新CrackMe160之092 - FaNtOm - crackme6
汇编的程序直接看代码
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 BF010000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 84304000 mov dword ptr ds:[0x403084],eax
0040100C |. 6A 00 push 0x0 ; /lParam = NULL
0040100E |. 68 2C104000 push CRACKME6.0040102C ; |DlgProc = CRACKME6.0040102C
00401013 |. 6A 00 push 0x0 ; |hOwner = NULL
00401015 |. 68 00304000 push CRACKME6.00403000 ; |pTemplate = "MAINDIALOG"
0040101A |. FF35 84304000 push dword ptr ds:[0x403084] ; |hInst = NULL
00401020 |. E8 7D010000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401025 |. 6A 00 push 0x0 ; /ExitCode = 0x0
00401027 \. E8 94010000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
0040102C /. 55 push ebp
0040102D |. 8BEC mov ebp,esp
0040102F |. 817D 0C 10010>cmp [arg.2],0x110
00401036 |. 74 15 je short CRACKME6.0040104D
00401038 |. 837D 0C 10 cmp [arg.2],0x10
0040103C |. 74 11 je short CRACKME6.0040104F
0040103E |. 817D 0C 11010>cmp [arg.2],0x111
00401045 |. 74 14 je short CRACKME6.0040105B
00401047 |. 33C0 xor eax,eax
00401049 |. C9 leave
0040104A |. C2 1000 retn 0x10
0040104D |> EB 46 jmp short CRACKME6.00401095
0040104F |> 6A 00 push 0x0 ; /Result = 0x0
00401051 |. FF75 08 push [arg.1] ; |hWnd = 002E3000
00401054 |. E8 4F010000 call <jmp.&USER32.EndDialog> ; \EndDialog
00401059 |. EB 3A jmp short CRACKME6.00401095
0040105B |> 8B45 10 mov eax,[arg.3]
0040105E |. 66:3D 419C cmp ax,0x9C41
00401062 |.^ 74 EB je short CRACKME6.0040104F
00401064 |. 66:3D 439C cmp ax,0x9C43
00401068 |. 74 08 je short CRACKME6.00401072
0040106A |. 66:3D 429C cmp ax,0x9C42
0040106E |. 74 09 je short CRACKME6.00401079
00401070 |. EB 23 jmp short CRACKME6.00401095
00401072 |> E8 6A000000 call CRACKME6.004010E1
00401077 |. EB 1C jmp short CRACKME6.00401095
00401079 |> 6A 00 push 0x0 ; /lParam = NULL
0040107B |. 68 9E104000 push CRACKME6.0040109E ; |DlgProc = CRACKME6.0040109E
00401080 |. FF75 08 push [arg.1] ; |hOwner = 002E3000
00401083 |. 68 0B304000 push CRACKME6.0040300B ; |pTemplate = "ABOUTDIALOG"
00401088 |. FF35 84304000 push dword ptr ds:[0x403084] ; |hInst = NULL
0040108E |. E8 0F010000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401093 |. EB 00 jmp short CRACKME6.00401095
00401095 |> B8 01000000 mov eax,0x1
0040109A |. C9 leave
0040109B \. C2 1000 retn 0x10
0040109E /. 55 push ebp
0040109F |. 8BEC mov ebp,esp
004010A1 |. 817D 0C 10010>cmp [arg.2],0x110
004010A8 |. 74 15 je short CRACKME6.004010BF
004010AA |. 837D 0C 10 cmp [arg.2],0x10
004010AE |. 74 11 je short CRACKME6.004010C1
004010B0 |. 817D 0C 11010>cmp [arg.2],0x111
004010B7 |. 74 14 je short CRACKME6.004010CD
004010B9 |. 33C0 xor eax,eax
004010BB |. C9 leave
004010BC |. C2 1000 retn 0x10
004010BF |> EB 17 jmp short CRACKME6.004010D8
004010C1 |> 6A 00 push 0x0 ; /Result = 0x0
004010C3 |. FF75 08 push [arg.1] ; |hWnd = 002E3000
004010C6 |. E8 DD000000 call <jmp.&USER32.EndDialog> ; \EndDialog
004010CB |. EB 0B jmp short CRACKME6.004010D8
004010CD |> 8B45 10 mov eax,[arg.3]
004010D0 |. 66:3D EC03 cmp ax,0x3EC
004010D4 |. 75 02 jnz short CRACKME6.004010D8
004010D6 |.^ EB E9 jmp short CRACKME6.004010C1
004010D8 |> B8 01000000 mov eax,0x1
004010DD |. C9 leave
004010DE \. C2 1000 retn 0x10
004010E1 /$ 6A 00 push 0x0 ; /hTemplateFile = NULL
004010E3 |. 68 80000000 push 0x80 ; |Attributes = NORMAL
004010E8 |. 6A 03 push 0x3 ; |Mode = OPEN_EXISTING
004010EA |. 6A 00 push 0x0 ; |pSecurity = NULL
004010EC |. 6A 01 push 0x1 ; |ShareMode = FILE_SHARE_READ
004010EE |. 68 00000080 push 0x80000000 ; |Access = GENERIC_READ
004010F3 |. 68 17304000 push CRACKME6.00403017 ; |FileName = "keyfile.dat"
004010F8 |. E8 BD000000 call <jmp.&KERNEL32.CreateFileA> ; \CreateFileA
004010FD |. A3 88304000 mov dword ptr ds:[0x403088],eax
00401102 |. 83F8 FF cmp eax,-0x1
00401105 |. 75 14 jnz short CRACKME6.0040111B
00401107 |. 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
00401109 |. 68 23304000 push CRACKME6.00403023 ; |Title = "Error!"
