Замена команд в ollyDBG
Модифицировать код так, чтобы проверка использования откладчика не выполнялась и выполнялся обход проверок пароля. Меняю команды, но блокировка не обходится. Где и как нужно подправить?
1
00401776 74 1F JE SHORT GUARD_3.00401797
00401776 74 1F JMP SHORT GUARD_3.00401797
2
004017DE 75 3D JNZ SHORT GUARD_3.0040181D
004017DE 75 3D JMP SHORT GUARD_3.00401804
3
0040188B 74 07 JE SHORT GUARD_3.00401894
0040188B 74 07 JMP SHORT GUARD_3.00401894
00401730 /$ 55 PUSH EBP
00401731 |. 8BEC MOV EBP,ESP
00401733 |. 83EC 0C SUB ESP,0C
00401736 |. A1 00304000 MOV EAX,DWORD PTR DS:[403000]
0040173B |. 33C5 XOR EAX,EBP
0040173D |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
00401740 |. C645 F4 00 MOV BYTE PTR SS:[EBP-C],0
00401744 |. 33C0 XOR EAX,EAX
00401746 |. 8945 F5 MOV DWORD PTR SS:[EBP-B],EAX
00401749 |. 66:8945 F9 MOV WORD PTR SS:[EBP-7],AX
0040174D |. 8845 FB MOV BYTE PTR SS:[EBP-5],AL
00401750 |. 68 24214000 PUSH GUARD_3.00402124 ; /format = "Enter your password (MAX 6 Symbols): "
00401755 |. FF15 98204000 CALL DWORD PTR DS:[<&MSVCR80.printf>] ; \printf
0040175B |. 83C4 04 ADD ESP,4
0040175E |. 8D4D F4 LEA ECX,DWORD PTR SS:[EBP-C]
00401761 |. 51 PUSH ECX
00401762 |. 68 4C214000 PUSH GUARD_3.0040214C ; /format = "%8s"
00401767 |. FF15 9C204000 CALL DWORD PTR DS:[<&MSVCR80.scanf>] ; \scanf
0040176D |. 83C4 08 ADD ESP,8
00401770 |. 0FBE55 FB MOVSX EDX,BYTE PTR SS:[EBP-5]
00401774 |. 85D2 TEST EDX,EDX
00401776 74 1F JE SHORT GUARD_3.00401797
00401778 68 00000100 PUSH 10000
0040177D |. 68 50214000 PUSH GUARD_3.00402150 ; |Title = "ERROR"
00401782 |. 68 5C214000 PUSH GUARD_3.0040215C ; |Text = "6 SYMBOLS MAX !!! SIX !!!! "
00401787 |. 6A 00 PUSH 0 ; |hOwner = NULL
00401789 |. FF15 A8204000 CALL DWORD PTR DS:[<&USER32.MessageBoxW>>; \MessageBoxW
0040178F |. 6A 00 PUSH 0 ; /status = 0
00401791 |. FF15 94204000 CALL DWORD PTR DS:[<&MSVCR80.exit>] ; \exit
00401797 |> FF15 00204000 CALL DWORD PTR DS:[<&KERNEL32.IsDebugger>; [IsDebuggerPresent
0040179D |. 85C0 TEST EAX,EAX
0040179F |. 74 36 JE SHORT GUARD_3.004017D7
004017A1 |. 68 00000100 PUSH 10000 ; /Style = MB_OK|MB_APPLMODAL|10000
004017A6 |. 68 94214000 PUSH GUARD_3.00402194 ; |Title = "ERROR"
004017AB |. 68 A0214000 PUSH GUARD_3.004021A0 ; |Text = "Are you trying to hack me? Stop This ! "
004017B0 |. 6A 00 PUSH 0 ; |hOwner = NULL
004017B2 |. FF15 A8204000 CALL DWORD PTR DS:[<&USER32.MessageBoxW>>; \MessageBoxW
004017B8 |. 68 00000100 PUSH 10000 ; /Style = MB_OK|MB_APPLMODAL|10000
004017BD |. 68 F0214000 PUSH GUARD_3.004021F0 ; |Title = "ERROR"
004017C2 |. 68 FC214000 PUSH GUARD_3.004021FC ; |Text = "DEBUG still active"
004017C7 |. 6A 00 PUSH 0 ; |hOwner = NULL
004017C9 |. FF15 A8204000 CALL DWORD PTR DS:[<&USER32.MessageBoxW>>; \MessageBoxW
004017CF |. 6A 00 PUSH 0 ; /status = 0
004017D1 |. FF15 94204000 CALL DWORD PTR DS:[<&MSVCR80.exit>] ; \exit
004017D7 |> 0FBE45 F4 MOVSX EAX,BYTE PTR SS:[EBP-C]
