用ildasm和ilasm对.net下的exe程序进行破解初探
2024-04-02 21:36:41
1、对ildasm和ilasm的解释和用法在msdn上有。
ildasm：MSIL 反汇编程序是 MSIL 汇编程序 (Ilasm.exe) 的伙伴工具。 Ildasm.exe 采用包含 Microsoft 中间语言 (MSIL) 代码的可迁移可执行 (PE) 文件，并创建相应的 文本文件作为 Ilasm.exe 的输入
ilasm：MSIL 汇编程序从 Microsoft 中间语言 (MSIL) 生成可迁移可执行的 (PE) 文件。 （有关 MSIL 的更多信息，请参见 托管执行过程。）可以运行结果可执行文件（该文件包含 MSIL 和所需的元数据）以确定 MSIL 是否按预期执行。
2、如下是控制台程序ClassLibrary.exe的原代码
namespace ClassLibrary
{
class Class1
{
public static void Main()
{
string input;
do
{ input = System.Console.ReadLine();
if (input == "admin")
{
System.Console.WriteLine("登录成功\n");
}
else
{
System.Console.WriteLine("登录失败\n");
}
} while (input!="end"); }
}
}
3、用ildasm对ClassLibrary.exe程序进行反汇编
可以直接在Vs2012开发人员工具命令里用命令：C:\Program Files\Microsoft Visual Studio 11.0>ildasm D:\快盘\StudyNoteOfCsharp\ClassLibrary\bin\Debug\ClassLibrary.exe /output:D:\快盘\StudyNoteOfCsharp\ClassLibrary\bin\Debug\broker.il 将ClassLibrary.exe生成broder.il文件
也可以找到ildasm.exe，运行界面，存储为il文件
4、用记事本修改.il文件
5、用ilasm将修改后的il文件编辑成exe文件
运行命令：C:\Program Files\Microsoft Visual Studio 11.0>ilasm D:\快盘\StudyNoteOfCsharp\CassLibrary\bin\Debug\broker
将broker.il文件在当前目录下生成broker.exe程序
修改后的exe和原exe程序的对比
6、破解程序实例
6.1、一个程序登录界面点登录后运行的是如下代码。
private void bdl_Click(object sender, EventArgs e)
{ //用户名不为空，才进行登录操作
if (this.tbyhm.Text.Length > 0)
{
//用户验证
if (this.yhdljc())
{
string user = this.tbyhm.Text.Trim();
if (!this.tbyhm.AutoCompleteCustomSource.Contains(user))
{
this.tbyhm.AutoCompleteCustomSource.Add(user);
}
this.IsLogIn = true;
this.Close();
}
} } public bool yhdljc()
{
bool re = false; ArrayList ap = new ArrayList();
ap.Add(new UProcPara("@yhdm", SqlDbType.NVarChar, 20, tbyhm.Text.ToUpper()));
ap.Add(new UProcPara("@yhmm", SqlDbType.NVarChar, 50, tbmm.Text));
DataTable dt = USql.getInstance().procedure("p_yhdljc", ap); if (dt.Rows[0]["sm"].ToString().Length > 0)
{
MessageBoxEx.Show(dt.Rows[0]["sm"].ToString());
tbyhm.SelectAll();
tbyhm.Focus();
}
else
{
//初始化登录人员的信息 UInf._yhdm = dt.Rows[0]["yhdm"].ToString();
UInf._yhmc = dt.Rows[0]["yhmc"].ToString();
UInf._ryid = int.Parse(dt.Rows[0]["ryid"].ToString());
UInf._hisdm = dt.Rows[0]["hisdm"].ToString();
UInf._hismc = dt.Rows[0]["hismc"].ToString();
UInf._ddid = int.Parse(dt.Rows[0]["ddid"].ToString());
UInf._ddmc = dt.Rows[0]["ddmc"].ToString();
UInf._bmid = int.Parse(dt.Rows[0]["bmid"].ToString());
UInf._bmdm = dt.Rows[0]["bmdm"].ToString();
UInf._bmmc = dt.Rows[0]["bmmc"].ToString();
UInf.dlbz = 1; re = true;
}
return re;
}
6.2、在程序反编译后的.il文件找到yhdjc()函数
.method public hidebysig instance bool
yhdljc() cil managed
{
// 代码大小 554 (0x22a)
.maxstack 6
.locals init ([0] bool re,
[1] class [mscorlib]System.Collections.ArrayList ap,
[2] class [System.Data]System.Data.DataTable dt,
[3] bool CS$1$0000,
[4] bool CS$4$0001)
IL_0000: nop
IL_0001: ldc.i4.0
IL_0002: stloc.0
IL_0003: newobj instance void [mscorlib]System.Collections.ArrayList::.ctor()
IL_0008: stloc.1
IL_0009: ldloc.1
IL_000a: ldstr "@yhdm"
IL_000f: ldc.i4.s 12
IL_0011: ldc.i4.s 20
IL_0013: ldarg.0
IL_0014: ldfld class [DevComponents.DotNetBar2]DevComponents.DotNetBar.Controls.ComboBoxEx yywlxt.ui.LoginForm::tbyhm
IL_0019: callvirt instance string [System.Windows.Forms]System.Windows.Forms.Control::get_Text()
IL_001e: callvirt instance string [mscorlib]System.String::ToUpper()
IL_0023: newobj instance void yywlxt.conn.UProcPara::.ctor(string,
valuetype [System.Data]System.Data.SqlDbType,
int32,
object)
IL_0028: callvirt instance int32 [mscorlib]System.Collections.ArrayList::Add(object)
IL_002d: pop
IL_002e: ldloc.1
IL_002f: ldstr "@yhmm"
IL_0034: ldc.i4.s 12
IL_0036: ldc.i4.s 50
