新CrackMe160之028 - AD_CM#3

1. 脱壳
   使用ESP定律脱壳，OD载入程序，第7行0046D05C才是pushad，单步执行到第8行，此时ESP的值为红值0019FF4A, 右键在数据窗口中跟随，在数据窗口中选择值 42 D0 46 00
   右键->断点->硬件访问->Word, 这样断点就下好了, F9运行到popad下一行0046D03D, 下两行跳转到解码后程序区004584C0,便可以OllyDump了,选用方式2,并记住
   界面中的几个值, OEP: 584C0, RVA: 5900, Size: 6E000, 接着修复IAT表,以管理员方式打开Import REConstructor V1.7c Final, 选择ad_cm#3.exe这个进程, 其中OEP,RVA,SIZE分别
   填前面记下的值,点Get Import, 需要等一会, 搜索的内容大小比较大, 完成后左侧框框也会出来一大堆的东东, 把后缀是:NO的都删除掉(选中右键Delete thunk(s),有s说明可以多选哈)
   再点Fix Dump选择脱壳后的文件,就成功了, 文件大了4K左右, 如果前面不删除:NO的那些表,也是可以的,只是文件会大了100K左右, 到此IAT修复完成,脱壳就成功了

2. 破解
   Delphi的程序IDR查看源码:

 Unit1::TForm1.Button1Click
 00458160    push       ebp
 00458161    mov        ebp,esp
 00458163    xor        ecx,ecx
 00458165    push       ecx
 00458166    push       ecx
 00458167    push       ecx
 00458168    push       ecx
 00458169    push       ecx
 0045816A    push       ecx
 0045816B    push       ecx
 0045816C    push       ebx
 0045816D    push       esi
 0045816E    push       edi
 0045816F    mov        edi,eax
 00458171    xor        eax,eax
 00458173    push       ebp
 00458174    push       458271
 00458179    push       dword ptr fs:[eax]
 0045817C    mov        dword ptr fs:[eax],esp
 0045817F    lea        edx,[ebp-4]
 00458182    mov        eax,dword ptr [edi+2D8]; TForm1.Edit1:TEdit
 00458188    call       TControl.GetText
 0045818D    lea        edx,[ebp-10]
 00458190    mov        eax,dword ptr [edi+2D8]; TForm1.Edit1:TEdit
 00458196    call       TControl.GetText
 0045819B    cmp        dword ptr [ebp-10],0
>0045819F    jne        004581AB
 004581A1    mov        eax,458288; 'Enter you name, pls.'
 004581A6    call       ShowMessage
 004581AB    lea        edx,[ebp-14]
 004581AE    mov        eax,dword ptr [edi+2DC]; TForm1.Edit2:TEdit
 004581B4    call       TControl.GetText
 004581B9    cmp        dword ptr [ebp-14],0
>004581BD    jne        004581C9
 004581BF    mov        eax,4582A8; 'Enter the serial, pls.'
 004581C4    call       ShowMessage
 004581C9    mov        eax,dword ptr [ebp-4]
 004581CC    call       @LStrLen
 004581D1    mov        ebx,eax
 004581D3    test       ebx,ebx
>004581D5    jle        00458204
 004581D7    mov        esi,1
 004581DC    mov        eax,dword ptr [ebp-4]
 004581DF    movzx      eax,byte ptr [eax+esi-1]      ;;; 循环取名称
 004581E4    mov        ecx,3     ;;; 除以3
 004581E9    xor        edx,edx
 004581EB    div        eax,ecx
 004581ED    lea        edx,[ebp-18]
 004581F0    call       IntToStr      ;;; 结果转整形
 004581F5    mov        edx,dword ptr [ebp-18]
 004581F8    lea        eax,[ebp-8]
 004581FB    call       @LStrCat      ;;; 连接到字符串
 00458200    inc        esi
 00458201    dec        ebx
<00458202    jne        004581DC
 00458204    lea        eax,[ebp-0C]
 00458207    mov        ecx,dword ptr [ebp-8]
 0045820A    mov        edx,4582C8; 'ADCM3-'      ;;; 连接好的字符串前面再连接固定串"ADCM3-"
 0045820F    call       @LStrCat3
 00458214    lea        edx,[ebp-1C]
 00458217    mov        eax,dword ptr [edi+2DC]; TForm1.Edit2:TEdit
 0045821D    call       TControl.GetText
 00458222    mov        edx,dword ptr [ebp-1C]
 00458225    mov        eax,dword ptr [ebp-0C]
 00458228    call       @LStrCmp      ;;; 与系列号对比
>0045822D    jne        00458239
 0045822F    mov        eax,4582D8; 'Well done Cracker, You did it!'
 00458234    call       ShowMessage
 00458239    xor        eax,eax
 0045823B    pop        edx
 0045823C    pop        ecx
 0045823D    pop        ecx
 0045823E    mov        dword ptr fs:[eax],edx
 00458241    push       458278
 00458246    lea        eax,[ebp-1C]
 00458249    call       @LStrClr
 0045824E    lea        eax,[ebp-18]
 00458251    call       @LStrClr
 00458256    lea        eax,[ebp-14]
 00458259    mov        edx,2
 0045825E    call       @LStrArrayClr
 00458263    lea        eax,[ebp-0C]
 00458266    mov        edx,3
 0045826B    call       @LStrArrayClr
 00458270    ret
<00458271    jmp        @HandleFinally
<00458276    jmp        00458246
 00458278    pop        edi
 00458279    pop        esi
 0045827A    pop        ebx
 0045827B    mov        esp,ebp
 0045827D    pop        ebp
 0045827E    ret

看完源码, 算法就明朗了, 直接上注册机

#include <stdio.h>
#include <string.h>
int main() {
	char user[21] = {0};
	char code[51] = {0};
	char tmp[5] = {0};
	printf("用户名: ");
	fgets(user, sizeof(user), stdin);
	int i, j = 0, k, lt, len = strlen(user) - 1; //最后一个\n
		
	for(i=0; i<len; i++){
		sprintf(tmp, "%d\0", user[i] / 3); //转整形字符串 
		lt = strlen(tmp);
		for(k=0; k<lt; k++) {
			code[j++] = tmp[k];
			tmp[k] = 0;
		}
	}
	
	printf("系列号: ADCM3-%s\n", code);
	getchar();
	return 0;
}

运行示例：
用户名: abc
系列号: ADCM3-323233

 
 
本节高手录制的视频,点击前往查看

 
 
 

使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~