新手破解练习Crackme160之130 - phox.3
作者说了源程序是汇编写的, 代码量不多, 直接看OD结果(100多行):
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 C6010000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 44204000 mov dword ptr ds:[0x402044],eax
0040100C |. 6A 30 push 0x30 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL
0040100E |. 68 79204000 push phox_3.00402079 ; |CrackMe 1.0 by PhoX
00401013 |. 68 8D204000 push phox_3.0040208D ; |Plz registrate this CrackMe...\r\nor crack it!! =)\r\n\r\nThis CrackMe maybe not so hard crack.\r\nIve made this in asm and its not my best language
00401018 |. FF35 48204000 push dword ptr ds:[0x402048] ; |hOwner = NULL
0040101E |. E8 DA010000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA ;;;;;;;;;;;;;;;;;这行nop掉, NAG弹框就没了
00401023 |. C705 00204000>mov dword ptr ds:[0x402000],0x4003
0040102D |. C705 04204000>mov dword ptr ds:[0x402004],phox_3.0040113D ; è
00401037 |. C705 08204000>mov dword ptr ds:[0x402008],0x0
00401041 |. C705 0C204000>mov dword ptr ds:[0x40200C],0x0
0040104B |. A1 44204000 mov eax,dword ptr ds:[0x402044]
00401050 |. A3 10204000 mov dword ptr ds:[0x402010],eax
00401055 |. 68 047F0000 push 0x7F04 ; /RsrcName = IDI_ASTERISK
0040105A |. 6A 00 push 0x0 ; |hInst = NULL
0040105C |. E8 90010000 call <jmp.&USER32.LoadIconA> ; \LoadIconA
00401061 |. A3 14204000 mov dword ptr ds:[0x402014],eax
00401066 |. 68 007F0000 push 0x7F00 ; /RsrcName = IDC_ARROW
0040106B |. 6A 00 push 0x0 ; |hInst = NULL
0040106D |. E8 85010000 call <jmp.&USER32.LoadCursorA> ; \LoadCursorA
00401072 |. A3 18204000 mov dword ptr ds:[0x402018],eax
00401077 |. C705 1C204000>mov dword ptr ds:[0x40201C],0x6
00401081 |. C705 20204000>mov dword ptr ds:[0x402020],0x0
0040108B |. C705 24204000>mov dword ptr ds:[0x402024],phox_3.00402063 ; ASMClass
00401095 |. 68 00204000 push phox_3.00402000 ; /pWndClass = phox_3.00402000
0040109A |. E8 6A010000 call <jmp.&USER32.RegisterClassA> ; \RegisterClassA
0040109F |. 6A 00 push 0x0 ; /lParam = NULL
004010A1 |. FF35 44204000 push dword ptr ds:[0x402044] ; |hInst = NULL
004010A7 |. 6A 00 push 0x0 ; |hMenu = NULL
004010A9 |. 6A 00 push 0x0 ; |hParent = NULL
004010AB |. 6A 50 push 0x50 ; |Height = 50 (80.)
004010AD |. 68 C8000000 push 0xC8 ; |Width = C8 (200.)
004010B2 |. 68 00800000 push 0x8000 ; |Y = 8000 (32768.)
004010B7 |. 68 00800000 push 0x8000 ; |X = 8000 (32768.)
004010BC |. 68 00004B10 push 0x104B0000 ; |Style = WS_OVERLAPPED|WS_MINIMIZEBOX|WS_MAXIMIZEBOX|WS_VISIBLE|WS_SYSMENU|WS_DLGFRAME
004010C1 |. 68 50204000 push phox_3.00402050 ; |PhoX's CrackMe 1.0
004010C6 |. 68 63204000 push phox_3.00402063 ; |ASMClass
004010CB |. 6A 00 push 0x0 ; |ExtStyle = 0
004010CD |. E8 07010000 call <jmp.&USER32.CreateWindowExA> ; \CreateWindowExA
004010D2 |. A3 48204000 mov dword ptr ds:[0x402048],eax
004010D7 |. 6A 00 push 0x0 ; /lParam = NULL
004010D9 |. FF35 44204000 push dword ptr ds:[0x402044] ; |hInst = NULL
004010DF |. 6A 20 push 0x20 ; |hMenu = 00000020 (window)
004010E1 |. FF35 48204000 push dword ptr ds:[0x402048] ; |hParent = NULL
004010E7 |. 6A 1E push 0x1E ; |Height = 1E (30.)
