破解 crackme4（深入底层抓出关键算法）

系统： Windows xp

程序： crackme4

程序下载地址：http://pan.baidu.com/s/1nu452xN

要求：注册机编写

使用工具： OD & IDA

可在“PEDIY CrackMe 2007”中查找关于此程序的破文，标题为“一个简单CrackMe的破解”。

老规矩，先用IDA载入程序，查看字串表得到关键字串“You cracked the CFF CrackMe #4 ! Please send your solution to aci”。定位字串调用位置并向上翻找到关键算法：

00457BCA  |.  8D55 FC       lea     edx, dword ptr [ebp-4]                       ;  取变量地址给edx
00457BCD  |.  8B83 D8020000 mov     eax, dword ptr [ebx+2D8]
00457BD3  |.  E8 08C3FCFF   call    00423EE0                                     ;  取用户名字符数给eax
00457BD8  |.  837D FC 00    cmp     dword ptr [ebp-4], 0
00457BDC  |.  75 18         jnz     short 00457BF6
00457BDE  |.  6A 00         push    0
00457BE0  |.  B9 987E4500   mov     ecx, 00457E98                                ;  ASCII "Enter your Name !"
00457BE5  |.  BA AC7E4500   mov     edx, 00457EAC                                ;  ASCII "You must enter your Name !"
00457BEA  |.  A1 98A54500   mov     eax, dword ptr [45A598]
00457BEF  |.  8B00          mov     eax, dword ptr [eax]
00457BF1  |.  E8 3A85FEFF   call    00440130
00457BF6  |>  8D55 FC       lea     edx, dword ptr [ebp-4]                       ;  取用户名字串地址给edx
00457BF9  |.  8B83 DC020000 mov     eax, dword ptr [ebx+2DC]
00457BFF  |.  E8 DCC2FCFF   call    00423EE0
00457C04  |.  837D FC 00    cmp     dword ptr [ebp-4], 0                         ;  序列号是否为空？
00457C08  |.  75 18         jnz     short 00457C22
00457C0A  |.  6A 00         push    0
00457C0C  |.  B9 C87E4500   mov     ecx, 00457EC8                                ;  ASCII "Enter a Serial !"
00457C11  |.  BA DC7E4500   mov     edx, 00457EDC                                ;  ASCII "You must enter a Serial !"
00457C16  |.  A1 98A54500   mov     eax, dword ptr [45A598]
00457C1B  |.  8B00          mov     eax, dword ptr [eax]
00457C1D  |.  E8 0E85FEFF   call    00440130
00457C22  |>  33C0          xor     eax, eax
00457C24  |.  A3 40B84500   mov     dword ptr [45B840], eax
00457C29  |.  8D55 FC       lea     edx, dword ptr [ebp-4]                       ;  取序列号
00457C2C  |.  8B83 D8020000 mov     eax, dword ptr [ebx+2D8]
00457C32  |.  E8 A9C2FCFF   call    00423EE0
00457C37  |.  8B45 FC       mov     eax, dword ptr [ebp-4]                       ;  取用户名
00457C3A  |.  E8 F9BFFAFF   call    00403C38
00457C3F  |.  A3 44B84500   mov     dword ptr [45B844], eax
00457C44  |.  A1 44B84500   mov     eax, dword ptr [45B844]
00457C49  |.  E8 82FDFAFF   call    004079D0
00457C4E  |.  83F8 06       cmp     eax, 6                                       ;  用户名大于等于6？
00457C51  |.  73 1D         jnb     short 00457C70
00457C53  |.  6A 00         push    0
00457C55  |.  B9 F87E4500   mov     ecx, 00457EF8                                ;  ASCII "Name too short !"
00457C5A  |.  BA 0C7F4500   mov     edx, 00457F0C                                ;  ASCII "Your Name must be at least 6 Chars long !"
00457C5F  |.  A1 98A54500   mov     eax, dword ptr [45A598]
00457C64  |.  8B00          mov     eax, dword ptr [eax]
00457C66  |.  E8 C584FEFF   call    00440130
00457C6B  |.  E9 59010000   jmp     00457DC9
00457C70  |>  8D55 FC       lea     edx, dword ptr [ebp-4]                       ;  取用户名
00457C73  |.  8B83 D8020000 mov     eax, dword ptr [ebx+2D8]
00457C79  |.  E8 62C2FCFF   call    00423EE0
00457C7E  |.  8B45 FC       mov     eax, dword ptr [ebp-4]                       ;  取用户名
00457C81  |.  BA 01000000   mov     edx, 1
00457C86  |.  4A            dec     edx                                          ;  dex = 0
00457C87  |.  3B50 FC       cmp     edx, dword ptr [eax-4]                       ;  用户名长度大于0？
00457C8A  |.  72 05         jb      short 00457C91
00457C8C  |.  E8 F3AEFAFF   call    00402B84
00457C91  |>  42            inc     edx                                          ;  dex = 1
00457C92  |.  0FB64410 FF   movzx   eax, byte ptr [eax+edx-1]                    ;  取第一个字符
00457C97  |.  6BF0 02       imul    esi, eax, 2                                  ;  esi = eax * 2
00457C9A  |.  71 05         jno     short 00457CA1                               ;  无溢出则跳转
00457C9C  |.  E8 EBAEFAFF   call    00402B8C
00457CA1  |>  8D55 F8       lea     edx, dword ptr [ebp-8]                       ;  取内存地址
00457CA4  |.  8B83 D8020000 mov     eax, dword ptr [ebx+2D8]
00457CAA  |.  E8 31C2FCFF   call    00423EE0
00457CAF  |.  8B45 F8       mov     eax, dword ptr [ebp-8]                       ;  取用户名字串
00457CB2  |.  BA 02000000   mov     edx, 2
00457CB7  |.  4A            dec     edx                                          ;  edx = 1
00457CB8  |.  3B50 FC       cmp     edx, dword ptr [eax-4]                       ;  用户名长度是否大于1？
00457CBB  |.  72 05         jb      short 00457CC2
00457CBD  |.  E8 C2AEFAFF   call    00402B84
00457CC2  |>  42            inc     edx                                          ;  edx=2
00457CC3  |.  0FB64410 FF   movzx   eax, byte ptr [eax+edx-1]                    ;  取第二个字符
00457CC8  |.  6BC0 02       imul    eax, eax, 2                                  ;  eax = eax * 2
00457CCB  |.  71 05         jno     short 00457CD2                               ;  无溢出则跳转
00457CCD  |.  E8 BAAEFAFF   call    00402B8C
00457CD2  |>  03F0          add     esi, eax                                     ;  运算结果累加存入esi
00457CD4  |.  71 05         jno     short 00457CDB                               ;  无溢出则跳转
00457CD6  |.  E8 B1AEFAFF   call    00402B8C
00457CDB  |>  8D55 F4       lea     edx, dword ptr [ebp-C]                       ;  取内存地址
00457CDE  |.  8B83 D8020000 mov     eax, dword ptr [ebx+2D8]
00457CE4  |.  E8 F7C1FCFF   call    00423EE0
00457CE9  |.  8B45 F4       mov     eax, dword ptr [ebp-C]                       ;  取用户名
00457CEC  |.  BA 03000000   mov     edx, 3
00457CF1  |.  4A            dec     edx
00457CF2  |.  3B50 FC       cmp     edx, dword ptr [eax-4]                       ;  用户名长度是否大于2？
00457CF5  |.  72 05         jb      short 00457CFC
00457CF7  |.  E8 88AEFAFF   call    00402B84
00457CFC  |>  42            inc     edx
00457CFD  |.  0FB64410 FF   movzx   eax, byte ptr [eax+edx-1]                    ;  取第三个字符
00457D02  |.  6BC0 02       imul    eax, eax, 2                                  ;  eax = eax * 2
00457D05  |.  71 05         jno     short 00457D0C                               ;  无溢出则跳转
00457D07  |.  E8 80AEFAFF   call    00402B8C
00457D0C  |>  03F0          add     esi, eax                                     ;  运算结果累加存入esi
00457D0E  |.  71 05         jno     short 00457D15                               ;  无溢出则跳转
00457D10  |.  E8 77AEFAFF   call    00402B8C
00457D15  |>  8D55 F0       lea     edx, dword ptr [ebp-10]                      ;  取内存地址
00457D18  |.  8B83 D8020000 mov     eax, dword ptr [ebx+2D8]
00457D1E  |.  E8 BDC1FCFF   call    00423EE0
00457D23  |.  8B45 F0       mov     eax, dword ptr [ebp-10]                      ;  取用户名
