分析-去除天狼星视频加密系统及各种限制

1、.大家好，最近看到去除天狼星加密系统的各种限制炒得比较火爆，那个混蛋论坛居然还要公开对外出售。觉得好奇，于是就拿来分析了一下，还算收获不少，把分析过程贴出来，希望高手别见笑。言归正传，限制主要有智能防翻录（抓屏）、防止屏幕录像软件翻录，用户名（水印）、3389检测、断网限制。那就下面就逐一来分析一下吧。加密视频破解天狼星讨论群：88649216加密视频破解天狼星讨论群：88649216一、智能防翻录（抓屏）这个就是用一些冷门的翻录软件、或者截屏时，虽然不被发现，但是录出来却是黑屏的。原理是：软件调用了Direct3D加速，普通的录像软件自然黑屏了。解决方法：自然是不让他启用Direct3D加速

2、了。用OD载入我们的录像文件，在字符串里找到DirectDrawCreate，然后双击，跳转到相应的汇编代码处。如下：00413B358B85FCFEFFFFmoveax,dwordptrebp-0x10400413B3BF6802706000002testbyteptreax+0x627,0x200413B427410jeshort00413B5400413B448B15E8844B00movedx,dwordptr0x4B84E800413B4AC7826C0200000200>movdwordptredx+0x26C,0x200413B548B0DE8844B00movecx,dw

3、ordptr0x4B84E800413B5A83B96C02000000cmpdwordptrecx+0x26C,0x000413B610F8ECC040000jle0041403300413B676843964B00push004B9643;ddraw.dll00413B6CE89D2E0A00call<jmp.&KERNEL32.LoadLibraryA>/加载ddraw.dll00413B718B15E8844B00movedx,dwordptr0x4B84E800413B778982EC010000movdwordptredx+0x1EC,eax00413B7DA1

4、E8844B00moveax,dwordptr0x4B84E800413B8283B8EC01000000cmpdwordptreax+0x1EC,0x000413B897505jnzshort00413B9000413B8B83C9FForecx,-0x100413B8EEB78jmpshort00413C0800413B90684D964B00push004B964D;directdrawcreate00413B95A1E8844B00moveax,dwordptr0x4B84E800413B9A8B90EC010000movedx,dwordptreax+0x1EC00413BA052p

5、ushedx00413BA1E8A22D0A00call<jmp.&KERNEL32.GetProcAddress>/初始化directdraw00413BA68985B4FEFFFFmovdwordptrebp-0x14C,eax00413BAC83BDB4FEFFFF00cmpdwordptrebp-0x14C,0x000413BB37507jnzshort00413BBC00413BB5B9FEFFFFFFmovecx,-0x2我们的目的是直接不让程序加载Direct，那么可以看出00413B610F8ECC040000jle00414033可以完全跳过direct加

6、载，那就改成jmp了。这样改了之后，就不黑屏了。但是会弹出一个错误框，提示)directx错误2,请关闭后重新运行试试。错误代码找到相应的代码：0041C490/7567jnzshort0041C4F90041C492|66:C78558FFFFFFE>movwordptrebp-0xA8,0xE00041C49B|8D45B0leaeax,dwordptrebp-0x500041C49E|8B950CFFFFFFmovedx,dwordptrebp-0xF40041C4A4|E8DF5A0800call004A1F880041C4A9|FF8564FFFFFFincdwordptreb

7、p-0x9C0041C4AF|8BD0movedx,eax0041C4B1|33C0xoreax,eax0041C4B3|8D4DACleaecx,dwordptrebp-0x540041C4B6|8945ACmovdwordptrebp-0x54,eax0041C4B9|B8489A4B00moveax,004B9A48;directx错误2,请关闭后重新运行试试。错误代码:0041C4BE|FF8564FFFFFFincdwordptrebp-0x9C0041C4C4|E8AB5F0800call004A2474这句0041C490/7567jnzshort0041C4F9/改为jmp就行

8、了这样经过测试，就完美解决智能防翻录问题了。此时用不知名的录像软件录就不黑屏了，抓屏自然也没问题。二、防止屏幕录像软件翻录防止屏幕录像软件翻录，这里主要就是指的屏幕录像专家。这里下断GetWindowTextA，载入教程，运行断下后，取消断点，alt+F9返回，00411482|.68549B4B00push004B9B54;/pmlxzj00411487|.6A00push0x0;|Inheritable=FALSE00411489|.6801001F00push0x1F0001;|Access=1F00010041148E|.E8B1550A00call<jmp.&KERNE

