新CrackMe160之076 - ArturDents - CrackMe#1
汇编写的，代码很少直接看
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 45010000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 54304000 mov dword ptr ds:[0x403054],eax
0040100C |. 6A 00 push 0x0 ; /lParam = NULL
0040100E |. 68 2B104000 push AD_CM#1.0040102B ; |DlgProc = AD_CM#1.0040102B
00401013 |. 6A 00 push 0x0 ; |hOwner = NULL
00401015 |. 68 00304000 push AD_CM#1.00403000 ; |pTemplate = "ADDialog"
0040101A |. FF35 54304000 push dword ptr ds:[0x403054] ; |hInst = NULL
00401020 |. E8 F7000000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401025 |. 50 push eax ; /ExitCode = 0x19FFCC
00401026 \. E8 1B010000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
0040102B /. 55 push ebp
0040102C |. 8BEC mov ebp,esp
0040102E |. 817D 0C 10010>cmp [arg.2],0x110
00401035 |. 75 18 jnz short AD_CM#1.0040104F
00401037 |. 68 B80B0000 push 0xBB8 ; /ControlID = BB8 (3000.)
0040103C |. FF75 08 push [arg.1] ; |hWnd = 002AF000
0040103F |. E8 E4000000 call <jmp.&USER32.GetDlgItem> ; \GetDlgItem
00401044 |. 50 push eax ; /hWnd = 0019FFCC
00401045 |. E8 F6000000 call <jmp.&USER32.SetFocus> ; \SetFocus
0040104A |. E9 C4000000 jmp AD_CM#1.00401113
0040104F |> 837D 0C 10 cmp [arg.2],0x10
00401053 |. 75 19 jnz short AD_CM#1.0040106E
00401055 |. 6A 00 push 0x0 ; /lParam = 0x0
00401057 |. 68 027D0000 push 0x7D02 ; |wParam = 0x7D02
0040105C |. 68 11010000 push 0x111 ; |Message = WM_COMMAND
00401061 |. FF75 08 push [arg.1] ; |hWnd = 0x2AF000
00401064 |. E8 D1000000 call <jmp.&USER32.SendMessageA> ; \SendMessageA
00401069 |. E9 A5000000 jmp AD_CM#1.00401113
0040106E |> 817D 0C 11010>cmp [arg.2],0x111
00401075 |. 0F85 8F000000 jnz AD_CM#1.0040110A
0040107B |. 8B45 10 mov eax,[arg.3]
0040107E |. 837D 14 00 cmp [arg.4],0x0
00401082 |. 75 16 jnz short AD_CM#1.0040109A
00401084 |. 66:3D 027D cmp ax,0x7D02
00401088 |. 0F85 85000000 jnz AD_CM#1.00401113
0040108E |. 6A 00 push 0x0 ; /Result = 0x0
00401090 |. FF75 08 push [arg.1] ; |hWnd = 002AF000
00401093 |. E8 8A000000 call <jmp.&USER32.EndDialog> ; \EndDialog
00401098 |. EB 79 jmp short AD_CM#1.00401113
0040109A |> 8B55 10 mov edx,[arg.3]
0040109D |. C1EA 10 shr edx,0x10
004010A0 |. 66:0BD2 or dx,dx
004010A3 |. 75 63 jnz short AD_CM#1.00401108
004010A5 |. 66:3D B90B cmp ax,0xBB9
004010A9 |. 75 43 jnz short AD_CM#1.004010EE
004010AB |. 6A 07 push 0x7 ; /Count = 0x7
004010AD |. 68 5C304000 push AD_CM#1.0040305C ; |Buffer = AD_CM#1.0040305C
004010B2 |. 68 B80B0000 push 0xBB8 ; |ControlID = BB8 (3000.)
004010B7 |. FF75 08 push [arg.1] ; |hWnd = 002AF000
004010BA |. E8 6F000000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
004010BF |. B8 5C304000 mov eax,AD_CM#1.0040305C
004010C4 |. BB 1E304000 mov ebx,AD_CM#1.0040301E ; ASCII "qWeRtZ" ; 看这里看这里
004010C9 |. B9 07000000 mov ecx,0x7
004010CE |> 8A13 /mov dl,byte ptr ds:[ebx]
004010D0 |. 3810 |cmp byte ptr ds:[eax],dl
004010D2 |. 75 18 |jnz short AD_CM#1.004010EC
004010D4 |. 40 |inc eax
004010D5 |. 43 |inc ebx
004010D6 |.^ E2 F6 \loopd short AD_CM#1.004010CE
004010D8 |. 6A 40 push 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
004010DA |. 68 09304000 push AD_CM#1.00403009 ; |Title = "ArturDents CrackMe#1"
004010DF |. 68 36304000 push AD_CM#1.00403036 ; |Text = "Yeah, you did it!"
004010E4 |. FF75 08 push [arg.1] ; |hOwner = 002AF000
004010E7 |. E8 48000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
004010EC |> EB 1A jmp short AD_CM#1.00401108
004010EE |> 66:3D BA0B cmp ax,0xBBA
004010F2 |. 75 14 jnz short AD_CM#1.00401108
004010F4 |. 6A 00 push 0x0 ; /lParam = 0x0
004010F6 |. 68 027D0000 push 0x7D02 ; |wParam = 0x7D02
004010FB |. 68 11010000 push 0x111 ; |Message = WM_COMMAND
00401100 |. FF75 08 push [arg.1] ; |hWnd = 0x2AF000
00401103 |. E8 32000000 call <jmp.&USER32.SendMessageA> ; \SendMessageA
00401108 |> EB 09 jmp short AD_CM#1.00401113
0040110A |> B8 00000000 mov eax,0x0
0040110F |. C9 leave
00401110 |. C2 1000 retn 0x10
00401113 |> B8 01000000 mov eax,0x1
00401118 |. C9 leave
00401119 \. C2 1000 retn 0x10
0040111C $- FF25 20204000 jmp dword ptr ds:[<&USER32.DialogBoxPara>; user32.DialogBoxParamA
00401122 $- FF25 18204000 jmp dword ptr ds:[<&USER32.EndDialog>] ; user32.EndDialog
00401128 $- FF25 10204000 jmp dword ptr ds:[<&USER32.GetDlgItem>] ; user32.GetDlgItem
0040112E $- FF25 0C204000 jmp dword ptr ds:[<&USER32.GetDlgItemTex>; user32.GetDlgItemTextA
00401134 $- FF25 1C204000 jmp dword ptr ds:[<&USER32.MessageBoxA>] ; user32.MessageBoxA
0040113A $- FF25 24204000 jmp dword ptr ds:[<&USER32.SendMessageA>>; user32.SendMessageA
00401140 $- FF25 14204000 jmp dword ptr ds:[<&USER32.SetFocus>] ; user32.SetFocus
00401146 .- FF25 04204000 jmp dword ptr ds:[<&KERNEL32.ExitProcess>; kernel32.ExitProcess
0040114C $- FF25 00204000 jmp dword ptr ds:[<&KERNEL32.GetModuleHa>; kernel32.GetModuleHandleA
00401152 00 db 00
00401153 00 db 00
一眼就看到了固定串 qWeRtZ 输入测试验证成功~
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号