00457D26  |.  BA 04000000   mov     edx, 4
00457D2B  |.  4A            dec     edx
00457D2C  |.  3B50 FC       cmp     edx, dword ptr [eax-4]                       ;  用户名长度是否大于3？
00457D2F  |.  72 05         jb      short 00457D36
00457D31  |.  E8 4EAEFAFF   call    00402B84
00457D36  |>  42            inc     edx
00457D37  |.  0FB64410 FF   movzx   eax, byte ptr [eax+edx-1]                    ;  取第四个字符
00457D3C  |.  6BC0 02       imul    eax, eax, 2                                  ;  eax = eax * 2
00457D3F  |.  71 05         jno     short 00457D46                               ;  无溢出则跳转
00457D41  |.  E8 46AEFAFF   call    00402B8C
00457D46  |>  03F0          add     esi, eax                                     ;  运算结果累加存入esi
00457D48  |.  71 05         jno     short 00457D4F                               ;  无溢出则跳转
00457D4A  |.  E8 3DAEFAFF   call    00402B8C
00457D4F  |>  8D55 EC       lea     edx, dword ptr [ebp-14]                      ;  取内存地址
00457D52  |.  8B83 D8020000 mov     eax, dword ptr [ebx+2D8]
00457D58  |.  E8 83C1FCFF   call    00423EE0
00457D5D  |.  8B45 EC       mov     eax, dword ptr [ebp-14]                      ;  取用户名
00457D60  |.  BA 05000000   mov     edx, 5
00457D65  |.  4A            dec     edx
00457D66  |.  3B50 FC       cmp     edx, dword ptr [eax-4]                       ;  用户名长度是否大于4？
00457D69  |.  72 05         jb      short 00457D70
00457D6B  |.  E8 14AEFAFF   call    00402B84
00457D70  |>  42            inc     edx
00457D71  |.  0FB64410 FF   movzx   eax, byte ptr [eax+edx-1]                    ;  取第五个字符
00457D76  |.  6BC0 02       imul    eax, eax, 2                                  ;  eax = eax * 2
00457D79  |.  71 05         jno     short 00457D80                               ;  无溢出则跳转
00457D7B  |.  E8 0CAEFAFF   call    00402B8C
00457D80  |>  03F0          add     esi, eax                                     ;  运算结果累加存入esi
00457D82  |.  71 05         jno     short 00457D89                               ;  无溢出则跳转
00457D84  |.  E8 03AEFAFF   call    00402B8C
00457D89  |>  8D55 E8       lea     edx, dword ptr [ebp-18]                      ;  取内存地址
00457D8C  |.  8B83 D8020000 mov     eax, dword ptr [ebx+2D8]
00457D92  |.  E8 49C1FCFF   call    00423EE0
00457D97  |.  8B45 E8       mov     eax, dword ptr [ebp-18]                      ;  取用户名
00457D9A  |.  BA 06000000   mov     edx, 6
00457D9F  |.  4A            dec     edx
00457DA0  |.  3B50 FC       cmp     edx, dword ptr [eax-4]                       ;  用户名长度是否大于5？
00457DA3  |.  72 05         jb      short 00457DAA
00457DA5  |.  E8 DAADFAFF   call    00402B84
00457DAA  |>  42            inc     edx
00457DAB  |.  0FB64410 FF   movzx   eax, byte ptr [eax+edx-1]                    ;  取第六个字符
00457DB0  |.  6BC0 02       imul    eax, eax, 2                                  ;  eax = eax * 2
00457DB3  |.  71 05         jno     short 00457DBA                               ;  无溢出则跳转
00457DB5  |.  E8 D2ADFAFF   call    00402B8C
00457DBA  |>  03F0          add     esi, eax                                     ;  运算结果累加存入esi
00457DBC  |.  71 05         jno     short 00457DC3                               ;  无溢出则跳转
00457DBE  |.  E8 C9ADFAFF   call    00402B8C
00457DC3  |>  8935 40B84500 mov     dword ptr [45B840], esi                      ;  将结果存入内存
00457DC9  |>  A1 44B84500   mov     eax, dword ptr [45B844]
00457DCE  |.  E8 FDFBFAFF   call    004079D0
00457DD3  |.  6BC0 02       imul    eax, eax, 2                                  ;  eax = 用户名长度*2
00457DD6  |.  73 05         jnb     short 00457DDD                               ;  若eax无进位，则跳转
00457DD8  |.  E8 AFADFAFF   call    00402B8C
00457DDD  |>  33D2          xor     edx, edx
00457DDF  |.  52            push    edx
00457DE0  |.  50            push    eax
00457DE1  |.  A1 40B84500   mov     eax, dword ptr [45B840]                      ;  取结果
00457DE6  |.  99            cdq                                                  ;  把原来的 EAX 扩展成 EDX:EAX (带正负值)
00457DE7  |.  030424        add     eax, dword ptr [esp]                         ;  结果加上用户名长度*2
00457DEA  |.  135424 04     adc     edx, dword ptr [esp+4]                       ;  带进位加法指令
00457DEE  |.  71 05         jno     short 00457DF5                               ;  无溢出则跳转
00457DF0  |.  E8 97ADFAFF   call    00402B8C
00457DF5  |>  83C4 08       add     esp, 8                                       ;  清除局部变量内存
00457DF8  |.  50            push    eax                                          ;  结果入栈
00457DF9  |.  C1F8 1F       sar     eax, 1F                                      ;  算术右移1F（最高位不变）
00457DFC  |.  3BC2          cmp     eax, edx
00457DFE  |.  58            pop     eax                                          ;  还原eax
00457DFF  |.  74 05         je      short 00457E06
00457E01  |.  E8 7EADFAFF   call    00402B84
00457E06  |>  A3 40B84500   mov     dword ptr [45B840], eax                      ;  保存结果
00457E0B  |.  8D55 E4       lea     edx, dword ptr [ebp-1C]                      ;  取内存地址
00457E0E  |.  A1 40B84500   mov     eax, dword ptr [45B840]
00457E13  |.  E8 2CF9FAFF   call    00407744                                     ;  根据用户名得出的结果算出一个字串
00457E18  |.  8B45 E4       mov     eax, dword ptr [ebp-1C]                      ;  取计算结果
00457E1B  |.  50            push    eax
00457E1C  |.  8D55 FC       lea     edx, dword ptr [ebp-4]                       ;  取用户名
00457E1F  |.  8B83 DC020000 mov     eax, dword ptr [ebx+2DC]
00457E25  |.  E8 B6C0FCFF   call    00423EE0
00457E2A  |.  8B55 FC       mov     edx, dword ptr [ebp-4]                       ;  取序列号
00457E2D  |.  58            pop     eax                                          ;  还原第一次的运算结果
00457E2E  |.  E8 51BDFAFF   call    00403B84                                     ;  比较两次的运算结果，不相同则序列号无效
00457E33  |.  75 1A         jnz     short 00457E4F
00457E35  |.  6A 00         push    0
00457E37  |.  B9 387F4500   mov     ecx, 00457F38                                ;  ASCII "Congratz !"
00457E3C  |.  BA 447F4500   mov     edx, 00457F44                                ;  ASCII "You cracked the CFF CrackMe #4 ! Please send your solution to acidbytes@gmx.net !"
00457E41  |.  A1 98A54500   mov     eax, dword ptr [45A598]
00457E46  |.  8B00          mov     eax, dword ptr [eax]
00457E48  |.  E8 E382FEFF   call    00440130
00457E4D  |.  EB 18         jmp     short 00457E67
00457E4F  |>  6A 00         push    0
00457E51  |.  B9 987F4500   mov     ecx, 00457F98                                ;  ASCII "Serial not valid"
00457E56  |.  BA AC7F4500   mov     edx, 00457FAC                                ;  ASCII "The Serial you entered is in any case not valid !"
00457E5B  |.  A1 98A54500   mov     eax, dword ptr [45A598]
00457E60  |.  8B00          mov     eax, dword ptr [eax]
00457E62  |.  E8 C982FEFF   call    00440130

