首页 > 代码库 > [反汇编练习] 160个CrackMe之014

[反汇编练习] 160个CrackMe之014

[反汇编练习] 160个CrackMe之014.

本系列文章的目的是从一个没有任何经验的新手的角度(其实就是我自己),一步步尝试将160个CrackMe全部破解,如果可以,通过任何方式写出一个类似于注册机的东西。

其中,文章中按照如下逻辑编排(解决如下问题):

1、使用什么环境和工具

2、程序分析

3、思路分析和破解流程

4、注册机的探索

----------------------------------

提醒各位看客: 如果文章中的逻辑看不明白,那你一定是没有亲手操刀!OD中的跳转提示很强大,只要你跟踪了,不用怎么看代码就理解了!

----------------------------------

1、工具和环境:

WinXP SP3 + 52Pojie六周年纪念版OD + PEID + 汇编金手指。

160个CrackMe的打包文件。

下载地址: http://pan.baidu.com/s/1xUWOY 密码: jbnq

注:

1、Win7系统对于模块和程序开启了随机初始地址的功能,会给分析带来很大的负担,所以不建议使用Win7进行分析。

2、以上工具都是在52PoJie论坛下的原版程序,NOD32不报毒,个人承诺绝对不会进行任何和木马病毒相关内容。

wps_clip_image-880

2、程序分析:

想要破解一个程序,必须先了解这个程序。所以,在破解过程中,对最初程序的分析很重要,他可以帮助我们理解作者的目的和意图,特别是对于注册码的处理细节,从而方便我们反向跟踪和推导。

和上一节一样,打开CHM,选择第14个bjanes.exe,保存下来。运行程序,程序界面如下:

image

和之前的很多程序一样,有错误对话框。

使用PEID查看:VB 5.0 – 6.0

 

3、思路分析和破解流程

由于没壳,还有信息框,所以我们直接使用OD暂停,查看堆栈就可以跟踪到了。具体步骤:

1、打开OD,将exe拖入OD中,F9运行。

2、在Exe中输入伪码123456,点击Check it,信息框提示try again!

