新手破解练习Crackme160之154 - The_q.2
这个是汇编写的程序, 直接载入OD, 300多行代码, 还行~ 直接分析~
00401000 > $ 6A 00 push 0x0 ; /pModule = NULL
00401002 . E8 61040000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 . A3 00204000 mov dword ptr ds:[0x402000],eax
0040100C . C705 08204000>mov dword ptr ds:[0x402008],0xB
00401016 . C705 0C204000>mov dword ptr ds:[0x40200C],The_q_2.WndP>
00401020 . C705 10204000>mov dword ptr ds:[0x402010],0x0
0040102A . C705 14204000>mov dword ptr ds:[0x402014],0x0
00401034 . A1 00204000 mov eax,dword ptr ds:[0x402000]
00401039 . A3 18204000 mov dword ptr ds:[0x402018],eax
0040103E . 68 AB204000 push The_q_2.004020AB ; /RsrcName = "ICON_1"
00401043 . FF35 00204000 push dword ptr ds:[0x402000] ; |hInst = NULL
00401049 . E8 EA030000 call <jmp.&USER32.LoadIconA> ; \LoadIconA
0040104E . A3 1C204000 mov dword ptr ds:[0x40201C],eax
00401053 . 68 007F0000 push 0x7F00 ; /RsrcName = IDC_ARROW
00401058 . 6A 00 push 0x0 ; |hInst = NULL
0040105A . E8 D3030000 call <jmp.&USER32.LoadCursorA> ; \LoadCursorA
0040105F . A3 20204000 mov dword ptr ds:[0x402020],eax
00401064 . C705 24204000>mov dword ptr ds:[0x402024],0x6
0040106E . C705 28204000>mov dword ptr ds:[0x402028],The_q_2.0040>; ASCII "CrkMe2"
00401078 . C705 2C204000>mov dword ptr ds:[0x40202C],The_q_2.0040>; ASCII "CrkMe2"
00401082 . 68 08204000 push The_q_2.00402008 ; /pWndClass = The_q_2.00402008
00401087 . E8 BE030000 call <jmp.&USER32.RegisterClassA> ; \RegisterClassA
0040108C . 6A 00 push 0x0 ; /lParam = NULL
0040108E . FF35 00204000 push dword ptr ds:[0x402000] ; |hInst = NULL
00401094 . 6A 00 push 0x0 ; |hMenu = NULL
00401096 . 6A 00 push 0x0 ; |hParent = NULL
00401098 . 68 C6000000 push 0xC6 ; |Height = C6 (198.)
0040109D . 68 F5000000 push 0xF5 ; |Width = F5 (245.)
004010A2 . 68 00000080 push 0x80000000 ; |Y = 80000000 (-2147483648.)
004010A7 . 68 00000080 push 0x80000000 ; |X = 80000000 (-2147483648.)
004010AC . 68 0000CF00 push 0xCF0000 ; |Style = WS_OVERLAPPED|WS_MINIMIZEBOX|WS_MAXIMIZEBOX|WS_SYSMENU|WS_THICKFRAME|WS_CAPTION
004010B1 . 68 8C204000 push The_q_2.0040208C ; |WindowName = "CrAcK me #2 By THE_q/PC"
004010B6 . 68 A4204000 push The_q_2.004020A4 ; |Class = "CrkMe2"
004010BB . 6A 00 push 0x0 ; |ExtStyle = 0
004010BD . E8 3A030000 call <jmp.&USER32.CreateWindowExA> ; \CreateWindowExA
004010C2 . A3 04204000 mov dword ptr ds:[0x402004],eax
004010C7 . 6A 01 push 0x1 ; /ShowState = SW_SHOWNORMAL
004010C9 . FF35 04204000 push dword ptr ds:[0x402004] ; |hWnd = NULL
004010CF . E8 88030000 call <jmp.&USER32.ShowWindow> ; \ShowWindow
004010D4 . FF35 04204000 push dword ptr ds:[0x402004] ; /hWnd = NULL
004010DA . E8 11030000 call <jmp.&USER32.UpdateWindow> ; \UpdateWindow
004010DF > 6A 00 push 0x0 ; /MsgFilterMax = 0x0
004010E1 . 6A 00 push 0x0 ; |MsgFilterMin = 0x0
004010E3 . 6A 00 push 0x0 ; |hWnd = NULL
004010E5 . 68 30204000 push The_q_2.00402030 ; |pMsg = The_q_2.00402030
