鹏X校园网破解过程

鹏X校园网，买的时候说是终身免费，其实加密狗做了限制，每几年就要交一次钱买一个新的加密狗。

闲着没事，把这个加密过程给破解了，现在把破解过程分享一下。

2个工具：

ILSpy/dnSpy

官方网址：http://ilspy.net/

ildasm 把dll文件生成il代码，修改该后可重新编译

找到

Pantosoft.Elearning.SystemFramework.dll

备份

把Pantosoft.Elearning.SystemFramework.dll拖进ILSpy

Pantosoft.Elearning.SystemFramework -> SoftwareLicence -> Validate

可看到加密狗调用代码

public static void Validate(SystemType type)
{
lock (typeof(SoftwareLicence))
{
_isValid = false;
try
{
string licenceString = RunVerify();
ValidateUnderVerifyCall10(licenceString);
}
catch
{
try
{
string licenceString = RunVerify(Convert.ToInt32(type));
ValidateUnderVerifyCall20(type, licenceString);
}
catch (Exception ex)
{
_lastError = SystemFrameworkErrReader.GetString(9201.ToString(), ex.Message);
}
}
}
}

思路如下修改 _isValid = true; 删除红字部分

在ILSpy下无法删除

通过ildasm 删除

把Pantosoft.Elearning.SystemFramework.dll文件导入到ildasm工具中

在ildasm中File->dump，把dll文件转储为*.il文件存到某个指定文件夹里，得到a.il和a.res两个文件，有时也会有*.resource文件

打开得到的a.il文件，找到对应的方法，进行修改

.method public hidebysig static void Validate(valuetype Pantosoft.Elearning.SystemFramework.SystemType ‘type’) cil managed
{
// Code size 122 (0x7a)
.maxstack 4
.locals init (object V_0,
string V_1,
class [mscorlib]System.Exception V_2,
int32 V_3,
object[] V_4)
IL_0000: ldtoken Pantosoft.Elearning.SystemFramework.SoftwareLicence
IL_0005: call class [mscorlib]System.Type [mscorlib]System.Type::GetTypeFromHandle(valuetype [mscorlib]System.RuntimeTypeHandle)
IL_000a: stloc.0
IL_000b: ldloc.0
IL_000c: call void [mscorlib]System.Threading.Monitor::Enter(object)
.try
{
IL_0011: ldc.i4.0
IL_0012: stsfld bool Pantosoft.Elearning.SystemFramework.SoftwareLicence::_isValid
.try
{
IL_0017: call string Pantosoft.Elearning.SystemFramework.SoftwareLicence::RunVerify()
IL_001c: stloc.1
IL_001d: ldloc.1
IL_001e: call void Pantosoft.Elearning.SystemFramework.SoftwareLicence::ValidateUnderVerifyCall10(string)
IL_0023: leave.s IL_0070
} // end .try
catch [mscorlib]System.Object
{
IL_0025: pop
.try
{
IL_0026: ldarg.0
IL_0027: box Pantosoft.Elearning.SystemFramework.SystemType
IL_002c: call int32 [mscorlib]System.Convert::ToInt32(object)
IL_0031: call string Pantosoft.Elearning.SystemFramework.SoftwareLicence::RunVerify(int32)
IL_0036: stloc.1
IL_0037: ldarg.0
IL_0038: ldloc.1
IL_0039: call void Pantosoft.Elearning.SystemFramework.SoftwareLicence::ValidateUnderVerifyCall20(valuetype Pantosoft.Elearning.SystemFramework.SystemType,
string)
IL_003e: leave.s IL_006e
} // end .try
catch [mscorlib]System.Exception
{
IL_0040: stloc.2
IL_0041: ldc.i4 0x23f1
IL_0046: stloc.3
IL_0047: ldloca.s V_3
IL_0049: call instance string [mscorlib]System.Int32::ToString()
IL_004e: ldc.i4.1
IL_004f: newarr [mscorlib]System.Object
IL_0054: stloc.s V_4
IL_0056: ldloc.s V_4
IL_0058: ldc.i4.0
IL_0059: ldloc.2
IL_005a: callvirt instance string [mscorlib]System.Exception::get_Message()
IL_005f: stelem.ref
IL_0060: ldloc.s V_4
IL_0062: call string Pantosoft.Elearning.SystemFramework.SystemFrameworkErrReader::GetString(string,
object[])
IL_0067: stsfld string Pantosoft.Elearning.SystemFramework.SoftwareLicence::_lastError
IL_006c: leave.s IL_006e
} // end handler
IL_006e: leave.s IL_0070
} // end handler
IL_0070: leave.s IL_0079

} // end .try
finally
{
IL_0072: ldloc.0
IL_0073: call void [mscorlib]System.Threading.Monitor::Exit(object)
IL_0078: endfinally
} // end handler
IL_0079: ret
} // end of method SoftwareLicence::Validate

上图红字部分删除,

篮字ldc.i4.0修改为ldc.i4.1

最终结果如下

.method public hidebysig static void  Validate(valuetype Pantosoft.Elearning.SystemFramework.SystemType 'type') cil managed
  {
    // Code size       122 (0x7a)
    .maxstack  4
    .locals init (object V_0,
             string V_1,
             class [mscorlib]System.Exception V_2,
             int32 V_3,
             object[] V_4)
    IL_0000:  ldtoken    Pantosoft.Elearning.SystemFramework.SoftwareLicence
    IL_0005:  call       class [mscorlib]System.Type [mscorlib]System.Type::GetTypeFromHandle(valuetype [mscorlib]System.RuntimeTypeHandle)
    IL_000a:  stloc.0
    IL_000b:  ldloc.0
    IL_000c:  call       void [mscorlib]System.Threading.Monitor::Enter(object)
    .try
    {
      IL_0011:  ldc.i4.1
      IL_0012:  stsfld     bool Pantosoft.Elearning.SystemFramework.SoftwareLicence::_isValid
      IL_0070:  leave.s    IL_0079
    }  // end .try
    finally
    {
      IL_0072:  ldloc.0
      IL_0073:  call       void [mscorlib]System.Threading.Monitor::Exit(object)
      IL_0078:  endfinally
    }  // end handler
    IL_0079:  ret
  } // end of method SoftwareLicence::Validate

然后运行(最好在XP系统下进行，XP系统下安装.net framework v2.0.50727 )

在dump目录中执行（即是a.il a.res所在目录）

c:\windows\microsoft.net\framework\v2.0.50727\ildasm.exe /dll/resource=a.res a.il

执行后 生成a.dll

把 a.dll拖进ILSpy

Pantosoft.Elearning.SystemFramework -> SoftwareLicence -> Validate

可看到加密狗调用代码(修改成功)

public static void Validate(SystemType type)
		{
			lock (typeof(SoftwareLicence))
			{
				_isValid = true;
				
			}
		
}

把a.dll改名Pantosoft.Elearning.SystemFramework.dll，替换掉网站目录下的Pantosoft.Elearning.SystemFramework.dll

打狗成功

---

业务联系QQ：95565541

工作室网站：https://www.pendyxiao.com

微信扫一扫添加我为好友