用ildasm和ilasm对.net下的exe程序进行破解初探
1、对ildasm和ilasm的解释和用法在msdn上有。
ildasm：MSIL 反汇编程序是 MSIL 汇编程序 (Ilasm.exe) 的伙伴工具。 Ildasm.exe 采用包含 Microsoft 中间语言 (MSIL) 代码的可迁移可执行 (PE) 文件，并创建相应的 文本文件作为 Ilasm.exe 的输入
ilasm：MSIL 汇编程序从 Microsoft 中间语言 (MSIL) 生成可迁移可执行的 (PE) 文件。 （有关 MSIL 的更多信息，请参见 托管执行过程。）可以运行结果可执行文件（该文件包含 MSIL 和所需的元数据）以确定 MSIL 是否按预期执行。
2、如下是控制台程序ClassLibrary.exe的原代码
namespace ClassLibrary
{
class Class1
{
public static void Main()
{
string input;
do
{
input = System.Console.ReadLine();
if (input == "admin")
{
System.Console.WriteLine("登录成功\n");
}
else
{
System.Console.WriteLine("登录失败\n");
}
} while (input!="end");
}
}
}
3、用ildasm对ClassLibrary.exe程序进行反汇编
可以直接在Vs2012开发人员工具命令里用命令：C:\Program Files\Microsoft Visual Studio 11.0>ildasm D:\快盘\StudyNoteOfCsharp\ClassLibrary\bin\Debug\ClassLibrary.exe /output:D:\快盘\StudyNoteOfCsharp\ClassLibrary\bin\Debug\broker.il 将ClassLibrary.exe生成broder.il文件
也可以找到ildasm.exe，运行界面，存储为il文件
4、用记事本修改.il文件
5、用ilasm将修改后的il文件编辑成exe文件
运行命令：C:\Program Files\Microsoft Visual Studio 11.0>ilasm D:\快盘\StudyNoteOfCsharp\CassLibrary\bin\Debug\broker
将broker.il文件在当前目录下生成broker.exe程序
修改后的exe和原exe程序的对比
6、破解程序实例
6.1、一个程序登录界面点登录后运行的是如下代码。
private void bdl_Click(object sender, EventArgs e)
{
//用户名不为空，才进行登录操作
if (this.tbyhm.Text.Length > 0)
{
//用户验证
if (this.yhdljc())
{
string user = this.tbyhm.Text.Trim();
if (!this.tbyhm.AutoCompleteCustomSource.Contains(user))
{
this.tbyhm.AutoCompleteCustomSource.Add(user);
}
this.IsLogIn = true;
this.Close();
}
}
}
public bool yhdljc()
{
bool re = false;
ArrayList ap = new ArrayList();
ap.Add(new UProcPara("@yhdm", SqlDbType.NVarChar, 20, tbyhm.Text.ToUpper()));
ap.Add(new UProcPara("@yhmm", SqlDbType.NVarChar, 50, tbmm.Text));
DataTable dt = USql.getInstance().procedure("p_yhdljc", ap);
if (dt.Rows[0]["sm"].ToString().Length > 0)
{
MessageBoxEx.Show(dt.Rows[0]["sm"].ToString());
tbyhm.SelectAll();
tbyhm.Focus();
}
else
{
//初始化登录人员的信息
UInf._yhdm = dt.Rows[0]["yhdm"].ToString();
UInf._yhmc = dt.Rows[0]["yhmc"].ToString();
UInf._ryid = int.Parse(dt.Rows[0]["ryid"].ToString());
UInf._hisdm = dt.Rows[0]["hisdm"].ToString();
UInf._hismc = dt.Rows[0]["hismc"].ToString();
UInf._ddid = int.Parse(dt.Rows[0]["ddid"].ToString());
UInf._ddmc = dt.Rows[0]["ddmc"].ToString();
UInf._bmid = int.Parse(dt.Rows[0]["bmid"].ToString());
UInf._bmdm = dt.Rows[0]["bmdm"].ToString();
UInf._bmmc = dt.Rows[0]["bmmc"].ToString();
UInf.dlbz = 1;
re = true;
}
return re;
}
6.2、在程序反编译后的.il文件找到yhdjc()函数
.method public hidebysig instance bool
yhdljc() cil managed
{
// 代码大小 554 (0x22a)
.maxstack 6
.locals init ([0] bool re,
[1] class [mscorlib]System.Collections.ArrayList ap,
[2] class [System.Data]System.Data.DataTable dt,
[3] bool CS$1$0000,
[4] bool CS$4$0001)
IL_0000: nop
IL_0001: ldc.i4.0
IL_0002: stloc.0
IL_0003: newobj instance void [mscorlib]System.Collections.ArrayList::.ctor()
IL_0008: stloc.1
IL_0009: ldloc.1
IL_000a: ldstr "@yhdm"
IL_000f: ldc.i4.s 12
IL_0011: ldc.i4.s 20
IL_0013: ldarg.0
IL_0014: ldfld class [DevComponents.DotNetBar2]DevComponents.DotNetBar.Controls.ComboBoxEx yywlxt.ui.LoginForm::tbyhm
IL_0019: callvirt instance string [System.Windows.Forms]System.Windows.Forms.Control::get_Text()
IL_001e: callvirt instance string [mscorlib]System.String::ToUpper()
IL_0023: newobj instance void yywlxt.conn.UProcPara::.ctor(string,
valuetype [System.Data]System.Data.SqlDbType,
int32,
object)
IL_0028: callvirt instance int32 [mscorlib]System.Collections.ArrayList::Add(object)
