新CrackMe160之021 - Creakme
汇编的程序直接OD看代码：
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 B3010000 call <jmp.&kernel32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 50304000 mov dword ptr ds:[0x403050],eax
0040100C |. E8 AF010000 call <jmp.&comctl32.InitCommonControls> ; [InitCommonControls
00401011 |. 6A 00 push 0x0 ; /lParam = NULL
00401013 |. 68 30104000 push Creakme.00401030 ; |DlgProc = Creakme.00401030
00401018 |. 6A 00 push 0x0 ; |hOwner = NULL
0040101A |. 68 E8030000 push 0x3E8 ; |pTemplate = 0x3E8
0040101F |. FF35 50304000 push dword ptr ds:[0x403050] ; |hInst = NULL
00401025 |. E8 66010000 call <jmp.&user32.DialogBoxParamA> ; \DialogBoxParamA
0040102A |. 50 push eax ; /ExitCode = 0x19FFCC
0040102B \. E8 84010000 call <jmp.&kernel32.ExitProcess> ; \ExitProcess
00401030 /. 55 push ebp
00401031 |. 8BEC mov ebp,esp
00401033 |. 8B45 08 mov eax,[arg.1]
00401036 |. A3 00304000 mov dword ptr ds:[0x403000],eax
0040103B |. 8B45 0C mov eax,[arg.2]
0040103E |. 3D 10010000 cmp eax,0x110 ; Switch (cases 10..111)
00401043 |. 75 25 jnz short Creakme.0040106A
00401045 |. 68 C8000000 push 0xC8 ; /RsrcName = 200.; Case 110 (WM_INITDIALOG) of switch 0040103E
0040104A |. FF35 50304000 push dword ptr ds:[0x403050] ; |hInst = NULL
00401050 |. E8 4D010000 call <jmp.&user32.LoadIconA> ; \LoadIconA
00401055 |. 50 push eax ; /lParam = 0x19FFCC
00401056 |. 6A 01 push 0x1 ; |wParam = 0x1
00401058 |. 68 80000000 push 0x80 ; |Message = WM_SETICON
0040105D |. FF75 08 push [arg.1] ; |hWnd = 0x2EC000
00401060 |. E8 49010000 call <jmp.&user32.SendMessageA> ; \SendMessageA
00401065 |. E9 8E000000 jmp Creakme.004010F8
0040106A |> 3D 11010000 cmp eax,0x111
0040106F |. 75 78 jnz short Creakme.004010E9
00401071 |. 8B45 10 mov eax,[arg.3] ; Case 111 (WM_COMMAND) of switch 0040103E
00401074 |. 3D E9030000 cmp eax,0x3E9
00401079 |. 75 0E jnz short Creakme.00401089
0040107B |. 6A 00 push 0x0 ; /lParam = 0x0
0040107D |. 6A 00 push 0x0 ; |wParam = 0x0
0040107F |. 6A 10 push 0x10 ; |Message = WM_CLOSE
00401081 |. FF75 08 push [arg.1] ; |hWnd = 0x2EC000
00401084 |. E8 25010000 call <jmp.&user32.SendMessageA> ; \SendMessageA
00401089 |> 3D EC030000 cmp eax,0x3EC
0040108E |. 75 68 jnz short Creakme.004010F8
00401090 |. 68 FF000000 push 0xFF ; /Count = FF (255.)
00401095 |. 68 1A304000 push Creakme.0040301A ; |Buffer = Creakme.0040301A
0040109A |. 68 EB030000 push 0x3EB ; |ControlID = 3EB (1003.)
0040109F |. FF75 08 push [arg.1] ; |hWnd = 002EC000
004010A2 |. E8 F5000000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
004010A7 |. 68 FF000000 push 0xFF ; /Count = FF (255.)
004010AC |. 68 14304000 push Creakme.00403014 ; |Buffer = Creakme.00403014
004010B1 |. 68 EA030000 push 0x3EA ; |ControlID = 3EA (1002.)
004010B6 |. FF75 08 push [arg.1] ; |hWnd = 002EC000
004010B9 |. E8 DE000000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
004010BE |. 83F8 03 cmp eax,0x3
004010C1 |. 72 07 jb short Creakme.004010CA
004010C3 |. A3 25304000 mov dword ptr ds:[0x403025],eax
004010C8 |. EB 16 jmp short Creakme.004010E0
004010CA |> 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
004010CC |. 68 5F204000 push Creakme.0040205F ; |Title = ".:: DiS[IP] Programer ::."
004010D1 |. 68 79204000 push Creakme.00402079 ; |Text = "Min 3 Char on Name!!!"
