SourceInsight4.0最新4.00.01502026版本破解分析

admin
admin
admin
0
文章
0
评论
2026-04-25 04:40:46 网络安全文章 来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文分析了SourceInsight4.00.0150版本的许可证验证机制，通过IDA逆向工程揭示其19位序列号格式规则（S开头、特定位置分隔符和字符限制）及校验函数sub_51B7A0的算法逻辑。关键发现包括版本号检测、许可证类型判断以及通过前15字符生成校验码的流程，最终提供绕过验证的临时激活方法。 综合评分： 75 文章分类： 逆向分析,二进制安全,漏洞分析,安全工具,免杀

cover_image

SourceInsight4.0 最新4.00.0150 2026版本 破解分析

原创

吾爱pojie 吾爱pojie

吾爱破解论坛

2026年3月27日 08:48 北京

在小说阅读器读本章

去阅读

作者论坛账号：ZhangYixiSuccee

1、SourceInsight 软件说明

版本信息：4.00.0150 2026版本

2、SourceInsight 注册机说明 按照惯例，分析一下软件基本类型，32为程序，VC程序，还带签名（看起来是RSA PKCS #7填充算法）

打开SourceInsight，进入License 激活界面，随便输入S411111111111111111111，出现如下界面

接着搜索字符串，找到关键位置，首先用IDA分析看一下，点击Search Text，输入the serial number，可以搜索到关键位置

， 

可以看到sub_51C070如何检测错误之后，会进行错误信息的打印，所以该函数会对lincense进行检测

BOOL __cdecl sub_51C070(char *Str, _DWORD *a2, _DWORD *a3, _DWORD *a4, int a5){&nbsp; char v5;&nbsp;// al&nbsp; char v6;&nbsp;// al&nbsp; char v7;&nbsp;// al&nbsp; char v8;&nbsp;// al&nbsp; int v10;&nbsp;// [esp+4h] [ebp-18h] BYREF&nbsp; char Destination[20];&nbsp;// [esp+8h] [ebp-14h] BYREF&#8203;&nbsp; _strupr(Str);&nbsp;&nbsp;if&nbsp;( strlen(Str) !=&nbsp;19&nbsp;)&nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp;&nbsp;if&nbsp;( Str[4] !=&nbsp;'-'&nbsp;)&nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp;&nbsp;if&nbsp;( Str[9] !=&nbsp;'-'&nbsp;)&nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp;&nbsp;if&nbsp;( Str[14] !=&nbsp;'-'&nbsp;)&nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp;&nbsp;if&nbsp;( *Str !=&nbsp;'S'&nbsp;)&nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp;&nbsp;if&nbsp;( a5 )&nbsp; {&nbsp; &nbsp; v5 = Str[6];&nbsp; &nbsp;&nbsp;if&nbsp;( v5 !=&nbsp;'R'&nbsp;&& v5 !=&nbsp;'G'&nbsp;&& v5 !=&nbsp;'D'&nbsp;&& v5 !=&nbsp;'F'&nbsp;)&nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp; }&nbsp; v6 = Str[1];&nbsp;&nbsp;if&nbsp;( v6 <&nbsp;'0'&nbsp;|| v6 >&nbsp;'9'&nbsp;)&nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp; *a4 = v6 -&nbsp;'0';&nbsp; v7 = Str[2];&nbsp; switch ( v7 )&nbsp; {&nbsp; &nbsp; case&nbsp;'T':&nbsp; &nbsp; &nbsp; *a3 =&nbsp;1;&nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; case&nbsp;'B':&nbsp; &nbsp; &nbsp; *a3 =&nbsp;3;&nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; case&nbsp;'S':&nbsp; &nbsp; &nbsp; *a3 =&nbsp;0;&nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; case&nbsp;'U':&nbsp; &nbsp; &nbsp; *a3 =&nbsp;0;&nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; default:&nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp; }&nbsp; v8 = Str[3];&nbsp;&nbsp;if&nbsp;( v8 ==&nbsp;'G'&nbsp;)&nbsp; {&nbsp; &nbsp; *a2 =&nbsp;1;&nbsp; }&nbsp;&nbsp;else&nbsp; {&nbsp; &nbsp;&nbsp;if&nbsp;( v8 !=&nbsp;'R'&nbsp;)&nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp; &nbsp; *a2 =&nbsp;0;&nbsp; }&nbsp;&nbsp;if&nbsp;( !a5 )&nbsp; &nbsp;&nbsp;return&nbsp;1;&nbsp; strcpy(Destination, Str);&nbsp; Destination[15] =&nbsp;0;&nbsp; sub_51B7A0(Destination,&nbsp;15, &unk_612298, &v10);&nbsp;&nbsp;return&nbsp;*(_DWORD *)(Str +&nbsp;15) == v10;}

