NHibernate.Profiler918破解方法

最新推荐文章于 2018-07-08 19:58:15 发布

fjfdszj

最新推荐文章于 2018-07-08 19:58:15 发布

阅读量2.6k

点赞数

文章标签：破解 assembly buffer byte thread string

本文链接：https://blog.youkuaiyun.com/fjfdszj/article/details/6992238

版权

本文详细介绍了如何通过修改代码来移除软件自动更新功能，并成功破解了特定组件，包括移除定时验证机制和修改配置文件以实现非法使用。同时提供了详细的步骤和代码示例。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

 





1.破解后的下载地址:
NHibernate.Profiler918破解版，去除自动更新，定时验证。
http://download.youkuaiyun.com/detail/fjfdszj/3812836
2.破解工具下载地址:
http://download.youkuaiyun.com/detail/fjfdszj/3811188
3.场景描述:
A.NHibernate.Profiler918,会定时每隔5~15分钟定时验证软件合法性
所以在日志中会出现报异常: throw 
new 
InvalidOleVariantTypeException("sn")引起的.
HibernatingRhinos.Profiler.Client.Model.ApplicationModel中如下方法:
 
 private static void MoveWindowEx()
{
    Thread.Sleep(TimeSpan.FromMinutes((double) new Random().Next(5, 15)));
    Assembly assembly = typeof(App).Assembly;
    byte[] buffer = Convert.FromBase64String("ACQAAASAAACUAAAABgIAAAAkAABSU0ExAAQAAAEAAQDBLTP+od21ZEnX3WXgZVRX1adQQHusYawlMrB4Mnz5vH3GcynLb4CvG7zwjJiYsit/xgN28VmeeQJ5PSdcXH1aB54Qnm4TMa+HcRFxcnGLQQfzwKa/rQIufkQ+Du1hERNZRdERss/wpbnyF2mcNsmGDa09Y+x0264LLK/sK4SIog==");
    byte[] publicKey = assembly.GetName().GetPublicKey();
    for (int i = 0; i < publicKey.Length; i++)
    {
        if (publicKey[i] != buffer[i])
        {
            throw new InvalidOleVariantTypeException("pk");
        }
    }
    bool pfWasVerified = false;
    if (!Program.StrongNameSignatureVerificationEx(assembly.Location, true, ref pfWasVerified))
    {
        throw new InvalidOleVariantTypeException("sn");
    }
}

 

 



 
B.无法关闭软件自动更新的原因,
HibernatingRhinos.Profiler.Client.Model.UserSettings
public bool AutoUpdate
{
    get
    {
        Assembly assembly = typeof(App).Assembly;
        byte[] buffer = Convert.FromBase64String("ACQAAASAAACUAAAABgIAAAAkAABSU0ExAAQAAAEAAQDBLTP+od21ZEnX3WXgZVRX1adQQHusYawlMrB4Mnz5vH3GcynLb4CvG7zwjJiYsit/xgN28VmeeQJ5PSdcXH1aB54Qnm4TMa+HcRFxcnGLQQfzwKa/rQIufkQ+Du1hERNZRdERss/wpbnyF2mcNsmGDa09Y+x0264LLK/sK4SIog==");
        byte[] publicKey = assembly.GetName().GetPublicKey();
        for (int i = 0; i < publicKey.Length; i++)
        {
            if (publicKey[i] != buffer[i])
            {
                return true;
            }
        }
        bool pfWasVerified = false;
        return (!Program.StrongNameSignatureVerificationEx(assembly.Location, true, ref pfWasVerified) || this._autoUpdate);
    }
    set
    {
        this._autoUpdate = value;
        this.RaisePropertyChanged("AutoUpdate");
    }
}



4.解决方案:
A.去除掉用HibernatingRhinos.Profiler.Client.Model.ApplicationModel该类中的MoveWindowEx()
是以下方法启动这该线程
private void OnApplicationAttached(IProfiledApplicationIdentity attachedApplication)
{
    <>c__DisplayClass17 class2;
    new Thread(new ThreadStart(ApplicationModel.MoveWindowEx)) { IsBackground = true }.Start();
    AttachedApplication item = Enumerable.FirstOrDefault<AttachedApplication>(this.AttachedApplications, new Func<AttachedApplication, bool>(class2, (IntPtr) this.<OnApplicationAttached>b__16));
    if (item == null)
    {
        item = new AttachedApplication(this, attachedApplication.Name);
        this.AttachedApplications.Add(item);
    }
    item.RegisterNewInstance(attachedApplication.Id);
}