004010EA . E8 3D030000 call <jmp.&USER32.GetMessageA> ; \GetMessageA
004010EF . 66:3D 0000 cmp ax,0x0
004010F3 . 74 1A je short The_q_2.0040110F
004010F5 . 90 nop
004010F6 . 90 nop
004010F7 . 90 nop
004010F8 . 90 nop
004010F9 . 68 30204000 push The_q_2.00402030 ; /pMsg = WM_NULL
004010FE . E8 5F030000 call <jmp.&USER32.TranslateMessage> ; \TranslateMessage
00401103 . 68 30204000 push The_q_2.00402030 ; /pMsg = WM_NULL
00401108 . E8 01030000 call <jmp.&USER32.DispatchMessageA> ; \DispatchMessageA
0040110D .^ EB D0 jmp short The_q_2.004010DF
0040110F > FF35 38204000 push dword ptr ds:[0x402038] ; /ExitCode = 0x0
00401115 . E8 54030000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
0040111A > $ C8 040000 enter 0x4,0x0
0040111E . 53 push ebx
0040111F . 57 push edi ; The_q_2.<ModuleEntryPoint>
00401120 . 56 push esi ; The_q_2.<ModuleEntryPoint>
00401121 . 8B45 08 mov eax,dword ptr ss:[ebp+0x8]
00401124 . A3 B2204000 mov dword ptr ds:[0x4020B2],eax
00401129 . 8B45 0C mov eax,dword ptr ss:[ebp+0xC]
0040112C . A3 B6204000 mov dword ptr ds:[0x4020B6],eax
00401131 . 8B45 10 mov eax,dword ptr ss:[ebp+0x10]
00401134 . A3 BA204000 mov dword ptr ds:[0x4020BA],eax
00401139 . 8B45 14 mov eax,dword ptr ss:[ebp+0x14]
0040113C . A3 BE204000 mov dword ptr ds:[0x4020BE],eax
00401141 . 33C0 xor eax,eax
00401143 . 66:A1 B620400>mov ax,word ptr ds:[0x4020B6]
00401149 . 66:3D 0200 cmp ax,0x2
0040114D . 75 0E jnz short The_q_2.0040115D
0040114F . 90 nop
00401150 . 90 nop
00401151 . 90 nop
00401152 . 90 nop
00401153 . E8 6C000000 call The_q_2.004011C4
00401158 . EB 43 jmp short The_q_2.0040119D
0040115A 90 nop
0040115B 90 nop
0040115C 90 nop
0040115D > 66:3D 0F00 cmp ax,0xF
00401161 . 75 0E jnz short The_q_2.00401171
00401163 . 90 nop
00401164 . 90 nop
00401165 . 90 nop
00401166 . 90 nop
00401167 . E8 3A000000 call The_q_2.004011A6
0040116C . EB 2F jmp short The_q_2.0040119D
0040116E 90 nop
0040116F 90 nop
00401170 90 nop
00401171 > 66:3D 1101 cmp ax,0x111
00401175 . 75 0E jnz short The_q_2.00401185
00401177 . 90 nop
00401178 . 90 nop
00401179 . 90 nop
0040117A . 90 nop
0040117B . E8 4C000000 call The_q_2.004011CC
00401180 . EB 1B jmp short The_q_2.0040119D
00401182 90 nop
00401183 90 nop
00401184 90 nop
00401185 > FF75 14 push dword ptr ss:[ebp+0x14] ; /lParam = 0x0
00401188 . FF75 10 push dword ptr ss:[ebp+0x10] ; |wParam = 0x0
0040118B . FF75 0C push dword ptr ss:[ebp+0xC] ; |Message = MSG(0x9741DF01)
0040118E . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 003F9000
00401191 . E8 6C020000 call <jmp.&USER32.DefWindowProcA> ; \DefWindowProcA
00401196 . 5E pop esi ; kernel32.7724FCC9
00401197 . 5F pop edi ; kernel32.7724FCC9
00401198 . 5B pop ebx ; kernel32.7724FCC9
00401199 . C9 leave
0040119A . C2 1000 retn 0x10
0040119D > 33C0 xor eax,eax
0040119F . 5E pop esi ; kernel32.7724FCC9