格式如下：

  • 长度为19个字符
  • 以S开始，5,10,15出位”-“字符，类似xxxx-xxxx-xxxx-xxxx这样的形式
  • 第7个字符，RGDF中字符一个
  • 第2个字符，> ‘0’，< ‘9’，字符
  • 第3个字符，TBSU字符中一个
  • 第4个字符，GR字符中一个

所以初步格式如下： S(0-9)(T/B/S/U)(G/R)-x(RGDF)xx-xxxx-xxxx接着sub_51B7A0会对lincense进一步进行检查

int&nbsp;__cdecl&nbsp;sub_51B7A0(_BYTE *a1,&nbsp;unsigned&nbsp;int&nbsp;a2,&nbsp;int&nbsp;a3,&nbsp;int&nbsp;a4){&nbsp;&nbsp;unsigned&nbsp;int&nbsp;i;&nbsp;// esi&nbsp;&nbsp;unsigned&nbsp;__int8 v5;&nbsp;// cl&nbsp;&nbsp;unsigned&nbsp;int&nbsp;j;&nbsp;// eax&nbsp;&nbsp;int&nbsp;result;&nbsp;// eax&#8203;&nbsp;&nbsp;for&nbsp;( i =&nbsp;0; i <&nbsp;4; *(_BYTE *)(i + a4 -&nbsp;1) = byte_612178[v5 %&nbsp;26] )&nbsp; {&nbsp; &nbsp; v5 = *(_BYTE *)((unsigned&nbsp;__int8)(i + *a1) + a3);&nbsp; &nbsp;&nbsp;for&nbsp;( j =&nbsp;1; j < a2; ++j )&nbsp; &nbsp; &nbsp; v5 = *(_BYTE *)((v5 ^ (char)a1[j]) + a3);&nbsp; &nbsp; result = a4;&nbsp; &nbsp; ++i;&nbsp; }&nbsp;&nbsp;return&nbsp;result;}

