text + Class10.string_19).ToString(), MsgBoxStyle.OkOnly, Nothing)
End If
result = Class22.smethod_60(text + Class10.string_19)
Else
result = False
End If
End If
ElseIf num = 1 Then
Interaction.MsgBox("No check of the Lic.ga file", MsgBoxStyle.OkOnly, Nothing)
End If
Else
result = False
End If
Else
result =False'鼠标右键，进入编辑IL指令，ide.i4.0修改为ide.i4.1，result =True,即为注册
End If
Return result
End Function

查找 Class10.bool_19 ，发现 frmOptions.CheckLic 中有此字符。很明显，frmOptions.CheckLic 就是证书验证注册过程：
Public Sub CheckLic()
Dim flag As Boolean = False
Dim flag2 As Boolean = True
Dim num As Integer = Class13.smethod_17()
Dim num2 As Integer = Class13.smethod_18()
Dim text As String = Application.StartupPath
If Not text.EndsWith("\") Then
text += "\"
End If
Me.lblWarning.Visible = False
If Operators.CompareString(Me.txtLicence.Text, "", False) <> 0 Then
Try
Me.lblWarning.Visible = False
Dim text2 As String = Class17.smethod_1(Me.txtLicence.Text)
If num = 1 Then
Interaction.MsgBox(text2, MsgBoxStyle.OkOnly, Nothing)
End If
If Strings.InStr(text2, "joshtewalt@msn.com", CompareMethod.Binary) > 0 Then
flag = False
ElseIf Strings.InStr(text2, "ednardo.mail@gmail.com", CompareMethod.Binary) > 0 Then
flag = False
Else
Dim text3 As String = Strings.Left(text2, 1)
If num = 1 Then
Interaction.MsgBox(text3, MsgBoxStyle.OkOnly, "License version")
End If
Dim num3 As Integer
Try
num3 = Conversions.ToInteger(text3)
Catch ex As Exception
flag = False
GoTo IL_23F
End Try
Dim num4 As Integer = Conversions.ToInteger(Class10.CkTaiTnuSv)
If num2 = 1 AndAlso Operators.CompareString(FileSystem.Dir(text + Class10.string_19, FileAttribute.Normal), "", False) = 0 Then
Using frmLicFehlt As frmLicFehlt = New frmLicFehlt()
frmLicFehlt.ShowDialog(Me)
End Using
flag2 = False
flag = False
ElseIf num3 >= num4 Then
flag = True
If Strings.InStr(text2, "HeLL 2008", CompareMethod.Binary) = 0 And Strings.InStr(text2, "=", CompareMethod.Binary) = 0 Then
flag = True
If num2 = 0 Then
If Class10.bool_18 Then
If num = 1 Then
Interaction.MsgBox("1. Lig.ga = " + Class22.smethod_60(text + Class10.string_19).ToString(), MsgBoxStyle.OkOnly, Nothing)
End If
If Operators.CompareString(FileSystem.Dir(text + Class10.string_19, FileAttribute.Normal), "", False) <> 0 Then
If num = 1 Then
Interaction.MsgBox("2. Lig.ga = " + Class22.smethod_60(text + Class10.string_19).ToString(), MsgBoxStyle.OkOnly, Nothing)
End If
flag = Class22.smethod_60(text + Class10.string_19)
Else
flag = False
End If
End If
ElseIf num = 1 Then
Interaction.MsgBox("No check of the Lic.ga file", MsgBoxStyle.OkOnly, Nothing)
End If
Else
flag = False
End If
Else
flag = False
End If
End If
IL_23F:
If flag Then
Class17.smethod_4(Me.txtLicence.Text)
Dim text4 As String = Strings.Mid(text2, 3)
Me.txtLicenceName.Text = text4
Me.txtLicenceName.Visible = True
Me.lblAddLicence.Visible = False
Me.txtLicence.Visible = False
Me.btnAddLicence.Visible = False
Me.btnBuy.Visible = False
Me.btnSelectFiles.Visible = False
Class10.bool_19 = True
Else
Class10.bool_19 = False
End If
GoTo IL_2F4
Catch ex2 As Exception
Class10.bool_19 = False
GoTo IL_2F4
End Try
End If
If flag2 Then
Me.lblWarning.Visible = True'编辑IL指令，ide.i4.1修改为ide.i4.0，Me.lblWarning.Visible =False,不显示警告,即为注册
End If
Me.txtLicence.Text = ""
IL_2F4:
If Operators.CompareString(Me.txtLicenceName.Text, Me.string_0, False) = 0 Then
If flag2 Then
Me.lblWarning.Visible = True '编辑IL指令，ide.i4.1修改为ide.i4.0，Me.lblWarning.Visible = False,不显示警告,即为注册
End If
Me.txtLicence.Text = ""
Class10.bool_19 =False'编辑IL指令，ide.i4.0修改为ide.i4.1，Class10.bool_19 =True,即为注册
End If
End Sub