在457E13中调用了子程序407744，在这个函数里对入栈的运算结果进行了操作，我们F7跟进：

00407744  /$  83C4 F8       add     esp, -8                                      ;  开辟8个字节的内存单元
00407747  |.  6A 00         push    0
00407749  |.  894424 04     mov     dword ptr [esp+4], eax                       ;  存入运算结果
0040774D  |.  C64424 08 00  mov     byte ptr [esp+8], 0
00407752  |.  8D4C24 04     lea     ecx, dword ptr [esp+4]
00407756  |.  8BC2          mov     eax, edx
00407758  |.  BA 70774000   mov     edx, 00407770                                ;  ASCII "%d"
0040775D  |.  E8 CA090000   call    0040812C                                     ;  进入有关键call的子程序
00407762  |.  59            pop     ecx
00407763  |.  5A            pop     edx
00407764  \.  C3            retn

继续跟进40812C：

0040812C  /$  55            push    ebp
0040812D  |.  8BEC          mov     ebp, esp
0040812F  |.  81C4 04F0FFFF add     esp, -0FFC                                   ;  猜测是开辟1023个4个字节的内存
00408135  |.  50            push    eax
00408136  |.  83C4 F4       add     esp, -0C                                     ;  三个局部变量
00408139  |.  53            push    ebx
0040813A  |.  56            push    esi
0040813B  |.  894D F8       mov     dword ptr [ebp-8], ecx
0040813E  |.  8955 FC       mov     dword ptr [ebp-4], edx
00408141  |.  8BF0          mov     esi, eax
00408143  |.  BB 02100000   mov     ebx, 1002
00408148  |.  8B45 FC       mov     eax, dword ptr [ebp-4]
0040814B  |.  E8 24B9FFFF   call    00403A74
00408150  |.  8BD3          mov     edx, ebx
00408152  |.  85D2          test    edx, edx
00408154  |.  79 03         jns     short 00408159
00408156  |.  83C2 03       add     edx, 3
00408159  |>  C1FA 02       sar     edx, 2
0040815C  |.  8BCB          mov     ecx, ebx
0040815E  |.  2BCA          sub     ecx, edx
00408160  |.  3BC1          cmp     eax, ecx
00408162  |.  7D 24         jge     short 00408188
00408164  |.  8B45 FC       mov     eax, dword ptr [ebp-4]
00408167  |.  E8 08B9FFFF   call    00403A74                                     ;  如果eax不为空则将他前一个变量的值赋给它
0040816C  |.  50            push    eax
0040816D  |.  8B45 F8       mov     eax, dword ptr [ebp-8]
00408170  |.  50            push    eax
00408171  |.  8B45 08       mov     eax, dword ptr [ebp+8]
00408174  |.  50            push    eax
00408175  |.  8B4D FC       mov     ecx, dword ptr [ebp-4]
00408178  |.  8BD3          mov     edx, ebx
0040817A  |.  4A            dec     edx
0040817B  |.  8D85 F6EFFFFF lea     eax, dword ptr [ebp-100A]
00408181  |.  E8 32FBFFFF   call    00407CB8                                     ;  关键call
00408186  |.  EB 0C         jmp     short 00408194
00408188  |>  8B45 FC       mov     eax, dword ptr [ebp-4]
0040818B  |.  E8 E4B8FFFF   call    00403A74
00408190  |.  8BD8          mov     ebx, eax
00408192  |.  8BC3          mov     eax, ebx
00408194  |>  8BD3          mov     edx, ebx
00408196  |.  4A            dec     edx
00408197  |.  3BC2          cmp     eax, edx
00408199  |.  7C 43         jl      short 004081DE
0040819B  |.  EB 30         jmp     short 004081CD
0040819D  |>  03DB          /add     ebx, ebx
0040819F  |.  8BC6          |mov     eax, esi
004081A1  |.  E8 52B6FFFF   |call    004037F8
004081A6  |.  8BC6          |mov     eax, esi
004081A8  |.  8BD3          |mov     edx, ebx
004081AA  |.  E8 99BBFFFF   |call    00403D48
004081AF  |.  8B45 FC       |mov     eax, dword ptr [ebp-4]
004081B2  |.  E8 BDB8FFFF   |call    00403A74
004081B7  |.  50            |push    eax
004081B8  |.  8B45 F8       |mov     eax, dword ptr [ebp-8]
004081BB  |.  50            |push    eax
004081BC  |.  8B45 08       |mov     eax, dword ptr [ebp+8]
004081BF  |.  50            |push    eax
004081C0  |.  8B4D FC       |mov     ecx, dword ptr [ebp-4]
004081C3  |.  8BD3          |mov     edx, ebx
004081C5  |.  4A            |dec     edx
004081C6  |.  8B06          |mov     eax, dword ptr [esi]
004081C8  |.  E8 EBFAFFFF   |call    00407CB8
004081CD  |>  8BD3           mov     edx, ebx
004081CF  |.  4A            |dec     edx
004081D0  |.  3BC2          |cmp     eax, edx
004081D2  |.^ 7D C9         \jge     short 0040819D
004081D4  |.  8BD6          mov     edx, esi
004081D6  |.  92            xchg    eax, edx
004081D7  |.  E8 6CBBFFFF   call    00403D48
004081DC  |.  EB 0E         jmp     short 004081EC
004081DE  |>  8D95 F6EFFFFF lea     edx, dword ptr [ebp-100A]
004081E4  |.  8BCE          mov     ecx, esi
004081E6  |.  91            xchg    eax, ecx
004081E7  |.  E8 F0B6FFFF   call    004038DC
004081EC  |>  5E            pop     esi
004081ED  |.  5B            pop     ebx
004081EE  |.  8BE5          mov     esp, ebp
004081F0  |.  5D            pop     ebp
004081F1  \.  C2 0400       retn    4