004011A0 . 5F pop edi ; kernel32.7724FCC9
004011A1 . 5B pop ebx ; kernel32.7724FCC9
004011A2 . C9 leave
004011A3 . C2 1000 retn 0x10
004011A6 /$ 68 4C204000 push The_q_2.0040204C ; /pPaintstruct = The_q_2.0040204C
004011AB |. FF75 08 push [arg.1] ; |hWnd = 003F9000
004011AE |. E8 43020000 call <jmp.&USER32.BeginPaint> ; \BeginPaint
004011B3 |. 8945 FC mov [local.1],eax
004011B6 |. 68 4C204000 push The_q_2.0040204C ; /pPaintstruct = The_q_2.0040204C
004011BB |. FF75 08 push [arg.1] ; |hWnd = 003F9000
004011BE |. E8 57020000 call <jmp.&USER32.EndPaint> ; \EndPaint
004011C3 \. C3 retn
004011C4 /$ 6A 00 push 0x0 ; /ExitCode = 0x0
004011C6 |. E8 79020000 call <jmp.&USER32.PostQuitMessage> ; \PostQuitMessage
004011CB \. C3 retn
004011CC /$ 66:A1 BE20400>mov ax,word ptr ds:[0x4020BE]
004011D2 |. 66:3D 0000 cmp ax,0x0
004011D6 |. 75 6A jnz short The_q_2.00401242
004011D8 |. 90 nop
004011D9 |. 90 nop
004011DA |. 90 nop
004011DB |. 90 nop
004011DC |. 66:A1 BA20400>mov ax,word ptr ds:[0x4020BA]
004011E2 |. 66:3D 6B00 cmp ax,0x6B
004011E6 |. 75 10 jnz short The_q_2.004011F8
004011E8 |. 90 nop
004011E9 |. 90 nop
004011EA |. 90 nop
004011EB |. 90 nop
004011EC |. 6A 00 push 0x0 ; /ExitCode = 0x0
004011EE |. E8 51020000 call <jmp.&USER32.PostQuitMessage> ; \PostQuitMessage
004011F3 |. EB 4D jmp short The_q_2.00401242
004011F5 | 90 nop
004011F6 | 90 nop
004011F7 | 90 nop
004011F8 |> 66:3D 6900 cmp ax,0x69
004011FC |. 75 20 jnz short The_q_2.0040121E
004011FE |. 90 nop
004011FF |. 90 nop
00401200 |. 90 nop
00401201 |. 90 nop
00401202 |. 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
00401204 |. 68 35214000 push The_q_2.00402135 ; |Title = "Info"
00401209 |. 68 C2204000 push The_q_2.004020C2 ; |Text = " CrackME #2 written By THE_q/PC
In pure win32 ASM using Barry Kauler Skeleton Source "
0040120E |. FF35 B2204000 push dword ptr ds:[0x4020B2] ; |hOwner = NULL
00401214 |. E8 25020000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401219 |. EB 27 jmp short The_q_2.00401242
0040121B | 90 nop
0040121C | 90 nop
0040121D | 90 nop
0040121E |> 66:3D 6A00 cmp ax,0x6A
00401222 |. 75 1E jnz short The_q_2.00401242
00401224 |. 90 nop
00401225 |. 90 nop
00401226 |. 90 nop
00401227 |. 90 nop
00401228 |. 6A 00 push 0x0 ; /lParam = NULL
0040122A |. 68 43124000 push The_q_2.00401243 ; |DlgProc = The_q_2.00401243
0040122F |. FF35 04204000 push dword ptr ds:[0x402004] ; |hOwner = NULL
00401235 |. 6A 01 push 0x1 ; |pTemplate = 0x1
00401237 |. FF35 00204000 push dword ptr ds:[0x402000] ; |hInst = NULL
0040123D |. E8 C6010000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401242 \> C3 retn
00401243 /. C8 000000 enter 0x0,0x0
00401247 |. 817D 0C 10010>cmp [arg.2],0x110
0040124E |. 75 48 jnz short The_q_2.00401298
00401250 |. 90 nop
00401251 |. 90 nop
00401252 |. 90 nop
00401253 |. 90 nop
00401254 |. 6A 65 push 0x65 ; /ControlID = 65 (101.)
