新手破解练习Crackme160之013 - badboy
这个程序是两个版本整合在一起了, OD搜索界面没发现有用的东东, 先用PEiD分析是VB写的, 然后用VB Decompiler分析
是P-Code方式编译的, 由于OD无法定位跟踪就没办法暴力破解了, OD上没法玩了, 我们就直接在VB Decompiler上看每个事件的代码
- 左侧 Code -> Form1 -> Combo1_Click_405550, 右侧:
Private Sub Combo1_Click() '405550
'Data Table: 403D90
Dim var_15C As Variant
Dim var_1CC As Variant
loc_405374: var_15C = ((Day(Now) * Day(23)) + (Month(Now) * Month(2)))
loc_4053A2: var_1CC = (var_15C + (Year(Now) * Year(3)))
loc_4053DB: var_1D0 = CStr((((CLng(var_1CC) + CLng(var_1CC)) + CLng((Day(14) * Year(2020)))) + CLng((Day(14) * Year(2020)))))
loc_4053EA: Me.Command1.Visible = True
loc_4053FE: Me.Command3.Visible = False
loc_405412: Me.Frame3.Visible = False
loc_405435: If (Me.Combo1.ListIndex = 1) Then (如果选择的是第一个, 程序都是从0开始的, 所以就是排在第二的那个了)
loc_405444: Me.Command2.Visible = True
loc_405458: Me.Command4.Visible = False
loc_40546C: Me.Frame1.Visible = True
loc_405480: Me.Frame4.Visible = False
loc_405494: Me.Frame2.Visible = False
loc_4054A7: Form1.Height = CDbl(2265)
loc_4054B8: Me.Text2.Visible = True
loc_4054C3: Else (那这里就是选择第0个了)
loc_4054CF: Me.Command4.Visible = True (这个为true, 就是说明这个显示了, 其它隐藏了, 那我们就看这个对应的事件)
loc_4054E3: Me.Command2.Visible = False
loc_4054F7: Me.Frame4.Visible = True
loc_40550C: Me.Label3.Caption = var_1D0
loc_405520: Me.Frame1.Visible = False
loc_405534: Me.Frame2.Visible = False
loc_405547: Form1.Height = CDbl(2265)
loc_40554C: End If
loc_40554C: Exit Sub
End Sub
继续看这里Code -> Form1 -> Command4_Click_4052AC, 右侧代码:
Private Sub Command4_Click() '4052AC
'Data Table: 403D90
loc_4051DA: If (Me.Text3.Text = Me.Label3.Caption) Then
loc_4051E9: Me.Command2.Visible = False
loc_4051FD: Me.Frame3.Visible = False
loc_405211: Me.Command1.Visible = False
loc_405225: Me.Command5.Visible = False
loc_405239: Me.Command3.Visible = True
loc_40524D: Me.Text2.Visible = False
loc_405261: Me.Frame3.Visible = True
loc_405275: Me.Command4.Visible = False
loc_40528A: Me.Label3.Caption = "Congratulation !"
loc_405295: Else
loc_4052A2: Me.Text3.Text = "Try Again!"