观察如上函数，

  • a1是字符串的前15个字符，a2=15，a3是table表，a4是最后4字节的地址
  • 所以该函数就是利用前15个字符，生成最后4个字符

license 函数生成如下：

#include&nbsp;<stdint.h>&#8203;// 外部数组声明extern&nbsp;unsigned&nbsp;char&nbsp;byte_612178[]; &nbsp;// 实际上应该是 byte_612178，extern&nbsp;unsigned&nbsp;char&nbsp;byte_612298[]; &nbsp;// 根据您的数据&#8203;// 代码中引用的 byte_612178，// 可能是地址偏移或者重命名，这里我们使用 byte_612298#define&nbsp;SBOX_SIZE 26 &nbsp;// 代码中使用 v5 % 26 作为索引&#8203;unsigned&nbsp;char&nbsp;byte_612178[] = {&nbsp;"KV96GMJYH7QF5TCW4U3XZPRSDN"&nbsp;};&#8203;int&nbsp;sub_51B7A0(unsigned&nbsp;char&nbsp;*a1,&nbsp;unsigned&nbsp;int&nbsp;a2,&nbsp;int&nbsp;a3,&nbsp;int&nbsp;a4){&nbsp; &nbsp;&nbsp;unsigned&nbsp;int&nbsp;i;&nbsp; &nbsp;&nbsp;unsigned&nbsp;char&nbsp;v5;&nbsp; &nbsp;&nbsp;unsigned&nbsp;int&nbsp;j;&nbsp; &nbsp;&nbsp;int&nbsp;result;&#8203;&nbsp; &nbsp;&nbsp;// 循环4次，生成4个字节的输出&nbsp; &nbsp;&nbsp;for&nbsp;(i =&nbsp;0; i <&nbsp;4; i++)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 初始值：从 a1[0] 和 i 计算索引，然后从 a3 指向的表中取值&nbsp; &nbsp; &nbsp; &nbsp; v5 = *(unsigned&nbsp;char&nbsp;*)((unsigned&nbsp;char)(i + *a1) + a3);
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 内层循环：对 a1[1] 到 a1[a2-1] 进行异或操作&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;(j =&nbsp;1; j < a2; j++)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v5 = *(unsigned&nbsp;char&nbsp;*)((v5 ^ a1[j]) + a3);&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 将结果通过 S-box (byte_612178) 转换后存储到 a4 指向的缓冲区&nbsp; &nbsp; &nbsp; &nbsp; *(unsigned&nbsp;char&nbsp;*)(i + a4 ) = byte_612178[v5 %&nbsp;26];
&nbsp; &nbsp; &nbsp; &nbsp; result = a4; &nbsp;// 返回原始指针 a4&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;return&nbsp;result;}&#8203;#include&nbsp;<stdio.h>#include&nbsp;<stdint.h>#include&nbsp;<string.h>&#8203;// 根据您提供的数组数据定义// 注意：原始数据从 612298 开始，unsigned&nbsp;char&nbsp;byte_612298[] = {&nbsp; &nbsp;&nbsp;0x23,&nbsp;0xDD,&nbsp;0x78,&nbsp;0xB5,&nbsp;0x33,&nbsp;0x6F,&nbsp;0xD4,&nbsp;0xF9,&nbsp;0xA6,&nbsp;0xE8,&nbsp; &nbsp;&nbsp;0xCC,&nbsp;0x7C,&nbsp;0x9F,&nbsp;0xB3,&nbsp;0x22,&nbsp;0xDA,&nbsp;0x32,&nbsp;0xDF,&nbsp;0x71,&nbsp;0xB7,&nbsp; &nbsp;&nbsp;0x61,&nbsp;0x3D,&nbsp;0x6B,&nbsp;0x57,&nbsp;0xD7,&nbsp;0xA1,&nbsp;0x34,&nbsp;0x38,&nbsp;0xF2,&nbsp;0xE1,&nbsp; &nbsp;&nbsp;0xF3,&nbsp;0xB8,&nbsp;0x1A,&nbsp;0x80,&nbsp;0xF5,&nbsp;0xFE,&nbsp;0x91,&nbsp;0x01,&nbsp;0x3C,&nbsp;0x73,&nbsp; &nbsp;&nbsp;0x93,&nbsp;0x48,&nbsp;0xA0,&nbsp;0xE0,&nbsp;0x94,&nbsp;0xAA,&nbsp;0x39,&nbsp;0x8F,&nbsp;0x58,&nbsp;0xE2,&nbsp; &nbsp;&nbsp;0x31,&nbsp;0x0B,&nbsp;0xBB,&nbsp;0xCE,&nbsp;0x4C,&nbsp;0xD2,&nbsp;0x56,&nbsp;0xC2,&nbsp;0x5E,&nbsp;0x27,&nbsp; &nbsp;&nbsp;0xB6,&nbsp;0xFB,&nbsp;0x65,&nbsp;0xAE,&nbsp;0x55,&nbsp;0x60,&nbsp;0xBD,&nbsp;0x10,&nbsp;0x86,&nbsp;0xF7,&nbsp; &nbsp;&nbsp;0xC1,&nbsp;0x88,&nbsp;0x12,&nbsp;0xED,&nbsp;0x67,&nbsp;0xC4,&nbsp;0x74,&nbsp;0x30,&nbsp;0x1B,&nbsp;0xBC,&nbsp; &nbsp;&nbsp;0x9A,&nbsp;0xB0,&nbsp;0xEF,&nbsp;0x36,&nbsp;0xC5,&nbsp;0x72,&nbsp;0x5B,&nbsp;0x7E,&nbsp;0x54,&nbsp;0x2C,&nbsp; &nbsp;&nbsp;0x0F,&nbsp;0xF6,&nbsp;0xA9,&nbsp;0x85,&nbsp;0x2A,&nbsp;0xB1,&nbsp;0x37,&nbsp;0xF1,&nbsp;0x2F,&nbsp;0x4E,&nbsp; &nbsp;&nbsp;0xE7,&nbsp;0x6A,&nbsp;0x75,&nbsp;0xA8,&nbsp;0x26,&nbsp;0xEB,&nbsp;0x3F,&nbsp;0x6C,&nbsp;0x69,&nbsp;0x20,&nbsp; &nbsp;&nbsp;0x87,&nbsp;0x62,&nbsp;0x8D,&nbsp;0x68,&nbsp;0xA5,&nbsp;0xFA,&nbsp;0x3A,&nbsp;0x04,&nbsp;0x21,&nbsp;0x1F,&nbsp; &nbsp;&nbsp;0xAC,&nbsp;0x05,&nbsp;0xA4,&nbsp;0x76,&nbsp;0x11,&nbsp;0x70,&nbsp;0x9E,&nbsp;0x46,&nbsp;0x24,&nbsp;0x5D,&nbsp; &nbsp;&nbsp;0xC6,&nbsp;0xE4,&nbsp;0x95,&nbsp;0x82,&nbsp;0x1C,&nbsp;0xBA,&nbsp;0x59,&nbsp;0x09,&nbsp;0xD9,&nbsp;0x44,&nbsp; &nbsp;&nbsp;0x98,&nbsp;0x92,&nbsp;0x07,&nbsp;0xAF,&nbsp;0xA7,&nbsp;0x41,&nbsp;0x96,&nbsp;0x90,&nbsp;0xB4,&nbsp;0x42,&nbsp; &nbsp;&nbsp;0x63,&nbsp;0x99,&nbsp;0xD0,&nbsp;0x4D,&nbsp;0x97,&nbsp;0xBE,&nbsp;0x40,&nbsp;0xCF,&nbsp;0x84,&nbsp;0xE5,&nbsp; &nbsp;&nbsp;0x1D,&nbsp;0x5A,&nbsp;0x0C,&nbsp;0x7F,&nbsp;0xC7,&nbsp;0xEA,&nbsp;0xEE,&nbsp;0xEC,&nbsp;0x00,&nbsp;0xD5,&nbsp; &nbsp;&nbsp;0x49,&nbsp;0x2D,&nbsp;0x51,&nbsp;0xAD,&nbsp;0xB9,&nbsp;0x89,&nbsp;0x77,&nbsp;0x52,&nbsp;0x3E,&nbsp;0x8C,&nbsp; &nbsp;&nbsp;0xE6,&nbsp;0xFF,&nbsp;0x15,&nbsp;0xDE,&nbsp;0x6D,&nbsp;0x14,&nbsp;0xA2,&nbsp;0xCD,&nbsp;0xA3,&nbsp;0xD6,&nbsp; &nbsp;&nbsp;0x17,&nbsp;0x81,&nbsp;0xC8,&nbsp;0x45,&nbsp;0x4B,&nbsp;0x35,&nbsp;0x0A,&nbsp;0x0D,&nbsp;0xFC,&nbsp;0x9D,&nbsp; &nbsp;&nbsp;0x16,&nbsp;0x3B,&nbsp;0xD3,&nbsp;0x7D,&nbsp;0xD1,&nbsp;0xF4,&nbsp;0xFD,&nbsp;0xCA,&nbsp;0x25,&nbsp;0x06,&nbsp; &nbsp;&nbsp;0x6E,&nbsp;0xF8,&nbsp;0x5F,&nbsp;0xBF,&nbsp;0x8A,&nbsp;0x7B,&nbsp;0x50,&nbsp;0xD8,&nbsp;0x79,&nbsp;0x9C,&nbsp; &nbsp;&nbsp;0xAB,&nbsp;0x43,&nbsp;0x53,&nbsp;0xCB,&nbsp;0x8E,&nbsp;0x4F,&nbsp;0xE3,&nbsp;0xC9,&nbsp;0x8B,&nbsp;0xDC,&nbsp; &nbsp;&nbsp;0x5C,&nbsp;0xC0,&nbsp;0x1E,&nbsp;0x9B,&nbsp;0x18,&nbsp;0x02,&nbsp;0x47,&nbsp;0x03,&nbsp;0x2B,&nbsp;0x0E,&nbsp; &nbsp;&nbsp;0x66,&nbsp;0x4A,&nbsp;0xB2,&nbsp;0xF0,&nbsp;0xE9,&nbsp;0x19,&nbsp;0x29,&nbsp;0x7A,&nbsp;0xC3,&nbsp;0x08,&nbsp; &nbsp;&nbsp;0x83,&nbsp;0xDB,&nbsp;0x64,&nbsp;0x13,&nbsp;0x2E,&nbsp;0x28};&#8203;// 函数声明int&nbsp;sub_51B7A0(unsigned&nbsp;char&nbsp;*a1,&nbsp;unsigned&nbsp;int&nbsp;a2,&nbsp;int&nbsp;a3,&nbsp;int&nbsp;a4);&#8203;// 测试函数void&nbsp;main(){
&nbsp; &nbsp;&nbsp;unsigned&nbsp;char&nbsp;input[19] = {"S4SR-1R23-4567-xxxx"}; &nbsp;// 示例输入&nbsp; &nbsp;&nbsp;unsigned&nbsp;char&nbsp;output[4]; &nbsp; &nbsp;// 输出缓冲区 a4
&nbsp; &nbsp;&nbsp;// 调用函数&nbsp; &nbsp;&nbsp;sub_51B7A0(input,&nbsp;15, (int)byte_612298, (int)output);
&nbsp; &nbsp;&nbsp;// 打印输出&nbsp; &nbsp;&nbsp;printf("Output: ");&nbsp; &nbsp;&nbsp;for&nbsp;(int&nbsp;i =&nbsp;0; i <&nbsp;4; i++)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; input[15+i]=output[i];&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("%c \t", output[i]);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;printf("\n");&nbsp; &nbsp;&nbsp;printf("%s\r\n",input);}

