首页 > 代码库 > [反汇编练习] 160个CrackMe之031
[反汇编练习] 160个CrackMe之031
[反汇编练习] 160个CrackMe之031.
本系列文章的目的是从一个没有任何经验的新手的角度(其实就是我自己)，一步步尝试将160个CrackMe全部破解，如果可以，通过任何方式写出一个类似于注册机的东西。
其中，文章中按照如下逻辑编排（解决如下问题）：
1、使用什么环境和工具
2、程序分析
3、思路分析和破解流程
4、注册机的探索
----------------------------------
提醒各位看客: 如果文章中的逻辑看不明白,那你一定是没有亲手操刀!OD中的跳转提示很强大,只要你跟踪了,不用怎么看代码就理解了!
----------------------------------
1、工具和环境：
WinXP SP3 + 52Pojie六周年纪念版OD + PEID + 汇编金手指。
160个CrackMe的打包文件。
下载地址： http://pan.baidu.com/s/1xUWOY 密码: jbnq
注：
1、Win7系统对于模块和程序开启了随机初始地址的功能，会给分析带来很大的负担，所以不建议使用Win7进行分析。
2、以上工具都是在52PoJie论坛下的原版程序，NOD32不报毒，个人承诺绝对不会进行任何和木马病毒相关内容。
2、程序分析：
想要破解一个程序，必须先了解这个程序。所以，在破解过程中，对最初程序的分析很重要，他可以帮助我们理解作者的目的和意图，特别是对于注册码的处理细节，从而方便我们反向跟踪和推导。
和上一节一样，打开CHM，选择第31个cracking4all.2.exe，保存下来。运行程序，程序界面如下：
点击上面的OK按钮,弹出了信息框，很好。
注意的是，点击确定按钮后，程序直接退出了。
PEID：Microsoft Visual Basic 5.0 / 6.0
哎，又是一个郁闷的征程！
3、思路分析和破解流程
1、打开OD，将exe拖到OD窗口中，等程序暂停后，直接点击运行按钮(F9)，不用理会。
2、随意输入伪码：21312321。点击OK按钮，弹出信息框，不要关闭，回到OD。
3、Ctrl+K查看堆栈信息：
选中rtcMsgBox，右键->Binary->Fill with NOPs。
4、向上浏览代码：
00402EBA > \8D45 B4 lea eax,dword ptr ss:[ebp-0x4C]00402EBD . 8D8D 28FFFFFF lea ecx,dword ptr ss:[ebp-0xD8]00402EC3 . 50 push eax00402EC4 . 51 push ecx00402EC5 . C785 30FFFFFF>mov dword ptr ss:[ebp-0xD0],0040259C ; UNICODE "VeiajeEjbavwij"00402ECF . C785 28FFFFFF>mov dword ptr ss:[ebp-0xD8],0x800800402ED9 . FF15 A4614000 call dword ptr ds:[<&MSVBVM50.__vbaVarTs>; msvbvm50.__vbaVarTstNe00402EDF . 66:85C0 test ax,ax00402EE2 . /0F84 A1000000 je 00402F89 ; // 关键跳转00402EE8 . |8B35 A8614000 mov esi,dword ptr ds:[<&MSVBVM50.__vbaVa>; msvbvm50.__vbaVarDup00402EEE . |B8 04000280 mov eax,0x8002000400402EF3 . |BB 0A000000 mov ebx,0xA00402EF8 . |BF 08000000 mov edi,0x800402EFD . |8D95 18FFFFFF lea edx,dword ptr ss:[ebp-0xE8]00402F03 . |8D4D 88 lea ecx,dword ptr ss:[ebp-0x78]00402F06 . |8985 70FFFFFF mov dword ptr ss:[ebp-0x90],eax00402F0C . |899D 68FFFFFF mov dword ptr ss:[ebp-0x98],ebx00402F12 . |8945 80 mov dword ptr ss:[ebp-0x80],eax00402F15 . |899D 78FFFFFF mov dword ptr ss:[ebp-0x88],ebx00402F1B . |C785 20FFFFFF>mov dword ptr ss:[ebp-0xE0],00402618 ; UNICODE "Invalid"00402F25 . |89BD 18FFFFFF mov dword ptr ss:[ebp-0xE8],edi00402F2B . |FFD6 call esi ; <&MSVBVM50.__vbaVarDup>00402F2D . |8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]00402F33 . |8D4D 98 lea ecx,dword ptr ss:[ebp-0x68]00402F36 . |C785 30FFFFFF>mov dword ptr ss:[ebp-0xD0],004025C0 ; UNICODE "Password incorrect, please try again ..."00402F40 . |89BD 28FFFFFF mov dword ptr ss:[ebp-0xD8],edi00402F46 . |FFD6 call esi00402F48 . |8D95 68FFFFFF lea edx,dword ptr ss:[ebp-0x98]00402F4E . |8D85 78FFFFFF lea eax,dword ptr ss:[ebp-0x88]00402F54 . |52 push edx00402F55 . |8D4D 88 lea ecx,dword ptr ss:[ebp-0x78]00402F58 . |50 push eax00402F59 . |51 push ecx00402F5A . |8D55 98 lea edx,dword ptr ss:[ebp-0x68]00402F5D . |6A 00 push 0x000402F5F . |52 push edx00402F60 . |FF15 2C614000 call dword ptr ds:[<&MSVBVM50.