跟进关键call：

00407CB8   $  55            push    ebp                                          ;  ↓关键算法
00407CB9   .  8BEC          mov     ebp, esp
00407CBB   .  83C4 8C       add     esp, -74
00407CBE   .  53            push    ebx
00407CBF   .  33DB          xor     ebx, ebx
00407CC1   .  895D F0       mov     dword ptr [ebp-10], ebx
00407CC4   .  53            push    ebx
00407CC5   .  56            push    esi
00407CC6   .  57            push    edi
00407CC7   .  89C7          mov     edi, eax
00407CC9   .  89CE          mov     esi, ecx
00407CCB   .  034D 10       add     ecx, dword ptr [ebp+10]
00407CCE   .  897D FC       mov     dword ptr [ebp-4], edi
00407CD1   .  31C0          xor     eax, eax
00407CD3   .  8945 F8       mov     dword ptr [ebp-8], eax
00407CD6   .  8945 F4       mov     dword ptr [ebp-C], eax
00407CD9   .  8945 F0       mov     dword ptr [ebp-10], eax
00407CDC   >  09D2          or      edx, edx
00407CDE   .  74 0E         je      short 00407CEE
00407CE0   >  39CE          cmp     esi, ecx
00407CE2   .  74 0A         je      short 00407CEE
00407CE4   .  AC            lods    byte ptr [esi]
00407CE5   .  80F8 25       cmp     al, 25
00407CE8   .  74 0E         je      short 00407CF8
00407CEA   >  AA            stos    byte ptr es:[edi]
00407CEB   .  4A            dec     edx
00407CEC   .^ 75 F2         jnz     short 00407CE0
00407CEE   >  89F8          mov     eax, edi
00407CF0   .  2B45 FC       sub     eax, dword ptr [ebp-4]
00407CF3   .  E9 A8030000   jmp     004080A0
00407CF8   >  39CE          cmp     esi, ecx
00407CFA   .^ 74 F2         je      short 00407CEE
00407CFC   .  AC            lods    byte ptr [esi]
00407CFD   .  80F8 25       cmp     al, 25
00407D00   .^ 74 E8         je      short 00407CEA
00407D02   .  8D5E FE       lea     ebx, dword ptr [esi-2]
00407D05   .  895D EC       mov     dword ptr [ebp-14], ebx
00407D08   >  8845 EB       mov     byte ptr [ebp-15], al
00407D0B   .  80F8 2D       cmp     al, 2D
00407D0E   .  75 05         jnz     short 00407D15
00407D10   .  39CE          cmp     esi, ecx
00407D12   .^ 74 DA         je      short 00407CEE
00407D14   .  AC            lods    byte ptr [esi]
00407D15   >  E8 80000000   call    00407D9A
00407D1A   .  80F8 3A       cmp     al, 3A
00407D1D   .  75 0A         jnz     short 00407D29
00407D1F   .  895D F8       mov     dword ptr [ebp-8], ebx
00407D22   .  39CE          cmp     esi, ecx
00407D24   .^ 74 C8         je      short 00407CEE
00407D26   .  AC            lods    byte ptr [esi]
00407D27   .^ EB DF         jmp     short 00407D08
00407D29   >  895D E4       mov     dword ptr [ebp-1C], ebx
00407D2C   .  BB FFFFFFFF   mov     ebx, -1
00407D31   .  80F8 2E       cmp     al, 2E
00407D34   .  75 0A         jnz     short 00407D40
00407D36   .  39CE          cmp     esi, ecx
00407D38   .^ 74 B4         je      short 00407CEE
00407D3A   .  AC            lods    byte ptr [esi]
00407D3B   .  E8 5A000000   call    00407D9A
00407D40   >  895D E0       mov     dword ptr [ebp-20], ebx
00407D43   .  8975 DC       mov     dword ptr [ebp-24], esi
00407D46   .  51            push    ecx
00407D47   .  52            push    edx
00407D48   .  E8 96000000   call    00407DE3                                     
00407D4D   .  5A            pop     edx
00407D4E   .  8B5D E4       mov     ebx, dword ptr [ebp-1C]
00407D51   .  29CB          sub     ebx, ecx
00407D53   .  73 02         jnb     short 00407D57
00407D55   .  31DB          xor     ebx, ebx
00407D57   >  807D EB 2D    cmp     byte ptr [ebp-15], 2D
00407D5B   .  75 0A         jnz     short 00407D67
00407D5D   .  29CA          sub     edx, ecx
00407D5F   .  73 04         jnb     short 00407D65
00407D61   .  01D1          add     ecx, edx
00407D63   .  31D2          xor     edx, edx
00407D65   >  F3:A4         rep     movs byte ptr es:[edi], byte ptr [esi]
00407D67   >  87CB          xchg    ebx, ecx
00407D69   .  29CA          sub     edx, ecx
00407D6B   .  73 04         jnb     short 00407D71
00407D6D   .  01D1          add     ecx, edx
00407D6F   .  31D2          xor     edx, edx
00407D71   >  B0 20         mov     al, 20
00407D73   .  F3:AA         rep     stos byte ptr es:[edi]
00407D75   .  87CB          xchg    ebx, ecx
00407D77   .  29CA          sub     edx, ecx
00407D79   .  73 04         jnb     short 00407D7F
00407D7B   .  01D1          add     ecx, edx
00407D7D   .  31D2          xor     edx, edx
00407D7F   >  F3:A4         rep     movs byte ptr es:[edi], byte ptr [esi]
00407D81   .  837D F4 00    cmp     dword ptr [ebp-C], 0
00407D85   .  74 0A         je      short 00407D91
00407D87   .  52            push    edx
00407D88   .  8D45 F4       lea     eax, dword ptr [ebp-C]
00407D8B   .  E8 1CFFFFFF   call    00407CAC
00407D90   .  5A            pop     edx
00407D91   >  59            pop     ecx
00407D92   .  8B75 DC       mov     esi, dword ptr [ebp-24]
