您的位置：首页 > 其它

运用Mono.Ceci类库修改.NET程序集走上破解软件的道路

2013-07-02 19:10 288 查看

代码注入在C++时代很流行，主要是对现有的程序做一些修改，以达到预期的目的。一部分的破解程序，注册机也是借助于此方法，让被注入的程序绕过验证，达到破解的目录。在.NET中，借助于Mono.Cecil程序集，注入代码也相当容易。请看下面的代码，将要被注入的程序：

using System;

namespace Victim
{
class Program
{
static void Main(string[] args)
{
Console.WriteLine("Hello World!");
Console.ReadLine();
}
}
}

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }把上面的程序编译成一个程序集Victim，执行程序，它会在控制台出版Hello,world。

下面我做一个新的程序，它修改上面的程序集，在Program类型中定义一个新的Test方法，修改Main方法调用我注入的Test方法。

先添加对程序Mono.cecil的引用。

using System;
using Mono.Cecil;
using Mono.Cecil.Cil;

现在，开始加载程序集

AssemblyDefinition asm= AssemblyFactory.GetAssembly("Victim.exe");

//Declare returntype "void"
TypeReference returntype = asm.MainModule.Import(typeof(void));
//Define Methodsignature "private static void Test()"
MethodDefinition testmethod = new MethodDefinition("Test",MethodAttributes.Private|MethodAttributes.Static, returntype);

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }Test方法的访问级别为private,static

给Test方法增加方法体，参考下面的代码写法

//Push string onto the stack
Instruction msg = testmethod.Body.CilWorker.Create(OpCodes.Ldstr, "Hello from Test()");
//Import external method reference to Console.WriteLine()
MethodReference writeline = asm.MainModule.Import(typeof(Console).GetMethod("WriteLine",new Type[]{typeof(string)}));

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }加载常量为方法的签名，在控制台上打印出来

这种写法，与MSIL代码一致，C#代码被翻译成MSIL，生成的代码就是这样的。

最后生成Test方法，代码如下

//Generate stack-push
testmethod.Body.CilWorker.Append(msg);
//Generate call to WriteLine()
testmethod.Body.CilWorker.InsertAfter (msg,testmethod.Body.CilWorker.Create(OpCodes.Call,writeline));
//Generate return
testmethod.Body.CilWorker.Append (testmethod.Body.CilWorker.Create (OpCodes.Ret));

asm.MainModule.Inject(testmethod, asm.MainModule.Types["Victim.Program"]);

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }最后，修改程序，让它调用被注入的Test方法

//Get Method reference with Name test,
MethodReference testmethod_ref = null;
foreach (MethodDefinition mdef in asm.MainModule.Types["Victim.Program"].Methods)
{
if (mdef.Name == "Test")
{
testmethod_ref=asm.MainModule.Import(mdef);
}

}

//Create call to the reference
Instruction call_test = testmethod.Body.CilWorker.Create(OpCodes.Call, testmethod_ref);
//Insert reference
asm.EntryPoint.Body.CilWorker.InsertBefore (asm.EntryPoint.Body.Instructions[0],call_test);

AssemblyFactory.SaveAssembly(asm, "patched.exe");

现在，最初始的程序集代码看起来是这样的

using System;

namespace Victim
{
class Program
{
static void Main(string[] args)
{
Test();
Console.WriteLine("Hello World!");
Console.ReadLine();
}

private static void Test()
{
Console.WriteLine("Hello from Test()");

}
}
}

可以用Reflector来查看生成的Patched.exe，应该与这里的一致。

如果被修改的方法，是许可验证，或是注册算法验证，这一方便可以直接把它的指令清空，另存为一个程序集文件，达到绕过验证的目的。

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }
.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }

内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理

标签：

相关文章推荐

新的分享

章节导航

运用Mono.Ceci类库修改.NET程序集 走上破解软件的道路

运用Mono.Ceci类库修改.NET程序集走上破解软件的道路