新手破解练习Crackme160之001_Acid burn

暴力破解:
这个程序有三个地方需要破解,

  1. 去弹框
  2. 系列号模式
  3. 用户名和系列号模式

说明: 第一篇会加入对应的详细截图, 后面的章节将不带图,需要自己实操才能进步的快, 实在破解不了时,再去看大佬的文章参考一下~

下面开始暴力破解操作,
运行程序后第一个界面是一个提示框

  1. OD搜索(菜单->插件->中文搜索引擎->智能搜索)弹框关键字 "Welcome to this ..." 成功查找(Ctrl+F调出搜索框输入关键字搜索)到并双击定位到 0042F78B , 在LCG界面的0042F78B这行按一下F2加个断点, F9运行, 成功运行到断点处,

    一路F8到retn返回上一层到00425643, 前几行0042562F处有个关键跳转, 直接je改为jmp跳过这个弹框, 第一个破解搞定,

    先保存一个版本(LCG界面右键->复制到可执行文件->选择所有->全部复制->新界面右键->保存文件)

  2. 进入Serial / Name 界面, 点验证按钮提示"Sorry, The serial is incorect!" , 在OD中搜索, 成功定位到0042FA63, 向上几行0042FA5A看到关键跳,
    直接改jge为jmp, 住下执行又发现一个关键跳跳到失败去了, 所以继续改为不跳, jnz转nop, 成功搞定~, 保存起来!

  3. 进入Serial 界面, 点验证按钮提示"Try Again!" , 在OD中搜索, 成功定位到0042F4F8,0042FA5E,0042FB21三处,都F2加入断点, 重新点"Check it Baby!"按钮,在0042F4F8处停下, 继续向上看几行找关键跳, 0042F4D5, jnz转nop
    测试成功~ 保存, 到此3个都破解成功~

正常破解:

  1. 由Delphi Decomiler分析可知(吾爱破解的工具集挺好用,建议优先下载好), 系列号框的验证按钮入口地址为 0042F470, 在入口这行F2下断点单步跟踪可知, 0042F4CA "Hello Dude!"就是正确的答案

  2. 由Delphi Decomiler分析可知, 用户名和系列号模式的验证按钮入口地址为 0042F998, 单步分析算法

0042F998   55                     push    ebp

...

0042F9E3   E870B0FEFF             call    0041AA58
0042F9E8   8B45F0                 mov     eax, [ebp-$10]
0042F9EB   0FB600                 movzx   eax, byte ptr [eax]            ; esi = 取出用户名第一个字符
0042F9EE   8BF0                   mov     esi, eax
0042F9F0   C1E603                 shl     esi, $03                       ; esi = esi 左移 3
0042F9F3   2BF0                   sub     esi, eax                       ; esi = esi 减 第一个字符值
0042F9F5   8D55EC                 lea     edx, [ebp-$14]

* Reference to control TNS.Edit1 : TEdit
|
0042F9F8   8B83DC010000           mov     eax, [ebx+$01DC]

* Reference to : TImageList._PROC_0041AA58()
|
0042F9FE   E855B0FEFF             call    0041AA58
0042FA03   8B45EC                 mov     eax, [ebp-$14]
0042FA06   0FB64001               movzx   eax, byte ptr [eax+$01]        ; eax = 取出第二个字符值
0042FA0A   C1E004                 shl     eax, $04                       ; eax = eax 左移 4
0042FA0D   03F0                   add     esi, eax                       ; esi = esi + eax
0042FA0F   893554174300           mov     [$00431754], esi
0042FA15   8D55F0                 lea     edx, [ebp-$10]

* Reference to control TNS.Edit1 : TEdit
|
0042FA18   8B83DC010000           mov     eax, [ebx+$01DC]

* Reference to : TImageList._PROC_0041AA58()
|
0042FA1E   E835B0FEFF             call    0041AA58
0042FA23   8B45F0                 mov     eax, [ebp-$10]
0042FA26   0FB64003               movzx   eax, byte ptr [eax+$03]        ; eax = 取出第4个字符值
0042FA2A   6BF00B                 imul    esi, eax, $0B                  ; esi = esi 乘以 11
0042FA2D   8D55EC                 lea     edx, [ebp-$14]

* Reference to control TNS.Edit1 : TEdit
|
0042FA30   8B83DC010000           mov     eax, [ebx+$01DC]

* Reference to : TImageList._PROC_0041AA58()
|
0042FA36   E81DB0FEFF             call    0041AA58
0042FA3B   8B45EC                 mov     eax, [ebp-$14]
0042FA3E   0FB64002               movzx   eax, byte ptr [eax+$02]        ; eax = 取出第3个字符值
0042FA42   6BC00E                 imul    eax, eax, $0E                  ; eax = eax 乘以 14
0042FA45   03F0                   add     esi, eax                       ; esi = esi + eax
0042FA47   893558174300           mov     [$00431758], esi
0042FA4D   A16C174300             mov     eax, dword ptr [$0043176C]

* Reference to: Unit_00405A40.Proc_00406930
|
0042FA52   E8D96EFDFF             call    00406930                        ; 计算用户名长度
0042FA57   83F804                 cmp     eax, +$04                       ; 是否小于4
0042FA5A   7D1D                   jnl     0042FA79
0042FA5C   6A00                   push    $00

...

