新手破解练习Crackme160之038 - CyberBlade.2 (p-code)

暴力破解, 因为这个应用是VB p-code编译的, 正常途径OD已经没办法暴力破解了, 用VB Decomiler分析按钮点击事件00408C处为第一个关键跳, OD中查看对应代码值是FF1C5500, 用UE打开源应用, 搜索到位置(0000d68bh左右), 因为OD无法修改, 所以我们就尝试直接在UE中修改, 经过无数次尝试, 发现了一点点小规律, 其中的1C中1是if语句, 改为1D 程序变成了 if not, 后面的00控制了end if的范围, 我改为02, 即FF1C5500改为了FF1D5502, 程序竟然跳过了所有的判断, , 将中间的55改为了65, 发现成功分支的判断条件也变了, 这个是意外的惊喜, 来看下来修改前,与修改后的对比
修改前代码:

Private Sub Command1_Click() '40E680
  'Data Table: 402AEC
  Dim var_11C As Variant
  Dim var_176 As Integer
  loc_40E28C: If (Me.txtname.Text = vbNullString) Then
  loc_40E2B0:   MsgBox("You have to enter you name first.", &H40, "Error", var_FC, var_11C)
  loc_40E2C0:   Exit Sub
  loc_40E2C1: End If
  loc_40E2E1: If (Me.txtkey.Text = vbNullString) Then
  loc_40E305:   MsgBox("You have to enter a key first.", &H40, "Error", var_FC, var_11C)
  loc_40E315:   Exit Sub
  loc_40E316: End If
  loc_40E336: If (Me.txtkey.Text = vbNullString) Then
  loc_40E35A:   MsgBox("You have to enter at least 5 chars.", &H40, "Error", var_FC, var_11C)
  loc_40E36A:   Exit Sub
  loc_40E36B: End If
  loc_40E393: For var_14C = 1 To CVar(Len(Me.txtname.Text)): var_12C = var_14C 'Variant
  loc_40E3C1:   var_FC = Mid(CVar(Me.txtname.Text), CLng(var_12C), 1)
  loc_40E3D5:   var_11C = var_94 & CVar(Asc(CStr(var_FC))) 
  loc_40E3D9:   var_94 = var_11C 'Variant
  loc_40E3EF: Next var_14C 'Variant
  loc_40E3F5: ' Referenced from: 40E422
  loc_40E404: If (Len(var_94) > 9) Then
  loc_40E41E:   var_94 = Fix((var_94 / 3.141592654)) 'Variant
  loc_40E422:   GoTo loc_40E3F5
  loc_40E425: End If
  loc_40E449: var_94 = (var_94 Xor &H30F85678 - CVar(global_76)) 'Variant
  loc_40E45A: For var_170 = 1 To 10: var_12C = var_170 'Variant
  loc_40E489:   If (Me.txtkey.Text = global_52(CLng(var_12C))) Then
  loc_40E48C:   End If
  loc_40E48F: Next var_170 'Variant
  loc_40E4DE: If ((CVar(Me.txtkey.Text) - var_94) = CVar(Len(Me.txtname.Text))) Then
  loc_40E502:   MsgBox("Wow, you have found a correct key!", &H40, "Correct key", var_FC, var_11C)
  loc_40E533:   MsgBox("Mail me, how you got it: CyberBlade@gmx.net ", &H40, "Correct key!", var_FC, var_11C)
  loc_40E550:   Me.Command2.Caption = "Exit"
  loc_40E558:   GoTo loc_40E66D
  loc_40E55B: End If
  ......
  loc_40E67F: Exit Sub
End Sub

修改后代码:

Private Sub Command1_Click() '40E680
  'Data Table: 402AEC
  Dim var_AC As Variant
  Dim var_DC As Variant
  Dim var_11C As Variant
  Dim var_176 As Integer
  loc_40E28C: If Not (Me.txtname.Text = vbNullString) Then
  loc_40E2B0:   MsgBox("You have to enter you name first.", &H40, "Error", var_FC, var_11C)
  loc_40E2C0:   Exit Sub
  loc_40E2E1:   If (Me.txtkey.Text = vbNullString) Then
  loc_40E305:     MsgBox("You have to enter a key first.", &H40, "Error", var_FC, var_11C)
  loc_40E315:     Exit Sub
  loc_40E316:   End If
  loc_40E336:   If (Me.txtkey.Text = vbNullString) Then
  loc_40E35A:     MsgBox("You have to enter at least 5 chars.", &H40, "Error", var_FC, var_11C)
  loc_40E36A:     Exit Sub
  loc_40E36B:   End If
  loc_40E393:   For var_14C = 1 To CVar(Len(Me.txtname.Text)): var_12C = var_14C 'Variant
  loc_40E3C1:     var_FC = Mid(CVar(Me.txtname.Text), CLng(var_12C), 1)
  loc_40E3D5:     var_11C = var_94 & CVar(Asc(CStr(var_FC))) 
  loc_40E3D9:     var_94 = var_11C 'Variant
  loc_40E3EF:   Next var_14C 'Variant
  loc_40E3F5:   ' Referenced from: 40E422
  loc_40E404:   If (Len(var_94) > 9) Then
  loc_40E41E:     var_94 = Fix((var_94 / 3.141592654)) 'Variant
  loc_40E422:     GoTo loc_40E3F5
  loc_40E425:   End If
  loc_40E449:   var_94 = (var_94 Xor &H30F85678 - CVar(global_76)) 'Variant
  loc_40E45A:   For var_170 = 1 To 10: var_12C = var_170 'Variant
  loc_40E489:     If (Me.txtkey.Text = global_52(CLng(var_12C))) Then
  loc_40E48C:     End If
  loc_40E48F:   Next var_170 'Variant
  loc_40E4B0:   var_DC = (CVar(Me.txtkey.Text) - var_94)
  loc_40E4CA:   var_AC = CVar(Len(Me.txtname.Text)) 'Long
  loc_40E4D1: End If
  loc_40E4DE: If (var_DC = var_AC) Then
  loc_40E502:   MsgBox("Wow, you have found a correct key!", &H40, "Correct key", var_FC, var_11C)
  loc_40E533:   MsgBox("Mail me, how you got it: CyberBlade@gmx.net ", &H40, "Correct key!", var_FC, var_11C)
  loc_40E550:   Me.Command2.Caption = "Exit"
  loc_40E558:   GoTo loc_40E66D
  loc_40E55B: End If
  ......
  loc_40E67F: Exit Sub
End Sub

