新手破解练习Crackme160之086 - zerocool.2
- 暴力破解, 用VB Decompiler分析源码可知, 这个程序是p-code编译的, OD加载后看到的全是db xxx, 看来OD是不能直接单步调试了, 我们试着用前面一篇破文(038)的方法看能否也解决这个程序的暴破, 找到第一个关键跳0042D5F4处, 看到了与038一样的数据结构FF1C5700, 感觉看到了希望, 哈哈, UE打开程序, 搜索FF1C5700, 在0002d5f0h行发现, 我们改为FF1D5702试下, 发现失败了, end if直接到程序最后去了, 看下面改前与改后的对比,
改前代码:
Private Sub Command1_Click() '42D818
'Data Table: 42B49C
Dim var_BC As Variant
Dim var_9C As Variant
Dim var_10C As Variant
Dim var_EC As Variant
loc_42D5F4: If (Me.Text1.Text = vbNullString) Then
loc_42D618: MsgBox("Entering a name would help!", &H30, "Name required!", var_EC, var_10C)
loc_42D628: GoTo loc_42D815
loc_42D62B: End If
loc_42D653: For var_13C = 1 To CVar(Len(Me.Text1.Text)): var_11C = var_13C 'Variant
loc_42D699: var_14C = (var_14C + CVar(Asc(CStr(Mid(CVar(Me.Text1.Text), CLng(var_11C), 1))))) 'Variant
loc_42D6AF: Next var_13C 'Variant
loc_42D6D6: var_14C = var_14C & CVar(Len(Me.Text1.Text)) 'Variant
loc_42D711: var_BC = CVar((2.1 * (3.34 ^ 2.7))) 'Double
loc_42D719: var_160 = ((var_14C * 1.7) / var_BC) 'Variant
loc_42D737: var_170 = (var_14C + (var_160 * 2.918)) 'Variant
loc_42D79A: var_9C = "]qcc["
loc_42D7A3: var_14C = (((var_14C + var_160) + var_170) + (((var_14C + var_160) + var_170) * ((var_14C + var_160) + (var_170 / 1.213)))) & var_9C 'Variant
loc_42D7D4: If CBool(CVar(Me.Text2.Text) <> var_14C) Then
loc_42D7E5: Wrong.Show var_9C, var_BC
loc_42D7F7: Me.Text2.Text = vbNullString
loc_42D7FF: GoTo loc_42D815
loc_42D802: End If
loc_42D810: Me.Show var_9C, var_BC
loc_42D815: ' Referenced from: 42D7FF
loc_42D815: ' Referenced from: 42D628
loc_42D815: Exit Sub
End Sub
改后代码:
Private Sub Command1_Click() '42D818
'Data Table: 42B49C
Dim var_BC As Variant
Dim var_9C As Variant
Dim var_10C As Variant
Dim var_EC As Variant
loc_42D5F4: If Not (Me.Text1.Text = vbNullString) Then Exit Sub
loc_42D618: MsgBox("Entering a name would help!", &H30, "Name required!", var_EC, var_10C)
loc_42D628: GoTo loc_42D815
loc_42D653: For var_13C = 1 To CVar(Len(Me.Text1.Text)): var_11C = var_13C 'Variant
loc_42D699: var_14C = (var_14C + CVar(Asc(CStr(Mid(CVar(Me.Text1.Text), CLng(var_11C), 1))))) 'Variant
loc_42D6AF: Next var_13C 'Variant
loc_42D6D6: var_14C = var_14C & CVar(Len(Me.Text1.Text)) 'Variant
loc_42D711: var_BC = CVar((2.1 * (3.34 ^ 2.7))) 'Double
loc_42D719: var_160 = ((var_14C * 1.7) / var_BC) 'Variant
loc_42D737: var_170 = (var_14C + (var_160 * 2.918)) 'Variant
loc_42D79A: var_9C = "]qcc["
loc_42D7A3: var_14C = (((var_14C + var_160) + var_170) + (((var_14C + var_160) + var_170) * ((var_14C + var_160) + (var_170 / 1.213)))) & var_9C 'Variant
loc_42D7D4: If CBool(CVar(Me.Text2.Text) <> var_14C) Then
loc_42D7E5: Wrong.Show var_9C, var_BC
loc_42D7F7: Me.Text2.Text = vbNullString
loc_42D7FF: GoTo loc_42D815
loc_42D802: End If
loc_42D810: Me.Show var_9C, var_BC
loc_42D815: ' Referenced from: 42D7FF
loc_42D815: ' Referenced from: 42D628
loc_42D815: Exit Sub
loc_42D816: End If
End Sub
其中1C改1D是没问题的, 那我们尝试改02这个, 尝试多次后发现不管改什么都没办法实现像038那样一步到成功前的位置, 所以这里就放弃改这个了, FF 1C 57 00 改成 FF 1D 57 00即可, 跳过本次判断, 由反编出来的代码可知, 程序中只有两处判断, 现在我们已经跳过了一处, 我们继续跳过另一处就可以了, 我们操作一下, 看是否可行~ OD定位到0042D7D4, 对应的代码块是FF1C2E02, 我们同理在UE中找到位置0002d7d0h这行, 将FF1C2E02改为FF1D2E02保存再看反编代码, 如下:
Private Sub Command1_Click() '42D818
'Data Table: 42B49C
Dim var_BC As Variant