过掉该license函数检查下面，其实还有对上面license的补充说明，比如

  • 第2字符必须是4，因为这个是SourceInsight4版本，dword_6696F8为04 byte
if&nbsp;(&nbsp;*((_DWORD&nbsp;*)ArgList&nbsp;+&nbsp;0x181)&nbsp;!=&nbsp;HIBYTE(dword_6696F8) )&nbsp; {&nbsp; &nbsp; sub_40B560(&nbsp; &nbsp; &nbsp;&nbsp;"The serial number you entered is for a different version of Source Insight.\n"&nbsp; &nbsp; &nbsp;&nbsp;"\n"&nbsp; &nbsp; &nbsp;&nbsp;"This version requires a version 4.x serial number.",&nbsp; &nbsp; &nbsp; v7,&nbsp; &nbsp; &nbsp; v8,&nbsp; &nbsp; &nbsp;&nbsp;Destination[0],&nbsp; &nbsp; &nbsp;&nbsp;Destination[1],&nbsp; &nbsp; &nbsp;&nbsp;Destination[2],&nbsp; &nbsp; &nbsp; v10,&nbsp; &nbsp; &nbsp; v11,&nbsp; &nbsp; &nbsp; v12,&nbsp; &nbsp; &nbsp; v13);&nbsp; &nbsp; sub_406DF0(a1,&nbsp;30);&nbsp; &nbsp; sub_404830();&nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp; }