00407D95   .^ E9 42FFFFFF   jmp     00407CDC
00407D9A   $  31DB          xor     ebx, ebx
00407D9C   .  80F8 2A       cmp     al, 2A
00407D9F   .  74 22         je      short 00407DC3
00407DA1   >  80F8 30       cmp     al, 30
00407DA4   .  72 3C         jb      short 00407DE2
00407DA6   .  80F8 39       cmp     al, 39
00407DA9   .  77 37         ja      short 00407DE2
00407DAB   .  6BDB 0A       imul    ebx, ebx, 0A
00407DAE   .  80E8 30       sub     al, 30
00407DB1   .  0FB6C0        movzx   eax, al
00407DB4   .  01C3          add     ebx, eax
00407DB6   .  39CE          cmp     esi, ecx
00407DB8   .  74 03         je      short 00407DBD
00407DBA   .  AC            lods    byte ptr [esi]
00407DBB   .^ EB E4         jmp     short 00407DA1
00407DBD   >  58            pop     eax
00407DBE   .^ E9 2BFFFFFF   jmp     00407CEE
00407DC3   >  8B45 F8       mov     eax, dword ptr [ebp-8]
00407DC6   .  3B45 08       cmp     eax, dword ptr [ebp+8]
00407DC9   .  77 12         ja      short 00407DDD
00407DCB   .  FF45 F8       inc     dword ptr [ebp-8]
00407DCE   .  8B5D 0C       mov     ebx, dword ptr [ebp+C]
00407DD1   .  807CC3 04 00  cmp     byte ptr [ebx+eax*8+4], 0
00407DD6   .  8B1CC3        mov     ebx, dword ptr [ebx+eax*8]
00407DD9   .  74 02         je      short 00407DDD
00407DDB   .  31DB          xor     ebx, ebx
00407DDD   >  39CE          cmp     esi, ecx
00407DDF   .^ 74 DC         je      short 00407DBD
00407DE1   .  AC            lods    byte ptr [esi]
00407DE2   >  C3            retn
00407DE3  /$  24 DF         and     al, 0DF
00407DE5  |.  88C1          mov     cl, al
00407DE7  |.  B8 01000000   mov     eax, 1
00407DEC  |.  8B5D F8       mov     ebx, dword ptr [ebp-8]
00407DEF  |.  3B5D 08       cmp     ebx, dword ptr [ebp+8]
00407DF2  |.  77 5C         ja      short 00407E50
00407DF4  |.  FF45 F8       inc     dword ptr [ebp-8]
00407DF7  |.  8B75 0C       mov     esi, dword ptr [ebp+C]
00407DFA  |.  8D34DE        lea     esi, dword ptr [esi+ebx*8]
00407DFD  |.  8B06          mov     eax, dword ptr [esi]
00407DFF  |.  0FB65E 04     movzx   ebx, byte ptr [esi+4]
00407E03  |.  FF249D 0A7E40>jmp     dword ptr [ebx*4+407E0A]
00407E0A  |.  FE7E4000      dd      CrackMe#.00407EFE                            ;  Switch table used at 00407E03
00407E0E  |.  4E7E4000      dd      CrackMe#.00407E4E
00407E12  |.  657F4000      dd      CrackMe#.00407F65
00407E16  |.  23804000      dd      CrackMe#.00408023
00407E1A  |.  957F4000      dd      CrackMe#.00407F95
00407E1E  |.  05804000      dd      CrackMe#.00408005
00407E22  |.  E57F4000      dd      CrackMe#.00407FE5
00407E26  |.  4E7E4000      dd      CrackMe#.00407E4E
00407E2A  |.  4E7E4000      dd      CrackMe#.00407E4E
00407E2E  |.  4E7E4000      dd      CrackMe#.00407E4E
00407E32  |.  A67F4000      dd      CrackMe#.00407FA6
00407E36  |.  C97F4000      dd      CrackMe#.00407FC9
00407E3A  |.  1F804000      dd      CrackMe#.0040801F
00407E3E  |.  747F4000      dd      CrackMe#.00407F74
00407E42  |.  4E7E4000      dd      CrackMe#.00407E4E
00407E46  |.  AD7F4000      dd      CrackMe#.00407FAD
00407E4A  |.  627E4000      dd      CrackMe#.00407E62
00407E4E  |>  31C0          xor     eax, eax                                     ;  Default case of switch 00408029
00407E50  |>  E8 40020000   call    00408095
00407E55  |.  8B55 EC       mov     edx, dword ptr [ebp-14]
00407E58  |.  8B4D DC       mov     ecx, dword ptr [ebp-24]
00407E5B  |.  29D1          sub     ecx, edx
00407E5D  |.  E8 DEFDFFFF   call    00407C40
00407E62  |>  8D5D D0       lea     ebx, dword ptr [ebp-30]
00407E65  |.  8B10          mov     edx, dword ptr [eax]
00407E67  |.  8913          mov     dword ptr [ebx], edx
00407E69  |.  8B50 04       mov     edx, dword ptr [eax+4]
00407E6C  |.  8953 04       mov     dword ptr [ebx+4], edx
00407E6F  |.  80F9 44       cmp     cl, 44                                       ;  Switch (cases 44..58)
00407E72  |.  74 11         je      short 00407E85
00407E74  |.  80F9 55       cmp     cl, 55
00407E77  |.  74 2A         je      short 00407EA3
00407E79  |.  80F9 58       cmp     cl, 58
00407E7C  |.^ 75 D0         jnz     short 00407E4E
00407E7E  |.  B9 10000000   mov     ecx, 10                                      ;  Case 58 ('X') of switch 00407E6F
00407E83  |.  EB 23         jmp     short 00407EA8
00407E85  |>  F743 04 00000>test    dword ptr [ebx+4], 80000000                  ;  Case 44 ('D') of switch 00407E6F
00407E8C  |.  74 15         je      short 00407EA3
00407E8E  |.  F71B          neg     dword ptr [ebx]
00407E90  |.  8353 04 00    adc     dword ptr [ebx+4], 0
00407E94  |.  F75B 04       neg     dword ptr [ebx+4]
00407E97  |.  E8 07000000   call    00407EA3
00407E9C  |.  B0 2D         mov     al, 2D
00407E9E  |.  41            inc     ecx
00407E9F  |.  4E            dec     esi
00407EA0  |.  8806          mov     byte ptr [esi], al
00407EA2  |.  C3            retn