保存 Ribbon2021.exe 模块，程序已经逆向，但注册名为空。
在 frmOptions.method_3中改:text = "这是完整注册版：洞庭鱼"，显示注册名。
Private Sub method_3()
Me.string_0 = "SHAREWARE" & vbCrLf & vbCrLf & " · 2 Tabs" & vbCrLf & " · 3 Groups" & vbCrLf & " · 10 Controls"
Me.lblWarning.Visible = False
Dim text As String = Class17.smethod_2()
If Operators.CompareString(text, "", False) <> 0 Then
text = Class17.smethod_1(text)
Else
text = "" '编辑IL指令，在""中加入字符这是完整注册版：洞庭鱼
End If
If Class10.bool_19 Then
Strings.Left(text, 1)
If Class10.bool_19 Then
Dim text2 As String = Strings.Mid(text, 3)
Me.txtLicenceName.Text = text2
Me.txtLicenceName.Visible = True
Me.lblAddLicence.Visible = False
Me.txtLicence.Visible = False
Me.btnAddLicence.Visible = False
Me.btnBuy.Visible = False
Me.btnSelectFiles.Visible = False
Else
Dim text2 As String = Me.string_0
Me.txtLicenceName.Text = text2
Me.txtLicenceName.Visible = True
Me.lblAddLicence.Visible = True
Me.txtLicence.Visible = True
Me.btnAddLicence.Visible = True
Me.btnBuy.Visible = True
Me.btnSelectFiles.Visible = True
End If
Else
Dim text2 As String = Me.string_0
Me.txtLicenceName.Text = text2
Me.txtLicenceName.Visible = True
Me.lblAddLicence.Visible = True
Me.txtLicence.Visible = True
Me.btnAddLicence.Visible = True
Me.btnBuy.Visible = True
Me.btnSelectFiles.Visible = True
End If
Me.OkButton.Focus()
End Sub