0040110E |. 68 2A304000 push CRACKME6.0040302A ; |Text = "Key file not found!"
00401113 |. 6A 00 push 0x0 ; |hOwner = NULL
00401115 |. E8 94000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
0040111A |. C3 retn
0040111B |> 6A 00 push 0x0 ; /pOverlapped = NULL
0040111D |. 68 96304000 push CRACKME6.00403096 ; |pBytesRead = CRACKME6.00403096
00401122 |. 6A 0A push 0xA ; |BytesToRead = A (10.)
00401124 |. 68 8C304000 push CRACKME6.0040308C ; |Buffer = CRACKME6.0040308C
00401129 |. FF35 88304000 push dword ptr ds:[0x403088] ; |hFile = NULL
0040112F |. E8 98000000 call <jmp.&KERNEL32.ReadFile> ; \ReadFile
00401134 |. 83F8 00 cmp eax,0x0
00401137 |. 75 15 jnz short CRACKME6.0040114E
00401139 |. 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
0040113B |. 68 23304000 push CRACKME6.00403023 ; |Title = "Error!"
00401140 |. 68 3E304000 push CRACKME6.0040303E ; |Text = "Error reading file!"
00401145 |. 6A 00 push 0x0 ; |hOwner = NULL
00401147 |. E8 62000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
0040114C |. EB 48 jmp short CRACKME6.00401196
0040114E |> 8D15 8C304000 lea edx,dword ptr ds:[0x40308C]
00401154 |. 83C2 05 add edx,0x5
00401157 |. 803A 31 cmp byte ptr ds:[edx],0x31
0040115A |. 75 10 jnz short CRACKME6.0040116C
0040115C |. 83C2 03 add edx,0x3
0040115F |. 803A 33 cmp byte ptr ds:[edx],0x33
00401162 |. 75 08 jnz short CRACKME6.0040116C
00401164 |. 42 inc edx ; CRACKME6.<ModuleEntryPoint>
00401165 |. 803A 30 cmp byte ptr ds:[edx],0x30
00401168 |. 74 02 je short CRACKME6.0040116C
0040116A |. EB 15 jmp short CRACKME6.00401181
0040116C |> 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
0040116E |. 68 23304000 push CRACKME6.00403023 ; |Title = "Error!"
00401173 |. 68 52304000 push CRACKME6.00403052 ; |Text = "Invalid key!"
00401178 |. 6A 00 push 0x0 ; |hOwner = NULL
0040117A |. E8 2F000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
0040117F |. EB 15 jmp short CRACKME6.00401196
00401181 |> 6A 40 push 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
00401183 |. 68 76304000 push CRACKME6.00403076 ; |Title = "Correct!!!"
00401188 |. 68 5F304000 push CRACKME6.0040305F ; |Text = "Correct key! Good job!"
0040118D |. 6A 00 push 0x0 ; |hOwner = NULL
0040118F |. E8 1A000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401194 |. EB 00 jmp short CRACKME6.00401196
00401196 |> FF35 88304000 push dword ptr ds:[0x403088] ; /hObject = NULL
0040119C |. E8 13000000 call <jmp.&KERNEL32.CloseHandle> ; \CloseHandle
004011A1 \. C3 retn
004011A2 $- FF25 20204000 jmp dword ptr ds:[<&USER32.DialogBoxPara>; user32.DialogBoxParamA
004011A8 $- FF25 18204000 jmp dword ptr ds:[<&USER32.EndDialog>] ; user32.EndDialog
004011AE $- FF25 1C204000 jmp dword ptr ds:[<&USER32.MessageBoxA>] ; user32.MessageBoxA
004011B4 $- FF25 0C204000 jmp dword ptr ds:[<&KERNEL32.CloseHandle>; kernel32.CloseHandle
004011BA $- FF25 00204000 jmp dword ptr ds:[<&KERNEL32.CreateFileA>; kernel32.CreateFileA
004011C0 .- FF25 10204000 jmp dword ptr ds:[<&KERNEL32.ExitProcess>; kernel32.ExitProcess
004011C6 $- FF25 08204000 jmp dword ptr ds:[<&KERNEL32.GetModuleHa>; kernel32.GetModuleHandleA
004011CC $- FF25 04204000 jmp dword ptr ds:[<&KERNEL32.ReadFile>] ; kernel32.ReadFile
004011D2 00 db 00
关键算法：
00401154 |. 83C2 05 add edx,0x5
00401157 |. 803A 31 cmp byte ptr ds:[edx],0x31
0040115A |. 75 10 jnz short CRACKME6.0040116C
0040115C |. 83C2 03 add edx,0x3
0040115F |. 803A 33 cmp byte ptr ds:[edx],0x33
00401162 |. 75 08 jnz short CRACKME6.0040116C
00401164 |. 42 inc edx ; CRACKME6.<ModuleEntryPoint>
00401165 |. 803A 30 cmp byte ptr ds:[edx],0x30
文件内容第6位为‘1’，第9位为‘3’，第10位不为‘0’，其它不限，如：“aaaaa1aa34aaaaa”
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号