返回信息流[QUOTE]软件名称:Auto Debug Professional version 5.1
官方网站:http://www.autodebug.com/
下载地址:http://www.autodebug.com/download/debugpro50_setup.exe
软件介绍:
Auto Debug software is an API monitor tool which can automatic trace all APIs and ActiveX interface to input and output parameters. After setting the API which you want to monitor easily, this application will auto trace the target program and monitor the function of inputting and outputting calling. It analysises PDB files automatic while monitoring any DLL and ActiveX interface.
Different from others apispy or API monitor tools, Auto Debug software doesn't need the user to develop any DLL or hook DLL. It's easy to use --- Only setting the APIs which we want to monitor with ON, once the target application running and calling these APIs, it will monitor their parameters of inputting and outputting automaticly! Don't need to develop any DLL, once installing the software, we can start to monitor APIs NOW!
If we have the API prototype(often from the .h file), we can build the PDB file without origin source easily. For example, we can found a sample for generating comdlg32.dll PDB file at ($InstallPath\PDBsample). --- (need Professional Version, it also generates over 30 windows system DLL's PDB files in the Professional Version)
Features
It doesn't need to rebuild the source code while monitoring inputting parameters and outputting results of the traced APIs in the target program automaticly, only monitoring the input and output of APIs.
* Use VBScript or JScript to control Auto Debug.(new in Professional V5.0).
* Source Code level monitor.(new in Professional V4.1).
* Automatic analysis parameter type with PDB files.(new in V4.0). Support for Visual Studio 2005, Visual Studio .NET 2003 and Visual C++ 6.0.
* Very easy to generate PDB files without source code if you know the api prototype.(new in Professional V4.0).
* Tracing your application with release version.
* The best API monitor tool.
* Tracing Release version with mapfile.
* Supporting Debug version and Release version, not need source code.
* Supporting tracing COM Interface.
* Supporting multithread.
* Not need to know the prototype of the functions.
* Not only trace for exported APIs, but also be effect for undocumented APIs.
[/QUOTE]
其实就是一API调用截获分析工具,MS是国人的作品,前几天偶然发现,拿来练练手,第一次做破解,不敢发到看雪(主要是见了几个发爆破补丁被BS的...5~) :) 就贡献给咱信安版吧....
去了程序自校验、部分反调试、恢复了部分有关的自解密代码、还算比较完美的爆破了注册校验...
文章的话等再积攒些经验再写吧,主要怕误导学弟学妹....呵...
旧补丁失效,新补丁请到7楼下载....
这是一条镜像帖。来源:北邮人论坛 / security / #20401同步于 2008/11/30
该镜像源已超过 30 天没有更新,可能在源站已被删除。
Security机器人发帖
Auto Debug Professional V5.1 Patch...已修改
ZenZero
2008/11/30镜像同步8 回复
订阅后,新回复会通过你的通知中心匿名送达。
8 条回复
好的 明天试试
【 在 ZenZero (ZenZero) 的大作中提到: 】
: [QUOTE]软件名称:Auto Debug Professional version 5.1
: 官方网站:http://www.autodebug.com/
: 下载地址:http://www.autodebug.com/download/debugpro50_setup.exe
: ...................
啊,又看了下,应该是代码解密后又动态修改了几条指令的操作数,做补丁时直接把解密后的代码dump出来,然后跳过解密代码的部分,导致运行到目标指令时操作数出错...
但是很奇怪在本机上尝试很多次,没出什么问题啊,算了不管了...
当时跟这个程序的时候烦透了,4、5个反调试的线程,各种检测,还都是动态解密,有异常直接ExitProcess
嗯,这次来个保险些的,改入口地址HOOK掉了ExitProcess的IAT,调用ExitProcess时判断来源地址然后跳转到ExitThread...
新补丁放在7楼,呵,更新一下就好了,虚拟机的XP SP2测试通过....
没脸见人了....5~~
【 在 redliuzt 的大作中提到: 】
: 报告: 我的xp sp2只能运行原版的 打补丁后不能运行。。。
修改后的补丁
附件(55.7KB) autodebug-patch.7z
【 在 redliuzt 的大作中提到: 】
: 报告: 我的xp sp2只能运行原版的 打补丁后不能运行。。。