IL_0038: ldarg.0
IL_0039: ldfld class [DevComponents.DotNetBar2]DevComponents.DotNetBar.Controls.TextBoxX yywlxt.ui.LoginForm::tbmm
IL_003e: callvirt instance string [System.Windows.Forms]System.Windows.Forms.Control::get_Text()
IL_0043: newobj instance void yywlxt.conn.UProcPara::.ctor(string,
valuetype [System.Data]System.Data.SqlDbType,
int32,
object)
IL_0048: callvirt instance int32 [mscorlib]System.Collections.ArrayList::Add(object)
IL_004d: pop
IL_004e: call class yywlxt.conn.USql yywlxt.conn.USql::getInstance()
IL_0053: ldstr "p_yhdljc"
IL_0058: ldloc.1
IL_0059: callvirt instance class [System.Data]System.Data.DataTable yywlxt.conn.USql::procedure(string,
class [mscorlib]System.Collections.ArrayList)
IL_005e: stloc.2
IL_005f: ldloc.2
IL_0060: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0065: ldc.i4.0
IL_0066: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_006b: ldstr "sm"
IL_0070: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0075: callvirt instance string [mscorlib]System.Object::ToString()
IL_007a: callvirt instance int32 [mscorlib]System.String::get_Length()
IL_007f: ldc.i4.0
IL_0080: cgt
IL_0082: ldc.i4.0
IL_0083: ceq
IL_0085: stloc.s CS$4$0001
IL_0087: ldloc.s CS$4$0001
IL_0089: brtrue.s IL_00cb IL_008b: nop
IL_008c: ldloc.2
IL_008d: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0092: ldc.i4.0
IL_0093: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_0098: ldstr "sm"
IL_009d: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_00a2: callvirt instance string [mscorlib]System.Object::ToString()
IL_00a7: call valuetype [System.Windows.Forms_6]System.Windows.Forms.DialogResult [DevComponents.DotNetBar2]DevComponents.DotNetBar.MessageBoxEx::Show(string)
IL_00ac: pop
IL_00ad: ldarg.0
IL_00ae: ldfld class [DevComponents.DotNetBar2]DevComponents.DotNetBar.Controls.ComboBoxEx yywlxt.ui.LoginForm::tbyhm
IL_00b3: callvirt instance void [System.Windows.Forms]System.Windows.Forms.ComboBox::SelectAll()
IL_00b8: nop
IL_00b9: ldarg.0
IL_00ba: ldfld class [DevComponents.DotNetBar2]DevComponents.DotNetBar.Controls.ComboBoxEx yywlxt.ui.LoginForm::tbyhm
IL_00bf: callvirt instance bool [System.Windows.Forms]System.Windows.Forms.Control::Focus()
IL_00c4: pop
IL_00c5: nop
IL_00c6: br IL_0224 IL_00cb: nop
IL_00cc: ldloc.2
IL_00cd: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_00d2: ldc.i4.0
IL_00d3: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_00d8: ldstr "yhdm"
IL_00dd: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_00e2: callvirt instance string [mscorlib]System.Object::ToString()
IL_00e7: stsfld string yywlxt.conn.UInf::_yhdm
IL_00ec: ldloc.2
IL_00ed: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_00f2: ldc.i4.0
IL_00f3: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_00f8: ldstr "yhmc"
IL_00fd: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0102: callvirt instance string [mscorlib]System.Object::ToString()
IL_0107: stsfld string yywlxt.conn.UInf::_yhmc
IL_010c: ldloc.2
IL_010d: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0112: ldc.i4.0
IL_0113: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_0118: ldstr "ryid"
IL_011d: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0122: callvirt instance string [mscorlib]System.Object::ToString()
IL_0127: call int32 [mscorlib]System.Int32::Parse(string)
IL_012c: stsfld int32 yywlxt.conn.UInf::_ryid
IL_0131: ldloc.2
IL_0132: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0137: ldc.i4.0
IL_0138: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_013d: ldstr "hisdm"