现在已经完美PJ注册了。

以上是在使用 de4dot 脱壳后PJ程序的，若不脱壳，可以直接使用 dnSpy 或 x64dbg 进行分析调试修改：
1、直接使用 dnSpy 打开未脱壳 Ribbon2021.exe，按上述同样方法进入 Ribbon2021.Form1.AddMRU 模块最后有:
   If Not LFGPTTVcnyR0TrfPkp.Bca0OOf2Zm(True) Then
         Me.Text = str + jsVuxH0K1keS75PDDNW.USUDEwbkFu(897094) + strNewFile
         Return
   End If
   Me.Text = str + jsVuxH0K1keS75PDDNW.USUDEwbkFu(897128) + strNewFile
   点击 Bca0OOf2Zm(True) 进入此过程：
   Public Function Bca0OOf2Zm(Optional \u0020 As Boolean = False) As Boolean
         Dim num As Integer = yVf3MXWbheppAomy6U.w6Uf5xH49F()
         Dim num2 As Integer = yVf3MXWbheppAomy6U.nY2fFwc47d()
         Dim text As String = Application.StartupPath
         If Not text.EndsWith(jsVuxH0K1keS75PDDNW.USUDEwbkFu(0)) Then
            text += jsVuxH0K1keS75PDDNW.USUDEwbkFu(0)
         End If
         Dim text2 As String = AQWbL0tIS1ots0GARC.LOFO9fZvtd()
         If Operators.CompareString(text2, "", False) <> 0 Then
            text2 = AQWbL0tIS1ots0GARC.WyFOXEbK6s(text2)
            If num = 1 Then
               Interaction.MsgBox(text2, MsgBoxStyle.OkOnly, Nothing)
            End If
         Else
            text2 = ""
         End If
         Dim result As Boolean
         If Strings.InStr(text2, jsVuxH0K1keS75PDDNW.USUDEwbkFu(985850), CompareMethod.Binary) > 0 Then
            result = False
         ElseIf Strings.InStr(text2, jsVuxH0K1keS75PDDNW.USUDEwbkFu(1168428), CompareMethod.Binary) > 0 Then
            result = False
         ElseIf Strings.InStr(text2, jsVuxH0K1keS75PDDNW.USUDEwbkFu(1168484), CompareMethod.Binary) > 0 Then
            result = False
         ElseIf Strings.InStr(text2, jsVuxH0K1keS75PDDNW.USUDEwbkFu(985890), CompareMethod.Binary) > 0 Then
            result = False
         ElseIf Operators.CompareString(text2, "", False) <> 0 Then
            Dim value As String = Strings.Left(text2, 1)
            Dim num3 As Integer
            Try
               ' The following expression was wrapped in a checked-expression
               num3 = CInt(Conversions.ToLong(value))
               If num = 1 Then
                     Interaction.MsgBox(text + GQWPXEyGMYorsw1YN4.Mp1aIbevE3, MsgBoxStyle.OkOnly, Nothing)
               End If
               If Operators.CompareString(FileSystem.Dir(text + GQWPXEyGMYorsw1YN4.Mp1aIbevE3, FileAttribute.Normal), "", False) = 0 Then
                     If Not \u0020 Then
                        Using frmLicFehlt As frmLicFehlt = New frmLicFehlt()
                           frmLicFehlt.ShowDialog()
                        End Using
                     End If
                     Return False
               End If
               If num = 1 Then
                     Interaction.MsgBox(jsVuxH0K1keS75PDDNW.USUDEwbkFu(1168528), MsgBoxStyle.OkOnly, Nothing)
               End If
            Catch ex As Exception
               Return False
            End Try
            Dim num4 As Integer = Conversions.ToInteger(GQWPXEyGMYorsw1YN4.CkTaiTnuSv)
            If num3 >= num4 Then
               result = True
               result = (Strings.InStr(text2, jsVuxH0K1keS75PDDNW.USUDEwbkFu(985972), CompareMethod.Binary) = 0 And Strings.InStr(text2, jsVuxH0K1keS75PDDNW.USUDEwbkFu(985994), CompareMethod.Binary) = 0)
               If num2 = 0 Then
                     If GQWPXEyGMYorsw1YN4.AO2aQASEFy Then
                        If Operators.CompareString(FileSystem.Dir(text + GQWPXEyGMYorsw1YN4.Mp1aIbevE3, FileAttribute.Normal), "", False) <> 0 Then
                           If num = 1 Then
                                 Interaction.MsgBox(jsVuxH0K1keS75PDDNW.USUDEwbkFu(1168570) + LFGPTTVcnyR0TrfPkp.VKv03H9xsp(text + GQWPXEyGMYorsw1YN4.Mp1aIbevE3).ToString(), MsgBoxStyle.OkOnly, Nothing)
                           End If
                           result = LFGPTTVcnyR0TrfPkp.VKv03H9xsp(text + GQWPXEyGMYorsw1YN4.Mp1aIbevE3)
                        Else
                           result = False
                        End If
                     End If
               ElseIf num = 1 Then
                     Interaction.MsgBox(jsVuxH0K1keS75PDDNW.USUDEwbkFu(986056), MsgBoxStyle.OkOnly, Nothing)
               End If
            Else
               result = False
            End If
         Else
            result = False‘鼠标点此，右键进入在十六进制编辑器中显示指令
         End If
         Return result
   End Function