IL_002d: pop
IL_002e: ldloc.1
IL_002f: ldstr "@yhmm"
IL_0034: ldc.i4.s 12
IL_0036: ldc.i4.s 50
IL_0038: ldarg.0
IL_0039: ldfld class [DevComponents.DotNetBar2]DevComponents.DotNetBar.Controls.TextBoxX yywlxt.ui.LoginForm::tbmm
IL_003e: callvirt instance string [System.Windows.Forms]System.Windows.Forms.Control::get_Text()
IL_0043: newobj instance void yywlxt.conn.UProcPara::.ctor(string,
valuetype [System.Data]System.Data.SqlDbType,
int32,
object)
IL_0048: callvirt instance int32 [mscorlib]System.Collections.ArrayList::Add(object)
IL_004d: pop
IL_004e: call class yywlxt.conn.USql yywlxt.conn.USql::getInstance()
IL_0053: ldstr "p_yhdljc"
IL_0058: ldloc.1
IL_0059: callvirt instance class [System.Data]System.Data.DataTable yywlxt.conn.USql::procedure(string,
class [mscorlib]System.Collections.ArrayList)
IL_005e: stloc.2
IL_005f: ldloc.2
IL_0060: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0065: ldc.i4.0
IL_0066: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_006b: ldstr "sm"
IL_0070: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0075: callvirt instance string [mscorlib]System.Object::ToString()
IL_007a: callvirt instance int32 [mscorlib]System.String::get_Length()
IL_007f: ldc.i4.0
IL_0080: cgt
IL_0082: ldc.i4.0
IL_0083: ceq
IL_0085: stloc.s CS$4$0001
IL_0087: ldloc.s CS$4$0001
IL_0089: brtrue.s IL_00cb
IL_008b: nop
IL_008c: ldloc.2
IL_008d: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0092: ldc.i4.0
IL_0093: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_0098: ldstr "sm"
IL_009d: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_00a2: callvirt instance string [mscorlib]System.Object::ToString()
IL_00a7: call valuetype [System.Windows.Forms_6]System.Windows.Forms.DialogResult [DevComponents.DotNetBar2]DevComponents.DotNetBar.MessageBoxEx::Show(string)
IL_00ac: pop
IL_00ad: ldarg.0
IL_00ae: ldfld class [DevComponents.DotNetBar2]DevComponents.DotNetBar.Controls.ComboBoxEx yywlxt.ui.LoginForm::tbyhm
IL_00b3: callvirt instance void [System.Windows.Forms]System.Windows.Forms.ComboBox::SelectAll()
IL_00b8: nop
IL_00b9: ldarg.0
IL_00ba: ldfld class [DevComponents.DotNetBar2]DevComponents.DotNetBar.Controls.ComboBoxEx yywlxt.ui.LoginForm::tbyhm
IL_00bf: callvirt instance bool [System.Windows.Forms]System.Windows.Forms.Control::Focus()
IL_00c4: pop
IL_00c5: nop
IL_00c6: br IL_0224
IL_00cb: nop
IL_00cc: ldloc.2
IL_00cd: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_00d2: ldc.i4.0
IL_00d3: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_00d8: ldstr "yhdm"
IL_00dd: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_00e2: callvirt instance string [mscorlib]System.Object::ToString()
IL_00e7: stsfld string yywlxt.conn.UInf::_yhdm
IL_00ec: ldloc.2
IL_00ed: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_00f2: ldc.i4.0
IL_00f3: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_00f8: ldstr "yhmc"
IL_00fd: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0102: callvirt instance string [mscorlib]System.Object::ToString()
IL_0107: stsfld string yywlxt.conn.UInf::_yhmc
IL_010c: ldloc.2
IL_010d: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0112: ldc.i4.0
IL_0113: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_0118: ldstr "ryid"
IL_011d: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0122: callvirt instance string [mscorlib]System.Object::ToString()
IL_0127: call int32 [mscorlib]System.Int32::Parse(string)