IL_0142: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0147: callvirt instance string [mscorlib]System.Object::ToString()
IL_014c: stsfld string yywlxt.conn.UInf::_hisdm
IL_0151: ldloc.2
IL_0152: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0157: ldc.i4.0
IL_0158: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_015d: ldstr "hismc"
IL_0162: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0167: callvirt instance string [mscorlib]System.Object::ToString()
IL_016c: stsfld string yywlxt.conn.UInf::_hismc
IL_0171: ldloc.2
IL_0172: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0177: ldc.i4.0
IL_0178: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_017d: ldstr "ddid"
IL_0182: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0187: callvirt instance string [mscorlib]System.Object::ToString()
IL_018c: call int32 [mscorlib]System.Int32::Parse(string)
IL_0191: stsfld int32 yywlxt.conn.UInf::_ddid
IL_0196: ldloc.2
IL_0197: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_019c: ldc.i4.0
IL_019d: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_01a2: ldstr "ddmc"
IL_01a7: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_01ac: callvirt instance string [mscorlib]System.Object::ToString()
IL_01b1: stsfld string yywlxt.conn.UInf::_ddmc
IL_01b6: ldloc.2
IL_01b7: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_01bc: ldc.i4.0
IL_01bd: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_01c2: ldstr "bmid"
IL_01c7: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_01cc: callvirt instance string [mscorlib]System.Object::ToString()
IL_01d1: call int32 [mscorlib]System.Int32::Parse(string)
IL_01d6: stsfld int32 yywlxt.conn.UInf::_bmid
IL_01db: ldloc.2
IL_01dc: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_01e1: ldc.i4.0
IL_01e2: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_01e7: ldstr "bmdm"
IL_01ec: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_01f1: callvirt instance string [mscorlib]System.Object::ToString()
IL_01f6: stsfld string yywlxt.conn.UInf::_bmdm
IL_01fb: ldloc.2
IL_01fc: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0201: ldc.i4.0
IL_0202: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_0207: ldstr "bmmc"
IL_020c: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0211: callvirt instance string [mscorlib]System.Object::ToString()
IL_0216: stsfld string yywlxt.conn.UInf::_bmmc
IL_021b: ldc.i4.1
IL_021c: stsfld int32 yywlxt.conn.UInf::dlbz
IL_0221: ldc.i4.1
IL_0222: stloc.0
IL_0223: nop
IL_0224: ldloc.0
IL_0225: stloc.3
IL_0226: br.s IL_0228 IL_0228: ldloc.3
IL_0229: ret
} // end of method LoginForm::yhdljc
将上面的代码改成如下：
.method public hidebysig instance bool
yhdljc() cil managed
{
// 代码大小 7 (0x7)
.maxstack 1
.locals init ([0] bool CS$1$0000)
IL_0000: nop
IL_0001: ldc.i4.1
IL_0002: stloc.0
IL_0003: br.s IL_0005 IL_0005: ldloc.0
IL_0006: ret
} // end of method LoginForm::yhdljc
上面函数里的汇编代码对应:return true;
改过后，相当于原yhdljc()函数改成了总返回true的新函数：
public bool yhdljc()
{
return true;
}
6.3、编辑反汇编后的.il文件，生成新的exe执行程序，现在直接点“登录”就能进系统了。
最新文章
- SQL Server 2016 SP1 标准版等同企业版？！
- TypeScript Declaration Merging(声明合并)
- 斗地主——扎金花——3DMark
- Bookstore project using XAMPP 详细配置 Part 3
- Mecanim 动作复用示例
- cg tut
- css的6中居中的方式
- win8， VS2013 .NET 4.5在哪找svcutil.exe？
- 30天轻松学习javaweb_http头信息实例
- Android yyyymmdd转成yyyy-MM-dd格式
- SaltStack 最新版WebUI部署
- 3 D. Least Cost Bracket Sequence
- Java服务器下载速度的限制
- CODE大全告诉你java是否开始没落了
- 远程工作社区|远程工作|APCOW社区|AP社区
- Python中列表
- Java、Linux、Win 快速生成指定大小的空文件
- Android-Genymotion Unable to load VirtualBox engine
- 【Spark】Spark-性能调优-系列文章
- Asp.net Ajax(ashx)