新CrackMe160之063 - dc0de - crackme

IDA分析按钮事件源码:

int __usercall TForm1_Button1Click@<eax>(int a1@<eax>, int a2@<ebx>, int a3@<edi>, int a4@<esi>)
{
  int v4; // esi@1
  signed int v5; // ebx@1
  int v6; // eax@1
  int v7; // esi@3
  signed int v8; // ebx@4
  int v9; // eax@5
  int v10; // esi@8
  signed int v11; // ebx@9
  int v12; // eax@9
  int v13; // esi@11
  signed int v14; // ebx@12
  int v15; // eax@13
  signed int v16; // eax@14
  char v17; // dl@14
  signed int v18; // ecx@15
  int v19; // ecx@17
  int v20; // ecx@18
  int v21; // ecx@21
  int v22; // ecx@22
  signed int v23; // ebx@37
  unsigned int v25; // [sp-18h] [bp-2740h]@1
  _UNKNOWN *v26; // [sp-14h] [bp-273Ch]@1
  int *v27; // [sp-10h] [bp-2738h]@1
  int v28; // [sp-Ch] [bp-2734h]@1
  int v29; // [sp-8h] [bp-2730h]@1
  int v30; // [sp-4h] [bp-272Ch]@1
  int v31; // [sp+0h] [bp-2728h]@1
  char v32[10000]; // [sp+4h] [bp-2724h]@1
  int v33; // [sp+2714h] [bp-14h]@3
  int v34; // [sp+2718h] [bp-10h]@14
  int v35; // [sp+271Ch] [bp-Ch]@3
  int v36; // [sp+2720h] [bp-8h]@1
  int v37; // [sp+2724h] [bp-4h]@1
  int savedregs; // [sp+2728h] [bp+0h]@1

  v30 = a2;
  v29 = a4;
  v28 = a3;
  v31 = 0;
  v37 = 0;
  v36 = 0;
  v4 = a1;
  v27 = &savedregs;
  v26 = &loc_453A3B;
  v25 = __readfsdword(0);
  __writefsdword(0, (unsigned int)&v25);
  v5 = 10000;
  v6 = (int)v32;
  do
  {
    *(_BYTE *)v6++ = 0;
    --v5;
  }
  while ( v5 );
  Controls::TControl::GetText(*(Controls::TControl **)(v4 + 764));
  Controls::TControl::GetText(*(Controls::TControl **)(v4 + 768));
  v33 = Sysutils::StrToInt(v31);
  v35 = unknown_libname_69(v37);
  System::__linkproc__ LStrLAsg(&v36, &str________________[1]);
  v7 = unknown_libname_69(v36);
  if ( v7 > 0 )
  {
    v8 = 1;
    do
    {
      v9 = j_unknown_libname_70_0(&v36);
      *(_BYTE *)(v9 + v8 - 1) = *(_BYTE *)(v36 + v8 - 1) + 1;
      ++v8;
      --v7;
    }
    while ( v7 );
  }
  if ( v35 > 0 && v35 < 10 )
  {
    v10 = unknown_libname_69(v36);
    if ( v10 > 0 )
    {
      v11 = 1;
      v12 = (int)v32;
      do
      {
        *(_BYTE *)v12++ = *(_BYTE *)(v36 + v11++ - 1);
        --v10;
      }
      while ( v10 );
    }
    v13 = v35;
    if ( v35 > 0 )
    {
      v14 = 1;
      do
      {
        v15 = unknown_libname_69(v36);
        *(&v32[v14] + v15) = *(_BYTE *)(v37 + v14 - 1);
        ++v14;
        --v13;
      }
      while ( v13 );
    }
    v34 = unknown_libname_69(v36) + 2;
    v16 = 1;
    v17 = 0;
    do
    {
      v18 = *((_BYTE *)&v31 + v16 + 3);
      if ( v18 > 60 )
      {
        v21 = v18 - 62;
        if ( v21 )
        {
          v22 = v21 - 29;
          if ( v22 )
          {
            if ( v22 == 2 && *((_BYTE *)&v31 + v34 + 3) )
            {
              do
                --v16;
              while ( *((_BYTE *)&v31 + v16 + 3) != 91 );
            }
          }
          else if ( !*((_BYTE *)&v31 + v34 + 3) )
          {
            do
              ++v16;
            while ( *((_BYTE *)&v31 + v16 + 3) != 93 );
          }
        }
        else
        {
          ++v34;
        }
      }
      else if ( v18 == 60 )
      {
        --v34;
      }
      else
      {
        v19 = v18 - 33;
        if ( v19 )
        {
          v20 = v19 - 10;
          if ( v20 )
          {
            if ( v20 == 2 )
              --*((_BYTE *)&v31 + v34 + 3);
          }
          else
          {
            ++*((_BYTE *)&v31 + v34 + 3);
          }
        }
        else
        {
          v17 = 1;
        }
      }
      ++v16;
    }
    while ( v17 != 1 );
  }
  v23 = 1;
  do
    a3 += *((_BYTE *)&v31 + v23++ + unknown_libname_69(v36) + 3);
  while ( v23 != 10 );
  if ( a3 == v33 )
    Dialogs::ShowMessage(&str_well_done_[1]);
  else
    Dialogs::ShowMessage(&str_wrong[1]);
  __writefsdword(0, v25);
  v27 = (int *)&loc_453A42;
  System::__linkproc__ LStrClr(&v31);
  return System::__linkproc__ LStrArrayClr(&v36, 2);
}

看上面基本上算法就出来了, 用户名经过几次循环处理再累加起来与系列号对比
下面是大佬写的注册机keygen.py

Username = input('用户名为: ')
Username_list = [ord(i)for i in Username]

# 得到str3
str1 = ';;;;;;;;;;;;;**====,,=,,========*=**=*=**=*=**=*=*=* '
str2 = []
for i in str1:
    str2.append(ord(i) + 1)
str3 = str2
str3.append(0)
str3.extend(Username_list)
str3.extend([0]*(1000-len(str3)))

# 计算得到str3的Username部分
v17 = 0
v16 = 1
str1_length_plus_2 = 0x37
while ( v17 != 1 ):
  v18 = str3[v16 - 1];
  if ( v18 > 0x3C ):
    v21 = v18 - 0x3E;
    if ( v21 ):
      v22 = v21 - 0x1D;
      if ( v22 ):
        if ( v22 == 2 and str3[str1_length_plus_2 - 1] ):
            v16 -= 1
            while ( str3[v16 - 1] != 91 ):
                v16 -= 1
      elif ( str3[str1_length_plus_2 - 1] == 0 ):
        v16 += 1;
        while ( str3[v16 - 1] != 93 ):
            v16 += 1;
    else:
        str1_length_plus_2 += 1;
  elif ( v18 == 0x3C ):
    str1_length_plus_2 -= 1;
  else:
    v19 = v18 - 0x21;
    if ( v19 ):
      v20 = v19 - 10;
      if ( v20 ):
        if ( v20 == 2 ):
            str3[str1_length_plus_2 - 1] -= 1;
      else:
        str3[str1_length_plus_2 - 1] += 1;
    else:
      v17 = 1;
  v16 += 1
Username_calc = str3[0x36:0x36+len(Username)]

# 计算得到Serial
Serial = 0x19F50C
for i in Username_calc:
    Serial += i

print('系列号为: ' + str(Serial))

运行示例:
用户名为: abcde
系列号为: 1701637

 
 
本节高手录制的视频,点击前往查看

 
 
 
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~