新手破解练习Crackme160之022 - CarLitoZ.1

1. 改路径, 程序是VB写的, 用VB Decomiler查看form的load事件看到程序会读取C:\Windows\MTR.dat这个文件, 不管三七二十一, 先把路径改了, 在C盘玩总不放心, 用UE打开, 搜索"c", 差不多在00001640h处看到了完整的路径, 把C:\Windows\MTR.dat改成.\MTR.dat, 多余的字符全用00顶掉, 保存, 这样路径就改成本目录下了,

2. 暴力破解, 有两种方法可以暴破~
   1). OD定位到错误提示处00402F51, 向上找关键跳, 找到00402DE9, nop掉保存, 暴破成功~
   2). 因为程序是通过文件来验证是否注册过的, 所以我们直接把正确答案写入到文件即可, 从注册事件成功分支可知, 注册成功后, 会向文件中第45个位置处写入"trv2156j0e", 即, 正确答案为: " trv2156j0e"(不包含引号), 前面45个可随意字符

3. 正常破解, VB Decomiler查看注册按钮事件,

Private Sub reg_Click() '402D20
  Dim var_1C As Variant
  loc_00402D7E: var_8004 = Crack.rgr
  loc_00402DB0: var_8008 = (global_52 = 1)
  loc_00402DE9: If var_8008 = 0 Then GoTo loc_00402F49
  loc_00402DEF: var_3C = "CrackMe v1.0"
  loc_00402E05: var_2C = "Registration Successful"
  loc_00402E19: var_800C = MsgBox(var_2C, 48, var_3C, var_4C, var_5C)
  loc_00402E4E: Open ".\MTR.dat" For Binary As #CInt(global_68) Len = -1
  loc_00402E72: Put #CInt(global_68), 45, "trv2156j0e"
  loc_00402E89: Close #CInt(global_68)
  loc_00402EAB: Crack.info.Caption = "REGISTERED"
  loc_00402EE3: Crack.reg.Enabled = False
  loc_00402F16: Set var_1C = Crack.Text
  loc_00402F23: var_1C.Enabled = False
  loc_00402F2B: If var_1C >= 0 Then GoTo loc_00402F3F
  loc_00402F39: var_1C = CheckObj(var_1C, global_004022C0, 140)
  loc_00402F3F: ' Referenced from: 00402F2B
  loc_00402F49: ' Referenced from: 00402DE9
  loc_00402F51: var_64 = " Wrong Code! Try Again"
  loc_00402F73: var_801C = MsgBox(var_2C, 16, var_3C, var_4C, var_5C)
  loc_00402FB0: Crack.Text.Text = global_0040235C
  loc_00402FE1: GoTo loc_00403011
  loc_00403010: Exit Sub
  loc_00403011: ' Referenced from: 00402FE1
End Sub

第二行又调用了一个内部方法Crack.rgr, 我们进入方法查看

Public Sub rgr() '403230
  loc_00403267: var_368 = Me
  loc_004033A9: var_1C = abt.Label1.Caption
  loc_004033F6: var_20 = abt.Label1.Caption
  loc_00403443: var_24 = abt.Label1.Caption
  loc_00403490: var_28 = abt.Label1.Caption
  loc_004034DD: var_2C = abt.Label1.Caption
  loc_0040352A: var_30 = abt.Label1.Caption
  loc_00403577: var_34 = abt.Label1.Caption
  loc_004035C4: var_38 = abt.Label1.Caption
  loc_004035E4: Me = var_368.UnkVCall_00000308h
  loc_004035FA: var_18 = var_368.UnkVCall_00000308h.MousePointer
  loc_00403892: var_8034 = Mid(var_1C, 6, 1) + Mid(var_20, 9, 1) + Mid(var_24, 143, 1) + Mid(var_28, 16, 1) + Mid(var_2C, 161, 1) + Mid(var_30, 171, 1)
  loc_004038B7: var_8040 = (var_18 = var_8034 + Mid(var_34, 166, 1) + Mid(var_38, 168, 1))
  loc_004039D9: If var_8040 = 0 Then GoTo loc_004039FD
  loc_004039F7: global_52 = CInt(1)
  loc_004039FD: ' Referenced from: 004039D9
  loc_00403A02: GoTo loc_00403B55
  loc_00403B54: Exit Sub
  loc_00403B55: ' Referenced from: 00403A02
End Sub

明显这个算法就是从关于我们提示框内容(abt.Label1.Caption)中获取对应位置的值连起来, 内容如下:

"bPe CrackMe   v1.0                                                                                                                           This CrackMe it's to trainer your VB cracking ability                                                                                                                           Developed by CarLitoZ"

取位置6, 9, 143, 16, 161, 171, 166, 168, 这些字符对应的是r+k+h+1+o+y+i+e = rkh1oyie, 这个串输入测试, 注册成功!~

相关软件与破解示例程序可到前十个练习处下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~