#595>] ; msvbvm50.rtcMsgBox00402F66 . |8D85 68FFFFFF lea eax,dword ptr ss:[ebp-0x98]00402F6C . |8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]00402F72 . |50 push eax00402F73 . |8D55 88 lea edx,dword ptr ss:[ebp-0x78]00402F76 . |51 push ecx00402F77 . |8D45 98 lea eax,dword ptr ss:[ebp-0x68]00402F7A . |52 push edx00402F7B . |50 push eax00402F7C . |6A 04 push 0x400402F7E . |FF15 08614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeV>; msvbvm50.__vbaFreeVarList00402F84 . |83C4 14 add esp,0x1400402F87 . |EB 10 jmp short 00402F9900402F89 > \8B35 A8614000 mov esi,dword ptr ds:[<&MSVBVM50.__vbaVa>; msvbvm50.__vbaVarDup00402F8F . BB 0A000000 mov ebx,0xA00402F94 . BF 08000000 mov edi,0x800402F99 > 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C]00402F9C . 8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]00402FA2 . 51 push ecx ; /Arg200402FA3 . 52 push edx ; |Arg100402FA4 . C785 30FFFFFF>mov dword ptr ss:[ebp-0xD0],0040259C ; |UNICODE "VeiajeEjbavwij"00402FAE . C785 28FFFFFF>mov dword ptr ss:[ebp-0xD8],0x8008 ; |00402FB8 . FF15 4C614000 call dword ptr ds:[<&MSVBVM50.__vbaVarTs>; \__vbaVarTstEq00402FBE . 66:85C0 test ax,ax00402FC1 . 0F84 8F000000 je 0040305600402FC7 . B8 04000280 mov eax,0x8002000400402FCC . 8D95 18FFFFFF lea edx,dword ptr ss:[ebp-0xE8]00402FD2 . 8D4D 88 lea ecx,dword ptr ss:[ebp-0x78]00402FD5 . 8985 70FFFFFF mov dword ptr ss:[ebp-0x90],eax00402FDB . 899D 68FFFFFF mov dword ptr ss:[ebp-0x98],ebx00402FE1 . 8945 80 mov dword ptr ss:[ebp-0x80],eax00402FE4 . 899D 78FFFFFF mov dword ptr ss:[ebp-0x88],ebx00402FEA . C785 20FFFFFF>mov dword ptr ss:[ebp-0xE0],00402668 ; UNICODE "Valid"00402FF4 . 89BD 18FFFFFF mov dword ptr ss:[ebp-0xE8],edi00402FFA . FFD6 call esi00402FFC . 8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]00403002 . 8D4D 98 lea ecx,dword ptr ss:[ebp-0x68]00403005 . C785 30FFFFFF>mov dword ptr ss:[ebp-0xD0],0040262C ; UNICODE "Password correct, hehe, :-)"0040300F . 89BD 28FFFFFF mov dword ptr ss:[ebp-0xD8],edi00403015 . FFD6 call esi00403017 . 8D85 68FFFFFF lea eax,dword ptr ss:[ebp-0x98]0040301D . 8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]00403023 . 50 push eax00403024 . 8D55 88 lea edx,dword ptr ss:[ebp-0x78]00403027 . 51 push ecx00403028 . 52 push edx00403029 . 8D45 98 lea eax,dword ptr ss:[ebp-0x68]0040302C . 6A 00 push 0x00040302E . 50 push eax0040302F . FF15 2C614000 call dword ptr ds:[<&MSVBVM50.#595>] ; msvbvm50.rtcMsgBox
这里使用msvbvm50.__vbaVarTstNe 进行文本比较，下面的00402EE2 地址处 je 00402F89就是关键跳转。
爆破，修改 je 00402F89 为jmp 00402F89,但是发现地址00402F89又进行了一次判断，所以还需要把这个判断屏蔽掉，修改je 00403056，使用NOPs填充！
OK！
4、注册机的探索
直接向上到段头，开始分析：