004010E9 |. 6A 38 push 0x38 ; |Width = 38 (56.)
004010EB |. 6A 14 push 0x14 ; |Y = 14 (20.)
004010ED |. 6A 3E push 0x3E ; |X = 3E (62.)
004010EF |. 68 01008050 push 0x50800001 ; |Style = WS_CHILD|WS_VISIBLE|WS_BORDER|1
004010F4 |. 68 6C204000 push phox_3.0040206C ; |About
004010F9 |. 68 72204000 push phox_3.00402072 ; |Button
004010FE |. 6A 00 push 0x0 ; |ExtStyle = 0
00401100 |. E8 D4000000 call <jmp.&USER32.CreateWindowExA> ; \CreateWindowExA
00401105 |. A3 4C204000 mov dword ptr ds:[0x40204C],eax
0040110A |> 6A 00 /push 0x0 ; /MsgFilterMax = 0x0
0040110C |. 6A 00 |push 0x0 ; |MsgFilterMin = 0x0
0040110E |. 6A 00 |push 0x0 ; |hWnd = NULL
00401110 |. 68 28204000 |push phox_3.00402028 ; |pMsg = phox_3.00402028
00401115 |. E8 CB000000 |call <jmp.&USER32.GetMessageA> ; \GetMessageA
0040111A |. 66:3D 0000 |cmp ax,0x0
0040111E |. 74 16 |je short phox_3.00401136
00401120 |. 68 28204000 |push phox_3.00402028 ; /pMsg = WM_NULL
00401125 |. E8 E5000000 |call <jmp.&USER32.TranslateMessage> ; \TranslateMessage
0040112A |. 68 28204000 |push phox_3.00402028 ; /pMsg = WM_NULL
0040112F |. E8 AB000000 |call <jmp.&USER32.DispatchMessageA> ; \DispatchMessageA
00401134 |.^ EB D4 \jmp short phox_3.0040110A
00401136 |> 6A 00 push 0x0 ; /ExitCode = 0x0
00401138 |. E8 96000000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
0040113D |. C8 000000 enter 0x0,0x0
00401141 |. 53 push ebx
00401142 |. 57 push edi ; phox_3.<ModuleEntryPoint>
00401143 |. 56 push esi ; phox_3.<ModuleEntryPoint>
00401144 |. 817D 0C 11010>cmp [arg.2],0x111
0040114B |. 74 27 je short phox_3.00401174
0040114D |. 837D 0C 02 cmp [arg.2],0x2
00401151 |. 74 47 je short phox_3.0040119A
00401153 |. 817D 0C 01020>cmp [arg.2],0x201
0040115A |. 74 51 je short phox_3.004011AD
0040115C |. FF75 14 push [arg.4] ; /lParam = 0x0
0040115F |. FF75 10 push [arg.3] ; |wParam = 0x0
00401162 |. FF75 0C push [arg.2] ; |Message = MSG(0xF2F946E3)
00401165 |. FF75 08 push [arg.1] ; |hWnd = 002BB000
00401168 |. E8 A8000000 call <jmp.&USER32.DefWindowProcA> ; \DefWindowProcA
0040116D |. 5E pop esi ; kernel32.7724FCC9
0040116E |. 5F pop edi ; kernel32.7724FCC9
0040116F |. 5B pop ebx ; kernel32.7724FCC9
00401170 |. C9 leave
00401171 |. C2 1000 retn 0x10
00401174 |> 837D 10 20 cmp [arg.3],0x20
00401178 |. 75 17 jnz short phox_3.00401191
0040117A |. 6A 20 push 0x20 ; /Style = MB_OK|MB_ICONQUESTION|MB_APPLMODAL
0040117C |. 68 1A214000 push phox_3.0040211A ; |About
00401181 |. 68 20214000 push phox_3.00402120 ; |CrackMe 1.0\r\nMade by Phox\r\nPhoX greets REVOLT, UCF, PC, MEXELITE,\r\nFireWorx, and all the ones that cracks this CrackMe.\r\nAnd special greets to _masta_,iczelion and _hak_ for great win32asm tuts.