3、回到OD,点击暂停按钮(Ctrl+F2),然后点击K图标(Ctrl+K),可以看到此时的堆栈信息

2

选中最后一个rtcMsgBox,右键->Show Call,返回到了反汇编窗口。

4、从Call xxxrtcMsgBox的位置开始,在附近浏览代码,发现很明显有提示正确和失败的文本。

00403A1D   .^ E9 5AFDFFFF      jmp 0040377C00403A22   >  33DB             xor ebx,ebx00403A24   >  8B35 A4104000    mov esi,dword ptr ds:[<&MSVBVM60.__vbaVa>;  msvbvm60.__vbaVarDup00403A2A   .  B9 04000280      mov ecx,0x8002000400403A2F   .  894D 98          mov dword ptr ss:[ebp-0x68],ecx00403A32   .  B8 0A000000      mov eax,0xA00403A37   .  894D A8          mov dword ptr ss:[ebp-0x58],ecx00403A3A   .  BF 08000000      mov edi,0x800403A3F   .  8D95 50FFFFFF    lea edx,dword ptr ss:[ebp-0xB0]00403A45   .  8D4D B0          lea ecx,dword ptr ss:[ebp-0x50]00403A48   .  8945 90          mov dword ptr ss:[ebp-0x70],eax00403A4B   .  8945 A0          mov dword ptr ss:[ebp-0x60],eax00403A4E   .  C785 58FFFFFF F0>mov dword ptr ss:[ebp-0xA8],004022F0     ;  UNICODE "Wrong serial!"00403A58   .  89BD 50FFFFFF    mov dword ptr ss:[ebp-0xB0],edi00403A5E   .  FFD6             call esi                                 ;  <&MSVBVM60.__vbaVarDup>00403A60   .  8D95 60FFFFFF    lea edx,dword ptr ss:[ebp-0xA0]00403A66   .  8D4D C0          lea ecx,dword ptr ss:[ebp-0x40]00403A69   .  C785 68FFFFFF C8>mov dword ptr ss:[ebp-0x98],004022C8     ;  UNICODE "Sorry, try again!"00403A73   .  89BD 60FFFFFF    mov dword ptr ss:[ebp-0xA0],edi00403A79   .  FFD6             call esi00403A7B   .  8D45 90          lea eax,dword ptr ss:[ebp-0x70]00403A7E   .  8D4D A0          lea ecx,dword ptr ss:[ebp-0x60]00403A81   .  50               push eax00403A82   .  8D55 B0          lea edx,dword ptr ss:[ebp-0x50]00403A85   .  51               push ecx00403A86   .  52               push edx00403A87   .  8D45 C0          lea eax,dword ptr ss:[ebp-0x40]00403A8A   .  53               push ebx00403A8B   .  50               push eax00403A8C   .  FF15 30104000    call dword ptr ds:[<&MSVBVM60.#595>]     ;  msvbvm60.rtcMsgBox00403A92   .  8D4D 90          lea ecx,dword ptr ss:[ebp-0x70]00403A95   .  8D55 A0          lea edx,dword ptr ss:[ebp-0x60]00403A98   .  51               push ecx00403A99   .  8D45 B0          lea eax,dword ptr ss:[ebp-0x50]00403A9C   .  52               push edx00403A9D   .  8D4D C0          lea ecx,dword ptr ss:[ebp-0x40]00403AA0   .  50               push eax00403AA1   .  51               push ecx00403AA2   .  EB 7E            jmp short 00403B2200403AA4   >  8B35 A4104000    mov esi,dword ptr ds:[<&MSVBVM60.__vbaVa>;  msvbvm60.__vbaVarDup00403AAA   .  B9 04000280      mov ecx,0x8002000400403AAF   .  894D 98          mov dword ptr ss:[ebp-0x68],ecx00403AB2   .  B8 0A000000      mov eax,0xA00403AB7   .  894D A8          mov dword ptr ss:[ebp-0x58],ecx00403ABA   .  BF 08000000      mov edi,0x800403ABF   .  8D95 50FFFFFF    lea edx,dword ptr ss:[ebp-0xB0]00403AC5   .  8D4D B0          lea ecx,dword ptr ss:[ebp-0x50]00403AC8   .  8945 90          mov dword ptr ss:[ebp-0x70],eax00403ACB   .  8945 A0          mov dword ptr ss:[ebp-0x60],eax00403ACE   .  C785 58FFFFFF A4>mov dword ptr ss:[ebp-0xA8],004022A4     ;  UNICODE "Correct serial!"00403AD8   .  89BD 50FFFFFF    mov dword ptr ss:[ebp-0xB0],edi00403ADE   .  FFD6             call esi                                 ;  <&MSVBVM60.__vbaVarDup>00403AE0   .  8D95 60FFFFFF    lea edx,dword ptr ss:[ebp-0xA0]00403AE6   .  8D4D C0          lea ecx,dword ptr ss:[ebp-0x40]00403AE9   .  C785 68FFFFFF 58>mov dword ptr ss:[ebp-0x98],00402258     ;  UNICODE "Good job, tell me how you do that!"00403AF3   .  89BD 60FFFFFF    mov dword ptr ss:[ebp-0xA0],edi00403AF9   .  FFD6             call esi00403AFB   .  8D55 90          lea edx,dword ptr ss:[ebp-0x70]00403AFE   .  8D45 A0          lea eax,dword ptr ss:[ebp-0x60]00403B01   .  52               push edx00403B02   .  8D4D B0          lea ecx,dword ptr ss:[ebp-0x50]00403B05   .  50               push eax00403B06   .  51               push ecx00403B07   .  8D55 C0          lea edx,dword ptr ss:[ebp-0x40]00403B0A   .  53               push ebx00403B0B   .  52               push edx00403B0C   .  FF15 30104000    call dword ptr ds:[<&MSVBVM60.#595>]     ;  msvbvm60.rtcMsgBox

5、从这段代码开始,继续向上寻找,发现je/jg/jmp等跳转时选中这一行,查看跳转的位置,分析一下大概流程:

00403787      0F8F 17030000    jg 00403AA4                              ;  // 这个直接跳到正确,关键跳转0040378D   .  8B17             mov edx,dword ptr ds:[edi]0040378F   .  57               push edi00403790   .  FF92 08030000    call dword ptr ds:[edx+0x308]00403796   .  50               push eax00403797   .  8D45 D4          lea eax,dword ptr ss:[ebp-0x2C]0040379A   .  50               push eax0040379B   .  FF15 2C104000    call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet004037A1   .  8BD8             mov ebx,eax004037A3   .  8D55 E4          lea edx,dword ptr ss:[ebp-0x1C]004037A6   .  52               push edx004037A7   .  53               push ebx004037A8   .  8B0B             mov ecx,dword ptr ds:[ebx]004037AA   .  FF91 A0000000    call dword ptr ds:[ecx+0xA0]004037B0   .  85C0             test eax,eax004037B2   .  DBE2             fclex004037B4   .  7D 12            jge short 004037C8                       ;  // 不是004037B6   .  68 A0000000      push 0xA0004037BB   .  68 44224000      push 00402244004037C0   .  53               push ebx004037C1   .  50               push eax004037C2   .  FF15 24104000    call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj004037C8   >  8B07             mov eax,dword ptr ds:[edi]004037CA   .  57               push edi004037CB   .  FF90 08030000    call dword ptr ds:[eax+0x308]004037D1   .  8D4D D0          lea ecx,dword ptr ss:[ebp-0x30]004037D4   .  50               push eax004037D5   .  51               push ecx004037D6   .  FF15 2C104000    call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet004037DC   .  8BF8             mov edi,eax004037DE   .  8D45 DC          lea eax,dword ptr ss:[ebp-0x24]004037E1   .  50               push eax004037E2   .  57               push edi004037E3   .  8B17             mov edx,dword ptr ds:[edi]004037E5   .  FF92 A0000000    call dword ptr ds:[edx+0xA0]004037EB   .  85C0             test eax,eax004037ED   .  DBE2             fclex004037EF   .  7D 12            jge short 00403803                       ;  // 不是004037F1   .  68 A0000000      push 0xA0004037F6   .  68 44224000      push 00402244004037FB   .  57               push edi004037FC   .  50               push eax004037FD   .  FF15 24104000    call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj00403803   >  0FBF7D E8        movsx edi,word ptr ss:[ebp-0x18]00403807   .  8B55 DC          mov edx,dword ptr ss:[ebp-0x24]0040380A   .  B9 01000000      mov ecx,0x10040380F   .  894D C8          mov dword ptr ss:[ebp-0x38],ecx00403812   .  894D B8          mov dword ptr ss:[ebp-0x48],ecx00403815   .  8D4D B0          lea ecx,dword ptr ss:[ebp-0x50]00403818   .  B8 02000000      mov eax,0x20040381D   .  51               push ecx0040381E   .  57               push edi0040381F   .  52               push edx00403820   .  8945 C0          mov dword ptr ss:[ebp-0x40],eax00403823   .  8945 B0          mov dword ptr ss:[ebp-0x50],eax00403826   .  FF15 44104000    call dword ptr ds:[<&MSVBVM60.#631>]     ;  msvbvm60.rtcMidCharBstr0040382C   .  8BD0             mov edx,eax0040382E   .  8D4D D8          lea ecx,dword ptr ss:[ebp-0x28]00403831   .  FFD6             call esi00403833   .  50               push eax00403834   .  FF15 1C104000    call dword ptr ds:[<&MSVBVM60.#516>]     ;  msvbvm60.rtcAnsiValueBstr0040383A   .  8B4D E4          mov ecx,dword ptr ss:[ebp-0x1C]0040383D   .  33DB             xor ebx,ebx0040383F   .  66:3D 3900       cmp ax,0x3900403843   .  8D45 C0          lea eax,dword ptr ss:[ebp-0x40]00403846   .  50               push eax00403847   .  57               push edi00403848   .  0F9FC3           setg bl0040384B   .  51               push ecx0040384C   .  F7DB             neg ebx0040384E   .  FF15 44104000    call dword ptr ds:[<&MSVBVM60.#631>]     ;  msvbvm60.rtcMidCharBstr00403854   .  8BD0             mov edx,eax00403856   .  8D4D E0          lea ecx,dword ptr ss:[ebp-0x20]00403859   .  FFD6             call esi0040385B   .  50               push eax0040385C   .  FF15 1C104000    call dword ptr ds:[<&MSVBVM60.