Crack Xap Windows Phone Apps

download Crack Xap Windows Phone Apps

of 15

  • date post

    27-Oct-2015
  • Category

    Documents

  • view

    728
  • download

    2

Embed Size (px)

description

tutorial how to modify windows phone apps

Transcript of Crack Xap Windows Phone Apps

cum sa spargi wp apps

How to: crack windows mobile apps.Cerinta> unlocked wp phone .. nu vb despre asta aici.Aplicatiile pt windows phone vin in formatul XAP si se pot instala prinMarketplace direct pe telefon sau prin descarcare Download and install manually si instalare apoi cu Tom xap installer sau xap deployerFormatul .xap este de fapt o arhiva zip, ce se poate deschide cu winrar/zipDe mentionat ca mai nou fisierele de pe www.windowsphone.com vin acum criptate. Pt a obtine varianta decriptata se instaleaza aplicatia dorita in telefonsi cu program manager de aici http://forum.xda-developers.com/attachment.php?attachmentid=1489928&d=1353191485din el se alege a treia optiune de jos, cu XAP

Optiunea va crea fisierul XAP decriptat. Acesta se gaseste pe telefon aiciApplications/data/12345678-87BF-4D87-A529-0DFF41EFD592/isolatedstore/data/xap/De aici cu file explorer eu l-am dus in \My Documents, l-am redenumit in .docsi cu aplicatia Office i-am dat Share pe skydrive, de aici putand fi descarcat pe pc si redenumit direct in .zipAm ales ca tinta programul Turbo camera, care face poze in lant si apoi din ele gif.Ce ne intereseaza din arhiva zip: clar, turbocamera.dllIl deschidem cu ida pro 5.5, ( http:// http://thepiratebay.sx/torrent/5235650/IDA_Pro_Advanced_v5.5.0.925t_and_Hex-Rays_v1.1.0.090909www.4shared.com/zip/vFtlV0qe/IDApro55dapro55.html )alegem New, de duem la categoria .NET si alegem.NET Dynamic Library, ok, alegem fisierul nostru.Aici daca ne uitam un pic in IDA View-A sau cautam dupa Text: Trial modeGasim asa

Avem instructiunea ble.s care ne trimite la mesajul cu TrialNoi nu dorim sa ajungem acolo, asa ca gasim e inseamna ble.s, aicihttp://en.wikipedia.org/wiki/List_of_CIL_instructions0x31ble.s Branch to target if less than or equal to, short foInstructiunea opusa, ca sa nu ajungem la trial este:0x30bgt.s Branch to target if greater than, short form.A alternativa putem pune NOP x00nopDo nothing pt a fi 100% ca nu se va sari de instructiunea ble.s sau bgt.s.Dam click pe ble.s, trecem in Hex view-a avem asa

Cautam cu un hex editor hex string 31 12 72 58 03 00 70 *pt siguranta ;)Inlocuim 31 12 cu 00 00 nop. Am scapat de un mesaj, daca suntem sarguinciosi mai ne uitam in program simai gasim la offset 25e4 asta

Aici se poate ajunge din 3 instructiuni1. Bne.un.s (instructiunea opusa e: 0x34bge.un.s )2,3. Brfalse => trebuie schimbate in brtrue 0x39 devine 0x3AAlternativa e sa punem nop peste toate aceste 3 instructiuniMai gasim la offset @278c un bne.un.s care ne duce la trial, facem nop si peste el.La @2b4f gasim asa

Brfalse trebuie trecut in brtrueUltima si e gata @FFA0

Brtrue in brfalse. Ca o mica paranteza aici se mai poate face o fenta daca nu gasim salturi conditionale avem ldc.i4.3 asta zice ca putem face gif din 3 cadreCorespunzator instructiunii gasim in hex 19 . in locul ei daca ne uitam in tabela de instructiuni putem pune in locul ei maxim: 0x1Eldc.i4.8 = Push 8 onto the stack as int32. Deci 19 devine 1E si atunci pot face un gif in maxim 8 cadre..altceva!!!Acestea fiind spuse restul e simplu: se fac inlocuirile in .dll, se pune .dll in arhiva zip, se redenumeste .zip in .xap, se pune xap pe net, skydrive, se pune in telefon. Spor*

Hai ca e loc si de una mai simplaNight_Stand_Clock_v2.3.0.0.xap (8.2 MB)http://www.multiupload.nl/3EBSYR9AHIse urmeaza procedura de obtinere a fisierului xap decriptat * se poate lua dll direct din \applications\install\19c26c3-etc etc\NightStandClock.dll. gasim in el asa:

2 functii care returneaza 2 stringuriSystem.String get_FlurryFullApiKey() si System.String get_FlurryTrialApiKey()Ideea e ca trialapikey sa returneze aceeasi cheie ca fullapikeyDaca dam click pe ldstr "4TNNDWG2RP8K3VQJZXHX" in hexa ii corespunde72 B9 0B 00 70 iar lui ldstr "ZG5KXFCWST72M2VJXB83" - 72 E3 0B 00 70, hex ce va fi inlocuit de 72 B9 0B 00 70, ca sa returneze cheia de la full.