十六进制编辑器中显示指令：AE 00 00 0A 26 38 02 00 00 00 16 0A 06 2A 00 00 00 01 1C 00 00 02 00 在16上，鼠标右键选择用字节填充选择，将 16 改为 17 ，即 result = True

同理，在 Ribbon2021.frmOptions.CheckLic()
Public Sub CheckLic()
If jsVuxH0K1keS75PDDNW.YXWD4k2ZvC(1928) Then
   Dim flag As Boolean = False
   Dim flag2 As Boolean = True
   Dim num As Integer = yVf3MXWbheppAomy6U.w6Uf5xH49F()
   Dim num2 As Integer = yVf3MXWbheppAomy6U.nY2fFwc47d()
   Dim text As String = Application.StartupPath
   If Not text.EndsWith(jsVuxH0K1keS75PDDNW.USUDEwbkFu(0)) Then
         text += jsVuxH0K1keS75PDDNW.USUDEwbkFu(0)
   End If
   Me.lblWarning.Visible = False
   If Operators.CompareString(Me.txtLicence.Text, "", False) <> 0 Then
         Try
            Me.lblWarning.Visible = False
            Dim text2 As String = AQWbL0tIS1ots0GARC.WyFOXEbK6s(Me.txtLicence.Text)
            If num = 1 Then
               Interaction.MsgBox(text2, MsgBoxStyle.OkOnly, Nothing)
            End If
            If Strings.InStr(text2, jsVuxH0K1keS75PDDNW.USUDEwbkFu(985850), CompareMethod.Binary) > 0 Then
               flag = False
            ElseIf Strings.InStr(text2, jsVuxH0K1keS75PDDNW.USUDEwbkFu(985890), CompareMethod.Binary) > 0 Then
               flag = False
            Else
               Dim text3 As String = Strings.Left(text2, 1)
               If num = 1 Then
                     Interaction.MsgBox(text3, MsgBoxStyle.OkOnly, jsVuxH0K1keS75PDDNW.USUDEwbkFu(985938))
               End If
               Dim num3 As Integer
               Try
                     num3 = Conversions.ToInteger(text3)
               Catch ex As Exception
                     flag = False
                     GoTo IL_2D9
               End Try
               Dim num4 As Integer = Conversions.ToInteger(GQWPXEyGMYorsw1YN4.CkTaiTnuSv)
               If num2 = 1 AndAlso Operators.CompareString(FileSystem.Dir(text + GQWPXEyGMYorsw1YN4.Mp1aIbevE3, FileAttribute.Normal), "", False) = 0 Then
                     Using frmLicFehlt As frmLicFehlt = New frmLicFehlt()
                        frmLicFehlt.ShowDialog(Me)
                     End Using
                     flag2 = False
                     flag = False
               ElseIf num3 >= num4 Then
                     flag = True
                     If Strings.InStr(text2, jsVuxH0K1keS75PDDNW.USUDEwbkFu(985972), CompareMethod.Binary) = 0 And Strings.InStr(text2, jsVuxH0K1keS75PDDNW.USUDEwbkFu(985994), CompareMethod.Binary) = 0 Then
                        flag = True
                        If num2 = 0 Then
                           If GQWPXEyGMYorsw1YN4.AO2aQASEFy Then
                                 If num = 1 Then
                                    Interaction.MsgBox(jsVuxH0K1keS75PDDNW.USUDEwbkFu(986000) + LFGPTTVcnyR0TrfPkp.VKv03H9xsp(text + GQWPXEyGMYorsw1YN4.Mp1aIbevE3).ToString(), MsgBoxStyle.OkOnly, Nothing)
                                 End If
                                 If Operators.CompareString(FileSystem.Dir(text + GQWPXEyGMYorsw1YN4.Mp1aIbevE3, FileAttribute.Normal), "", False) <> 0 Then
                                    If num = 1 Then
                                       Interaction.MsgBox(jsVuxH0K1keS75PDDNW.USUDEwbkFu(986028) + LFGPTTVcnyR0TrfPkp.VKv03H9xsp(text + GQWPXEyGMYorsw1YN4.Mp1aIbevE3).ToString(), MsgBoxStyle.OkOnly, Nothing)
                                    End If
                                    flag = LFGPTTVcnyR0TrfPkp.VKv03H9xsp(text + GQWPXEyGMYorsw1YN4.Mp1aIbevE3)
                                 Else
                                    flag = False
                                 End If
                           End If
                        ElseIf num = 1 Then
                           Interaction.MsgBox(jsVuxH0K1keS75PDDNW.USUDEwbkFu(986056), MsgBoxStyle.OkOnly, Nothing)
                        End If
                     Else
                        flag = False
                     End If
               Else
                     flag = False
               End If
            End If
            IL_2D9:
            If flag Then
               AQWbL0tIS1ots0GARC.fRROUwIPGM(Me.txtLicence.Text)
               Dim text4 As String = Strings.Mid(text2, 3)
               Me.txtLicenceName.Text = text4
               Me.txtLicenceName.Visible = True
               Me.lblAddLicence.Visible = False
               Me.txtLicence.Visible = False
               Me.btnAddLicence.Visible = False
               Me.btnBuy.Visible = False
               Me.btnSelectFiles.Visible = False
               GQWPXEyGMYorsw1YN4.UIFa2PcyIT = True
            Else
               GQWPXEyGMYorsw1YN4.UIFa2PcyIT = False
            End If
            GoTo IL_39D
         Catch ex2 As Exception
            GQWPXEyGMYorsw1YN4.UIFa2PcyIT = False
            GoTo IL_39D
         End Try
   End If
   If flag2 Then
         Me.lblWarning.Visible = True ‘鼠标点此，右键进入在十六进制编辑器中显示指令，02 6F BE 0D 00 06 17 6F 17 01 00 0A 02 6F 2C 0E，鼠标右键选择用字节填充选择，17 改为 16，即 = False
   End If
   Me.txtLicence.Text = ""
   IL_39D:
   If Operators.CompareString(Me.txtLicenceName.Text, Me.OvaiXCqJKd, False) = 0 Then
         If flag2 Then
            Me.lblWarning.Visible = True ‘鼠标点此，右键进入在十六进制编辑器中显示指令，02 6F BE 0D 00 06 17 6F 17 01 00 0A 02 6F 2C 0E，鼠标右键选择用字节填充选择，17 改为 16，即 = False
         End If
         Me.txtLicence.Text = ""
         GQWPXEyGMYorsw1YN4.UIFa2PcyIT = False ‘鼠标点此，右键进入在十六进制编辑器中显示指令，0A 16 80 78 00 00 04 2A 00 41 4C，鼠标右键选择用字节填充选择，16 改为 17，即 = True
   End If
End If
End Sub