00407EA3  |$  B9 0A000000   mov     ecx, 0A                                      ;  Case 55 ('U') of switch 00407E6F
00407EA8  |>  8D75 AF       lea     esi, dword ptr [ebp-51]
00407EAB  |>  51            /push    ecx
00407EAC  |.  6A 00         |push    0
00407EAE  |.  51            |push    ecx
00407EAF  |.  8B03          |mov     eax, dword ptr [ebx]
00407EB1  |.  8B53 04       |mov     edx, dword ptr [ebx+4]
00407EB4  |.  E8 20DAFFFF   |call    004058D9
00407EB9  |.  59            |pop     ecx
00407EBA  |.  92            |xchg    eax, edx
00407EBB  |.  80C2 30       |add     dl, 30
00407EBE  |.  80FA 3A       |cmp     dl, 3A
00407EC1  |.  72 03         |jb      short 00407EC6
00407EC3  |.  80C2 07       |add     dl, 7
00407EC6  |>  4E            |dec     esi
00407EC7  |.  8816          |mov     byte ptr [esi], dl
00407EC9  |.  51            |push    ecx
00407ECA  |.  6A 00         |push    0
00407ECC  |.  51            |push    ecx
00407ECD  |.  8B03          |mov     eax, dword ptr [ebx]
00407ECF  |.  8B53 04       |mov     edx, dword ptr [ebx+4]
00407ED2  |.  E8 0DD9FFFF   |call    004057E4
00407ED7  |.  59            |pop     ecx
00407ED8  |.  8903          |mov     dword ptr [ebx], eax
00407EDA  |.  8953 04       |mov     dword ptr [ebx+4], edx
00407EDD  |.  09D0          |or      eax, edx
00407EDF  |.^ 75 CA         \jnz     short 00407EAB
00407EE1  |.  8D4D AF       lea     ecx, dword ptr [ebp-51]
00407EE4  |.  29F1          sub     ecx, esi
00407EE6  |.  8B55 E0       mov     edx, dword ptr [ebp-20]
00407EE9  |.  83FA 10       cmp     edx, 10
00407EEC  |.  72 01         jb      short 00407EEF
00407EEE  |.  C3            retn
00407EEF  |>  29CA          sub     edx, ecx
00407EF1  |.  76 0A         jbe     short 00407EFD
00407EF3  |.  01D1          add     ecx, edx
00407EF5  |.  B0 30         mov     al, 30
00407EF7  |>  4E            /dec     esi
00407EF8  |.  8806          |mov     byte ptr [esi], al
00407EFA  |.  4A            |dec     edx
00407EFB  |.^ 75 FA         \jnz     short 00407EF7
00407EFD  |>  C3            retn
00407EFE  |>  80F9 44       cmp     cl, 44                                       ;  Switch (cases 44..58)
00407F01  |.  74 15         je      short 00407F18
00407F03  |.  80F9 55       cmp     cl, 55
00407F06  |.  74 22         je      short 00407F2A
00407F08  |.  80F9 58       cmp     cl, 58
00407F0B  |.^ 0F85 3DFFFFFF jnz     00407E4E
00407F11  |.  B9 10000000   mov     ecx, 10                                      ;  Case 58 ('X') of switch 00407EFE
00407F16  |.  EB 17         jmp     short 00407F2F
00407F18  |>  09C0          or      eax, eax                                     ;  Case 44 ('D') of switch 00407EFE
00407F1A  |.  79 0E         jns     short 00407F2A
00407F1C  |.  F7D8          neg     eax
00407F1E  |.  E8 07000000   call    00407F2A
00407F23  |.  B0 2D         mov     al, 2D
00407F25  |.  41            inc     ecx
00407F26  |.  4E            dec     esi
00407F27  |.  8806          mov     byte ptr [esi], al
00407F29  |.  C3            retn
00407F2A  |$  B9 0A000000   mov     ecx, 0A                                      ;  Case 55 ('U') of switch 00407EFE
00407F2F  |>  8D75 9F       lea     esi, dword ptr [ebp-61]                      ;  此时，eax存放着之前的运算结果
00407F32  |>  31D2          /xor     edx, edx                                    ;  这个循环把十六进制数转化成对应的十进制字串
00407F34  |.  F7F1          |div     ecx                                         ;  除以10
00407F36  |.  80C2 30       |add     dl, 30
00407F39  |.  80FA 3A       |cmp     dl, 3A
00407F3C  |.  72 03         |jb      short 00407F41
00407F3E  |.  80C2 07       |add     dl, 7
00407F41  |>  4E            |dec     esi
00407F42  |.  8816          |mov     byte ptr [esi], dl
00407F44  |.  09C0          |or      eax, eax
00407F46  |.^ 75 EA         \jnz     short 00407F32
00407F48  |.  8D4D 9F       lea     ecx, dword ptr [ebp-61]
00407F4B  |.  29F1          sub     ecx, esi
00407F4D  |.  8B55 E0       mov     edx, dword ptr [ebp-20]
00407F50  |.  83FA 10       cmp     edx, 10
00407F53  |.  72 01         jb      short 00407F56
00407F55  |.  C3            retn
00407F56  |>  29CA          sub     edx, ecx
00407F58  |.  76 0A         jbe     short 00407F64
00407F5A  |.  01D1          add     ecx, edx
00407F5C  |.  B0 30         mov     al, 30
00407F5E  |>  4E            /dec     esi
00407F5F  |.  8806          |mov     byte ptr [esi], al
00407F61  |.  4A            |dec     edx
00407F62  |.^ 75 FA         \jnz     short 00407F5E
00407F64  |>  C3            retn
00407F65  |>  80F9 53       cmp     cl, 53
00407F68  |.^ 0F85 E0FEFFFF jnz     00407E4E
00407F6E  |.  B9 01000000   mov     ecx, 1
00407F73  |.  C3            retn
00407F74  |>  80F9 53       cmp     cl, 53
00407F77  |.^ 0F85 D1FEFFFF jnz     00407E4E
00407F7D  |.  66:8338 01    cmp     word ptr [eax], 1
00407F81  |.  76 0F         jbe     short 00407F92