00401256 |. FF75 08 push [arg.1] ; |hWnd = 003F9000
00401259 |. E8 C2010000 call <jmp.&USER32.GetDlgItem> ; \GetDlgItem
0040125E |. 50 push eax
0040125F |. 50 push eax ; /hWnd = 0019FFCC
00401260 |. E8 F1010000 call <jmp.&USER32.SetFocus> ; \SetFocus
00401265 |. 58 pop eax ; kernel32.7724FCC9
00401266 |. 6A 00 push 0x0 ; /lParam = 0x0
00401268 |. 6A 28 push 0x28 ; |wParam = 0x28
0040126A |. 68 C5000000 push 0xC5 ; |Message = EM_LIMITTEXT
0040126F |. 50 push eax ; |hWnd = 0x19FFCC
00401270 |. E8 DB010000 call <jmp.&USER32.SendMessageA> ; \SendMessageA
00401275 |. 6A 66 push 0x66 ; /ControlID = 66 (102.)
00401277 |. FF75 08 push [arg.1] ; |hWnd = 003F9000
0040127A |. E8 A1010000 call <jmp.&USER32.GetDlgItem> ; \GetDlgItem
0040127F |. 6A 00 push 0x0 ; /lParam = 0x0
00401281 |. 6A 0A push 0xA ; |wParam = 0xA
00401283 |. 68 C5000000 push 0xC5 ; |Message = EM_LIMITTEXT
00401288 |. 50 push eax ; |hWnd = 0x19FFCC
00401289 |. E8 C2010000 call <jmp.&USER32.SendMessageA> ; \SendMessageA
0040128E |. B8 00000000 mov eax,0x0
00401293 |. E9 BA000000 jmp The_q_2.00401352
00401298 |> 837D 0C 10 cmp [arg.2],0x10
0040129C |. 0F84 96000000 je The_q_2.00401338
004012A2 |. 817D 0C 11010>cmp [arg.2],0x111
004012A9 |. 0F85 9E000000 jnz The_q_2.0040134D
004012AF |. 8B45 10 mov eax,[arg.3]
004012B2 |. 83F8 68 cmp eax,0x68
004012B5 |. 0F84 7D000000 je The_q_2.00401338
004012BB |. 83F8 67 cmp eax,0x67
004012BE |. 0F85 89000000 jnz The_q_2.0040134D
004012C4 |. 6A 65 push 0x65 ; /ControlID = 65 (101.)
004012C6 |. FF75 08 push [arg.1] ; |hWnd = 003F9000
004012C9 |. E8 52010000 call <jmp.&USER32.GetDlgItem> ; \GetDlgItem
004012CE |. 68 A9214000 push The_q_2.004021A9 ; /lParam = 0x4021A9 ;;;;;;得到用户名
004012D3 |. 6A 28 push 0x28 ; |wParam = 0x28
004012D5 |. 6A 0D push 0xD ; |Message = WM_GETTEXT
004012D7 |. 50 push eax ; |hWnd = 0x19FFCC
004012D8 |. E8 73010000 call <jmp.&USER32.SendMessageA> ; \SendMessageA
004012DD |. A2 D1214000 mov byte ptr ds:[0x4021D1],al
004012E2 |. 3C 00 cmp al,0x0
004012E4 |. 74 67 je short The_q_2.0040134D
004012E6 |. 90 nop
004012E7 |. 90 nop
004012E8 |. 90 nop
004012E9 |. 90 nop
004012EA |. 3C 08 cmp al,0x8 ;;;;;;;;;;;;;;;;;;;;;;用户名得8位以上
004012EC |. 73 09 jnb short The_q_2.004012F7
004012EE |. 90 nop
004012EF |. 90 nop
004012F0 |. 90 nop
004012F1 |. 90 nop
004012F2 |. E8 5F000000 call The_q_2.00401356
004012F7 |> 6A 00 push 0x0 ; /IsSigned = FALSE
004012F9 |. 6A 00 push 0x0 ; |pSuccess = NULL
004012FB |. 6A 66 push 0x66 ; |ControlID = 66 (102.)