00401186 |. FF35 48204000 push dword ptr ds:[0x402048] ; |hOwner = NULL
0040118C |. E8 6C000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401191 |> 33C0 xor eax,eax
00401193 |. 5E pop esi ; kernel32.7724FCC9
00401194 |. 5F pop edi ; kernel32.7724FCC9
00401195 |. 5B pop ebx ; kernel32.7724FCC9
00401196 |. C9 leave
00401197 |. C2 1000 retn 0x10
0040119A |> 6A 00 push 0x0 ; /ExitCode = 0x0
0040119C |. E8 62000000 call <jmp.&USER32.PostQuitMessage> ; \PostQuitMessage
004011A1 |. B8 00000000 mov eax,0x0
004011A6 |. 5E pop esi ; kernel32.7724FCC9
004011A7 |. 5F pop edi ; kernel32.7724FCC9
004011A8 |. 5B pop ebx ; kernel32.7724FCC9
004011A9 |. C9 leave
004011AA |. C2 1000 retn 0x10
004011AD |> 6A 30 push 0x30 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL
004011AF |. 68 E3214000 push phox_3.004021E3 ; |Yeh!!!
004011B4 |. 68 EA214000 push phox_3.004021EA ; |U really had to push this window!!\r\nDidnt U?!?!
004011B9 |. FF35 48204000 push dword ptr ds:[0x402048] ; |hOwner = NULL
004011BF |. E8 39000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
004011C4 |. 33C0 xor eax,eax
004011C6 |. 5E pop esi ; kernel32.7724FCC9
004011C7 |. 5F pop edi ; kernel32.7724FCC9
004011C8 |. 5B pop ebx ; kernel32.7724FCC9
004011C9 |. C9 leave
004011CA \. C2 1000 retn 0x10
004011CD $- FF25 78304000 jmp dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; kernel32.GetModuleHandleA
004011D3 $- FF25 7C304000 jmp dword ptr ds:[<&KERNEL32.ExitProcess>] ; DTFRAME3.580AA800
004011D9 $- FF25 84304000 jmp dword ptr ds:[<&USER32.CreateWindowExA>] ; user32.CreateWindowExA
004011DF $- FF25 88304000 jmp dword ptr ds:[<&USER32.DispatchMessageA>] ; user32.DispatchMessageA
004011E5 $- FF25 8C304000 jmp dword ptr ds:[<&USER32.GetMessageA>] ; user32.GetMessageA
004011EB .- FF25 90304000 jmp dword ptr ds:[<&USER32.GetWindowTextA>] ; user32.GetWindowTextA
004011F1 $- FF25 94304000 jmp dword ptr ds:[<&USER32.LoadIconA>] ; user32.LoadIconA
004011F7 $- FF25 98304000 jmp dword ptr ds:[<&USER32.LoadCursorA>] ; user32.LoadCursorA
004011FD $- FF25 9C304000 jmp dword ptr ds:[<&USER32.MessageBoxA>] ; user32.MessageBoxA
00401203 $- FF25 A0304000 jmp dword ptr ds:[<&USER32.PostQuitMessage>] ; user32.PostQuitMessage
00401209 $- FF25 A4304000 jmp dword ptr ds:[<&USER32.RegisterClassA>] ; user32.RegisterClassA
0040120F $- FF25 A8304000 jmp dword ptr ds:[<&USER32.TranslateMessage>] ; user32.TranslateMessage
00401215 $- FF25 AC304000 jmp dword ptr ds:[<&USER32.DefWindowProcA>] ; ntdll.NtdllDefWindowProc_A
0040121B 00 db 00
除了去NAG是不是没有什么需要继续破解的了?
1~160每个破解过程,在吾爱破解论坛都有高手破解过了,也有整理好现成的, 我这边主要就是自己动手操作的过程,与他们的不太一样
附上高手们的连接: 点击前往查看
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
新人入门教程"玩玩破解，写给新人看" 点击前往查看
我就是从这里开始的,对我这样的小白感觉超级友好~
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号