Dim var_9C As Variant
Dim var_10C As Variant
Dim var_EC As Variant
loc_42D5F4: If Not (Me.Text1.Text = vbNullString) Then //这是第一处修改 成功跳过了判断
loc_42D618: MsgBox("Entering a name would help!", &H30, "Name required!", var_EC, var_10C)
loc_42D628: GoTo loc_42D815
loc_42D62B: End If
loc_42D653: For var_13C = 1 To CVar(Len(Me.Text1.Text)): var_11C = var_13C 'Variant
loc_42D699: var_14C = (var_14C + CVar(Asc(CStr(Mid(CVar(Me.Text1.Text), CLng(var_11C), 1))))) 'Variant
loc_42D6AF: Next var_13C 'Variant
loc_42D6D6: var_14C = var_14C & CVar(Len(Me.Text1.Text)) 'Variant
loc_42D711: var_BC = CVar((2.1 * (3.34 ^ 2.7))) 'Double
loc_42D719: var_160 = ((var_14C * 1.7) / var_BC) 'Variant
loc_42D737: var_170 = (var_14C + (var_160 * 2.918)) 'Variant
loc_42D79A: var_9C = "]qcc["
loc_42D7A3: var_14C = (((var_14C + var_160) + var_170) + (((var_14C + var_160) + var_170) * ((var_14C + var_160) + (var_170 / 1.213)))) & var_9C 'Variant
loc_42D7D4: If Not CBool(CVar(Me.Text2.Text) <> var_14C) Then //这是第二处修改, 也成功跳过了判断
loc_42D7E5: Wrong.Show var_9C, var_BC
loc_42D7F7: Me.Text2.Text = vbNullString
loc_42D7FF: GoTo loc_42D815
loc_42D802: End If
loc_42D810: Me.Show var_9C, var_BC //这里是成功提示框
loc_42D815: ' Referenced from: 42D7FF
loc_42D815: ' Referenced from: 42D628
loc_42D815: Exit Sub
End Sub
到此, 我们这个p-code程序也暴破成功了~ 不需要输入用户名和注册号直接点验证就提示成功了, 哈哈
- 正常破解, 由上面的反编译代码可知关键算法是这中间一段:
...
loc_42D653: For var_13C = 1 To CVar(Len(Me.Text1.Text)): var_11C = var_13C 'Variant
loc_42D699: var_14C = (var_14C + CVar(Asc(CStr(Mid(CVar(Me.Text1.Text), CLng(var_11C), 1))))) 'Variant //循环将用户名的每一位转asc值加起来
loc_42D6AF: Next var_13C 'Variant
loc_42D6D6: var_14C = var_14C & CVar(Len(Me.Text1.Text)) 'Variant //再连上用户名的长度, 下面就是各种运算再连接
loc_42D711: var_BC = CVar((2.1 * (3.34 ^ 2.7))) 'Double
loc_42D719: var_160 = ((var_14C * 1.7) / var_BC) 'Variant
loc_42D737: var_170 = (var_14C + (var_160 * 2.918)) 'Variant
loc_42D79A: var_9C = "]qcc["
loc_42D7A3: var_14C = (((var_14C + var_160) + var_170) + (((var_14C + var_160) + var_170) * ((var_14C + var_160) + (var_170 / 1.213)))) & var_9C 'Variant
...
我们直接把这段代码翻译成注册机代码: keygen.vbs
ulen = 0
while ulen = 0
user = inputbox("请输入用户名", "注册机") 'abc
ulen = len(user)
if ulen = 0 then ulen = -1
wend
if ulen > 0 then
sum = 0
For i = 1 To ulen
sum = sum + Asc(CStr(Mid(user, i, 1)))
next
var_14C = sum & ulen '=97+98+99 & 3 = 2943
var_BC = ((2.1 * (3.34 ^ 2.7))) '=54.4922518459754
var_160 = Int(CLng(var_14C * 1.7) / CLng(var_BC)) '=92 '标1
var_170 = (var_14C + (var_160 * 2.918)) '=3211.456
var_9C = "]qcc["
code = (var_14C + var_160 + var_170 + (var_14C + var_160 + var_170) * clng(var_14C + var_160 + CLng(var_170) / CLng(1.213))) & var_9C '标2
msgbox "用户名: " & user & chr(13) & chr(10) &_
"var14C: " & var_14C & chr(13) & chr(10) &_
"var_BC: " & var_BC & chr(13) & chr(10) &_
"var160: " & var_160 & chr(13) & chr(10) &_
"var170: " & var_170 & chr(13) & chr(10) &_
"注册码: " & code,64,"注册机"
end if
上面翻译过来的代码运行结果与内存中截取的结果完全不同, 经过与大佬的注册机代码对比, 发现是上面, 标1, 标2 这两处有转型操作反编译器没解析出来
内存截取示例:
用户名: abc
注册码: 39021610.632]qcc[
用户名: a
注册码: 4244711.94]qcc[
1~160每个破解过程,在吾爱破解论坛都有高手破解过了,也有整理好现成的, 我这边主要就是自己动手操作的过程,与他们的不太一样
附上高手们的连接: 点击前往查看
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
新人入门教程"玩玩破解，写给新人看" 点击前往查看
我就是从这里开始的,对我这样的小白感觉超级友好~
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号