004012FD |. FF75 08 push [arg.1] ; |hWnd = 003F9000
00401300 |. E8 21010000 call <jmp.&USER32.GetDlgItemInt> ; \GetDlgItemInt
00401305 |. A3 D2214000 mov dword ptr ds:[0x4021D2],eax ;;;;;;;;得到注册码
0040130A |. 3C 00 cmp al,0x0
0040130C |. 74 3F je short The_q_2.0040134D
0040130E |. 90 nop
0040130F |. 90 nop
00401310 |. 90 nop
00401311 |. 90 nop
00401312 |. E8 5E000000 call The_q_2.00401375 ;;;;;;;;;;这个是用户名算法
00401317 |. E8 A5000000 call The_q_2.004013C1 ;;;;;;;;;;这个是对比算法
0040131C |. 85C0 test eax,eax
0040131E |. 74 2D je short The_q_2.0040134D
00401320 |. 90 nop
00401321 |. 90 nop
00401322 |. 90 nop
00401323 |. 90 nop
00401324 |. 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
00401326 |. 68 9F214000 push The_q_2.0040219F ; |Title = "Correct !"
0040132B |. 68 3A214000 push The_q_2.0040213A ; |Text = " C00L !! U found a correct Serial ! =)
Tell Me how by e-mail to : Phrozen_q@cyberdude.com "
00401330 |. FF75 08 push [arg.1] ; |hOwner = 003F9000
00401333 |. E8 06010000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401338 |> FF75 10 push [arg.3] ; /Result = 0x0
0040133B |. FF75 08 push [arg.1] ; |hWnd = 003F9000
0040133E |. E8 D1000000 call <jmp.&USER32.EndDialog> ; \EndDialog
00401343 |. B8 01000000 mov eax,0x1
00401348 |. EB 08 jmp short The_q_2.00401352
0040134A | 90 nop
0040134B | 90 nop
0040134C | 90 nop
0040134D |> B8 00000000 mov eax,0x0
00401352 |> C9 leave
00401353 \. C2 1000 retn 0x10
00401356 /$ 33DB xor ebx,ebx
00401358 |. 8A1D D1214000 mov bl,byte ptr ds:[0x4021D1]
0040135E |. B1 08 mov cl,0x8
00401360 |. 2ACB sub cl,bl
00401362 |. BF A9214000 mov edi,The_q_2.004021A9
00401367 |. 66:03FB add di,bx
0040136A |. B0 30 mov al,0x30
0040136C |> AA stos byte ptr es:[edi]
0040136D |. FEC0 inc al
0040136F |.^ E2 FB loopd short The_q_2.0040136C
00401371 |. C607 00 mov byte ptr ds:[edi],0x0
00401374 \. C3 retn
00401375 /$ 33C9 xor ecx,ecx ; The_q_2.<ModuleEntryPoint>
00401377 |. BE A9214000 mov esi,The_q_2.004021A9
0040137C |. 8BFE mov edi,esi ; The_q_2.<ModuleEntryPoint>
0040137E |> AC /lods byte ptr ds:[esi]
0040137F |. F7D1 |not ecx ; The_q_2.<ModuleEntryPoint>
00401381 |. 8A99 B1214000 |mov bl,byte ptr ds:[ecx+0x4021B1]
00401387 |. F7D1 |not ecx ; The_q_2.<ModuleEntryPoint>
00401389 |. 02C3 |add al,bl ;;;;;;用户名8位头尾相加得4位
0040138B |. AA |stos byte ptr es:[edi]
0040138C |. FEC1 |inc cl
0040138E |. 80F9 04 |cmp cl,0x4
00401391 |.^ 75 EB \jnz short The_q_2.0040137E
00401393 |. B9 04000000 mov ecx,0x4
00401398 |. BE A9214000 mov esi,The_q_2.004021A9
0040139D |. 8BFE mov edi,esi ; The_q_2.<ModuleEntryPoint>