00402BF8 . FF15 1C614000 call dword ptr ds:[<&MSVBVM50.__vbaHresultCheckObj>; msvbvm50.__vbaHresultCheckObj00402BFE > 8B45 B0 mov eax,dword ptr ss:[ebp-0x50]00402C01 . 8D55 98 lea edx,dword ptr ss:[ebp-0x68]00402C04 . 8D4D D8 lea ecx,dword ptr ss:[ebp-0x28]00402C07 . 8975 B0 mov dword ptr ss:[ebp-0x50],esi00402C0A . 8945 A0 mov dword ptr ss:[ebp-0x60],eax00402C0D . C745 98 08000>mov dword ptr ss:[ebp-0x68],0x800402C14 . FF15 00614000 call dword ptr ds:[<&MSVBVM50.__vbaVarMove>] ; msvbvm50.__vbaVarMove00402C1A . 8D4D A8 lea ecx,dword ptr ss:[ebp-0x58]00402C1D . FF15 C0614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeObj>] ; msvbvm50.__vbaFreeObj00402C23 . 8D4D D8 lea ecx,dword ptr ss:[ebp-0x28]00402C26 . 8D55 98 lea edx,dword ptr ss:[ebp-0x68]00402C29 . 51 push ecx ; /Arg200402C2A . 52 push edx ; |Arg100402C2B . FF15 20614000 call dword ptr ds:[<&MSVBVM50.__vbaLenVar>] ; \__vbaLenVar00402C31 . 50 push eax ; // eax = 900402C32 . FF15 7C614000 call dword ptr ds:[<&MSVBVM50.__vbaI2Var>] ; msvbvm50.__vbaI2Var00402C38 . 8B35 14614000 mov esi,dword ptr ds:[<&MSVBVM50.#516>] ; msvbvm50.rtcAnsiValueBstr00402C3E . 8B3D 74614000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaStrVarVal>] ; msvbvm50.__vbaStrVarVal00402C44 . 8985 E8FEFFFF mov dword ptr ss:[ebp-0x118],eax00402C4A . B8 01000000 mov eax,0x1 ; // eax = 100402C4F . 8945 C4 mov dword ptr ss:[ebp-0x3C],eax00402C52 > 66:3B85 E8FEF>cmp ax,word ptr ss:[ebp-0x118] ; // 循环开始头，ax++00402C59 . 8B1D 40614000 mov ebx,dword ptr ds:[<&MSVBVM50.#632>] ; msvbvm50.rtcMidCharVar00402C5F . 0F8F EF000000 jg 00402D5400402C65 . 0FBFD0 movsx edx,ax00402C68 . 8D4D 98 lea ecx,dword ptr ss:[ebp-0x68]00402C6B . 8D45 D8 lea eax,dword ptr ss:[ebp-0x28]00402C6E . 51 push ecx ; // ecx = 9 100402C6F . 52 push edx ; // edx = ax = 1,2,...00402C70 . 8D4D 88 lea ecx,dword ptr ss:[ebp-0x78]00402C73 . 50 push eax ; // eax ="123123123"00402C74 . 51 push ecx00402C75 . C745 A0 01000>mov dword ptr ss:[ebp-0x60],0x100402C7C . C745 98 02000>mov dword ptr ss:[ebp-0x68],0x200402C83 . FFD3 call ebx ; msvbvm50.rtcMidCharVar; <&MSVBVM50.#632>00402C85 . 8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]00402C8B . 6A 01 push 0x1 ; /Arg3 = 0000000100402C8D . 8D85 68FFFFFF lea eax,dword ptr ss:[ebp-0x98] ; |00402C93 . 52 push edx ; |Arg2=400402C94 . 50 push eax ; |Arg100402C95 . C745 80 04000>mov dword ptr ss:[ebp-0x80],0x4 ; |00402C9C . C785 78FFFFFF>mov dword ptr ss:[ebp-0x88],0x2 ; |00402CA6 . FF15 AC614000 call dword ptr ds:[<&MSVBVM50.#617>] ; \rtcLeftCharVar00402CAC . 8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-0x98] ; // eax = "4"00402CB2 . 8D55 AC lea edx,dword ptr ss:[ebp-0x54]00402CB5 . 51 push ecx00402CB6 . 52 push edx00402CB7 . FFD7 call edi ; msvbvm50.__vbaStrVarVal00402CB9 . 