新手破解练习Crackme160之024 - Chafe.2

与上一个情况相同, 只能在xp下运行, win10无法输入

1. 暴力破解, xp下OD载入程序, 打开智能搜索界面, 定位到失败处004012EB, 向上找到关键跳0040128A, 改为jmp 00401301到成功分支, 保存~ 两个框随便一个聚焦一下就可以进入成功分支~

2. 正常破解, 与23上一个类似的, 程序也是通过GetDlgItemInt获取注册码(00401286处), GetWindowTextA获取用户名(0040129A处), 接下来就是算法:
   1). 004012AD处 循环16次 0x58455443 + 用户名[i]以后的值, 用户名不够16位的0补齐,
   2). 004012B9处 eax += 注册码
   3). [0x4012D9] ^= eax
   4). eax = eax >> 0x10
   5). [0x4012D9] -= ax(eax高位)
   6). eax=[esi], ebx ^=eax, ecx=0x3E
   7). ecx--, 跳6).
   8). ebx ?== 0xAFFCCFFB
   因为0x3E个[esi]是固定的, 所以由8).反算回6).后的ebx也是固定的, 得到的值是 0x5426EB58, 再反算回2).的固定值是: 0x580C3BA3, 所以1)~2)算出来的值等于这个就成功了,
   注册机代码如下:

#include <stdio.h>

int main() {
	unsigned char data[0x3E*4+1] = { 0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xFC, 0x8B, 0x45, 0x0C, 0x83, 0xF8, 0x10, 0x75, 0x0D, 0x6A, 0x00, 0xE8, 0x6B, 0x02, 0x00, 0x00, 0x33, 0xC0, 0xC9,
0xC2, 0x10, 0x00, 0x83, 0xF8, 0x0F, 0x75, 0x0E, 0x8B, 0x45, 0x08, 0xE8, 0x18, 0x01, 0x00, 0x00, 0x33, 0xC0, 0xC9, 0xC2, 0x10, 0x00, 0x83, 0xF8,
0x01, 0x75, 0x06, 0x33, 0xC0, 0xC9, 0xC2, 0x10, 0x00, 0x3D, 0x11, 0x01, 0x00, 0x00, 0x0F, 0x85, 0xE7, 0x00, 0x00, 0x00, 0x8B, 0x45, 0x14, 0x3B,
0x05, 0x60, 0x31, 0x40, 0x00, 0x75, 0x1A, 0x6A, 0x00, 0x68, 0x96, 0x30, 0x40, 0x00, 0x68, 0xA7, 0x30, 0x40, 0x00, 0xFF, 0x75, 0x08, 0xE8, 0x17,
0x02, 0x00, 0x00, 0x33, 0xC0, 0xC9, 0xC2, 0x10, 0x00, 0x3B, 0x05, 0x58, 0x31, 0x40, 0x00, 0x74, 0x0C, 0x3B, 0x05, 0x54, 0x31, 0x40, 0x00, 0x0F,
0x85, 0xAE, 0x00, 0x00, 0x00, 0xC7, 0x05, 0xD9, 0x12, 0x40, 0x00, 0x54, 0x45, 0x58, 0x00, 0x6A, 0x00, 0x8D, 0x45, 0xFC, 0x50, 0x6A, 0x64, 0xFF,
0x35, 0x50, 0x31, 0x40, 0x00, 0xE8, 0xBC, 0x01, 0x00, 0x00, 0x83, 0x7D, 0xFC, 0x00, 0x74, 0x5F, 0x50, 0x6A, 0x14, 0x68, 0x6C, 0x31, 0x40, 0x00,
0xFF, 0x35, 0x54, 0x31, 0x40, 0x00, 0xE8, 0xAF, 0x01, 0x00, 0x00, 0x85, 0xC0, 0x74, 0x48, 0xA1, 0x0B, 0x30, 0x40, 0x00, 0xBB, 0x6C, 0x31, 0x40,
0x00, 0x03, 0x03, 0x43, 0x81, 0xFB, 0x7C, 0x31, 0x40, 0x00, 0x75, 0xF5, 0x5B, 0x03, 0xC3, 0x31, 0x05, 0xD9, 0x12, 0x40, 0x00, 0xC1, 0xE8, 0x10,
0x66, 0x29, 0x05, 0xD9, 0x12, 0x40, 0x00, 0xBE, 0xEC, 0x11, 0x40, 0x00, 0xB9, 0x3E, 0x00, 0x00, 0x00, 0x33, 0xDB, 0xEB, 0x04, 0x00, 0x00, 0x00,
0x00, 0xAD, 0x33, 0xD8, 0x49, 0x75, 0xFA, 0x81,0 };
	unsigned long eax, key=0xAFFCCFFB, rlt=0x58455443;
	for(int i=(0x3E - 1)*4; i>=0; i-=4){
		eax = *(unsigned long *)&data[i];
		key ^= eax;
	}
	//3.4.5步反算,没整明白,参考高手的 
	key = (key << 24) + (key >> 8); //调整字节顺序
	key = ((key >> 0x10) << 0x10) + ((key & 0xffff) + ((key >> 0x10) ^ 0x58));
	key ^= 0x584554;
	printf("key为: 0x%X\n\n", key); 
	//以上算出固定值: key = 0x580C3BA3 
	char user[0x10 + 1] = {0};
	printf("请输入用户名: "); 
	scanf("%s", user);
	for(int i=0; i<0x10; i++){
		eax = *(unsigned long*)&user[i];
		rlt += eax;
	}
	rlt = key - rlt;
	printf("系列号为: %lu", rlt); 
    getchar();getchar();
    return 0;
}

运行结果示例:
请输入用户名: abcde
系列号为: 899241841

相关软件与破解示例程序可到前十个练习处下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~