新CrackMe160之006 - AD_CM#2
汇编写的，代码很少直接看
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 A1010000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 78304000 mov dword ptr ds:[0x403078],eax
0040100C |. 6A 00 push 0x0 ; /lParam = NULL
0040100E |. 68 2B104000 push AD_CM#2.0040102B ; |DlgProc = AD_CM#2.0040102B
00401013 |. 6A 00 push 0x0 ; |hOwner = NULL
00401015 |. 68 00304000 push AD_CM#2.00403000 ; |pTemplate = "ADDialog"
0040101A |. FF35 78304000 push dword ptr ds:[0x403078] ; |hInst = NULL
00401020 |. E8 53010000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401025 |. 50 push eax ; /ExitCode = 0x19FFCC
00401026 \. E8 77010000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
0040102B /. 55 push ebp
0040102C |. 8BEC mov ebp,esp
0040102E |. 817D 0C 10010>cmp [arg.2],0x110
00401035 |. 75 18 jnz short AD_CM#2.0040104F
00401037 |. 68 B80B0000 push 0xBB8 ; /ControlID = BB8 (3000.)
0040103C |. FF75 08 push [arg.1] ; |hWnd = 003BF000
0040103F |. E8 40010000 call <jmp.&USER32.GetDlgItem> ; \GetDlgItem
00401044 |. 50 push eax ; /hWnd = 0019FFCC
00401045 |. E8 52010000 call <jmp.&USER32.SetFocus> ; \SetFocus
0040104A |. E9 A4000000 jmp AD_CM#2.004010F3
0040104F |> 837D 0C 10 cmp [arg.2],0x10
00401053 |. 75 19 jnz short AD_CM#2.0040106E
00401055 |. 6A 00 push 0x0 ; /lParam = 0x0
00401057 |. 68 037D0000 push 0x7D03 ; |wParam = 0x7D03
0040105C |. 68 11010000 push 0x111 ; |Message = WM_COMMAND
00401061 |. FF75 08 push [arg.1] ; |hWnd = 0x3BF000
00401064 |. E8 2D010000 call <jmp.&USER32.SendMessageA> ; \SendMessageA
00401069 |. E9 85000000 jmp AD_CM#2.004010F3
0040106E |> 817D 0C 11010>cmp [arg.2],0x111
00401075 |. 75 73 jnz short AD_CM#2.004010EA
00401077 |. 8B45 10 mov eax,[arg.3]
0040107A |. 837D 14 00 cmp [arg.4],0x0
0040107E |. 75 12 jnz short AD_CM#2.00401092
00401080 |. 66:3D 037D cmp ax,0x7D03
00401084 |. 75 6D jnz short AD_CM#2.004010F3
00401086 |. 6A 00 push 0x0 ; /Result = 0x0
00401088 |. FF75 08 push [arg.1] ; |hWnd = 003BF000
0040108B |. E8 EE000000 call <jmp.&USER32.EndDialog> ; \EndDialog
00401090 |. EB 61 jmp short AD_CM#2.004010F3
00401092 |> 8B55 10 mov edx,[arg.3]
00401095 |. C1EA 10 shr edx,0x10
00401098 |. 66:0BD2 or dx,dx
0040109B |. 75 4B jnz short AD_CM#2.004010E8
0040109D |. 66:3D BA0B cmp ax,0xBBA
004010A1 |. 75 0A jnz short AD_CM#2.004010AD
004010A3 |. FF75 08 push [arg.1]
004010A6 |. E8 51000000 call AD_CM#2.004010FC
004010AB |. EB 3B jmp short AD_CM#2.004010E8
004010AD |> 66:3D BE0B cmp ax,0xBBE
004010B1 |. 75 1B jnz short AD_CM#2.004010CE
004010B3 |. 6A 00 push 0x0 ; /lParam = NULL
004010B5 |. 68 2B104000 push AD_CM#2.0040102B ; |DlgProc = AD_CM#2.0040102B
004010BA |. 6A 00 push 0x0 ; |hOwner = NULL
004010BC |. 68 09304000 push AD_CM#2.00403009 ; |pTemplate = "AboutDlg"
004010C1 |. FF35 78304000 push dword ptr ds:[0x403078] ; |hInst = NULL
004010C7 |. E8 AC000000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
004010CC |. EB 1A jmp short AD_CM#2.004010E8
004010CE |> 66:3D BB0B cmp ax,0xBBB
004010D2 |. 75 14 jnz short AD_CM#2.004010E8
004010D4 |. 6A 00 push 0x0 ; /lParam = 0x0
004010D6 |. 68 037D0000 push 0x7D03 ; |wParam = 0x7D03
004010DB |. 68 11010000 push 0x111 ; |Message = WM_COMMAND
004010E0 |. FF75 08 push [arg.1] ; |hWnd = 0x3BF000
004010E3 |. E8 AE000000 call <jmp.&USER32.SendMessageA> ; \SendMessageA
004010E8 |> EB 09 jmp short AD_CM#2.004010F3
004010EA |> B8 00000000 mov eax,0x0
004010EF |. C9 leave
004010F0 |. C2 1000 retn 0x10
004010F3 |> B8 01000000 mov eax,0x1
004010F8 |. C9 leave
004010F9 \. C2 1000 retn 0x10
004010FC /$ 55 push ebp
004010FD |. 8BEC mov ebp,esp
004010FF |. 6A 14 push 0x14 ; /Count = 14 (20.)