0040139F |. 83C7 04 add edi,0x4
004013A2 |. F2:A4 repne movs byte ptr es:[edi],byte ptr ds> ;;;;;;用户名变为上面计算的4位 + 4位
004013A4 |. BE A9214000 mov esi,The_q_2.004021A9
004013A9 |. 8BFE mov edi,esi ; The_q_2.<ModuleEntryPoint>
004013AB |. B9 08000000 mov ecx,0x8
004013B0 |> AC lods byte ptr ds:[esi]
004013B1 |. F7D1 not ecx ; The_q_2.<ModuleEntryPoint>
004013B3 |. 8A99 DF214000 mov bl,byte ptr ds:[ecx+0x4021DF] ;;;;;;与固定串PhrozenQ异或
004013B9 |. F7D1 not ecx ; The_q_2.<ModuleEntryPoint>
004013BB |. 32C3 xor al,bl
004013BD |. AA stos byte ptr es:[edi]
004013BE |.^ E2 F0 loopd short The_q_2.004013B0
004013C0 \. C3 retn
004013C1 /$ A1 D2214000 mov eax,dword ptr ds:[0x4021D2]
004013C6 |. 8A0D A9214000 mov cl,byte ptr ds:[0x4021A9]
004013CC |. D3C0 rol eax,cl
004013CE |. 8B0D AE214000 mov ecx,dword ptr ds:[0x4021AE]
004013D4 |. 33C1 xor eax,ecx ; The_q_2.<ModuleEntryPoint>
004013D6 |. 8B1D AA214000 mov ebx,dword ptr ds:[0x4021AA]
004013DC |. 8AC8 mov cl,al
004013DE |. D3CB ror ebx,cl
004013E0 |. 33C3 xor eax,ebx ;;;;;;;这里的异或结果需要=0, ZF标志位才会1
004013E2 |. B8 00000000 mov eax,0x0 ;;;;;;;;;;;这个改为1就可以暴破成功了~
004013E7 |. 75 06 jnz short The_q_2.004013EF ;;;;;;;标志位为1成功, 0失败
004013E9 |. 90 nop
004013EA |. 90 nop
004013EB |. 90 nop
004013EC |. 90 nop
004013ED |. FEC0 inc al ;;;;;;程序能执行到这里就能成功了~
004013EF \> C3 retn
004013F0 $- FF25 9C304000 jmp dword ptr ds:[<&USER32.UpdateWindow>>; user32.UpdateWindow
004013F6 $- FF25 A0304000 jmp dword ptr ds:[<&USER32.BeginPaint>] ; user32.BeginPaint
004013FC $- FF25 A4304000 jmp dword ptr ds:[<&USER32.CreateWindowE>; user32.CreateWindowExA
00401402 $- FF25 A8304000 jmp dword ptr ds:[<&USER32.DefWindowProc>; ntdll.NtdllDefWindowProc_A
00401408 $- FF25 AC304000 jmp dword ptr ds:[<&USER32.DialogBoxPara>; user32.DialogBoxParamA
0040140E $- FF25 B0304000 jmp dword ptr ds:[<&USER32.DispatchMessa>; user32.DispatchMessageA
00401414 $- FF25 B4304000 jmp dword ptr ds:[<&USER32.EndDialog>] ; user32.EndDialog
0040141A $- FF25 B8304000 jmp dword ptr ds:[<&USER32.EndPaint>] ; user32.EndPaint
00401420 $- FF25 BC304000 jmp dword ptr ds:[<&USER32.GetDlgItem>] ; user32.GetDlgItem
00401426 $- FF25 C0304000 jmp dword ptr ds:[<&USER32.GetDlgItemInt>; user32.GetDlgItemInt
0040142C $- FF25 C4304000 jmp dword ptr ds:[<&USER32.GetMessageA>] ; user32.GetMessageA
00401432 $- FF25 C8304000 jmp dword ptr ds:[<&USER32.LoadCursorA>] ; user32.LoadCursorA
00401438 $- FF25 CC304000 jmp dword ptr ds:[<&USER32.LoadIconA>] ; user32.LoadIconA
0040143E $- FF25 D0304000 jmp dword ptr ds:[<&USER32.MessageBoxA>] ; user32.MessageBoxA