启动修改插件reflexil直接对该段代码进行修改成如下就行,只要去掉new Thread(new ThreadStart(ApplicationModel.MoveWindowEx)) { IsBackground = true }.Start();.
	Offset	OpCode	Operand
	0	newobj	System.Void HibernatingRhinos.Profiler.Client.Model.ApplicationModel/<>c__DisplayClass17::.ctor()
	5	stloc.2	
	6	ldloc.2	
	7	ldarg.1	
	8	stfld	HibernatingRhinos.Profiler.BackEnd.Bridge.IProfiledApplicationIdentity HibernatingRhinos.Profiler.Client.Model.ApplicationModel/<>c__DisplayClass17::attachedApplication
	13	nop	
	14	ldarg.0	
	15	call	System.Collections.ObjectModel.ObservableCollection`1<HibernatingRhinos.Profiler.Client.Model.AttachedApplications.AttachedApplication> HibernatingRhinos.Profiler.Client.Model.ApplicationModel::get_AttachedApplications()
	20	ldloc.2	
	21	ldftn	System.Boolean HibernatingRhinos.Profiler.Client.Model.ApplicationModel/<>c__DisplayClass17::<OnApplicationAttached>b__16(HibernatingRhinos.Profiler.Client.Model.AttachedApplications.AttachedApplication)
	27	newobj	System.Void System.Func`2<HibernatingRhinos.Profiler.Client.Model.AttachedApplications.AttachedApplication,System.Boolean>::.ctor(System.Object,System.IntPtr)
	32	call	!!0 System.Linq.Enumerable::FirstOrDefault<HibernatingRhinos.Profiler.Client.Model.AttachedApplications.AttachedApplication>(System.Collections.Generic.IEnumerable`1<!!0>,System.Func`2<!!0,System.Boolean>)
	37	stloc.0	
	38	ldloc.0	
	39	ldnull	
	40	ceq	
	42	ldc.i4.0	
	43	ceq	
	45	stloc.3	
	46	ldloc.3	
	47	brtrue.s	-> (34) ldloc.0 
	49	nop	
	50	ldarg.0	
	51	ldloc.2	
	52	ldfld	HibernatingRhinos.Profiler.BackEnd.Bridge.IProfiledApplicationIdentity HibernatingRhinos.Profiler.Client.Model.ApplicationModel/<>c__DisplayClass17::attachedApplication
	57	callvirt	System.String HibernatingRhinos.Profiler.BackEnd.Bridge.IProfiledApplicationIdentity::get_Name()
	62	newobj	System.Void HibernatingRhinos.Profiler.Client.Model.AttachedApplications.AttachedApplication::.ctor(HibernatingRhinos.Profiler.Client.Model.ApplicationModel,System.String)
	67	stloc.0	
	68	ldarg.0	
	69	call	System.Collections.ObjectModel.ObservableCollection`1<HibernatingRhinos.Profiler.Client.Model.AttachedApplications.AttachedApplication> HibernatingRhinos.Profiler.Client.Model.ApplicationModel::get_AttachedApplications()
	74	ldloc.0	
	75	callvirt	System.Void System.Collections.ObjectModel.Collection`1<HibernatingRhinos.Profiler.Client.Model.AttachedApplications.AttachedApplication>::Add(!0)
	80	nop	
	81	nop	
	82	ldloc.0	
	83	ldloc.2	
	84	ldfld	HibernatingRhinos.Profiler.BackEnd.Bridge.IProfiledApplicationIdentity HibernatingRhinos.Profiler.Client.Model.ApplicationModel/<>c__DisplayClass17::attachedApplication
	89	callvirt	System.Guid HibernatingRhinos.Profiler.BackEnd.Bridge.IProfiledApplicationIdentity::get_Id()
	94	callvirt	System.Void HibernatingRhinos.Profiler.Client.Model.AttachedApplications.AttachedApplication::RegisterNewInstance(System.Guid)
	99	nop	
	100	nop	
	101	ret	


B.只要AutoUpdate的Get属性恒为false就可以了.
 
	Offset	OpCode	Operand
	0	nop	
	1	ldc.i4.0	
	2	stloc.0	
	3	br.s	-> (4) ldloc.0 
	5	ldloc.0	
	6	ret