Crackeme出处:http://bbs.pediy.com/showthread.php?t=101610
分析过程:
OD载入,bp MessageBoxA (用户名长度小于5才能断下)或者bp GetDlgItemTextA,输入假码,点确定成功断下:
00401777 |> \C74424 0C F40>MOV DWORD PTR SS:[ESP+C],1F4 ; |
0040177F |. 8D85 C8FDFFFF LEA EAX,DWORD PTR SS:[EBP-238] ; |
00401785 |. 894424 08 MOV DWORD PTR SS:[ESP+8],EAX ; |
00401789 |. C74424 04 ED0>MOV DWORD PTR SS:[ESP+4],3ED ; |
00401791 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] ; |
00401794 |. 890424 MOV DWORD PTR SS:[ESP],EAX ; |
00401797 |. E8 84080000 CALL <JMP.&USER32.GetDlgItemTextA> ; \取用户名
0040179C |. 83EC 10 SUB ESP,10
0040179F |. 8D85 C8FDFFFF LEA EAX,DWORD PTR SS:[EBP-238]
004017A5 |. 890424 MOV DWORD PTR SS:[ESP],EAX
004017A8 |. E8 27FBFFFF CALL 004012D4 ; 取用户名长度
004017AD |. 8985 C4FDFFFF MOV DWORD PTR SS:[EBP-23C],EAX ; |
004017B3 |. 83BD C4FDFFFF>CMP DWORD PTR SS:[EBP-23C],4 ; |
004017BA |. 7F 27 JG SHORT 004017E3 ; |用户名长度大于4
004017BC |. C74424 0C 000>MOV DWORD PTR SS:[ESP+C],0 ; |
004017C4 |. C74424 08 444>MOV DWORD PTR SS:[ESP+8],00404044 ; |ASCII "呵呵"
004017CC |. C74424 04 494>MOV DWORD PTR SS:[ESP+4],00404049 ; |
004017D4 |. C70424 000000>MOV DWORD PTR SS:[ESP],0 ; |
004017DB |. E8 50080000 CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
004017E0 |. 83EC 10 SUB ESP,10
004017E3 |> C785 C0FDFFFF>MOV DWORD PTR SS:[EBP-240],0
004017ED |> 8B85 C0FDFFFF /MOV EAX,DWORD PTR SS:[EBP-240] ; EAX=0
004017F3 |. 3B85 C4FDFFFF |CMP EAX,DWORD PTR SS:[EBP-23C] ; EAX与用户名长度比较
004017F9 |. 7D 2E |JGE SHORT 00401829 ; 大于等于则跳走
004017FB |. 8D45 F8 |LEA EAX,DWORD PTR SS:[EBP-8]
004017FE |. 0385 C0FDFFFF |ADD EAX,DWORD PTR SS:[EBP-240]
00401804 |. 8D90 D0FDFFFF |LEA EDX,DWORD PTR DS:[EAX-230]
0040180A |. 8D45 F8 |LEA EAX,DWORD PTR SS:[EBP-8]
0040180D |. 0385 C0FDFFFF |ADD EAX,DWORD PTR SS:[EBP-240]
00401813 |. 2D 30020000 |SUB EAX,230
00401818 |. 0FB600 |MOVZX EAX,BYTE PTR DS:[EAX] ; 用户名各位依次送EAX
0040181B |. 04 05 |ADD AL,5 ; ASCII码+5
0040181D |. 8802 |MOV BYTE PTR DS:[EDX],AL ; 结果保存
0040181F |. 8D85 C0FDFFFF |LEA EAX,DWORD PTR SS:[EBP-240]
00401825 |. FF00 |INC DWORD PTR DS:[EAX]
00401827 |.^ EB C4 \JMP SHORT 004017ED ; 此循环运算完后得到真码
00401829 C74424 0C F40>MOV DWORD PTR SS:[ESP+C],1F4 ; |
00401831 |. 8D85 D8FEFFFF LEA EAX,DWORD PTR SS:[EBP-128] ; |
00401837 |. 894424 08 MOV DWORD PTR SS:[ESP+8],EAX ; |
0040183B |. C74424 04 EE0>MOV DWORD PTR SS:[ESP+4],3EE ; |
00401843 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] ; |
00401846 |. 890424 MOV DWORD PTR SS:[ESP],EAX ; |
00401849 |. E8 D2070000 CALL <JMP.&USER32.GetDlgItemTextA> ; \取假码
0040184E |. 83EC 10 SUB ESP,10
00401851 |. 8D85 C8FDFFFF LEA EAX,DWORD PTR SS:[EBP-238]
00401857 |. 894424 04 MOV DWORD PTR SS:[ESP+4],EAX
0040185B |. 8D85 D8FEFFFF LEA EAX,DWORD PTR SS:[EBP-128]
00401861 |. 890424 MOV DWORD PTR SS:[ESP],EAX
00401864 |. E8 27FAFFFF CALL 00401290 ; 真假码比较
00401869 |. 8985 BCFDFFFF MOV DWORD PTR SS:[EBP-244],EAX ; |
0040186F |. 83BD BCFDFFFF>CMP DWORD PTR SS:[EBP-244],0 ; |
00401876 |. 75 65 JNZ SHORT 004018DD ; |跳走完蛋
00401878 |. C74424 0C 000>MOV DWORD PTR SS:[ESP+C],0 ; |
00401880 |. C74424 08 554>MOV DWORD PTR SS:[ESP+8],00404055 ; |ASCII "uuu"
00401888 |. C74424 04 594>MOV DWORD PTR SS:[ESP+4],00404059 ; |ASCII "sucess!"
00401890 |. C70424 000000>MOV DWORD PTR SS:[ESP],0 ; |
00401897 |. E8 94070000 CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
搞清楚过程,写注册机也就不难了,我就不贴了……
已经有(0)位网友发表了评论,你也评一评吧!
原创文章如转载,请注明:转载自Eddy Blog
原文地址:http://www.rrgod.com/technique/123.html 欢迎订阅Eddy Blog。