新手破解练习Crackme160之026 - Colormaster
-
暴力破解, 照例OD搜索提示关键字"Der Name muss mindestens 5 Chars haben", 定位到关键跳00402CE6, 再定位到成功分支关键跳0043036EB, 所以00402CE6改为jmp 004036F1, 保存搞定~
-
正常破解, 直接通过VB Decomiler分析按钮事件Code -> Form1 -> Command1_Click_402B10
Private Sub Command1_Click() '402B10
Dim var_4C As Form1.Label4
Dim var_48 As Variant
Dim var_124 As Variant
Dim var_12C As Me
Dim var_154 As Me
loc_00402BE1: Set var_4C = Form1.Label4
loc_00402BE6: var_124 = var_4C
loc_00402BF7: Set var_48 = Form1.Text1
loc_00402C00: var_11C = var_48
loc_00402C06: var_28 = var_48.Text
loc_00402C37: var_124.Caption = var_28
loc_00402C7F: Set var_48 = Form1.Text1
loc_00402C88: var_11C = var_48
loc_00402C8E: var_28 = var_48.Text
loc_00402CC6: var_124 = (Len(var_28) <= 4) //用户名得5位以上(abcde)
loc_00402CE6: If var_124 = 0 Then GoTo loc_00402D9C
loc_00402D6D: MsgBox(" Der Name muss mindestens 5 Chars haben ", 64, "Colormaster´s Crackme 7.0", 10, 10)
loc_00402D97: GoTo loc_0040379E
loc_00402D9C: ' Referenced from: 00402CE6
loc_00402DBE: call edi(var_48, Form1.Text1, Me, 0, 0, 0)
loc_00402DC7: var_11C = edi(var_48, Form1.Text1, Me, 0, 0, 0)
loc_00402DCD: var_28 = Text1.Text
loc_00402E46: For var_24 = 1 To Len(var_28) Step 1 //按用户名长度循环
loc_00402E4F: var_184 = var_178
loc_00402E6A: If var_184 = 0 Then GoTo loc_00403099
loc_00402E7E: call edi(var_4C, Form1.Text1)
loc_00402E87: var_11C = edi(var_4C, Form1.Text1)
loc_00402E8D: var_2C = Text1.Text
loc_00402EBE: var_118 = Asc(var_2C) //取第一位值
loc_00402ECF: call edi(var_50, Form1.Label1)
loc_00402ED1: var_12C = edi(var_50, Form1.Label1)
loc_00402EE5: call edi(var_48, Form1.Label2)
loc_00402EEE: var_124 = edi(var_48, Form1.Label2)
loc_00402EF4: var_28 = Label2.Caption //VB Decomiler Form属性查看可知 Label2.Caption = 432.4
loc_00402FA8: var_198 = var_12C
loc_00402FBC: Label2.Caption = CStr(((var_28 * var_118) * 17.79) / Hex(21))
loc_00403020: call edi(var_48, Form1.Text1) //Label2.Caption = CStr(((432.4 * user[0]) * 17.79) / 15)
loc_00403027: var_8010 = Text1.SetFocus
loc_00403065: SendKeys "{HOME}{DEL}", True
loc_00403086: Next var_24
loc_0040308C: var_184 = Next var_24
loc_00403094: GoTo loc_00402E64
loc_00403099: ' Referenced from: 00402E6A
loc_004030A7: call edi(var_4C, Form1.Label3, var_168, var_178)
loc_004030A9: var_124 = edi(var_4C, Form1.Label3, var_168, var_178)
loc_004030BD: call edi(var_48, Form1.Label1)
loc_004030C6: var_11C = edi(var_48, Form1.Label1)
loc_004030CC: var_28 = Label1.Caption //VB Decomiler Form属性查看可知 Label1.Caption = 0,
loc_00403123: Label1.Caption = CStr(Fix(var_28)) //后面分析可知,label1~5应该就是OD中那些内存变量,用于存储5段数据的
loc_0040316C: call edi(var_4C, Form1.Text1)
loc_0040316E: var_124 = edi(var_4C, Form1.Text1)
loc_00403182: call edi(var_48, Form1.Label4)
loc_0040318D: var_28 = Label4.Caption //VB Decomiler Form属性查看可知 Label4.Caption = "Label4"
loc_004031B2: Label4.MousePointer = var_28
loc_00403203: SendKeys "{END}", True
loc_00403220: call edi(var_4C, Form1.Label3)
loc_0040322B: var_2C = Label3.Caption //VB Decomiler Form属性查看可知 Label3.Caption = "Label3"