9、L32.OpenMutexA>OpenMutexA00411493|.85C0testeax,eax00411495|.742Cjeshort004114C300411497|.50pusheax;/hObject00411498|.E8BB530A00call<jmp.&KERNEL32.CloseHandle>CloseHandle0041149D|.B801000000moveax,0x1004114A2|.BA02000000movedx,0x200411482|.68549B4B00push004B9B54;/pmlxzj00411487|.6A00push

10、0x0;|Inheritable=FALSE00411489|.6801001F00push0x1F0001;|Access=1F00010041148E|.E8B1550A00call<jmp.&KERNEL32.OpenMutexA>OpenMutexA00411493|.85C0testeax,eax00411495|.742Cjeshort004114C300411497|.50pusheax;/hObject00411498|.E8BB530A00call<jmp.&KERNEL32.CloseHandle>CloseHandle0041149

11、D|.B801000000moveax,0x1004114A2|.BA02000000movedx,0x2004114A7|.50pusheax004114A8|.8D45FCleaeax,dwordptrebp-0x4004114AB|.FF4DECdecdwordptrebp-0x14004114AE|.E85D0B0900call004A2010004114B3|.58popeax004114B4|.8B55D0movedx,dwordptrebp-0x30004114B7|.64:891500000>movdwordptrfs:0,edx004114BE|.E9B1010000j

12、mp00411674004114C3|>33F6xoresi,esi004114C5|.85DBtestebx,ebx004114C7|.0F844E010000je0041161B004114CD|>6800040000/push0x400;/Arg3=00000400004114D2|.6A00|push0x0;|Arg2=00000000004114D4|.8D85C8F7FFFF|leaeax,dwordptrebp-0x838;|004114DA|.50|pusheax;|Arg1004114DB|.E8A4290800|call00493E84;第十八讲.00493E8

13、4004114E0|.83C40C|addesp,0xC004114E3|.8D95C8F7FFFF|leaedx,dwordptrebp-0x838004114E9|.6800040000|push0x400;/Count=400(1024.)004114EE|.52|pushedx;|Buffer004114EF|.53|pushebx;|hWnd004114F0|.E8E55A0A00|call<jmp.&USER32.GetWindowTextA>GetWindowTextA004114F5|.66:C745E020>|movwordptrebp-0x20,0

14、x20/返回到这里;004114FB|.8D95C8F7FFFF|leaedx,dwordptrebp-0x838向上看还发现00411482|.68549B4B00push004B9B54;/pmlxzj00411487|.6A00push0x0;|Inheritable=FALSE00411489|.6801001F00push0x1F0001;|Access=1F00010041148E|.E8B1550A00call<jmp.&KERNEL32.OpenMutexA>OpenMutexA这个地方OpenMutexA一般用来进程互斥，看到pmlxzj，很明显是屏幕录像

15、专家的缩写吧。哈哈F8F8F8">/e6*a6y+I:w#E那就修改这里，00411493|.85C0testeax,eax00411495|.742Cjeshort004114C3改为0041149333C0xoreax,eax00411495EB2Cjmpshort004114C3还有这里004114C3|>33F6xoresi,esi004114C5|.85DBtestebx,ebx004114C7|.0F844E010000je0041161B改为004114C3|>33F6xoresi,esi004114C5|.85DBtestebx,ebx004114C

16、790nop004114C8E94E010000jmp0041161B这样就修改好了。顺便在这个程序的断尾下段，看看这个call的上一层是什么。00411677|.8BE5movesp,ebp00411679|.5Dpopebp0041167A.C3retn/在这里F2，断下后F8来到下面00414A3F.50pusheax;/Arg100414A40.E8DBC9FFFFcall00411420;第十八讲.00411420/刚才的那个call00414A45.59popecx/来到这里。;00B1272400414A46.48deceax00414A47.0F8598000000jnz004

17、14AE5/有个跳转，不跳就检测到非法软件00414A4D.66:C78510FFF>movwordptrebp-0xF0,0x1DC00414A56.8B95FCFEFFFFmovedx,dwordptrebp-0x10400414A5C.33C0xoreax,eax00414A5E.8B8A401B0000movecx,dwordptredx+0x1B4000414A64.8D9540FFFFFFleaedx,dwordptrebp-0xC000414A6A.51pushecx00414A6B.898540FFFFFFmovdwordptrebp-0xC0,eax00414A71.5

