新CrackMe160之001 - wanao's CrackMe#1-2048

使用PEiD工具分析可知程序是VB编写的, 所以直接使用VB Decompiler v11.5反编译查看源码, 注册按钮事件代码如下(在Form3中):

Private Sub Command3_Click() '412E00
  loc_00412E8C: var_30 = Form3.Text1.Text
  loc_00412F10: var_28 = Form3.Text2.Text
  loc_00412F27: var_8004 = Proc_3_0_413520(Form3.Text2.Text, var_28, Me)
  loc_00412F2F: If var_8004 = 0 Then GoTo loc_00413017
  loc_00412F43: var_B8 = Form3.TestReg(var_28)
  loc_00412FF6: MsgBox("序列号错误！", 16, "错误", 10, 10)
  loc_0041301F: GoTo loc_0041304F
  loc_0041304E: Exit Sub
  loc_0041304F: ' Referenced from: 0041301F
End Sub

其中调用了两个方法Proc_3_0_413520( ) 和 TestReg( ), 代码分别是:

Private Sub Proc_3_0_413520(arg_C) '413520
  loc_00413599: If (Me = global_0040CDA4) Then GoTo loc_00413630
  loc_004135D9: var_58 = "错误"
  loc_004135DB: var_80 = "用户名不能为空！"
  loc_00413605: MsgBox(var_80, 16, var_58, 10, 10)
  loc_0041362B: GoTo loc_0041398D
  loc_00413630: ' Referenced from: 00413599
  loc_0041363E: If Len(var_58 = %S_edx_S) >= 5 Then GoTo loc_00413688
  loc_0041367A: var_58 = "错误"
  loc_0041367C: var_80 = "用户名不能少于5个字符！"
  loc_00413683: GoTo loc_004135E2
  loc_00413688: ' Referenced from: 0041363E
  loc_00413693: call edi(global_0040CDA4, arg_C, "婱餱婨躝^d?", 0, 0, 0)
  loc_00413697: If edi(global_0040CDA4, arg_C, "婱餱婨躝^d?", 0, 0, 0) Then GoTo loc_004136E1
  loc_004136D3: var_58 = "错误"
  loc_004136D5: var_80 = "序列号不能为空！"
  loc_004136DC: GoTo loc_004135E2
  loc_004136E1: ' Referenced from: 00413697
  loc_004136E4: var_800C = Len(ecx = %S_edx_S)
  loc_004136E9: If var_800C = 12 Then GoTo loc_00413733
  loc_00413725: var_58 = "错误"
  loc_00413727: var_80 = "序列号错误！"
  loc_0041372E: GoTo loc_004135E2
  loc_00413733: ' Referenced from: 004136E9
  loc_00413789: For var_20 = 1 To 12 Step Len(ecx = %S_edx_S)
  loc_004137A2: If var_D8 = 0 Then GoTo loc_00413937
  loc_004137C1: var_80 = arg_C
  loc_004137EE: var_38 = CStr(Mid(var_80, CLng(var_20), 1))
  loc_004137F5: var_8014 = Asc(var_38)
  loc_00413804: var_A0 = var_8014
  loc_00413815: var_34 = var_8014
  loc_00413883: var_8020 = CBool((var_34 < Asc(var_38)) Or (var_34 > 57))
  loc_0041388C: If var_8020 = 0 Then GoTo loc_0041391A
  loc_004138FD: MsgBox("序列号错误！", 16, "错误", var_68, 10)
  loc_0041391A: ' Referenced from: 0041388C
  loc_0041392C: Next var_20
  loc_00413932: GoTo loc_004137A0
  loc_00413937: ' Referenced from: 004137A2
  loc_0041394F: var_8024 = (var_20 = CBool(var_68))
  loc_00413958: If var_8024 = 0 Then GoTo loc_00413961
  loc_00413961: ' Referenced from: 00413958
  loc_00413966: GoTo loc_0041398D
  loc_0041398C: Exit Sub
  loc_0041398D: ' Referenced from: 0041362B
  loc_0041398D: ' Referenced from: 00413966
End Sub

Public Function TestReg(s) '413300
  loc_0041337E: var_68 = s
  loc_00413388: If 1 > 10 Then GoTo loc_004133F5
  loc_004133C1: var_800C = CInt("" + Int(Mid(var_68, 1, 1)))
  loc_004133F0: GoTo loc_0041335A
  loc_004133F5: ' Referenced from: 00413388
  loc_0041344F: cwd
  loc_0041347F: var_88 = CInt("" + Int(Mid(s, 12, 1))) Mod 0000000Ah
  loc_004134A6: var_8020 = (&H8002 = Int(Mid(s, 11, 1)))
  loc_004134C4: If var_8020 = 0 Then GoTo loc_004134CD
  loc_004134CD: ' Referenced from: 004134C4
  loc_004134D2: GoTo loc_004134F0
  loc_004134EF: Exit Function
  loc_004134F0: ' Referenced from: 004134D2
End Function