004017DB |. 83F8 4B CMP EAX,4B
004017DE 75 3D JNZ SHORT GUARD_3.0040181D
004017E0 |. 0FBE4D F8 MOVSX ECX,BYTE PTR SS:[EBP-8]
004017E4 |. 83F9 79 CMP ECX,79
004017E7 |. 75 34 JNZ SHORT GUARD_3.0040181D
004017E9 |. 0FBE55 F6 MOVSX EDX,BYTE PTR SS:[EBP-A]
004017ED |. 83FA 74 CMP EDX,74
004017F0 |. 75 2B JNZ SHORT GUARD_3.0040181D
004017F2 |. 0FBE45 F7 MOVSX EAX,BYTE PTR SS:[EBP-9]
004017F6 |. 83F8 74 CMP EAX,74
004017F9 |. 75 22 JNZ SHORT GUARD_3.0040181D
004017FB |. 0FBE4D F5 MOVSX ECX,BYTE PTR SS:[EBP-B]
004017FF |. 83F9 69 CMP ECX,69
00401802 |. 75 19 JNZ SHORT GUARD_3.0040181D
00401804 |. 68 00000100 PUSH 10000 ; /Style = MB_OK|MB_APPLMODAL|10000
00401809 |. 68 24224000 PUSH GUARD_3.00402224 ; |Title = "WELCOME"
0040180E |. 68 34224000 PUSH GUARD_3.00402234 ; |Text = " Good Work.Access Granted"
00401813 |. 6A 00 PUSH 0 ; |hOwner = NULL
00401815 |. FF15 A8204000 CALL DWORD PTR DS:[<&USER32.MessageBoxW>>; \MessageBoxW
0040181B |. EB 17 JMP SHORT GUARD_3.00401834
0040181D |> 68 00000100 PUSH 10000 ; /Style = MB_OK|MB_APPLMODAL|10000
00401822 |. 68 6C224000 PUSH GUARD_3.0040226C ; |Title = "ERROR"
00401827 |. 68 78224000 PUSH GUARD_3.00402278 ; |Text = "INCORRECT PASSWORD"
0040182C |. 6A 00 PUSH 0 ; |hOwner = NULL
0040182E |. FF15 A8204000 CALL DWORD PTR DS:[<&USER32.MessageBoxW>>; \MessageBoxW
00401834 |> 6A 01 PUSH 1 ; /status = 1
00401836 |. FF15 94204000 CALL DWORD PTR DS:[<&MSVCR80.exit>] ; \exit
0040183C |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0040183F |. 33CD XOR ECX,EBP
00401841 |. E8 BAF7FFFF CALL GUARD_3.00401000
00401846 |. 8BE5 MOV ESP,EBP
00401848 |. 5D POP EBP
00401849 \. C3 RETN
0040184A CC INT3
0040184B CC INT3
0040184C CC INT3
0040184D CC INT3
0040184E CC INT3
0040184F CC INT3
00401850 /$ 55 PUSH EBP
00401851 |. 8BEC MOV EBP,ESP
00401853 |. 68 00000100 PUSH 10000 ; /Style = MB_OK|MB_APPLMODAL|10000
00401858 |. 68 F8204000 PUSH GUARD_3.004020F8 ; |Title = "ERROR"
0040185D |. 68 04214000 PUSH GUARD_3.00402104 ; |Text = "DEBUG IS ACTIVE"
00401862 |. 6A 00 PUSH 0 ; |hOwner = NULL
00401864 |. FF15 A8204000 CALL DWORD PTR DS:[<&USER32.MessageBoxW>>; \MessageBoxW
0040186A |. 6A 00 PUSH 0 ; /status = 0
0040186C |. FF15 94204000 CALL DWORD PTR DS:[<&MSVCR80.exit>] ; \exit
00401872 |. 5D POP EBP
00401873 \. C3 RETN
00401874 CC INT3
00401875 CC INT3
00401876 CC INT3
00401877 CC INT3
00401878 CC INT3
00401879 CC INT3
0040187A CC INT3
0040187B CC INT3
0040187C CC INT3
0040187D CC INT3
0040187E CC INT3
0040187F CC INT3
00401880 /$ 55 PUSH EBP
00401881 |. 8BEC MOV EBP,ESP
00401883 |. FF15 00204000 CALL DWORD PTR DS:[<&KERNEL32.IsDebugger>; [IsDebuggerPresent
00401889 |. 85C0 TEST EAX,EAX
0040188B 74 07 JE SHORT GUARD_3.00401894
0040188D |. E8 BEFFFFFF CALL GUARD_3.00401850
00401892 |. EB 05 JMP SHORT GUARD_3.00401899
00401894 |> E8 97FEFFFF CALL GUARD_3.00401730
00401899 |> 33C0 XOR EAX,EAX
0040189B |. 5D POP EBP
0040189C \. C3 RETN