#516>]     ;  msvbvm60.rtcAnsiValueBstr00403862   .  33D2             xor edx,edx00403864   .  66:3D 3000       cmp ax,0x3000403868   .  0F9CC2           setl dl0040386B   .  F7DA             neg edx0040386D   .  8D45 D8          lea eax,dword ptr ss:[ebp-0x28]00403870   .  23DA             and ebx,edx00403872   .  8D4D DC          lea ecx,dword ptr ss:[ebp-0x24]00403875   .  50               push eax00403876   .  8D55 E0          lea edx,dword ptr ss:[ebp-0x20]00403879   .  51               push ecx0040387A   .  8D45 E4          lea eax,dword ptr ss:[ebp-0x1C]0040387D   .  52               push edx0040387E   .  50               push eax0040387F   .  6A 04            push 0x400403881   .  FF15 90104000    call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStrList00403887   .  8D4D D0          lea ecx,dword ptr ss:[ebp-0x30]0040388A   .  8D55 D4          lea edx,dword ptr ss:[ebp-0x2C]0040388D   .  51               push ecx0040388E   .  52               push edx0040388F   .  6A 02            push 0x200403891   .  FF15 18104000    call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObjList00403897   .  8D45 B0          lea eax,dword ptr ss:[ebp-0x50]0040389A   .  8D4D C0          lea ecx,dword ptr ss:[ebp-0x40]0040389D   .  50               push eax0040389E   .  51               push ecx0040389F   .  6A 02            push 0x2004038A1   .  FF15 0C104000    call dword ptr ds:[<&MSVBVM60.__vbaFreeV>;  msvbvm60.__vbaFreeVarList004038A7   .  83C4 2C          add esp,0x2C004038AA   .  66:85DB          test bx,bx004038AD   .  0F85 6F010000    jnz 00403A22                             ;  // 不是004038B3   .  8B45 08          mov eax,dword ptr ss:[ebp+0x8]004038B6   .  50               push eax004038B7   .  8B10             mov edx,dword ptr ds:[eax]004038B9   .  FF92 08030000    call dword ptr ds:[edx+0x308]004038BF   .  50               push eax004038C0   .  8D45 D4          lea eax,dword ptr ss:[ebp-0x2C]004038C3   .  50               push eax004038C4   .  FF15 2C104000    call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet004038CA   .  8BD8             mov ebx,eax004038CC   .  8D55 E4          lea edx,dword ptr ss:[ebp-0x1C]004038CF   .  52               push edx004038D0   .  53               push ebx004038D1   .  8B0B             mov ecx,dword ptr ds:[ebx]004038D3   .  FF91 A0000000    call dword ptr ds:[ecx+0xA0]004038D9   .  85C0             test eax,eax004038DB   .  DBE2             fclex004038DD   .  7D 12            jge short 004038F1                       ;  // 选中5,不是004038DF   .  68 A0000000      push 0xA0004038E4   .  68 44224000      push 00402244004038E9   .  53               push ebx004038EA   .  50               push eax004038EB   .  FF15 24104000    call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj004038F1   >  66:8B45 E8       mov ax,word ptr ss:[ebp-0x18]004038F5   .  8B1D 74104000    mov ebx,dword ptr ds:[<&MSVBVM60.#536>]  ;  msvbvm60.rtcStrFromVar004038FB   .  66:35 0200       xor ax,0x2004038FF   .  8D4D A0          lea ecx,dword ptr ss:[ebp-0x60]00403902   .  0F80 A4020000    jo 00403BAC                              ;  // 选中4,不是00403908   .  51               push ecx00403909   .  66:8945 A8       mov word ptr ss:[ebp-0x58],ax0040390D   .  C745 A0 02000000 mov dword ptr ss:[ebp-0x60],0x200403914   .  FFD3             call ebx                                 ;  <&MSVBVM60.#536>00403916   .  8BD0             mov edx,eax00403918   .  8D4D D8          lea ecx,dword ptr ss:[ebp-0x28]0040391B   .  FFD6             call esi0040391D   .  8B45 E4          mov eax,dword ptr ss:[ebp-0x1C]00403920   .  8D55 C0          lea edx,dword ptr ss:[ebp-0x40]00403923   .  52               push edx00403924   .  57               push edi00403925   .  50               push eax00403926   .  C745 C8 01000000 mov dword ptr ss:[ebp-0x38],0x10040392D   .  C745 C0 02000000 mov dword ptr ss:[ebp-0x40],0x200403934   .  FF15 44104000    call dword ptr ds:[<&MSVBVM60.#631>]     ;  msvbvm60.rtcMidCharBstr0040393A   .  