接着该版本为release版本，所以该值不能为3，标准版为0

if&nbsp;( *((_DWORD *)ArgList +&nbsp;0x183) ==&nbsp;3&nbsp;)&nbsp; {&nbsp; &nbsp; sub_40B560(&nbsp; &nbsp; &nbsp;&nbsp;"The serial number cannot be used with the 'release' version of Source Insight.",&nbsp; &nbsp; &nbsp; v7,&nbsp; &nbsp; &nbsp; v8,&nbsp; &nbsp; &nbsp; Destination[0],&nbsp; &nbsp; &nbsp; Destination[1],&nbsp; &nbsp; &nbsp; Destination[2],&nbsp; &nbsp; &nbsp; v10,&nbsp; &nbsp; &nbsp; v11,&nbsp; &nbsp; &nbsp; v12,&nbsp; &nbsp; &nbsp; v13);&nbsp; &nbsp; sub_404830();&nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp; }

这里检查license的长度，以及版本情况，如果是U，会走到版本更新检查的逻辑。

BOOL __cdecl&nbsp;sub_51C1A0(char&nbsp;*Str){&nbsp;&nbsp;return&nbsp;strlen(Str) ==&nbsp;19&nbsp;&& Str[2] ==&nbsp;'U';}

所以生成符合上面的字符串就可以过掉检查，到达如下界面联网激活，点击取消，

临时lincense 激活，使用

lincense如下：<!--&nbsp; &nbsp; Source Insight 4.x License File&#8203;&nbsp; &nbsp; DO NOT EDIT THIS FILE. Doing so will render it unusable.&#8203;&nbsp; &nbsp; This license was created for:&#8203;&nbsp; &nbsp; &nbsp; &nbsp; 111111111&#8203;--><SourceInsightLicense>&nbsp; &nbsp;&nbsp;<LicenseProperties&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;ActId="Deferred"&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Serial="S4SR-1R23-4567-CQCF"&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;LicensedUser="111111111"&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Organization=""&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Email=""&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Type="Standard"&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Version="4"&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;MinorVersion="0"&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Date="2026-03-08"&nbsp; &nbsp; />&nbsp; &nbsp;&nbsp;<Signature&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Value="TsJB9VMBkOWbUTxjfnW0Iwr064zOlB29eQ4T0RvbUEMYNuQ+wIjf3don6ImpeFYlIIpv4tIxTJHJHlj6KS9yuJOqxP0WsSLZuU/uEcsDlkhhKBU0FHGCw0ZpBKASrM2BRdz7apy31dOfmXQPX0Tm6Rqvhv+/52UQe0en8vy7g6I="&nbsp; &nbsp; /></SourceInsightLicense>

3、 联网激活分析

可以使用SourceInsight打开工程使用，但是临时重新启动软件就不行了，还得重新激活，所以需要过掉联网激活

联网lincese会进行检查

为什么联网部分以及验签检查不用IDA查看， 因为可能有花指令导致混淆了，IDA反编译失败，所以后面都调试分析

联网检查完成之后，会进行本地的签名校验，联网检查，这里是以试用lincense过掉的。签名校验的流程可以以试用lincense进行跟踪，断点设置在加解密函数上面，然后持续单步跟着走，就可以走到

然后断点可以断下来，说明到了加解密函数地方

找到verify函数，根据加密的一般知识可以得到，这里是验证签名的地方

单步走过之后函数返回值如下：0x1CE

单步之后，这个0x7A9916函数没什么作用，返回值做了保留

出来之后，这里会与0xC8进行比较，说明这里就是关键点，后面的je指令可以直接修改为jmp，则可以跳过签名检查。

后续发现上面过了之后，还有签名检查，但是地方不一样，

之后则校验成功

-官方论坛

www.52pojie.cn

👆👆👆

公众号设置“星标”，您不会错过新的消息通知

如开放注册、精华文章和周边活动等公告

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：吾爱破解论坛 吾爱pojie 吾爱pojie《SourceInsight4.0 最新4.00.0150 2026版本 破解分析》

版权声明

本站仅做备份收录，仅供研究与教学参考之用。
读者将信息用于其他用途的，全部法律及连带责任由读者自行承担，本站不承担任何责任。

ZONE.CI 全球网 | 安全领域涉猎者-乌云独行地带
ZONE.CI 全球网
安全领域涉猎者-乌云独行地带
ZONE.CI 全球网 | 安全领域涉猎者-乌云独行地带
安全领域涉猎者-乌云独行地带
ZONE.CI 全球网
评论：0   参与：  0