18、2pushedx00414A72.FF851CFFFFFFincdwordptrebp-0xE400414A78.E8E34D0200call0043986000414A7D.33C0xoreax,eax00414A7F.83C408addesp,0x800414A82.89853CFFFFFFmovdwordptrebp-0xC4,eax00414A88.B845994B00moveax,004B9945;播放时请关闭其它不相关软件:00414A8D.FF851CFFFFFFincdwordptrebp-0xE4从上面的代码，可以看出下GetWindowTextA还是比较准确的。至于0041

19、4A47.0F8598000000jnz00414AE5这里就没有必要修改了，因为我们已经在关键call里面改动了相关的代码了，这样防止屏幕录像软件翻录的限制就去除了，现在可以使用屏幕录像专家或者其他知名录像软件来翻录了。 用户名（水印）这个所谓的水印就是指跳动的用户名、屏幕上固定不动的字符原理应该是：视频解码之后，然后在临时电脑屏幕上绘上去的吧。,i那就下bpGDI32.ExtTextOutA这个断点既然是视频解码之后，然后在临时电脑屏幕上绘上去的，那我们就等录像显示正在打开那个进度条时，再下段吧。一开始就下断点，可能断的次数太多。重新载入教程，bpGDI32.ExtTextOut

20、A，断下之后，看堆栈：0012F2DC0044D30E/CALLtoExtTextOutAfrom第十八讲.0044D3090012F2E0E6011DDD|hDC=E6011DDD0012F2E400000000|X=00012F2E800000000|Y=00012F2EC00000000|Options=00012F2F000000000|pRect=NULL0012F2F400B4F3BC|String="用",BB,"?wWw.Begin09.COM"0012F2F800000016|StringSize=16(22.)0012F2FC0000

21、0000pSpacing=NULL 很明显，"用",BB,"?0012F2F800000016|StringSize=16(22.)指的就是水印的大小，我们改为1（注意不能改为0，因为程序会校验，改为0，播放一段时间，就出错b|!D)w.w-N2B#t0J-L结合上面的分析，我们这样修改：修改水印大小为1，把用户名变为“-”，很小的字符，占两个像素，几乎看不出来了。 四、3389检测这个的话，也非常容易。查找字符串“请断开远程终端后再播放”00412F5D./7421jeshort00412F8000412F5F.|66:C78510FFF&g

22、t;movwordptrebp-0xF0,0x5000412F68.|8B55E0movedx,dwordptrebp-0x2000412F6B.|52pushedx;/Arg100412F6C.|E8677F0200call0043AED8;第十八讲.0043AED800412F71.|59popecx00412F72.|66:C78510FFF>movwordptrebp-0xF0,0x4400412F7B.|8B5DE0movebx,dwordptrebp-0x2000412F7E.|EB03jmpshort00412F8300412F80>8B5DE0movebx,dwor

23、dptrebp-0x2000412F83>53pushebx;/Arg100412F84.E8EF800200call0043B078;第十八讲.0043B07800412F89.59popecx00412F8A.48deceax00412F8B.753Ejnzshort00412FCB00412F8D.66:C78510FFF>movwordptrebp-0xF0,0x5C00412F96.BAC3954B00movedx,004B95C3;请断开远程终端后再播放00412F9B.8D45DCleaeax,dwordptrebp-0x2400412F9E.E871EF0800ca

24、ll004A1F1400412FA3.FF851CFFFFFFincdwordptrebp-0xE400412FA9.8B00moveax,dwordptreax00412FAB.E87C120500call0046422C00412FB0.FF8D1CFFFFFFdecdwordptrebp-0xE400412FB6.8D45DCleaeax,dwordptrebp-0x2400412FB9.BA02000000movedx,0x200412FBE.E84DF00800call004A201000412FC3.6A00push0x000412FC5.E8C69F0800call0049CF9

25、000412FCA.59popecx00412FCB>6A03push0x3;/Arg2=0000000300412FCD.53pushebx;|Arg1 直接修改这个就行吧00412F8B.753Ejnzshort00412FCB/jnz改jmp即可不过，我更喜欢进上面的关键call里改。00412F84.E8EF800200call0043B078F7进到这里面，现在本机没有开3389，那就在OD里走一遍，把发生跳转的都改jmp，没跳的都nop，就行了。这里就不演示了。这样，就去除了3389检测的限制。五、断网限制断网限制，下断IPHLPAPI.PfCreateInterface，断下之后al