新CrackMe160之069 - ArturDents - CrackMe#4

1. 脱壳
   OD载入程序使用ESP定律轻松来到程序入口004584F0处, 便可以ollyDump了, 再用import rec工具导入iat表,OEP修改为000584F0点AutoSearch, Get Imports, Fix Dump搞定

2. 破解
   Delphi的程序,直接使用IDR查看按钮事件源码:

 Unit1::TForm1.Button1Click
 00458144    push       ebp
 00458145    mov        ebp,esp
 00458147    xor        ecx,ecx
 00458149    push       ecx
 0045814A    push       ecx
 0045814B    push       ecx
 0045814C    push       ecx
 0045814D    push       ecx
 0045814E    push       ecx
 0045814F    push       ecx
 00458150    push       ecx
 00458151    push       ebx
 00458152    push       esi
 00458153    push       edi
 00458154    mov        dword ptr [ebp-4],eax
 00458157    xor        eax,eax
 00458159    push       ebp
 0045815A    push       458290
 0045815F    push       dword ptr fs:[eax]
 00458162    mov        dword ptr fs:[eax],esp
 00458165    lea        edx,[ebp-8]
 00458168    mov        eax,dword ptr [ebp-4]
 0045816B    mov        eax,dword ptr [eax+2D8]; TForm1.Edit1:TEdit
 00458171    call       TControl.GetText
 00458176    lea        edx,[ebp-14]
 00458179    mov        eax,dword ptr [ebp-4]
 0045817C    mov        eax,dword ptr [eax+2D8]; TForm1.Edit1:TEdit
 00458182    call       TControl.GetText
 00458187    cmp        dword ptr [ebp-14],0
>0045818B    jne        00458197
 0045818D    mov        eax,4582A8; 'Enter you name, pls.'
 00458192    call       ShowMessage
 00458197    lea        edx,[ebp-18]
 0045819A    mov        eax,dword ptr [ebp-4]
 0045819D    mov        eax,dword ptr [eax+2DC]; TForm1.Edit2:TEdit
 004581A3    call       TControl.GetText
 004581A8    cmp        dword ptr [ebp-18],0
>004581AC    jne        004581B8
 004581AE    mov        eax,4582C8; 'Enter the serial, pls.'
 004581B3    call       ShowMessage
 004581B8    mov        eax,dword ptr [ebp-8]  ; 用户名
 004581BB    call       @LStrLen
 004581C0    mov        edi,eax
 004581C2    test       edi,edi
>004581C4    jle        00458216
 004581C6    mov        ebx,1
 004581CB    mov        eax,dword ptr [ebp-8]   ; 循环开始
 004581CE    movzx      esi,byte ptr [eax+ebx-1]  ; 取一位
 004581D3    mov        eax,esi
 004581D5    mov        ecx,6
 004581DA    xor        edx,edx
 004581DC    div        eax,ecx                   ; 除以6
 004581DE    mov        edx,dword ptr [ebp-8]
 004581E1    mov        edx,esi
 004581E3    shr        edx,2
 004581E6    imul       edx                       ; eax = user[i] * (user[i] >> 2)
 004581E8    push       eax
 004581E9    mov        eax,dword ptr [ebp-8]
 004581EC    mov        eax,esi
 004581EE    mov        ecx,0A
 004581F3    xor        edx,edx
 004581F5    div        eax,ecx                   ; edx = user[i] / 10
 004581F7    pop        edx                       ; 取出前面存的eax 与上面的eax交换
 004581F8    xchg       eax,edx
 004581F9    mov        ecx,edx
 004581FB    xor        edx,edx
 004581FD    div        eax,ecx                   ; eax = eax / edx
 004581FF    lea        edx,[ebp-1C]
 00458202    call       IntToStr
 00458207    mov        edx,dword ptr [ebp-1C]
 0045820A    lea        eax,[ebp-0C]              ; eax存到[ebp-0C]
 0045820D    call       @LStrCat
 00458212    inc        ebx
 00458213    dec        edi
<00458214    jne        004581CB            ; 循环结束
 00458216    push       4582E8; 'ADCM4-'
 0045821B    push       dword ptr [ebp-0C]
 0045821E    push       4582F8; '-YEAH!'
 00458223    lea        eax,[ebp-10]        ; 三个字符串连起来 与系列号对比
 00458226    mov        edx,3
 0045822B    call       @LStrCatN
 00458230    lea        edx,[ebp-20]
 00458233    mov        eax,dword ptr [ebp-4]
 00458236    mov        eax,dword ptr [eax+2DC]; TForm1.Edit2:TEdit
 0045823C    call       TControl.GetText
 00458241    mov        edx,dword ptr [ebp-20]
 00458244    mov        eax,dword ptr [ebp-10]
 00458247    call       @LStrCmp
>0045824C    jne        00458258
 0045824E    mov        eax,458308; 'Well done Cracker, You did it!'
 00458253    call       ShowMessage
 00458258    xor        eax,eax
 0045825A    pop        edx
 0045825B    pop        ecx
 0045825C    pop        ecx
 0045825D    mov        dword ptr fs:[eax],edx
 00458260    push       458297
 00458265    lea        eax,[ebp-20]
 00458268    call       @LStrClr
 0045826D    lea        eax,[ebp-1C]
 00458270    call       @LStrClr
 00458275    lea        eax,[ebp-18]
 00458278    mov        edx,2
 0045827D    call       @LStrArrayClr
 00458282    lea        eax,[ebp-10]
 00458285    mov        edx,3
 0045828A    call       @LStrArrayClr
 0045828F    ret
<00458290    jmp        @HandleFinally
<00458295    jmp        00458265
 00458297    pop        edi
 00458298    pop        esi
 00458299    pop        ebx
 0045829A    mov        esp,ebp
 0045829C    pop        ebp
 0045829D    ret

注册机代码如下：(keygen.vbs)

user = InputBox("请输入用户名")
ulen = len(user)
code = ""
for i=1 to ulen
  v = asc(Mid(user,  i,  1))
  a = fix(v / 6)
  b = fix(v / (2^2))
  c = fix(v / 10)
  code = code + cstr(fix(a * b / c))
next
msgbox "ADCM4-" & code & "-YEAH!"

运行示例：
用户名：abc
注册码：ADCM4-424242-YEAH!

 
 
本节高手录制的视频,点击前往查看

 
 
 
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~