IL_012c: stsfld int32 yywlxt.conn.UInf::_ryid
IL_0131: ldloc.2
IL_0132: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0137: ldc.i4.0
IL_0138: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_013d: ldstr "hisdm"
IL_0142: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0147: callvirt instance string [mscorlib]System.Object::ToString()
IL_014c: stsfld string yywlxt.conn.UInf::_hisdm
IL_0151: ldloc.2
IL_0152: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0157: ldc.i4.0
IL_0158: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_015d: ldstr "hismc"
IL_0162: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0167: callvirt instance string [mscorlib]System.Object::ToString()
IL_016c: stsfld string yywlxt.conn.UInf::_hismc
IL_0171: ldloc.2
IL_0172: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0177: ldc.i4.0
IL_0178: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_017d: ldstr "ddid"
IL_0182: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0187: callvirt instance string [mscorlib]System.Object::ToString()
IL_018c: call int32 [mscorlib]System.Int32::Parse(string)
IL_0191: stsfld int32 yywlxt.conn.UInf::_ddid
IL_0196: ldloc.2
IL_0197: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_019c: ldc.i4.0
IL_019d: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_01a2: ldstr "ddmc"
IL_01a7: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_01ac: callvirt instance string [mscorlib]System.Object::ToString()
IL_01b1: stsfld string yywlxt.conn.UInf::_ddmc
IL_01b6: ldloc.2
IL_01b7: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_01bc: ldc.i4.0
IL_01bd: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_01c2: ldstr "bmid"
IL_01c7: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_01cc: callvirt instance string [mscorlib]System.Object::ToString()
IL_01d1: call int32 [mscorlib]System.Int32::Parse(string)
IL_01d6: stsfld int32 yywlxt.conn.UInf::_bmid
IL_01db: ldloc.2
IL_01dc: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_01e1: ldc.i4.0
IL_01e2: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_01e7: ldstr "bmdm"
IL_01ec: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_01f1: callvirt instance string [mscorlib]System.Object::ToString()
IL_01f6: stsfld string yywlxt.conn.UInf::_bmdm
IL_01fb: ldloc.2
IL_01fc: callvirt instance class [System.Data]System.Data.DataRowCollection [System.Data]System.Data.DataTable::get_Rows()
IL_0201: ldc.i4.0
IL_0202: callvirt instance class [System.Data]System.Data.DataRow [System.Data]System.Data.DataRowCollection::get_Item(int32)
IL_0207: ldstr "bmmc"
IL_020c: callvirt instance object [System.Data]System.Data.DataRow::get_Item(string)
IL_0211: callvirt instance string [mscorlib]System.Object::ToString()
IL_0216: stsfld string yywlxt.conn.UInf::_bmmc
IL_021b: ldc.i4.1
IL_021c: stsfld int32 yywlxt.conn.UInf::dlbz
IL_0221: ldc.i4.1
IL_0222: stloc.0
IL_0223: nop
IL_0224: ldloc.0
IL_0225: stloc.3
IL_0226: br.s IL_0228
IL_0228: ldloc.3
IL_0229: ret
} // end of method LoginForm::yhdljc
将上面的代码改成如下：
.method public hidebysig instance bool
yhdljc() cil managed
{
// 代码大小 7 (0x7)
.maxstack 1
.locals init ([0] bool CS$1$0000)
IL_0000: nop
IL_0001: ldc.i4.1
IL_0002: stloc.0
IL_0003: br.s IL_0005
IL_0005: ldloc.0
IL_0006: ret
} // end of method LoginForm::yhdljc
上面函数里的汇编代码对应:return true;
改过后，相当于原yhdljc()函数改成了总返回true的新函数：
public bool yhdljc()
{
return true;
}
6.3、编辑反汇编后的.il文件，生成新的exe执行程序，现在直接点“登录”就能进系统了。