Save, enjoy.Neajiji did this.sugestii, reclamatii nuimipasa@mail.com Pacpac!Main article: Common Intermediate LanguageThis is a list of the instructions in the instruction set of the Common Intermediate Language bytecode.OpcodeInstructionDescriptionType of instruction0x58addAdd two values, returning a new value.0xD6add.ovfAdd signed integer values with overflow check. 0xD7add.ovf.unAdd unsigned integer values with overflow check. 0x5FandBitwise AND of two integral values, returns an integral value. 0xFE 0x00arglistReturn argument list handle for the current method. 0x3Bbeq Branch to target if equal. 0x2Ebeq.s Branch to target if equal, short form. 0x3Cbge Branch to target if greater than or equal to. 0x2Fbge.s Branch to target if greater than or equal to, short form. 0x41bge.un Branch to target if greater than or equal to (unsigned or unordered). 0x34bge.un.s Branch to target if greater than or equal to (unsigned or unordered), short form 0x3Dbgt Branch to target if greater than. 0x30bgt.s Branch to target if greater than, short form. 0x42bgt.un Branch to target if greater than (unsigned or unordered). 0x35bgt.un.s Branch to target if greater than (unsigned or unordered), short form. 0x3Eble Branch to target if less than or equal to. 0x31ble.s Branch to target if less than or equal to, short form. 0x43ble.un Branch to target if less than or equal to (unsigned or unordered). 0x36ble.un.s Branch to target if less than or equal to (unsigned or unordered), short form 0x3Fblt Branch to target if less than. 0x32blt.s Branch to target if less than, short form. 0x44blt.un Branch to target if less than (unsigned or unordered). 0x37blt.un.s Branch to target if less than (unsigned or unordered), short form. 0x40bne.un Branch to target if unequal or unordered. 0x33bne.un.s Branch to target if unequal or unordered, short form. 0x8Cbox Convert a boxable value to its boxed form 0x38br Branch to target. 0x2Bbr.s Branch to target, short form. 0x01breakInform a debugger that a breakpoint has been reached. 0x39brfalse Branch to target if value is zero (false). 0x2Cbrfalse.s Branch to target if value is zero (false), short form. 0x3Abrinst Branch to target if value is a non-null object reference (alias for brtrue). 0x2Dbrinst.s Branch to target if value is a non-null object reference, short form (alias for brtrue.s). 0x39brnull Branch to target if value is null (alias for brfalse). 0x2Cbrnull.s Branch to target if value is null (alias for brfalse.s), short form. 0x3Abrtrue Branch to target if value is non-zero (true). 0x2Dbrtrue.s Branch to target if value is non-zero (true), short form. 0x39brzero Branch to target if value is zero (alias for brfalse). 0x2Cbrzero.s Branch to target if value is zero (alias for brfalse.s), short form. 0x28call Call method described by method. 0x29calli Call method indicated on the stack with arguments described by callsitedescr. 0x6Fcallvirt Call a method associated with an object. 0x74castclass Cast obj to class. 0xFE 0x01ceqPush 1 (of type int32) if value1 equals value2, else push 0. 0xFE 0x02cgtPush 1 (of type int32) if value1 > value2, else push 0. 0xFE 0x03cgt.unPush 1 (of type int32) if value1 > value2, unsigned or unordered, else push 0. 0xC3ckfiniteThrow ArithmeticException if value is not a finite number. 0xFE 0x04cltPush 1 (of type int32) if value1 < value2, else push 0. 0xFE 0x05clt.unPush 1 (of type int32) if value1 < value2, unsigned or unordered, else push 0. 0xFE 0x16constrained. Call a virtual method on a type constrained to be type TPrefix to instruction0xD3conv.iConvert to native int, pushing native int on stack. 0x67conv.i1Convert to int8, pushing int32 on stack. 0x68conv.i2Convert to int16, pushing int32 on stack. 0x69conv.i4Convert to int32, pushing int32 on stack. 0x6Aconv.i8Convert to int64, pushing int64 on stack. 0xD4conv.ovf.iConvert to a native int (on the stack as native int) and throw an exception on overflow. 0x8Aconv.ovf.i.unConvert unsigned to a native int (on the stack as native int) and throw an exception on overflow. 0xB3conv.ovf.i1Convert to an int8 (on the stack as int32) and throw an exception on overflow. 0x82conv.ovf.i1.unConvert unsigned to an int8 (on the stack as int32) and throw an exception on overflow. 0xB5conv.ovf.i2Convert to an int16 (on the stack as int32) and throw an exception on overflow. 0x83conv.ovf.i2.unConvert unsigned to an int16 (on the stack as int32) and throw an exception on overflow. 0xB7conv.ovf.i4Convert to an int32 (on the stack as int32) and throw an exception on overflow. 0x84conv.ovf.i4.unConvert unsigned to an int32 (on the stack as int32) and throw an exception on overflow. 0xB9conv.ovf.i8Convert to an int64 (on the stack as int64) and throw an exception on overflow. 0x85conv.ovf.i8.unConvert unsigned to an int64 (on the stack as int64) and throw an exception on overflow.0xD5conv.ovf.uConvert to a native unsigned int (on the stack as native int) and throw an exception on overflow. 0x8Bconv.ovf.u.unConvert unsigned to a native unsigned int (on the stack as native int) and throw an exception on overflow. 0xB4conv.ovf.u1Convert to an unsigned int8 (on the stack as int32) and throw an exception on overflow. 0x86conv.ovf.u1.unConvert unsigned to an unsigned int8 (on the stack as int32) and throw an exception on overflow. 0xB6conv.ovf.u2Convert to an unsigned int16 (on the stack as int32) and throw an exception on overflow. 0x87conv.ovf.u2.unConvert unsigned to an unsigned int16 (on the stack as int32) and throw an exception on overflow. 0xB8conv.ovf.u4Convert to an unsigned int32 (on the stack as int32) and throw an exception on overflow. 0x88conv.ovf.u4.unConvert unsigned to an unsigned int32 (on the stack as int32) and throw an exception on overflow. 0xBAconv.ovf.u8Convert to an unsigned int64 (on the stack as int64) and throw an exception on overflow. 0x89conv.ovf.u8.unConvert unsigned to an unsigned int64 (on the stack as int64) and throw an exception on overflow. 0x76conv.r.unConv