loc_4052AA: End If
loc_4052AA: Exit Sub
End Sub
代码比较简单, 如果输入框的值等于label3的Caption值就显示"Congratulation !", 我们找找看label3的Caption值是什么
不就成功了吗, 返回上段代码, 我们看到了其值是var_1D0, 这个又是三行代码算出来的:
var_15C = ((Day(Now) * Day(23)) + (Month(Now) * Month(2)))
var_1CC = (var_15C + (Year(Now) * Year(3)))
var_1D0 = CStr((((CLng(var_1CC) + CLng(var_1CC)) + CLng((Day(14) * Year(2020)))) + CLng((Day(14) * Year(2020)))))
那我们直接就用网页写VB代码执行上面的算法, 如下代码保存为KeyGen.hta就可以直接运行得到系列号了
<html>
<head>
<title>1.0注册码</title>
</head>
<body>
<div>系列号为: <span id="rlt"></span></div>
<script language="VBScript">
window.resizeTo 300,90 '设置窗体大小
a = Day(Now) * Day(23) + Month(Now) * Month(2)
b = a + Year(Now) * Year(3)
c = 2 * b + 2 * Day(14) * Year(2020)
document.getElementById("rlt").innerHTML = c
</script>
</body>
</html>
也可以直接写VBS代码, 如下代码保存为KeyGen.vbs, 也可以直接运行
no = 2 * (Day(Now) * Day(23) + Month(Now) * Month(2) + Year(Now) * Year(3)) + 2 * Day(14) * Year(2020)
msgbox "系列号: " & no, 0, "系列号1.0"
- 同理, 从2.0版本的按钮事件 Code -> Form1 -> Command2_Click_4058EC 代码中取得算法如下:
1). hta (网页写的界面比vbs的漂亮)
<html>
<head>
<title>2.0注册码</title>
</head>
<body>
<script language="VBScript">
window.resizeTo 300,120
sub btn_click
name = document.getElementById("name").value
if ((Len(name) < 5) or ( Len(name) > 30)) Then
document.getElementById("name").value = "用户名5~30位"
exit sub
end if
str = "0110617121214051216101106141404110614140411091211100810101608040610121608100416"
c = 0
d = 0
n = 1
for i=4 to len(name)
c = CLng((CDbl(c) + (CDbl(Asc(Mid(name, CLng(i), 1))) * CInt(Mid(str, CLng((n * 3)), 3)))))
if (n + 1 >= 26) then n = 0
n = n + 1
next
n = 1
for i=4 to len(name)
d = d + CLng(CDbl(Asc(Mid(name, CLng(i), 1))) * CDbl(Asc(Mid(name, CLng((i - 1)), 1))) * CInt(Mid(str, CLng((n * 2)), 2)))
if (n + 1 >= 39) then n = 0
n = n + 1
next
document.getElementById("rlt").innerHTML = c & "-" & d
end sub
</script>
<div>用户名: <input type="text" id="name" style="width:120px" /> <input type="button" value="生成" onclick="btn_click" /></div>
<div>系列号: <span id="rlt"></span></div>
</body>
</html>
2). 下面用vbs来写:
do
name = inputbox("请输入用户名: ")
if name="" Then Wscript.Quit()
if ((Len(name) < 5) or (Len(name) > 30)) Then
msgbox("用户名5~30位")
else
exit do
end if
loop
str = "0110617121214051216101106141404110614140411091211100810101608040610121608100416"
c = 0
d = 0
n = 1
for i=4 to len(name)
c = CLng((CDbl(c) + (CDbl(Asc(Mid(name, CLng(i), 1))) * CInt(Mid(str, CLng((n * 3)), 3)))))
n = n + 1
if (n >= 39) then n = 0 '这里应该是26, 不能39, 3位, 3位的取, 只能最大取26次
next
n = 1
for i=4 to len(name)
d = d + CLng(CDbl(Asc(Mid(name, CLng(i), 1))) * CDbl(Asc(Mid(name, CLng((i - 1)), 1))) * CInt(Mid(str, CLng((n * 2)), 2)))
n = n + 1
if (n >= 39) then n = 0
next
msgbox "系列号: " & c & "-" & d, 0, "系列号2.0"
到此两个都正常破解完成了 VB Decompiler的反编译器灰常强大, 出来的代码基本上小调整就可以直接执行了,
1~160每个破解过程,在吾爱破解论坛都有高手破解过了,也有整理好现成的, 我这边主要就是自己动手操作的过程,与他们的不太一样
附上高手们的连接: 点击前往查看
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
新人入门教程"玩玩破解，写给新人看" 点击前往查看
我就是从这里开始的,对我这样的小白感觉超级友好~
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号