loc_00403251: call edi(var_54, Form1.Text1)
loc_0040325C: var_34 = Text1.Text
loc_0040327E: var_8018 = Asc(var_34)
loc_00403294: call edi(var_64, Form1.Label5)
loc_00403299: var_154 = edi(var_64, Form1.Label5)
loc_004032AA: call edi(var_48, Form1.Text1)
loc_004032B3: var_12C = edi(var_48, Form1.Text1)
loc_004032B9: var_28 = Text1.Text
loc_00403319: var_EC = (var_2C + Asc(var_28)) //var_EC = 循环计算结算+user[0]
loc_00403334: call edi(var_50, Form1.Label3)
loc_0040333D: var_134 = edi(var_50, Form1.Label3)
loc_00403343: var_30 = Label3.Caption
loc_004033AF: var_84 = Hex((var_30 - var_8018*0019h)) //var_84 = Hex(循环计算结算-user[0]*0x19)
loc_004033C3: call edi(var_58, Form1.Label3)
loc_004033CE: var_38 = Label3.Caption
loc_0040340E: var_B4 = Hex(0) //var_B4 = Hex(循环计算结算)
loc_00403422: call edi(var_5C, Form1.Text1)
loc_0040342D: var_3C = Text1.Text
loc_00403459: call edi(var_60, Form1.Text1)
loc_00403464: var_40 = Text1.Text
loc_0040351D: Text1.Caption = CStr(var_EC & var_84 & var_B4 & var_8020*Len(var_40)(-27))
loc_004035CB: call edi(var_48, Form1.Text2) //var_8020*Len(var_40)(-27) = user[0] * len(user) -27
loc_004035D6: var_28 = Text2.Text
loc_00403602: call edi(var_4C, Form1.Label5)
loc_0040360D: var_2C = Label5.Caption //VB Decomiler Form属性查看可知 Label5.Caption = "Label5"
loc_00403633: call edi(var_50, Form1.Text1)
loc_0040363E: var_30 = Text1.Text
loc_004036EB: If (var_28 = var_2C & CStr(Len(var_30)) & "-CM") + 1 = 0 Then GoTo loc_0040379C
loc_00403772: MsgBox(" Gratulation ,du hast es geschafft!", 64, "Colormaster´s Crackme 7.0", 10, 10)
loc_0040379C: ' Referenced from: 004036EB
loc_0040379E: ' Referenced from: 00402D97
loc_004037A7: GoTo loc_00403839
loc_00403838: Exit Sub
loc_00403839: ' Referenced from: 004037A7
End Sub
反编译出来的代码太乱, 头大, OD中的代码出现大量的内存地址变量, 将计算结果存来存去的, 看的好心酸~ 最好只好看大佬的结果了_, 然后再返回来跟上面的代码对比, 并加上注释, 基本的算法就出来了
最终的注册码就是这个 var_EC & var_84 & var_B4 & var_8020*Len(var_40)(-27) & CStr(Len(var_30)) & "-CM"), 下面便分别将6部分数据加进去, 即可得到注册码:
user = "abcde"; //user[0] = 'a' = 97;
var_for = int(user[0] * 432.4 * 17.79 / 15); //循环计算结算 = 49744
- var_1 = var_for + user[0]; // = 49841
- var_2 = Hex(var_for - user[0] * 0x19); // = B8D7
- var_3 = Hex(var_for); // = C250
- var_4 = user[0] * len(user) -27; // = 458
- var_5 = len(user); // = 5
- var_6 = "-CM";
注册机代码: keygen.vbs
user = inputbox("请输入用户名")
code = 0
ulen = len(user)
user0 = Asc(Mid(user, 1, 1))
var_for = Int(user0 * 432.4 * 17.79 / 15)
var_1 = var_for + user0
var_2 = Hex(var_for - user0 * 25)
var_3 = Hex(var_for)
var_4 = user0 * ulen - 27
var_5 = ulen
var_6 = "-CM"
code = CStr(var_1) & CStr(var_2) & CStr(var_3) & CStr(var_4) & CStr(var_5) & var_6
msgbox("用户名为: " & user & chr(13) & "注册码为: " & code)
运行结果示例:
** 用户名: abcde**
** 注册码: 49841B8D7C2504585-CM**
1~160每个破解过程,在吾爱破解论坛都有高手破解过了,也有整理好现成的, 我这边主要就是自己动手操作的过程,与他们的不太一样
附上高手们的连接: 点击前往查看
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
新人入门教程"玩玩破解，写给新人看" 点击前往查看
我就是从这里开始的,对我这样的小白感觉超级友好~
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号