8BD0             mov edx,eax0040393C   .  8D4D E0          lea ecx,dword ptr ss:[ebp-0x20]0040393F   .  FFD6             call esi00403941   .  50               push eax00403942   .  FF15 1C104000    call dword ptr ds:[<&MSVBVM60.#516>]     ;  msvbvm60.rtcAnsiValueBstr00403948   .  8D4D B0          lea ecx,dword ptr ss:[ebp-0x50]0040394B   .  66:8945 B8       mov word ptr ss:[ebp-0x48],ax0040394F   .  51               push ecx00403950   .  C745 B0 02000000 mov dword ptr ss:[ebp-0x50],0x200403957   .  FFD3             call ebx00403959   .  8BD0             mov edx,eax0040395B   .  8D4D DC          lea ecx,dword ptr ss:[ebp-0x24]0040395E   .  FFD6             call esi00403960   .  50               push eax00403961   .  FF15 84104000    call dword ptr ds:[<&MSVBVM60.__vbaR8Str>;  msvbvm60.__vbaR8Str00403967   .  DC25 D8104000    fsub qword ptr ds:[0x4010D8]0040396D   .  8D55 90          lea edx,dword ptr ss:[ebp-0x70]00403970   .  6A 01            push 0x100403972   .  52               push edx00403973   .  C785 30FFFFFF 05>mov dword ptr ss:[ebp-0xD0],0x80050040397D   .  DD9D 38FFFFFF    fstp qword ptr ss:[ebp-0xC8]00403983   .  DFE0             fstsw ax00403985   .  A8 0D            test al,0xD00403987   .  0F85 1A020000    jnz 00403BA7                             ;  // 选中3,查看,也不是0040398D   .  8B45 D8          mov eax,dword ptr ss:[ebp-0x28]00403990   .  C745 D8 00000000 mov dword ptr ss:[ebp-0x28],0x000403997   .  8945 98          mov dword ptr ss:[ebp-0x68],eax0040399A   .  8D45 80          lea eax,dword ptr ss:[ebp-0x80]0040399D   .  50               push eax0040399E   .  C745 90 08000000 mov dword ptr ss:[ebp-0x70],0x8004039A5   .  FF15 B0104000    call dword ptr ds:[<&MSVBVM60.#619>]     ;  msvbvm60.rtcRightCharVar004039AB   .  8D8D 30FFFFFF    lea ecx,dword ptr ss:[ebp-0xD0]004039B1   .  8D55 80          lea edx,dword ptr ss:[ebp-0x80]004039B4   .  51               push ecx004039B5   .  52               push edx004039B6   .  FF15 A0104000    call dword ptr ds:[<&MSVBVM60.__vbaVarTs>;  msvbvm60.__vbaVarTstNe004039BC   .  8BF8             mov edi,eax004039BE   .  8D45 D8          lea eax,dword ptr ss:[ebp-0x28]004039C1   .  8D4D DC          lea ecx,dword ptr ss:[ebp-0x24]004039C4   .  50               push eax004039C5   .  8D55 E0          lea edx,dword ptr ss:[ebp-0x20]004039C8   .  51               push ecx004039C9   .  8D45 E4          lea eax,dword ptr ss:[ebp-0x1C]004039CC   .  52               push edx004039CD   .  50               push eax004039CE   .  6A 04            push 0x4004039D0   .  FF15 90104000    call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStrList004039D6   .  83C4 14          add esp,0x14004039D9   .  8D4D D4          lea ecx,dword ptr ss:[ebp-0x2C]004039DC   .  FF15 C4104000    call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj004039E2   .  8D4D 80          lea ecx,dword ptr ss:[ebp-0x80]004039E5   .  8D55 90          lea edx,dword ptr ss:[ebp-0x70]004039E8   .  51               push ecx004039E9   .  8D45 A0          lea eax,dword ptr ss:[ebp-0x60]004039EC   .  52               push edx004039ED   .  8D4D B0          lea ecx,dword ptr ss:[ebp-0x50]004039F0   .  50               push eax004039F1   .  8D55 C0          lea edx,dword ptr ss:[ebp-0x40]004039F4   .  51               push ecx004039F5   .  52               push edx004039F6   .  6A 05            push 0x5004039F8   .  FF15 0C104000    call dword ptr ds:[<&MSVBVM60.__vbaFreeV>;  msvbvm60.__vbaFreeVarList004039FE   .  83C4 18          add esp,0x1800403A01   .  66:85FF          test di,di00403A04   .  75 1C            jnz short 00403A22                       ;  // 选中2,不是00403A06   .  8B7D 08          mov edi,dword ptr ss:[ebp+0x8]00403A09   .  B8 01000000      mov eax,0x100403A0E   .  66:0345 E8       add ax,word ptr ss:[ebp-0x18]00403A12   .  0F80 94010000    jo 00403BAC                              ;  // 选中1,查看跳转,不是00403A18   .  8945 E8          mov dword ptr ss:[ebp-0x18],eax00403A1B   .  33DB             xor ebx,ebx00403A1D   .^ E9 5AFDFFFF      jmp 0040377C