完成不脱壳PJ程序

2、使用 x64dbg 或 UltraEdit 直接打开未脱壳源文件，搜索以下特征码，将16改17，17改16，即可PJ程序。
AE 00 00 0A 26 38 02 00 00 00 16 0A 06 2A 00 00 00 01 1C 00 00 02 00
02 6F BE 0D 00 06 17 6F 17 01 00 0A 02 6F 2C 0E
0A 16 80 78 00 00 04 2A 00 41 4C

YKkUuXp10 发表于 2022-5-27 07:56

大佬无敌

AjI9634 发表于 2022-5-27 09:20

感谢楼主的热心分享

XeTI3 发表于 2022-5-27 09:27

谢谢分享

eoCqP 发表于 2022-5-27 09:30

谢谢分享

YDoJpBwEuh 发表于 2022-5-27 09:34

谢谢分享

ByEij534 发表于 2022-5-27 09:36

太好了，我看看，谢谢！

sKmUGeBk 发表于 2022-5-27 09:51

谢谢！看起来就比较高大上

LQpJlqFNXxE 发表于 2022-5-27 10:05

感谢楼主

JoHCmIh6457 发表于 2022-5-27 10:10

感谢楼主

页: [1] 2 3 4 5 6 7 8 9

吾爱汇编's Archiver

Setup IDBE Ribbon Creator2022_x64_V1.1001汇编分析IL代码