某安全工具逆向破解

Security Classification: C-1

Publish Time: 2026-02-28

Category: Old Posts

Old Version | Diff | Latest Version

AI Info

📌 AI Point 92

📝 AI Summary 本文详细阐述了如何通过静态修改和动态调试两种方式破解某安全工具的授权验证机制。核心思路是篡改关键跳转指令（jz→jnz）和跳过证书有效期检查，从而绕过正版验证，实现软件非法使用。整个过程结合了IDA Pro静态分析与OllyDbg动态调试，展示了逆向工程中常见的反汇编、补丁应用和断点调试技术。

⭐ AI Evaluation 本文是一份高质量的技术逆向分析文档，结构清晰，逻辑严谨，图文并茂，详细描述了从静态分析到动态调试的完整破解流程。作者不仅解释了底层汇编指令（如jz/jnz）的行为，还提供了具体的操作步骤和截图证据，增强了可信度。流程图进一步提升了可读性。不足之处在于未说明具体工具名称（如xray），可能影响通用性；且明确指出该方法仅适用于旧版本，体现了作者的技术诚实性。整体内容具有较高学习价值，适合作为逆向工程教学案例。

**This article is for personal reverse learning records only. Please support the official genuine software.**

## Static Analysis

Load x**y.exe, using the Windows 64-bit version of x**y as an example.

![](https://img.meituan.net/imgupload/ac9bfdc001b142a0e3823653b7ddeeb5161397.png)

By analyzing the code, locate the function related to certificate verification.

![](https://img.meituan.net/imgupload/606f3efc2543cff7a221d9f2c043fc18149821.png)

Here, a critical jump instruction `jz` is found. In assembly language, `jz` (Jump if Zero) means jumping when the zero flag (ZF) is 1. This implies that if the verification condition is met (result is 0), the program will jump to the specified function.

This is equivalent to the following logic:

```c
if (verification passed) {
    // jump to authorized usage module
}
```

Conversely, `jnz` (Jump if Not Zero) jumps when ZF is 0, i.e., when verification fails.

We can infer that xray's authentication process roughly involves: decrypting the license content, followed by legality verification, integrity verification, and validity verification.

```
if (all verifications passed, this user is genuine) {
    // jump to usage
}
```

If we change the `jz` instruction to `jnz`, the logic becomes:

```c
if (verification failed, this user is pirated) {
    // jump to usage
}
```

This clearly contradicts the original verification intent. Therefore, our cracking goal is to change `jz` to `jnz` to bypass the verification.

The specific steps are as follows:

1.  Settings -> General, check "Show Machine Code".
2.  Edit -> Patch Program -> Single Byte Patch.
 *   Original byte is `84` (corresponding to `jz` instruction).
    *   Modify it to `85` (corresponding to `jnz` instruction).
 ![](https://img.meituan.net/imgupload/d8a7b73f7e49ccb99aaca9ecedafad04110083.png)
    ![](https://img.meituan.net/imgupload/0e7171dc99754d5834f4890a93cc69e353384.png)
3.  Edit -> Patch Program -> Apply Patch.

The effect after modification is as follows:

![](https://img.meituan.net/imgupload/dbacc0371a6b45913b320ae58e04919f726606.png)

## Dynamic Debugging

After successful static analysis cracking, we attempt to use dynamic debugging to verify the cracking effect.

Since OllyDbg (OD) only supports 32-bit program debugging, we downloaded the 32-bit (x86) version of x**y and loaded it using OD.

![](https://img.meituan.net/imgupload/2edf4fec7eb2c77ed5b26ac9833c3d06167002.png)

Initially, attempts to use "read content breakpoint" and "open file breakpoint" were ineffective. It was not until we discovered that the program retrieves the registration time through the function shown in the image.

![](https://img.meituan.net/imgupload/7205b791ad57f94db50a5339050802c2261628.png)

We set a breakpoint on this function.

![](https://img.meituan.net/imgupload/949318c911c7e179ae3ae28da09b72f7206921.png)

However, the program ran away after one execution. Therefore, we need to use single-step debugging, continuously pressing F8.

![](https://img.meituan.net/imgupload/38e8b67c97f8b92bcda59ea5a048ca0e259435.png)

The program continues to run here, and we find it is reading the certificate's valid time. To prevent the program from running away, we add a breakpoint here.

![](https://img.meituan.net/imgupload/fd351b34ab4c48d4f4c2edee3241a51a25810.png)

Repeat the above operation.

![](https://img.meituan.net/imgupload/e0a7bfefc7addf04c223d2093924843e83285.png)

Until the program runs to this point, and the system prompts "Certificate expired".

![](https://img.meituan.net/imgupload/de29c8fda0f684afac863f51b0751a6f89782.png)

Then the program exits.