50 push eax ; // eax = "4"00402CBA . FFD6 call esi ; msvbvm50.rtcAnsiValueBstr00402CBC . 0FBFD8 movsx ebx,ax00402CBF . 8D45 88 lea eax,dword ptr ss:[ebp-0x78]00402CC2 . 8D4D B0 lea ecx,dword ptr ss:[ebp-0x50]00402CC5 . 50 push eax ; "1"00402CC6 . 51 push ecx00402CC7 . FFD7 call edi ; msvbvm50.__vbaStrVarVal00402CC9 . 50 push eax00402CCA . FFD6 call esi ; msvbvm50.rtcAnsiValueBstr00402CCC . 0FBFD0 movsx edx,ax00402CCF . 33DA xor ebx,edx ; // 将两个数异或00402CD1 . 8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]00402CD7 . 53 push ebx ; /Arg200402CD8 . 50 push eax ; |Arg100402CD9 . FF15 6C614000 call dword ptr ds:[<&MSVBVM50.#608>] ; \rtcVarBstrFromAnsi00402CDF . 8D4D C8 lea ecx,dword ptr ss:[ebp-0x38]00402CE2 . 8D95 58FFFFFF lea edx,dword ptr ss:[ebp-0xA8]00402CE8 . 51 push ecx ; /Arg3 = [] = 400402CE9 . 8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8] ; |00402CEF . 52 push edx ; |Arg200402CF0 . 50 push eax ; |Arg100402CF1 . FF15 78614000 call dword ptr ds:[<&MSVBVM50.__vbaVarCat>] ; \__vbaVarCat00402CF7 . 8BD0 mov edx,eax00402CF9 . 8D4D C8 lea ecx,dword ptr ss:[ebp-0x38]00402CFC . FF15 00614000 call dword ptr ds:[<&MSVBVM50.__vbaVarMove>] ; msvbvm50.__vbaVarMove00402D02 . 8D4D AC lea ecx,dword ptr ss:[ebp-0x54]00402D05 . 8D55 B0 lea edx,dword ptr ss:[ebp-0x50]00402D08 . 51 push ecx00402D09 . 52 push edx00402D0A . 6A 02 push 0x200402D0C . FF15 94614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeStrList>] ; msvbvm50.__vbaFreeStrList00402D12 . 83C4 0C add esp,0xC00402D15 . 8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]00402D1B . 8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-0x98]00402D21 . 8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]00402D27 . 50 push eax00402D28 . 51 push ecx00402D29 . 8D45 88 lea eax,dword ptr ss:[ebp-0x78]00402D2C . 52 push edx00402D2D . 8D4D 98 lea ecx,dword ptr ss:[ebp-0x68]00402D30 . 50 push eax00402D31 . 51 push ecx00402D32 . 6A 05 push 0x500402D34 . FF15 08614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeVarList>] ; msvbvm50.__vbaFreeVarList00402D3A . B8 01000000 mov eax,0x100402D3F . 83C4 18 add esp,0x1800402D42 . 66:0345 C4 add ax,word ptr ss:[ebp-0x3C]00402D46 . 0F80 A0030000 jo 004030EC00402D4C . 8945 C4 mov dword ptr ss:[ebp-0x3C],eax00402D4F .^ E9 FEFEFFFF jmp 00402C5200402D54 > 8D55 C8 lea edx,dword ptr ss:[ebp-0x38] ; // 0016E47400402D57 . 8D45 98 lea eax,dword ptr ss:[ebp-0x68]00402D5A . 52 push edx ; /Arg200402D5B . 50 push eax ; |Arg100402D5C . C745 E8 01000>mov dword ptr ss:[ebp-0x18],0x1 ; |00402D63 . FF15 20614000 call dword ptr ds:[<&MSVBVM50.__vbaLenVar>] ; \__vbaLenVar00402D69 . 50 push eax00402D6A . FF15 7C614000 call dword ptr ds:[<&MSVBVM50.__vbaI2Var>] ; msvbvm50.__vbaI2Var00402D70 . B9 01000000 mov ecx,0x100402D75 . 