00401444 $- FF25 D4304000 jmp dword ptr ds:[<&USER32.PostQuitMessa>; user32.PostQuitMessage
0040144A $- FF25 D8304000 jmp dword ptr ds:[<&USER32.RegisterClass>; user32.RegisterClassA
00401450 $- FF25 DC304000 jmp dword ptr ds:[<&USER32.SendMessageA>>; user32.SendMessageA
00401456 $- FF25 E0304000 jmp dword ptr ds:[<&USER32.SetFocus>] ; user32.SetFocus
0040145C $- FF25 E4304000 jmp dword ptr ds:[<&USER32.ShowWindow>] ; user32.ShowWindow
00401462 $- FF25 E8304000 jmp dword ptr ds:[<&USER32.TranslateMess>; user32.TranslateMessage
00401468 $- FF25 F0304000 jmp dword ptr ds:[<&KERNEL32.GetModuleHa>; kernel32.GetModuleHandleA
0040146E $- FF25 F4304000 jmp dword ptr ds:[<&KERNEL32.ExitProcess>; DTFRAME3.580AA800
00401474 00 db 00
00401475 00 db 00
上面算法分析完了, 接着我们试下注册机:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void getNameKey(char *name);
unsigned long getCode(char *key);
int getName(int index, int len, char *name);
unsigned long ror(unsigned long num, int i);
unsigned long rol(unsigned long num, int i);
int main(int argc, char** argv) {
char name[9] = {0}; //用户名8位
getName(0, 8, name);
system("pause");
return 0;
}
void getNameKey(char *name){ //num为所有奇数
for (int i = 0; i < 4; i++)
{
name[i] = name[i] + name[7 - i];
}
for (int i = 4; i < 8; i++)
{
name[i] = name[i - 4];
}
char str[9] = "PhroZenQ";
for (int i = 0; i < 8; i++)
{
name[i] ^= str[i];
}
}
int getName(int index, int len, char *name){
int rlt = 0;
if(index == len){
char key[9] = {0};
strcpy(key, name);
getNameKey(key);
unsigned long code = getCode(key);
if(code != 0){
printf("用户名: %s\n注册码: %lu\n\n", name, code);
return 1; //返回0则查找所有可能
}
return 0;
}
for(int i=0x41; i<0x5B; i++){ //这里只取A~Z 可见字符0x20~0x7E
name[index] = (char) i;
rlt = getName(index+1, len, name);
if(rlt == 1) return 1;
}
return 0;
}
unsigned long getCode(char *key){
unsigned long code = 0, t1, t2;
unsigned long *k1 = (unsigned long *) &key[1];
unsigned long *k2 = (unsigned long *) &key[5];
for(int i=0; i<=0xFF; i++){
t1 = ror(*k1, i);
if((t1 & 0xFF) == i){
t1 ^= *k2;
code = ror(t1, key[0] & 0xFF);
break;
}
}
return code;
}
unsigned long ror(unsigned long num, int i){
return (num >> i) | (num << (sizeof(int) * 8 - i));
}
unsigned long rol(unsigned long num, int i){
return (num << i) | (num >> (sizeof(int) * 8 - i));
}
运行示例:
用户名: AAAAAAAA
注册码: 2087651163
1~160每个破解过程,在吾爱破解论坛都有高手破解过了,也有整理好现成的, 我这边主要就是自己动手操作的过程,与他们的不太一样
附上高手们的连接: 点击前往查看
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
新人入门教程"玩玩破解，写给新人看" 点击前往查看
我就是从这里开始的,对我这样的小白感觉超级友好~
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号