这样看起来马上就要成功了的样子, 不输入数据的情况下已经直接执行到成功分支前面来了, 就差一个判断了, 我们用同样的方法改掉这个判断的条件就可以了, 找到0040E4DE对应的代码是FF1CEF02, 改为 FF1DEF02, If 变成了 if Not 另存UE, 暴破成功, 我会不会是第一个暴破成功p-code程序的呢, ^ _ ^

正常破解, p-code编译的, OD中也完全看不懂代码, 没什么规律的样子, 先不管, 直接看VB Decomiler代码吧, 前面判断直接跳过, 到循环部分才是真正的算法,
for(i=0; i<len; i++){
var_FC = Mid(name, i, 1)
var_94 = var_94 & CVar(Asc(CStr(var_FC)))
}
while(len(var_94) > 9){
var_94 = Fix((var_94 / 3.141592654))
}
得到一个小于等于9位的整数
var_94 = (var_94 Xor &H30F85678 - CVar(global_76))

if( key == global_52( ? ) ) { } 这里没做事, 应该是多余的
if ( key == (var_94+ len)){ 成功 } else { 失败 }

global_52, 与 global_76的数据是在Form_Load_40E1B4事件中初始化的
loc_40E04C: global_52(1) = CStr(&H164643F6)
loc_40E065: global_52(2) = CStr(&H28CFD34E)
loc_40E08B: global_52(3) = CStr(Fix((CDbl(&H1BC34652) * 1.5)))
loc_40E0B1: global_52(4) = CStr(Fix((CDbl(&H2C7F39C9) * 0.524)))
loc_40E0D7: global_52(5) = CStr(Fix((CDbl(&H38E1D5DB) * 0.3453)))
loc_40E0FD: global_52(6) = CStr(Fix((CDbl(&H1B32F187) * 1.435)))
loc_40E123: global_52(7) = CStr(Fix((CDbl(&H2525C10B) * 0.894)))
loc_40E149: global_52(8) = CStr(Fix((CDbl(&HDFE5AFB) * 1.65)))
loc_40E189: global_52(9) = CStr(Fix((CDbl(&HF2C31BB) * 0.834)))
loc_40E1AF: global_52(&HA) = CStr(Fix((CDbl(&H15236D15) * 2.4)))

loc_40E164: global_76 = CLng(Fix((CDbl(global_76) * 3.1124)))

没看到global_76具体是什么, 但看到了前面有个字符串拼接先拿出来看是什么

loc_40DE70: var_98 = Chr(&H4E)
loc_40DF45: var_1F8 = var_98 & Chr(&H55) & Chr(&H4D) & Chr(&H45) & Chr(&H47) & Chr(&H41) & " " & Chr(&H53) & Chr(&H4D) & Chr(&H41) & Chr(&H52) & Chr(&H54)
loc_40DFAE: var_88 = CStr(var_1F8 & Chr(&H43) & Chr(&H48) & Chr(&H45) & Chr(&H43) & Chr(&H4B))
写了个var_88.vbs执行一下这几行代码, 得到var_88=NUMEGA SMARTCHECK, 先放一边吧,

VB Decomiler中在Code -> Crackmefrm -> Form_Initialize_40DC38里找到了 loc_40DC34: global_76 = &H45A0, 到此, 应该所有条件都有了,

global_52.vbs运行结果:
01=373703670
02=684708686
03=698673531
04=391184533
05=329528230
06=654824169
07=557168731
08=387375850
09=212298498
10=851143730

开始写注册机代码吧,

name = inputbox("请输入用户名:")
nlen = len(name)
pi = 3.141592654
global_76 = Fix(&H45A0 * 3.1124) '55475
for i=1 to nlen
  var_94 = var_94 & CStr(Asc(Mid(name,  i,  1)))
next
while len(var_94) > 9
  var_94 = Fix(var_94 / pi)
wend
var_94 = (CLng(var_94) Xor &H30F85678) - global_76 + nlen '821581432
msgbox("用户名为:"&name&chr(10)&"系列号为: "&var_94)

这是160个软件part1
这是160个软件part2

1~160每个破解过程,在吾爱破解论坛都有高手破解过了,也有整理好现成的, 我这边主要就是自己动手操作的过程,与他们的不太一样
附上高手们的连接: 点击前往查看
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

新人入门教程"玩玩破解，写给新人看" 点击前往查看
我就是从这里开始的,对我这样的小白感觉超级友好~

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~

posted @ 2024-05-10 15:59 hankerstudio 阅读(23) 评论(0) 收藏举报

刷新页面返回顶部