8985 E0FEFFFF mov dword ptr ss:[ebp-0x120],eax00402D7B . 8BC1 mov eax,ecx00402D7D . 8945 C4 mov dword ptr ss:[ebp-0x3C],eax00402D80 > 66:3B85 E0FEF>cmp ax,word ptr ss:[ebp-0x120]00402D87 . 0F8F 2D010000 jg 00402EBA00402D8D . 66:837D E8 04 cmp word ptr ss:[ebp-0x18],0x400402D92 . 7E 03 jle short 00402D9700402D94 . 894D E8 mov dword ptr ss:[ebp-0x18],ecx00402D97 > 894D A0 mov dword ptr ss:[ebp-0x60],ecx00402D9A . 8D4D 98 lea ecx,dword ptr ss:[ebp-0x68]00402D9D . 0FBFD0 movsx edx,ax00402DA0 . 51 push ecx00402DA1 . 8D45 C8 lea eax,dword ptr ss:[ebp-0x38]00402DA4 . 52 push edx ; // edx = 100402DA5 . 8D4D 88 lea ecx,dword ptr ss:[ebp-0x78]00402DA8 . 50 push eax ; // eax = 上一个的返回值00402DA9 . 51 push ecx00402DAA . C745 98 02000>mov dword ptr ss:[ebp-0x68],0x200402DB1 . FFD3 call ebx ; msvbvm50.rtcMidCharVar00402DB3 . B8 02000000 mov eax,0x200402DB8 . 8D95 68FFFFFF lea edx,dword ptr ss:[ebp-0x98]00402DBE . 8985 68FFFFFF mov dword ptr ss:[ebp-0x98],eax00402DC4 . 8985 78FFFFFF mov dword ptr ss:[ebp-0x88],eax00402DCA . 0FBF45 E8 movsx eax,word ptr ss:[ebp-0x18]00402DCE . 52 push edx ; "4"00402DCF . 8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]00402DD5 . 50 push eax ; 100402DD6 . 8D95 58FFFFFF lea edx,dword ptr ss:[ebp-0xA8]00402DDC . 51 push ecx ; 400402DDD . 52 push edx00402DDE . C785 70FFFFFF>mov dword ptr ss:[ebp-0x90],0x100402DE8 . C745 80 D0070>mov dword ptr ss:[ebp-0x80],0x7D000402DEF . FFD3 call ebx ; msvbvm50.rtcMidCharVar00402DF1 . 8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]00402DF7 . 8D4D AC lea ecx,dword ptr ss:[ebp-0x54]00402DFA . 50 push eax00402DFB . 51 push ecx00402DFC . FFD7 call edi ; msvbvm50.__vbaStrVarVal00402DFE . 50 push eax ; "2"00402DFF . FFD6 call esi00402E01 . 0FBFD8 movsx ebx,ax00402E04 . 8D55 88 lea edx,dword ptr ss:[ebp-0x78]00402E07 . 8D45 B0 lea eax,dword ptr ss:[ebp-0x50]00402E0A . 52 push edx00402E0B . 50 push eax00402E0C . FFD7 call edi00402E0E . 50 push eax00402E0F . FFD6 call esi ; msvbvm50.rtcAnsiValueBstr00402E11 . 0FBFC8 movsx ecx,ax ; // ecx = ax=500402E14 . 33D9 xor ebx,ecx ; // 异或00402E16 . 8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]00402E1C . 53 push ebx ; /Arg200402E1D . 52 push edx ; |Arg100402E1E . FF15 6C614000 call dword ptr ds:[<&MSVBVM50.#608>] ; \rtcVarBstrFromAnsi00402E24 . 8D45 B4 lea eax,dword ptr ss:[ebp-0x4C]00402E27 . 8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-0xB8]00402E2D . 50 push eax ; /Arg300402E2E . 8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8] ; |00402E34 . 51 push ecx ; |Arg200402E35 . 52 push edx ; |Arg100402E36 . FF15 78614000 call dword ptr ds:[<&MSVBVM50.__vbaVarCat>] ; \__vbaVarCat00402E3C . 8BD0 mov edx,eax00402E3E . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C]00402E41 . FF15 00614000 call dword ptr ds:[<&MSVBVM50.