![](https://img.meituan.net/imgupload/71cd5434caccaba1b486ecc831ebac3b125706.png)

We use Ctrl+F2 to restart the program and set a breakpoint at this location again.

![](https://img.meituan.net/imgupload/1fbc419695dc70c3c2779102a075e870124747.png)

At this breakpoint, we find that the program executes two critical `call` instructions. In subsequent runs, we never see the "expired" prompt at this breakpoint. We set a breakpoint at the second `call` instruction.

![](https://img.meituan.net/imgupload/2125ee61d95f9c3d3ff45379045d4105119254.png)

At the second `call` breakpoint, the program exits directly. We replace this `call` instruction with a `NOP` (No Operation) instruction, i.e., skip this verification.

![](https://img.meituan.net/imgupload/f2461dc1b339a989eb72bd069c6f817386996.png)

After modification, the program successfully enters the authorized success interface.

![](https://img.meituan.net/imgupload/8c7eee43e10214710dd12871cb68d85f276180.png)

Although the first line still shows "Authorization expired", the software can be used normally.

![](https://img.meituan.net/imgupload/415ef87c57927317436292353c9c85fc67058.png)

The final running effect is as follows:

![](https://img.meituan.net/imgupload/769ecfd88d36018f5159bea1d460a61f40420.png)

![](https://img.meituan.net/imgupload/d711baf3cf5480159ec48733a0413c1a46047.png)

> (Note: The method described in the article is only applicable to specific old versions and may be ineffective for the latest versions. It is only for reference as a reverse learning idea.)

## Cracking Flowchart

```mermaid
flowchart TD
    A[Load x*y.exe] --> B[Static Analysis: Locate Certificate Verification Function]
    B --> C{Found Critical Jump Instruction jz}
    C -->|Verification Passed| D[Jump to Authorization Module]
    C -->|Verification Failed| E[Deny Usage]
    D --> F[Infer Authentication Process: Decrypt License -> Legality Check -> Integrity Check -> Validity Check]
    F --> G[Cracking Goal: Change jz to jnz]
    G --> H[Operation Steps: View Machine Code -> Single Byte Patch 84->85 -> Apply Patch]
    H --> I[Static Cracking Completed]

I --> J[Dynamic Debugging: Load 32-bit Version with OllyDbg]
    J --> K[Set Breakpoint: Function to Get Registration Time]
    K --> L{Program Runs Away?}
    L -->| M[Switch to Single-Step Debugging F8]
    L -->|No| N[Continue Breakpoint Monitoring]
    M --> N
    N --> O[Found Reading Certificate Validity Period]
    O --> P[Set Breakpoint Runaway]
    P --> Q[Repeat Operations Until Certificate Expired Prompt Appears]
    Q --> R[Program Exits]
    R --> S[Restart and Debug with Breakpoint]
    S --> T[Found Two Critical call Instructions]
    T --> U[Set Breakpoint at Second call]
    U --> V[Program Exits Directly]
    V --> W[Replace call with NOP Instruction]
    W --> X[Program Enters Authorization Success Interface]
    X --> Y[Software Functions Normally]
```

本内容由@depybot AI智能助手生成

This content was generated by @depybot AI intelligent assistant.

Comment List [Latest 5]

bdd0a04e 2026/02/09

@depybot 请评价一下文章质量

AI机器人
@depybot

本文是一篇关于安全工具逆向破解的技术分析文章，内容详实，逻辑清晰，适合有一定逆向工程基础的学习者参考。文章以Xray为例，通过静态分析和动态调试两种方式，完整展示了如何绕过软件授权验证机制。静态部分通过修改关键跳转指令（jz→jnz）实现破解，动态部分则利用OllyDbg进行断点调试，定位并NOP掉证书校验函数，最终达成授权绕过。文中配有大量截图和代码片段，极大提升了可读性。尽管作者注明方法可能已失效，但整体思路具有典型性和学习价值，尤其对理解软件保护机制与破解原理有较好帮助。建议读者仅用于学习目的，支持正版软件。 (注:本评论来自depybot-AI智能助手，请注意甄别内容真伪，所有观点并不代表平台立场。)

Comment

AI Assistant Reply

Add @depybot in your content to summon the AI robot for a reply. This action will automatically make your comment public. Do not use it if sensitive information is involved. Contact the site administrator for deletion if needed.

© Copyright: This article is an original work and the copyright belongs to the depy unless marked as Reproduced

Please contact the blogger for authorization to reprint

某安全工具逆向破解

© Copyright: This article is an original work and the copyright belongs to the depy unless marked as ReproducedPlease contact the blogger for authorization to reprint

© Copyright: This article is an original work and the copyright belongs to the depy unless marked as Reproduced

Please contact the blogger for authorization to reprint