004010D6 |. FF75 08 push [arg.1] ; |hOwner = 002EC000
004010D9 |. E8 CA000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004010DE |. EB 05 jmp short Creakme.004010E5
004010E0 |> E8 19000000 call Creakme.004010FE
004010E5 |> 33C0 xor eax,eax
004010E7 |. EB 0F jmp short Creakme.004010F8
004010E9 |> 83F8 10 cmp eax,0x10
004010EC |. 75 0A jnz short Creakme.004010F8
004010EE |. 6A 00 push 0x0 ; /Result = 0x0; Case 10 (WM_CLOSE) of switch 0040103E
004010F0 |. FF75 08 push [arg.1] ; |hWnd = 002EC000
004010F3 |. E8 9E000000 call <jmp.&user32.EndDialog> ; \EndDialog
004010F8 |> 33C0 xor eax,eax ; Default case of switch 0040103E
004010FA |. C9 leave
004010FB \. C2 1000 retn 0x10
004010FE /$ 33C0 xor eax,eax
00401100 |. 33DB xor ebx,ebx
00401102 |. 33C9 xor ecx,ecx ; Creakme.<ModuleEntryPoint>
00401104 |. A3 39304000 mov dword ptr ds:[0x403039],eax
00401109 |> 33DB /xor ebx,ebx
0040110B |. 8A98 14304000 |mov bl,byte ptr ds:[eax+0x403014]
00401111 |. 80FB 5A |cmp bl,0x5A ;;; Z
00401114 |. 75 02 |jnz short Creakme.00401118
00401116 |. FECB |dec bl
00401118 |> 80FB 7A |cmp bl,0x7A ;;; z
0040111B |. 75 02 |jnz short Creakme.0040111F
0040111D |. FECB |dec bl
0040111F |> 80FB 39 |cmp bl,0x39 ;;; 9 如果是Zz9分别减1
00401122 |. 75 02 |jnz short Creakme.00401126
00401124 |. FECB |dec bl
00401126 |> 50 |push eax
00401127 |. 83C0 61 |add eax,0x61 ;;; a
0040112A |. 02F8 |add bh,al
0040112C |. 58 |pop eax ; kernel32.7571FCC9
0040112D |. 80C3 01 |add bl,0x1
00401130 |. 66:8B0C45 1A3>|mov cx,word ptr ds:[eax*2+0x40301A]
00401138 |. 40 |inc eax
00401139 |. 50 |push eax
0040113A |. 66:3BD9 |cmp bx,cx
0040113D |. 75 37 |jnz short Creakme.00401176
0040113F |. 8305 39304000>|add dword ptr ds:[0x403039],0x1
00401146 |. 58 |pop eax ; kernel32.7571FCC9
00401147 |. 3B05 25304000 |cmp eax,dword ptr ds:[0x403025]
0040114D |.^ 75 BA \jnz short Creakme.00401109
0040114F |. 50 push eax
00401150 |. A1 39304000 mov eax,dword ptr ds:[0x403039]
00401155 |. 3B05 25304000 cmp eax,dword ptr ds:[0x403025]
0040115B |. 58 pop eax ; kernel32.7571FCC9
0040115C |. 75 18 jnz short Creakme.00401176
0040115E |. 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
00401160 |. 68 5F204000 push Creakme.0040205F ; |Title = ".:: DiS[IP] Programer ::."
00401165 |. 68 4A204000 push Creakme.0040204A ; |Text = "Register complite!!!"
0040116A |. FF35 00304000 push dword ptr ds:[0x403000] ; |hOwner = NULL
00401170 |. E8 33000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00401175 |. C3 retn
00401176 |> 58 pop eax ; kernel32.7571FCC9
00401177 |. 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
00401179 |. 68 5F204000 push Creakme.0040205F ; |Title = ".:: DiS[IP] Programer ::."
0040117E |. 68 30204000 push Creakme.00402030 ; |Text = "Name or Password is BAD!!"
00401183 |. FF35 00304000 push dword ptr ds:[0x403000] ; |hOwner = NULL
00401189 |. E8 1A000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
0040118E \. C3 retn
0040118F CC int3
00401190 $- FF25 14204000 jmp dword ptr ds:[<&user32.DialogBoxPara>; user32.DialogBoxParamA
00401196 $- FF25 24204000 jmp dword ptr ds:[<&user32.EndDialog>] ; user32.EndDialog
0040119C $- FF25 20204000 jmp dword ptr ds:[<&user32.GetDlgItemTex>; user32.GetDlgItemTextA
004011A2 $- FF25 1C204000 jmp dword ptr ds:[<&user32.LoadIconA>] ; user32.LoadIconA
004011A8 $- FF25 18204000 jmp dword ptr ds:[<&user32.MessageBoxA>] ; user32.MessageBoxA
004011AE $- FF25 28204000 jmp dword ptr ds:[<&user32.SendMessageA>>; user32.SendMessageA
004011B4 .- FF25 0C204000 jmp dword ptr ds:[<&kernel32.ExitProcess>; kernel32.ExitProcess
004011BA $- FF25 08204000 jmp dword ptr ds:[<&kernel32.GetModuleHa>; kernel32.GetModuleHandleA
004011C0 $- FF25 00204000 jmp dword ptr ds:[<&comctl32.InitCommonC>; comctl32.InitCommonControls
004011C6 00 db 00
从上面的关键算法代码 0040110B ~ 00401147 可得在用户名每位加1并在中间插入字母abc...即可得到密码，如：
用户名: zabc
+1 => zbcd (遇到Zz9这三个时本身先减1)
插入字母abc => bacbdc
密码为：bacbdc
再一组
用户名: 12345
密码: 2a3b4c5d6e
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号