__vbaVarMove>] ; msvbvm50.__vbaVarMove00402E47 . 8D45 AC lea eax,dword ptr ss:[ebp-0x54]00402E4A . 8D4D B0 lea ecx,dword ptr ss:[ebp-0x50]00402E4D . 50 push eax00402E4E . 51 push ecx00402E4F . 6A 02 push 0x200402E51 . FF15 94614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeStrList>] ; msvbvm50.__vbaFreeStrList00402E57 . 83C4 0C add esp,0xC00402E5A . 8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]00402E60 . 8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]00402E66 . 8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-0x98]00402E6C . 52 push edx00402E6D . 50 push eax00402E6E . 8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]00402E74 . 51 push ecx00402E75 . 8D45 88 lea eax,dword ptr ss:[ebp-0x78]00402E78 . 52 push edx00402E79 . 8D4D 98 lea ecx,dword ptr ss:[ebp-0x68]00402E7C . 50 push eax00402E7D . 51 push ecx00402E7E . 6A 06 push 0x600402E80 . FF15 08614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeVarList>] ; msvbvm50.__vbaFreeVarList00402E86 . 66:8B55 E8 mov dx,word ptr ss:[ebp-0x18]00402E8A . 83C4 1C add esp,0x1C00402E8D . 66:42 inc dx00402E8F . 0F80 57020000 jo 004030EC00402E95 . 8B1D 40614000 mov ebx,dword ptr ds:[<&MSVBVM50.#632>] ; msvbvm50.rtcMidCharVar00402E9B . B8 01000000 mov eax,0x100402EA0 . 66:0345 C4 add ax,word ptr ss:[ebp-0x3C]00402EA4 . 8955 E8 mov dword ptr ss:[ebp-0x18],edx00402EA7 . B9 01000000 mov ecx,0x100402EAC . 0F80 3A020000 jo 004030EC00402EB2 . 8945 C4 mov dword ptr ss:[ebp-0x3C],eax00402EB5 .^ E9 C6FEFFFF jmp 00402D8000402EBA > 8D45 B4 lea eax,dword ptr ss:[ebp-0x4C]00402EBD . 8D8D 28FFFFFF lea ecx,dword ptr ss:[ebp-0xD8]00402EC3 . 50 push eax ; //"767547565"00402EC4 . 51 push ecx ; //"VeiajeEjbavwij"00402EC5 . C785 30FFFFFF>mov dword ptr ss:[ebp-0xD0],0040259C ; UNICODE "VeiajeEjbavwij"00402ECF . C785 28FFFFFF>mov dword ptr ss:[ebp-0xD8],0x800800402ED9 . FF15 A4614000 call dword ptr ds:[<&MSVBVM50.__vbaVarTstNe>] ; msvbvm50.__vbaVarTstNe00402EDF . 66:85C0 test ax,ax00402EE2 0F84 A1000000 je 00402F89 ; // 关键跳转
核心流程和上一个一样，都是取一个字符，然后与另外一个异或，另外的那个字符也很难理清楚是什么，使用其他手段看看吧！
VB反编译：
Private Sub Command1_Click() ‘402B40 Dim var_58 As TextBox loc_00402B72: var_8 = &H401000 loc_00402BD3: Set var_58 = Me loc_00402BE2: var_50 = Text1.Text loc_00402C0A: var_60 = var_50 loc_00402C0D: var_68 = 8 loc_00402C14: var_28 = var_50 loc_00402C2B: var_68 = Len(var_28) loc_00402C44: var_118 = CInt(var_50) loc_00402C4F: var_3C = 1 If 00000001h > 0 Then GoTo loc_00402D54 loc_00402C75: var_60 = 1 loc_00402C7C: var_68 = 2 loc_00402C83: var_78 = Mid$(var_28, 1, 1) loc_00402C95: var_80 = 4 loc_00402C9C: var_88 = 2 loc_00402CA6: var_98 = Left(4, 1) loc_00402CB7: var_54 = CStr(var_98) loc_00402CC7: var_50 = CStr(var_78) loc_00402CD9: var_A8 = Chr(Asc(var_54) xor edx) loc_00402CFC: var_38 = var_38 & 4 loc_00402D42: 00000001h = 00000001h + 1 loc_00402D4C: var_3C = 1 loc_00402D4F: GoTo loc_00402C52 loc_00402D54: loc_00402D5C: var_18 = 1 loc_00402D63: var_68 = Len(var_38) loc_00402D75: var_120 = CInt(var_58) loc_00402D7D: var_3C = 1 If 00000001h > 0 Then GoTo loc_00402EBA If 1 <= 0 Then GoTo loc_00402D97 loc_00402D94: var_18 = 1 loc_00402D97: var_60 = 1 loc_00402DB1: call Asc(var_54) xor edx(var_78, var_38, 00000001h, 2, 00402588h, 000000A0h, var_98, var_A8, var_58) loc_00402DDE: var_90 = 1 loc_00402DE8: var_80 = &H7D0 loc_00402DEF: call Asc(var_54) xor edx(var_A8, 2, 1, 2) loc_00402E0C: var_50 = CStr(var_78) loc_00402E1E: var_B8 = Chr(Asc(CStr(var_A8)) xor ecx) loc_00402E41: var_4C = var_4C & 1 loc_00402E8D: dx = 1 + 1 loc_00402EA0: 00000001h = 00000001h + 1 loc_00402EB2: var_3C = 1 loc_00402EB5: GoTo loc_00402D80 loc_00402EBA: loc_00402EC5: var_D0 = "VeiajeEjbavwij" loc_00402ECF: var_D8 = &H8008 loc_00402ED9: Var_Ret_1 = (var_4C <> "VeiajeEjbavwij") If Var_Ret_1 = 0 Then GoTo loc_00402F89 loc_00402F06: var_90 = 80020004h loc_00402F0C: var_98 = 10 loc_00402F12: var_80 = 80020004h loc_00402F15: var_88 = 10 loc_00402F1B: var_E0 = "Invalid" loc_00402F25: var_E8 = 8 loc_00402F36: var_D0 = "Password incorrect, please try again ..." loc_00402F40: var_D8 = 8 loc_00402F60: MsgBox "Password incorrect, please try again ...", 0, "Invalid" loc_00402FA4: var_D0 = "VeiajeEjbavwij" loc_00402FAE: var_D8 = &H8008 loc_00402FB8: Var_Ret_2 = (var_4C = "VeiajeEjbavwij") If Var_Ret_2 = 0 Then GoTo loc_00403056 loc_00402FD5: var_90 = 80020004h loc_00402FDB: var_98 = 10 loc_00402FE1: var_80 = 80020004h loc_00402FE4: var_88 = 10 loc_00402FEA: var_E0 = "Valid" loc_00402FF4: var_E8 = 8 loc_00403005: var_D0 = "Password correct, hehe, :-)" loc_0040300F: var_D8 = 8 loc_0040302F: MsgBox "Password correct, hehe, :-)", 0, "Valid" loc_00403056: var_4 = 0 loc_00403062: GoTo loc_004030B7 loc_004030B6: Exit Sub loc_004030B7: loc_004030CA: GoTo loc_00esi loc_004030CC: Exit SubEnd Sub
晕啊，中间的那个异或也太复杂了！
SmartCheck:
看完这个，对那个无法显示出来的字符疑惑了，它是从哪里来的呢？继续跟踪OD分析，发现，他就是第一部分异或得到的字符串，然后继续与2000的每个字符进行异或处理，大概是这样的：
pKey[i]=pName[i]^‘4‘;
pKey[i]=pKey[i]^"2000"[i%4];
pKey == "VeiajeEjbavwij";
所以，pName长度必须是14。我们反过来算原码：
// CrackMeDemo.cpp : 定义控制台应用程序的入口点。//#include "stdafx.h"#include <iostream>/*pKey[i]=pName[i]^‘4‘;pKey[i]=pKey[i]^"2000"[i%4];pKey == "VeiajeEjbavwij";*/int _tmain(int argc, _TCHAR* argv[]){ char pkey[] = "VeiajeEjbavwij"; char pName[15] = {0}; int nLen = strlen(pkey); for (int i=0;i<nLen;i++) { pName[i] = pkey[i] ^ "2000"[i%4]; pName[i] = pName[i] ^ ‘4‘; } printf("the input is: %s\r\n",pName); system("pause"); return 0;}
BY 笨笨D幸福
声明：以上内容来自用户投稿及互联网公开渠道收集整理发布，本网站不拥有所有权，未作人工编辑处理，也不承担相关法律责任，若内容有误或涉及侵权可进行投诉： 投诉/举报 工作人员会在5个工作日内联系你，一经查实，本站将立刻删除涉嫌侵权内容。