0042FA82   E8D1AFFEFF             call    0041AA58
0042FA87   8B45F0                 mov     eax, [ebp-$10]
0042FA8A   0FB600                 movzx   eax, byte ptr [eax]              ; eax = 取出第1个字符值
0042FA8D   F72D50174300           imul    dword ptr [$00431750]            ; eax = eax * 0x29

* Reference to GlobalVar_00431750
|
0042FA93   A350174300             mov     dword ptr [$00431750], eax      ; 变量 = eax
0042FA98   A150174300             mov     eax, dword ptr [$00431750]      ; eax = 变量
0042FA9D   010550174300           add     [$00431750], eax                ; 变量 = 变量 + eax (相当于翻一倍 * 2)
0042FAA3   8D45FC                 lea     eax, [ebp-$04]

* Possible String Reference to: 'CW'
|
0042FAA6   BAACFB4200             mov     edx, $0042FBAC                ; 得到字符串 "CW"

* Reference to: System.Proc_00403708
|
0042FAAB   E8583CFDFF             call    00403708
0042FAB0   8D45F8                 lea     eax, [ebp-$08]

* Possible String Reference to: 'CRACKED'
|
0042FAB3   BAB8FB4200             mov     edx, $0042FBB8                ; 得到字符串 "CRACKED"

* Reference to: System.Proc_00403708
|
0042FAB8   E84B3CFDFF             call    00403708
0042FABD   FF75FC                 push    dword ptr [ebp-$04]
0042FAC0   68C8FB4200             push    $0042FBC8
0042FAC5   8D55E8                 lea     edx, [ebp-$18]
0042FAC8   A150174300             mov     eax, dword ptr [$00431750]

* Reference to: SYSUTILS.IntToStr(Value:
|
0042FACD   E8466CFDFF             call    00406718
0042FAD2   FF75E8                 push    dword ptr [ebp-$18]
0042FAD5   68C8FB4200             push    $0042FBC8
0042FADA   FF75F8                 push    dword ptr [ebp-$08]
0042FADD   8D45F4                 lea     eax, [ebp-$0C]
0042FAE0   BA05000000             mov     edx, $00000005

* Reference to: System.Proc_004039AC
|
0042FAE5   E8C23EFDFF             call    004039AC
0042FAEA   8D55F0                 lea     edx, [ebp-$10]

* Reference to control TNS.Edit2 : TEdit
|
0042FAED   8B83E0010000           mov     eax, [ebx+$01E0]

* Reference to : TImageList._PROC_0041AA58()
|
0042FAF3   E860AFFEFF             call    0041AA58
0042FAF8   8B55F0                 mov     edx, [ebp-$10]
0042FAFB   8B45F4                 mov     eax, [ebp-$0C]

* Reference to: System.Proc_004039FC
|
0042FAFE   E8F93EFDFF             call    004039FC
0042FB03   751A                   jnz     0042FB1F
0042FB05   6A00                   push    $00

* Possible String Reference to: 'Congratz !!'
|
0042FB07   B9CCFB4200             mov     ecx, $0042FBCC

* Possible String Reference to: 'Good job dude =)'
|
0042FB0C   BAD8FB4200             mov     edx, $0042FBD8

* Reference to TApplication instance
|
0042FB11   A1480A4300             mov     eax, dword ptr [$00430A48]
0042FB16   8B00                   mov     eax, [eax]

* Reference to: Forms.Proc_0042A170
|
0042FB18   E853A6FFFF             call    0042A170
0042FB1D   EB18                   jmp     0042FB37
0042FB1F   6A00                   push    $00

* Possible String Reference to: 'Try Again!'
|
0042FB21   B974FB4200             mov     ecx, $0042FB74

* Possible String Reference to: 'Sorry , The serial is incorect !'
|
0042FB26   BA80FB4200             mov     edx, $0042FB80

...

0042FB73   C3                     ret

1). 取第一个字符 esi = user[0] << 0x3 - user[0]
2). 取第二个字符 esi += user[1] << 0x4 + user[1]
3). 取第四个字符 esi += user[3] * 0xB
4). 取第三个字符 esi += user[2] *0xE
5). if(len(user) < 0x4)
6). 取第一个字符 eax = user[0] * 0x29 * 2
7). 拼接字符串 str = CW-eax(10)-CRACKED
8). 比较str与serial
由此可知1).~4).是没什么用的, 输入用户名后, 系列号直接就用计算器就可以算出来, 比如,
用户名为: 52pojie.cn,
那么算法为: '5' * 0x29 * 2 = 0x35 * 0x29 * 2 = 0x10FA = 4346,
系列号为: CW-4346-CRACKED

这是160个软件part1
这是160个软件part2

1~160每个破解过程,在吾爱破解论坛都有高手破解过了,也有整理好现成的, 我这边主要就是自己动手操作的过程,与他们的不太一样
附上高手们的连接: 点击前往查看
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

新人入门教程"玩玩破解，写给新人看" 点击前往查看
我就是从这里开始的,对我这样的小白感觉超级友好~

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
OD界面布局

posted @ 2024-04-03 17:10  hankerstudio  阅读(249)  评论(0)    收藏  举报