第一个方法 Proc_3_0_413520( ) 验证用户名是否小于5位, 系列号是否为纯数字
第二个方法 TestReg( ) 验证第11位是否等于其它位和 模 10
到这里似乎没用户名什么事~ 只要5位以上即可, 系列号, 11个数的和mod 10 = 第11个数, 我们可以让前10个数都为0, 那就是11位=12位即可满足条件, 如: 000000000011, 测试正常, 成功看到恭喜的提示框, 到这里以为成功了, 按提示重开应用, 发现注册按钮还在, 并没有成功注册~, 所以再分析一下Form1所有事件(VB Decompiler中查看), Form_Load事件中看到了RegStart方法, 代码如下:

Public Sub RegStart() '410780
  Dim var_68 As CommandButton
  loc_004107DA: On Error Resume Next
  loc_00410807: Set var_30 = CreateObject("wscript.shell", 0)
  loc_0041086D: var_68 = IsError(var_30.regread("HKEY_LOCAL_MACHINE\SOFTWARE\2048\name"))
  loc_00410880: If var_68 = 0 Then GoTo loc_00410887
  loc_00410882: GoTo loc_00410A5A
  loc_00410887: ' Referenced from: 00410880
  loc_004108E3: var_2C = var_30.regread("HKEY_LOCAL_MACHINE\SOFTWARE\2048\name")
  loc_0041094E: var_28 = var_30.regread("HKEY_LOCAL_MACHINE\SOFTWARE\2048\serial")
  loc_00410971: var_24 = Proc_3_0_413520(var_2C, var_28, -1)
  loc_00410982: If var_24 = 0 Then GoTo loc_004109D5
  loc_004109A2: var_68 = Form1.TestRegist(var_2C, var_28)
  loc_004109E5: If global_92 = 0 Then GoTo loc_00410A5A
  loc_00410A08: var_68 = Form1.Command3
  loc_00410A16: var_68.Visible = False
  loc_00410A1E: var_6C = var_68
  loc_00410A5A: ' Referenced from: 00410882
  loc_00410A5F: GoTo loc_00410A74
  loc_00410A73: Exit Sub
  loc_00410A74: ' Referenced from: 00410A5F
End Sub

看到需要读取注册表, 这个是Form3注册成功时写入的, 接着又用了两个方法验证是否注册成功 Proc_3_0_413520( ) [这个和上面的一样] 和 TestRegist( ), 代码如下:

Public Sub TestRegist(n, s) '410AC0
  loc_00410B3B: var_20 = "wanao"
  loc_00410B60: If Len(n) <= 7 Then GoTo loc_00410BA6
  loc_00410B97: var_28 = Left(n, 7)
  loc_00410BA6: ' Referenced from: 00410B60
  loc_00410BAC: global_96 = var_28
  loc_00410BDA: If 1 > Len(var_28) Then GoTo loc_00410C83
  loc_00410C4C: var_30 = (Asc(CStr(Mid(var_28, 1, 1))) * var_30)
  loc_00410C7E: GoTo loc_00410BD3
  loc_00410C83: ' Referenced from: 00410BDA
  loc_00410D0F: var_30 = (Asc(CStr(Mid(var_20, esi+1, 1))) * var_30)
  loc_00410D31: GoTo loc_00410C85
  loc_00410D46: var_8C = var_30
  loc_00410DD5: If 1 > 10 Then GoTo loc_00410E8A
  loc_00410E6E: If (Mid(Left(var_30, 10), 1, 1) <> Mid(Left(s, 10), 1, 1)) Then GoTo loc_00410E87
  loc_00410E7F: var_18 = 1+var_18
  loc_00410E82: GoTo loc_00410DCE
  loc_00410E87: ' Referenced from: 00410E6E
  loc_00410E8A: ' Referenced from: 00410DD5
  loc_00410E8E: If var_18 <> 11 Then GoTo loc_00410E99
  loc_00410E93: global_92 = &HFFFFFF
  loc_00410E99: ' Referenced from: 00410E8E
  loc_00410E9F: GoTo loc_00410ECD
  loc_00410ECC: Exit Sub
  loc_00410ECD: ' Referenced from: 00410E9F
End Sub

可看到这里算法跟用户名有关~
1). 用户名取前7位
2). 每位值相乘
3). 再与"wanao"的每一位相乘直到大于100000000
4). 结果前10位与sn前10位要相等
再结果前面分析的结果, sn前10位和加最后一位模10后要等于第11位
到这里我们便可以写注册机了

user = inputbox("请输入用户名(5位以上)")
ulen = len(user)
sum = 1
for i=1 to ulen
  sum = cdbl(sum * asc(mid(user,i,1)))
next
i = 1
str = "wanao"
while sum < 1000000000
  sum = cdbl(sum * asc(mid(str, i, 1)))
wend
Randomize

str = cstr(sum)
n12 = Int(10 * Rnd)
sum = 0
for i=1 to 10
  sum = sum + int(mid(str,i,1))
next
n11 = (sum + n12) mod 10
n12 = cstr(n12)
str = "用户名: " & user & chr(13) & chr(10) & "系列号: " & str & n11 & n12
msgbox str, 0, "注册机"

运行示例:
用户名: abcde
系列号: 950504940004

这节大佬没有尹录视频

 
 
 

使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~