风过明岚,雁过留痕

08.05：打击盗版狗目的已达到，停止发放

RT，之前iebook 2010发布的时候也凑过热闹，扔了一个截图，当时没有发布，鉴于最近某论坛打着复制加密狗的旗号进行破解并贩卖，因此特免费放出此全功能破解版，无需任何狗。

现发布iebook 2010 全功能破解版，实现专业版的所有功能，另加按钮可替换。

附去除封底技术支持信息步骤：

如下图所示，将显示技术支持设置为false，并且点击 应用，之后生成杂志即无封底技术支持信息：

下为截图：

阅读全文…

BoxedAppSdk 2.1.0.16破解，带X64版本。

链接——>   猛击下载

What is BoxedApp SDK?

BoxedApp SDK is a developer library that provides a set of functions for emulating a file system and a system registry for an application. Using these functions, you can create virtual files, fake registry entries, keys and values.

32-bit and x64 are supported.

Why and when is it useful?

• When an application must run properly even if it doesn’t have the right to write to the system registry and to the file system
• When an application uses DLL and files, which are to be kept secure, and because of that you can’t save them to disk
• When an application needs ActiveX but doesn’t have an installer because it must run instantly, without the installation (for example, when it’s a portable application that runs from a flash card)

Just a quick example: suppose, your application uses a Flash ActiveX player to display a Flash movie or video. The end users would need a Flash player ActiveX to allow your application work properly. Also, keep in mind that Flash player is not capable of loading files directly from memory. That exposes two major problems: first, you would have to install a Flash player ActiveX, and second, you would have to have the movie in a file. BoxedApp SDK solves these problems: you simply create a virtual file that contains the flash movie, another virtual file that contains the Flash player ActiveX DLL, and virtual registry entries that point to that virtual file. That’s it. Now the application “thinks” that that the Flash player ActiveX is actually installed, so the Flash player works just as if the movie file was actually there.

In other words, you can now embed all DLL and content files, all ActiveX and OCX components, which your application uses, into a single EXE file. BoxedApp SDK doesn’t unpack these files to disk; it doesn’t use temporary files either.

Would like to see BoxedApp SDK in action? Download the demo right now! It includes many examples:

• The basic example that explains how to create virtual files and registry keys
• Embedding Flash player and Flash movies

and more!

 

Features

• Create virtual files
• Create virtual registry keys
• API for intercepting functions
• Embed DLL
• Embed ActiveX / OCX
• Launching a virtual file-based process
• Using virtual file system by several processes simultaneously

继续补全之前blog的博文~~
FLASH吸血鬼是众多网友用来从exe可执行文件中提取swf的利器，其直接读取内存，从内存中取出swf文件。
经过分析，发现其原理还是比较简单的。

第一步。通过GetWindowThreadProcessId函数获得进程PID。为以后基本的进程内存搜索奠定基础。
第二步。通过OpenProcess打开前面获得的pid的进程对象。
第三步。通过VirtualQueryEx函数和ReadProcessMemory函数遍历进程的内存，在内存中搜索swf文件的文件头“CWS”和“FWS”。如果搜索到，则进行解密，并输出swf文件。

Anti-vampire的启示:
1、阻止吸血鬼得到窗口句柄
2、阻止吸血鬼打开程序内存
3、使swf文件不完整的存在于程序内存中
其中第一种实现后用起来很怪异，第二种强度凑合，但是如果吸血鬼采取一定的跟进措施，很容易搞定，第三种就目前来说，算是比较有效的。

RT，继解决action script viewer后又解决的一个buraksd的产品，不过可惜的是，这个并不是最新版本，而是6.0 pre-release2.不过keygen倒是兼容之后的版本的，如果buraksd不做啥变化的话:wink:

本来这贴在旧blog上已经备份过的，不过由于那个blog所在的服务器归期无望，我还是从新备份一份吧。

　　首先，这些函数名都有一定的格式：

_xStryyy

　　其中x可以是字符P、L、W。P代表该函数是处理传统Pascal字符串的，L代表该函数是处理长字符串的，W当然就是Unicode了。yyy就是表示函数的实际作用了。比如_PStrCat就是表示传统Pascal字符串的连接函数。大家可以查阅system.pas来验证一下。不过一般不大见到W开头的函数。

　　下面是经过整理的结果，算是为大家提供一个方便。说明一下，列表不全，但没列出来的函数完全可以见名知意。当然，前提是你看完列表。

　　另外，需要注意的是，对于在堆栈里的返回值，一般以EBP引用。如果你看到函数调用后下一条语句是MOV xxx,[EBP+yy]，那通常就是保存返回值了。特别是_LStrCopy。 阅读全文…