00401101 |. 68 80304000 push AD_CM#2.00403080 ; |Buffer = AD_CM#2.00403080
00401106 |. 68 B80B0000 push 0xBB8 ; |ControlID = BB8 (3000.)
0040110B |. FF75 08 push [arg.1] ; |hWnd = 003BF000
0040110E |. E8 77000000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
00401113 |. 8BF0 mov esi,eax
00401115 |. 8D01 lea eax,dword ptr ds:[ecx]
00401117 |. 83FE 05 cmp esi,0x5
0040111A |. 7D 18 jge short AD_CM#2.00401134
0040111C |. 6A 40 push 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0040111E |. 68 12304000 push AD_CM#2.00403012 ; |Title = "ArturDents CrackMe#2"
00401123 |. 68 44304000 push AD_CM#2.00403044 ; |Text = "Your name must be at least five characters long!"
00401128 |. FF75 08 push [arg.1] ; |hOwner = 003BF000
0040112B |. E8 60000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401130 |. 33C0 xor eax,eax
00401132 |. EB 40 jmp short AD_CM#2.00401174
00401134 |> 6A 14 push 0x14 ; /Count = 14 (20.)
00401136 |. 68 80324000 push AD_CM#2.00403280 ; |Buffer = AD_CM#2.00403280
0040113B |. 68 B90B0000 push 0xBB9 ; |ControlID = BB9 (3001.)
00401140 |. FF75 08 push [arg.1] ; |hWnd = 003BF000
00401143 |. E8 42000000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
00401148 |. B8 80304000 mov eax,AD_CM#2.00403080
0040114D |. BB 80324000 mov ebx,AD_CM#2.00403280
00401152 |. 8BCE mov ecx,esi ; AD_CM#2.<ModuleEntryPoint>
00401154 |> 8A10 /mov dl,byte ptr ds:[eax]
00401156 |. 2AD1 |sub dl,cl
00401158 |. 3813 |cmp byte ptr ds:[ebx],dl
0040115A |. 75 18 |jnz short AD_CM#2.00401174
0040115C |. 40 |inc eax
0040115D |. 43 |inc ebx
0040115E |.^ E2 F4 \loopd short AD_CM#2.00401154
00401160 |. 6A 40 push 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
00401162 |. 68 12304000 push AD_CM#2.00403012 ; |Title = "ArturDents CrackMe#2"
00401167 |. 68 27304000 push AD_CM#2.00403027 ; |Text = "Yeah, you did it!"
0040116C |. FF75 08 push [arg.1] ; |hOwner = 003BF000
0040116F |. E8 1C000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401174 |> C9 leave
00401175 \. C2 0400 retn 0x4
00401178 $- FF25 20204000 jmp dword ptr ds:[<&USER32.DialogBoxPara>; user32.DialogBoxParamA
0040117E $- FF25 18204000 jmp dword ptr ds:[<&USER32.EndDialog>] ; user32.EndDialog
00401184 $- FF25 10204000 jmp dword ptr ds:[<&USER32.GetDlgItem>] ; user32.GetDlgItem
0040118A $- FF25 0C204000 jmp dword ptr ds:[<&USER32.GetDlgItemTex>; user32.GetDlgItemTextA
00401190 $- FF25 1C204000 jmp dword ptr ds:[<&USER32.MessageBoxA>] ; user32.MessageBoxA
00401196 $- FF25 24204000 jmp dword ptr ds:[<&USER32.SendMessageA>>; user32.SendMessageA
0040119C $- FF25 14204000 jmp dword ptr ds:[<&USER32.SetFocus>] ; user32.SetFocus
004011A2 .- FF25 04204000 jmp dword ptr ds:[<&KERNEL32.ExitProcess>; kernel32.ExitProcess
004011A8 $- FF25 00204000 jmp dword ptr ds:[<&KERNEL32.GetModuleHa>; kernel32.GetModuleHandleA
004011AE 00 db 00
004011AF 00 db 00
后面到00401FFF都是0了, 可以看到后面几行就关键方法跳转，再上一点就是关键算法了，
用户名每一位减去用户名剩余长度是否等于系列号 user[i] - (ulen-i) ?== serl[i]
如：
用户名为：56789
系列号则：02468
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号