新手破解练习Crackme160之103 - AC_Crackme_01_A

这个跟上个差不多, 都是VB, P-code模式的程序, 同样的操作VB Decomipler
按钮事件代码, Decomipler:

Private Sub Command1_Click() '401E30
  'Data Table: 4019F0
  Dim var_94 As String
  loc_401DF6: var_94 = "Another NAG"
  loc_401E01: MsgBox(var_94, 0, var_C4, var_E4, var_104)
  loc_401E14: Me.Hide
  loc_401E27: Done.Show var_94, var_B4
  loc_401E2C: Exit Sub
End Sub

Disassembler:

  loc_401DE8: 27FCFE                LitVar_Missing var_104
  loc_401DEB: 271CFF                LitVar_Missing var_E4
  loc_401DEE: 273CFF                LitVar_Missing var_C4
  loc_401DF1: F500000000            LitI4 0
  loc_401DF6: 3A6CFF0000            LitVarStr var_94, "Another NAG"
  loc_401DFB: 4E5CFF                FStVarCopyObj var_A4
  loc_401DFE: 045CFF                FLdRfVar var_A4
  loc_401E01: 0A01001400            ImpAdCallFPR4 MsgBox(, , , , )   //这句去掉
  loc_401E11: 080800                FLdPr arg_8
  loc_401E14: 0DB4020200            Me.Hide
  loc_401E19: 274CFF                LitVar_Missing var_B4
  loc_401E1C: 25                    PopAdLdVar
  loc_401E1D: 276CFF                LitVar_Missing var_94
  loc_401E20: 25                    PopAdLdVar
  loc_401E21: 050300                ImpAdLdRf MemVar_40201C
  loc_401E24: 240400                NewIfNullPr Done
  loc_401E27: 0DB0020500            Done.Show , 
  loc_401E2C: 13                    ExitProcHresult
  loc_401E2D: 48C00F                ILdPr

HEX Edior: (这里可以修改, 可以不用UE)

......
00001DE0	DC 18 40 00 3C 23 40 00 27 FC FE 27 1C FF 27 3C
00001DF0	FF F5 00 00 00 00 3A 6C FF 00 00 4E 5C FF 04 5C	//这里
00001E00		FF 0A 01 00 14 00 36 08 00 5C FF 3C FF 1C FF FC	//这里
00001E10		FE 08 08 00 0D B4 02 02 00 27 4C FF 25 27 6C FF
00001E20		25 05 03 00 24 04 00 0D B0 02 05 00 13 48 C0 0F
......

修改为:

......
00001DE0	DC 18 40 00 3C 23 40 00 27 FC FE 27 1C FF 27 3C
00001DF0	FF F5 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00001E00		00 00 00 00 00 00 36 08 00 5C FF 3C FF 1C FF FC	//这里改为00
00001E10		FE 08 08 00 0D B4 02 02 00 27 4C FF 25 27 6C FF
00001E20		25 05 03 00 24 04 00 0D B0 02 05 00 13 48 C0 0F
......

保存后, 代码变成了

Private Sub Command1_Click() '401E30
  'Data Table: 4019F0
  loc_401E14: Me.Hide
  loc_401E27: Done.Show var_94, var_B4
  loc_401E2C: Exit Sub
End Sub

成功把弹框去掉了~
作者应该是想第一个界面也要去掉, 直接到done界面~这个, 要是能把点击事件改成form_load事件就好了(当然这个我还不会)
现在只好使用4C法了, 我们OD载入程序, 第一行push 004011C8, 在下面内存数据区ctrl+G输入 004011C8 + 4C, 看对对应地址的值还是一个地址00401264, 继续ctrl+G输入00401264, 看到如下数据:

00401264  50 00 00 00 ED 87 8E 38 70 AB 84 47 A3 8C BC C6  P...韲?p珓G计
00401274  6F 3E 7E 64 00 00 00 00 00 00 00 00 00 00 00 00  o>~d............
00401284  00 00 00 00 **00** 00 00 00 10 01 00 00 00 00 00 00  ....
...
......
00401294  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
004012A4  2A 01 00 00 00 00 00 00 9C 10 40 00 4C 00 00 00  *
......?@.L...
004012B4  50 00 00 00 19 A9 90 C5 58 82 6F 45 86 A6 BE 22  P...臱俹E啨?
004012C4  36 84 3E 3A 00 00 00 00 00 00 00 00 00 00 00 00  6?:............
004012D4  00 00 00 00 **01** 00 00 00 80 00 00 00 00 00 00 00  ........€.......
004012E4  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
004012F4  E4 00 00 00 00 00 00 00 F4 1B 40 00 9C 00 00 00  ?......?@.?..
00401304  01 00 01 00 1C 17 40 00 00 00 00 00 5C 1D 40 00  
.
.@.....\@.
00401314  FF FF FF FF 00 00 00 00 A0 17 40 00 14 20 40 00  ....?@. @.

将上面的00, 01互换位置即可保存即可破解完成~

 
 
 
这是160个软件part1
这是160个软件part2

1~160每个破解过程,在吾爱破解论坛都有高手破解过了,也有整理好现成的, 我这边主要就是自己动手操作的过程,与他们的不太一样
附上高手们的连接: 点击前往查看
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

新人入门教程"玩玩破解，写给新人看" 点击前往查看
我就是从这里开始的,对我这样的小白感觉超级友好~

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~