到这段代码最上的位置时,发现回调到正确文本的位置,所以我么可以很肯定,这个跳转时关键跳转,改为jmp强制跳转就可以了。我们试试,选中这一行->空格键->将jg 00403AA4改为jmp 00403AA4,记得左下角的Nop填充打钩。然后回到程序,再次点击check it,发现仍然提示失败!

5、继续向上看:

004036D3   .  FF15 24104000    call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj004036D9   >  8B45 E4          mov eax,dword ptr ss:[ebp-0x1C]004036DC   .  50               push eax                                 ;  // eax="123123"004036DD   .  FF15 08104000    call dword ptr ds:[<&MSVBVM60.__vbaLenBs>;  msvbvm60.__vbaLenBstr004036E3   .  33C9             xor ecx,ecx004036E5   .  83F8 09          cmp eax,0x9                              ;  // 比较字符串长度与0x9,否则直接失败004036E8   .  0F95C1           setne cl                                 ;  // cl=1004036EB   .  F7D9             neg ecx                                  ;  // 取补,-1004036ED   .  8BF1             mov esi,ecx004036EF   .  8D4D E4          lea ecx,dword ptr ss:[ebp-0x1C]004036F2   .  FF15 C0104000    call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStr004036F8   .  8D4D D4          lea ecx,dword ptr ss:[ebp-0x2C]004036FB   .  FF15 C4104000    call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj00403701   .  66:3BF3          cmp si,bx00403704      0F85 1A030000    jnz 00403A24                             ;  // 这个会直接跳到失败0040370A   .  8B17             mov edx,dword ptr ds:[edi]0040370C   .  57               push edi0040370D   .  FF92 08030000    call dword ptr ds:[edx+0x308]

到这里发现它使用cmp比较和jnz进行字符串长度判断,如果不等于9则直接跳转到失败!所以,文本的长度必须为9。我们重新输入伪码123123123,点击check it,哈哈哈!成功了!

image

当然,你也可以将jnz跳转也修改了!这样字符串长度也不用必须是9了。

 

4、注册机的探索

注册码判断的内容在关键跳转的上面,我们大概分析一下:

0040373F   .  FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj00403745   >  8B45 E4       mov eax,dword ptr ss:[ebp-0x1C]00403748   .  50            push eax                                 ;  // "123123123"00403749   .  FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBs>;  msvbvm60.__vbaLenBstr0040374F   .  8BC8          mov ecx,eax                              ;  // eax = 900403751   .  FF15 50104000 call dword ptr ds:[<&MSVBVM60.__vbaI2I4>>;  msvbvm60.__vbaI2I400403757   .  8D4D E4       lea ecx,dword ptr ss:[ebp-0x1C]          ;  // ecx = "123123123"0040375A   .  8985 14FFFFFF mov dword ptr ss:[ebp-0xEC],eax          ;  // eax = 900403760   .  C745 E8 01000>mov dword ptr ss:[ebp-0x18],0x100403767   .  FF15 C0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStr0040376D   .  8D4D D4       lea ecx,dword ptr ss:[ebp-0x2C]00403770   .  FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj00403776   .  8B35 AC104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaSt>;  msvbvm60.__vbaStrMove0040377C   >  66:8B8D 14FFF>mov cx,word ptr ss:[ebp-0xEC]            ;  // cx =eax00403783   .  66:394D E8    cmp word ptr ss:[ebp-0x18],cx            ;  // cx与0x1比较00403787      0F8F 17030000 jg 00403AA4                              ;  // 这个直接跳到正确,关键跳转

这块算法只进行了一个比较,将文本长度和0x1比较,大于则成功!但是,由于在这之前又进行了文本长度校验,长度必须为9,所以按照正常逻辑,这是永远不可能提示正确的!

SO,这个程序没有注册码,只能爆破!

 

BY  笨笨D幸福