S7MicroWIN V32 EN保护机制分析

00A18E42     E8 69080600   call <jmp.&systemdata200.MW_GLOBAL_DeCrypt>
00A18E47     8BF0          mov esi,eax
00A18E49     83C4 0C       add esp,0C
00A18E4C     85F6          test esi,esi
00A18E4E     0F85 DB010000 jnz datamana.00A1902F
00A18E54     8B8424 500200>mov eax,dword ptr ss:[esp+250]
00A18E5B     8B4C24 24     mov ecx,dword ptr ss:[esp+24]
00A18E5F     8B7C24 20     mov edi,dword ptr ss:[esp+20]<----密码
00A18E63     33D2          xor edx,edx

入口是MessageboxA，核心是AuthoritePassword这个函数，最终是
DataManager200.dll里的authority

C:/Program Files/Siemens/STEP 7-MicroWIN/Bin/microwin.exe
dataManager200.dll里面的核心部分

:1002AEF2 51                      push ecx
:1002AEF3 68AAAA0000              push 0000AAAA
:1002AEF8 52                      push edx

* Reference To: systemdata200.?MW_GLOBAL_DeCrypt@@YAJPAEGH@Z, Ord:087Bh
                                  |
:1002AEF9 E8D8BA0B00              Call 100E69D6
:1002AEFE 8BF0                    mov esi, eax
:1002AF00 83C40C                  add esp, 0000000C
:1002AF03 85F6                    test esi, esi
:1002AF05 0F8567010000            jne 1002B072
:1002AF0B 8B442444                mov eax, dword ptr [esp+44]
:1002AF0F 8B4C2424                mov ecx, dword ptr [esp+24]
:1002AF13 8B7C2420                mov edi, dword ptr [esp+20]
:1002AF17 33D2                    xor edx, edx
:1002AF19 8B30                    mov esi, dword ptr [eax]
:1002AF1B F3                      repz
:1002AF1C A6                      cmpsb
:1002AF1D 741B                    je 1002AF3A
:1002AF1F 8D4C241C                lea ecx, dword ptr [esp+1C]
:1002AF23 C7442438FFFFFFFF        mov [esp+38], FFFFFFFF

/for 4.0
008F8E4E    /0F85 DB010000 jnz datamana.008F902F
008F8E54    |8B8424 500200>mov eax,dword ptr ss:[esp+250]
008F8E5B    |8B4C24 24     mov ecx,dword ptr ss:[esp+24]
008F8E5F    |8B7C24 20     mov edi,dword ptr ss:[esp+20]<----密码
008F8E63    |33D2          xor edx,edx