破解浩方的等级限制

 

这篇文章我将介绍自己如何破解了浩方程序的等级限制的

首先如果你等级未达到浩方的等级要求将无法进入指定的房间，将会提示什么等级不够阿，加入Vip等鸟语，RockHwnd非常讨厌

经Spy++检查弹出来的这个一个窗口，然后启动Softice Load 它，准备拦截

这里RockHwnd由于经验不足遇到了一些困难，几次企图用Dialogbox，CreateDialog(Param)拦截都没有拦截到
后来我无意间在MSDN里面看到一个CreateDialogIndirectParam的函数，他是从内存模板建立一个非模态的对话框

因为考虑到浩方的资源文件都在放在GameRes.dll里面的，因此很有可能利用了先把资源加载进内存的方法，因此我用了CreateDialogIndirectParam拦截成功了

接下来分析代码:

经过几个Ret来到了浩方程序的领空
* Referenced by a CALL at Addresses:
|:00416666   , :00416F7E   , :00419C38   , :0041D558   , :00438D6C  
|:00438FC1   , :0043BA29   , :00447A30  
|
:00462D60 56                      push esi
:00462D61 8BF1                    mov esi, ecx
:00462D63 57                      push edi
:00462D64 8B7C2410                mov edi, dword ptr [esp+10]
:00462D68 8B4624                  mov eax, dword ptr [esi+24]
:00462D6B 85C0                    test eax, eax
:00462D6D 740C                    je 00462D7B
:00462D6F 8D4E04                  lea ecx, dword ptr [esi+04]
:00462D72 E8E968FFFF              call 00459660                         //到这里就去调用等级不够对话框了
:00462D77 3BC7                    cmp eax, edi
:00462D79 7441                    je 00462DBC

那么向上去寻找根源,由于这是一个调用比较频繁的函数,因此可以看到有多入口进来,经过我一个个分析,最后断定00419c38入口是等级不够才会出现的,于是跑去看看00419c38

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419C1D(C), :00419CA5(C)
|
:00419C28 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419C26(U), :00419CAE(U)
|
:00419C2A 50                      push eax
:00419C2B A1F0074C00              mov eax, dword ptr [004C07F0]
:00419C30 6A06                    push 00000006
:00419C32 50                      push eax
:00419C33 B9540E4C00              mov ecx, 004C0E54
:00419C38 E823910400              call 00462D60              //在这里调用了
:00419C3D E95D150000              jmp 0041B19F

继续向上去看看代码如下:

* Reference To: GameShell.?FindGameRoom@CGameShell@@QAEHKKPAXAAHK@Z, Ord:0018h
                                  |
:00419B80 8B2D30A34900            mov ebp, dword ptr [0049A330] //哈哈，找房间的函数
:00419B86 897C242C                mov dword ptr [esp+2C], edi
:00419B8A 8BBC2438070000          mov edi, dword ptr [esp+00000738]
:00419B91 83FF01                  cmp edi, 00000001
:00419B94 C684243007000001        mov byte ptr [esp+00000730], 01
:00419B9C 7416                    je 00419BB4
:00419B9E 83FF09                  cmp edi, 00000009
:00419BA1 0F859B000000            jne 00419C42
:00419BA7 833D2C104C0001          cmp dword ptr [004C102C], 00000001
:00419BAE 0F85FF000000            jne 00419CB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419B9C(C)
|
:00419BB4 8B94243C070000          mov edx, dword ptr [esp+0000073C]
:00419BBB 8D44242C                lea eax, dword ptr [esp+2C]
:00419BBF 6A00                    push 00000000
:00419BC1 8D4C2474                lea ecx, dword ptr [esp+74]
:00419BC5 50                      push eax
:00419BC6 51                      push ecx
:00419BC7 53                      push ebx
:00419BC8 52                      push edx
:00419BC9 B908104C00              mov ecx, 004C1008
:00419BCE FFD5                    call ebp
:00419BD0 85C0                    test eax, eax
:00419BD2 746E                    je 00419C42
:00419BD4 8D442424                lea eax, dword ptr [esp+24]
:00419BD8 8D4C2418                lea ecx, dword ptr [esp+18]
:00419BDC 50                      push eax
:00419BDD 51                      push ecx
:00419BDE B908104C00              mov ecx, 004C1008

* Reference To: GameShell.?GetRateAndExp@CGameShell@@QAEXAAGAAK@Z, Ord:005Ch
                                  | //关键在这个名字古怪的的函数里面了
:00419BE3 FF15D8A24900            Call dword ptr [0049A2D8]
:00419BE9 F605F8074C0004          test byte ptr [004C07F8], 04
:00419BF0 7550                    jne 00419C42
:00419BF2 8B94248C000000          mov edx, dword ptr [esp+0000008C]
:00419BF9 8D8EF41E0000            lea ecx, dword ptr [esi+00001EF4]
:00419BFF 52                      push edx
:00419C00 E8CBD90100              call 004375D0
:00419C05 8B4C2418                mov ecx, dword ptr [esp+18]
:00419C09 0FBFC0                  movsx eax, ax
:00419C0C 81E1FFFF0000            and ecx, 0000FFFF //这个转换补码？
:00419C12 3BC8                    cmp ecx, eax
//此时CX=20H AX=23H正好是我需要进入的房间的等级和我的等级的16进制
:00419C14 7D2C                    jge 00419C42 //判断是不是我的等级大于要求的等级了，大于了我们才能Jump去哦，把它改成jpm把，无论是不是大于都让我们去

小弟虽然学破解已有一些时日，但是从未写过心得，头一次写，写得不好，欢迎指教

steven.shi@163.net