00407F83  |.  89C2          mov     edx, eax
00407F85  |.  8D45 F4       lea     eax, dword ptr [ebp-C]
00407F88  |.  E8 0BFDFFFF   call    00407C98
00407F8D  |.  8B75 F4       mov     esi, dword ptr [ebp-C]
00407F90  |.  EB 42         jmp     short 00407FD4
00407F92  |>  31C9          xor     ecx, ecx
00407F94  |.  C3            retn
00407F95  |>  80F9 53       cmp     cl, 53
00407F98  |.^ 0F85 B0FEFFFF jnz     00407E4E
00407F9E  |.  89C6          mov     esi, eax
00407FA0  |.  AC            lods    byte ptr [esi]
00407FA1  |.  0FB6C8        movzx   ecx, al
00407FA4  |.  EB 35         jmp     short 00407FDB
00407FA6  |>  BE DC394000   mov     esi, 004039DC
00407FAB  |.  EB 05         jmp     short 00407FB2
00407FAD  |>  BE 3C3A4000   mov     esi, 00403A3C
00407FB2  |>  80F9 53       cmp     cl, 53
00407FB5  |.^ 0F85 93FEFFFF jnz     00407E4E
00407FBB  |.  89C2          mov     edx, eax
00407FBD  |.  8D45 F0       lea     eax, dword ptr [ebp-10]
00407FC0  |.  FFD6          call    esi
00407FC2  |.  8B75 F0       mov     esi, dword ptr [ebp-10]
00407FC5  |.  89F0          mov     eax, esi
00407FC7  |.  EB 0B         jmp     short 00407FD4
00407FC9  |>  80F9 53       cmp     cl, 53
00407FCC  |.^ 0F85 7CFEFFFF jnz     00407E4E
00407FD2  |.  89C6          mov     esi, eax
00407FD4  |>  09F6          or      esi, esi
00407FD6  |.^ 74 BA         je      short 00407F92
00407FD8  |.  8B4E FC       mov     ecx, dword ptr [esi-4]
00407FDB  |>  3B4D E0       cmp     ecx, dword ptr [ebp-20]
00407FDE  |.  77 01         ja      short 00407FE1
00407FE0  |.  C3            retn
00407FE1  |>  8B4D E0       mov     ecx, dword ptr [ebp-20]
00407FE4  |.  C3            retn
00407FE5  |>  80F9 53       cmp     cl, 53
00407FE8  |.^ 0F85 60FEFFFF jnz     00407E4E
00407FEE  |.  89C6          mov     esi, eax
00407FF0  |.  57            push    edi
00407FF1  |.  89C7          mov     edi, eax
00407FF3  |.  30C0          xor     al, al
00407FF5  |.  8B4D E0       mov     ecx, dword ptr [ebp-20]
00407FF8  |.  E3 05         jecxz   short 00407FFF
00407FFA  |.  F2:AE         repne   scas byte ptr es:[edi]
00407FFC  |.  75 01         jnz     short 00407FFF
00407FFE  |.  4F            dec     edi
00407FFF  |>  89F9          mov     ecx, edi
00408001  |.  29F1          sub     ecx, esi
00408003  |.  5F            pop     edi
00408004  |.  C3            retn
00408005  |>  80F9 50       cmp     cl, 50
00408008  |.^ 0F85 40FEFFFF jnz     00407E4E
0040800E  |.  C745 E0 08000>mov     dword ptr [ebp-20], 8
00408015  |.  B9 10000000   mov     ecx, 10
0040801A  |.^ E9 10FFFFFF   jmp     00407F2F
0040801F  |>  B7 01         mov     bh, 1
00408021  |.  EB 02         jmp     short 00408025
00408023  |>  B7 00         mov     bh, 0
00408025  |>  89C6          mov     esi, eax
00408027  |.  B3 00         mov     bl, 0
00408029  |.  80F9 47       cmp     cl, 47                                       ;  Switch (cases 45..4E)
0040802C  |.  74 3F         je      short 0040806D
0040802E  |.  B3 01         mov     bl, 1
00408030  |.  80F9 45       cmp     cl, 45
00408033  |.  74 38         je      short 0040806D
00408035  |.  B3 02         mov     bl, 2
00408037  |.  80F9 46       cmp     cl, 46
0040803A  |.  74 12         je      short 0040804E
0040803C  |.  B3 03         mov     bl, 3
0040803E  |.  80F9 4E       cmp     cl, 4E
00408041  |.  74 0B         je      short 0040804E
00408043  |.  80F9 4D       cmp     cl, 4D
00408046  |.^ 0F85 02FEFFFF jnz     00407E4E
0040804C  |.  B3 04         mov     bl, 4                                        ;  Case 4D ('M') of switch 00408029
0040804E  |>  B8 12000000   mov     eax, 12                                      ;  Cases 46 ('F'),4E ('N') of switch 00408029
00408053  |.  8B55 E0       mov     edx, dword ptr [ebp-20]
00408056  |.  39C2          cmp     edx, eax
00408058  |.  76 25         jbe     short 0040807F
0040805A  |.  BA 02000000   mov     edx, 2
0040805F  |.  80F9 4D       cmp     cl, 4D
00408062  |.  75 1B         jnz     short 0040807F
00408064  |.  0FB615 F8B445>movzx   edx, byte ptr [45B4F8]
0040806B  |.  EB 12         jmp     short 0040807F
0040806D  |>  8B45 E0       mov     eax, dword ptr [ebp-20]                      ;  Cases 45 ('E'),47 ('G') of switch 00408029
00408070  |.  BA 03000000   mov     edx, 3
00408075  |.  83F8 12       cmp     eax, 12
00408078  |.  76 05         jbe     short 0040807F
0040807A  |.  B8 0F000000   mov     eax, 0F
0040807F  |>  53            push    ebx
00408080  |.  50            push    eax
00408081  |.  52            push    edx
00408082  |.  8D45 8F       lea     eax, dword ptr [ebp-71]
00408085  |.  89F2          mov     edx, esi
00408087  |.  0FB6CF        movzx   ecx, bh
0040808A  |.  E8 EB1C0000   call    00409D7A
0040808F  |.  89C1          mov     ecx, eax
00408091  |.  8D75 8F       lea     esi, dword ptr [ebp-71]
00408094  \.  C3            retn

