新手破解练习Crackme160之083 - Volatility

1. 按钮去灰, PEID工具分析可知, 程序是由vb5写的, 所以我们直接用VBExplorer来修改按钮属性Enabled改为true, 保存前先把原程序备份一份, 因为这个工具没有另存为的功能, 保存成功后, 去灰完成~
    
2. 暴力破解, OD载入程序, 搜索失败关键字"UNREGISTERED: Key File Present - You're Getting Closer!", 定位到004046FC与00404F5C两处, 代码都一样, 把对应的信息改成成功的信息便可以了, 分别改为push 00402020, 还有一个失败关键字"UNREGISTERED"(00404F8C处), 也改成push 00402020, 保存, 运行程序, 可以看到底下的提示信息已经变成成功信息了
    
3. 正常破解, 从VB Decompiler分析源码Text2_Change事件可得算法

Private Sub Text2_Change() '405090
  Dim var_80 As Variant
  loc_00405128: Set var_80 = Form1.Text1
  loc_00405137: var_78 = var_80.Text                        //得到用户名
  loc_00405191: var_8004 = Asc(CStr(Left(var_78, 1)))       //取用户名第一位asc值
  loc_004051A6: var_C8 = var_8004
  loc_004051B7: var_34 = var_8004
  loc_004051E7: call var_8008 = var_110(Me, Me, 0, 0, 0)
  loc_004051F2: Set var_80 = var_110(Me, Me, 0, 0, 0)
  loc_004051FF: var_E4 = var_80
  loc_00405205: var_78 = var_80.MousePointer
  loc_00405284: var_800C = Asc(CStr(Mid(var_78, 2, 1)))     //取用户名第二位值
  loc_00405293: var_D8 = var_800C
  loc_004052A4: var_44 = var_800C
  loc_004052D5: call var_8010 = var_110(Me)
  loc_004052E0: Set var_80 = var_110(Me)
  loc_004052ED: var_E4 = var_80
  loc_004052F3: var_78 = var_80.MousePointer
  loc_00405372: var_8014 = Asc(CStr(Mid(var_78, 3, 1)))     //取用户名第三位值
  loc_00405381: var_D8 = var_8014
  loc_00405392: var_54 = var_8014
  loc_004053C3: call var_8018 = var_110(Me)
  loc_004053CE: Set var_80 = var_110(Me)
  loc_004053DB: var_E4 = var_80
  loc_004053E1: var_78 = var_80.MousePointer
  loc_00405460: var_801C = Asc(CStr(Mid(var_78, 4, 1)))     //取用户名第四位值
  loc_0040546F: var_D8 = var_801C
  loc_00405480: var_64 = var_801C
  loc_004054B1: call var_8020 = var_110(Me)
  loc_004054BC: Set var_80 = var_110(Me)
  loc_004054C9: var_E4 = var_80
  loc_004054CF: var_78 = var_80.MousePointer
  loc_0040554E: var_8024 = Asc(CStr(Mid(var_78, 5, 1)))     //取用户名第五位值
  loc_0040555D: var_D8 = var_8024
  loc_00405643: var_24 = Mid(var_34 & var_44 & var_54 & var_64 & var_8024, 2, 10) //然后5个值连起来, 取2~10位
  loc_0040565F: Set var_80 = Form1.Text2
  loc_0040566E: var_78 = var_80.Text
  loc_004056D2: var_8028 = (var_78 - var_24 = "")           //与注册码对比
  loc_004056F2: If var_8028 = 0 Then GoTo loc_00405732
  loc_0040570D: Form1.Command1.Enabled = True
  loc_00405732: ' Referenced from: 004056F2
  loc_0040573E: GoTo loc_00405784
  loc_00405783: Exit Sub
  loc_00405784: ' Referenced from: 0040573E
  loc_004057A6: GoTo loc_00esi
End Sub

所以基本上从上面的代码截取关键部分就可以得到注册机代码了: keygen.vbs

ulen = 0
while ulen = 0
  user = inputbox("请输入用户名(最少5位)", "注册机")
  ulen = len(user)
  if ulen = 0 then ulen = -1
  if ulen > 0 and ulen < 5 then ulen = 0
wend

if ulen > 0 then
  u1 = Asc(CStr(Left(user, 1)))
  u2 = Asc(CStr(Mid(user, 2, 1)))
  u3 = Asc(CStr(Mid(user, 3, 1)))
  u4 = Asc(CStr(Mid(user, 4, 1)))
  u5 = Asc(CStr(Mid(user, 5, 1)))
  code = Mid(u1 & u2 & u3 & u4 & u5, 2, 10)

  msgbox "用户名: " & user & chr(13) & chr(10) & "注册码:" & code,64,"注册机"
end if

 
 
 
这是160个软件part1
这是160个软件part2

1~160每个破解过程,在吾爱破解论坛都有高手破解过了,也有整理好现成的, 我这边主要就是自己动手操作的过程,与他们的不太一样
附上高手们的连接: 点击前往查看
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

新人入门教程"玩玩破解，写给新人看" 点击前往查看
我就是从这里开始的,对我这样的小白感觉超级友好~

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~