　　至此，我们找出了关键算法所在的位置。在无数的汇编指令中翻找出关键算法的秘诀在于，你要定位存放算出序列号的内存地址，并一步一步跟踪，发现该内存地址写入了数据。那么这时所处的汇编指令之前肯定就是对于序列号的处理算法。好了，这个crackme很简单，直接打开http://www.cnblogs.com/ZRBYYXDM/p/5115596.html中搭建的框架，并修改OnBtnDecrypt函数如下：

void CKengen_TemplateDlg::OnBtnDecrypt() 
{
    // TODO: Add your control notification handler code here
    CString str;
    GetDlgItemText( IDC_EDIT_NAME,str );                    //获取用户名字串基本信息。
    int len = str.GetLength();

    if ( len >= 6 ){                                        //格式控制。
        unsigned int sum = 0;
        for ( int i = 0 ; i != 6 ; i++ )
            sum += ( str[i] * 2 );

        CString PassWord;
        PassWord.Format( "%d",sum + len * 2 );
        SetDlgItemText( IDC_EDIT_PASSWORD,PassWord );
    }
    else
        MessageBox( "用户名格式错误！" );
}

再在OnInitDialog中添加此代码修改标题：SetWindowText(_T("crackme4_Keygen"));

运行效果：

发表于 2016-01-13 15:28 顾南星阅读(1187) 评论(0) 编辑收藏举报

会员力量，点亮园子希望

刷新页面返回顶部

破解 crackme4（深入底层抓出关键算法）

公告