新CrackMe160之095 - tengxingCrackMe_v1
运行程序，发现输入框黑不溜秋的输入东东也看不见，直接使用ResScope1.96->RCData->TFlatEdit的ColorFocused改成与button一样的颜色，clInactiveCaptionText改为clGradientActiveCaption保存
Delphi写的程序直接使用IDR查看按钮源码：
crackme1::TForm1.FlatButton1Click
00459EF0 push ebp
00459EF1 mov ebp,esp
00459EF3 add esp,0FFFFFF9C
00459EF6 push ebx
00459EF7 push esi
00459EF8 push edi
00459EF9 xor ecx,ecx
00459EFB mov dword ptr [ebp-4],ecx
00459EFE mov dword ptr [ebp-8],ecx
00459F01 mov dword ptr [ebp-0C],ecx
00459F04 mov dword ptr [ebp-10],ecx
00459F07 mov dword ptr [ebp-24],ecx
00459F0A mov edi,eax
00459F0C xor eax,eax
00459F0E push ebp
00459F0F push 45A419
00459F14 push dword ptr fs:[eax]
00459F17 mov dword ptr fs:[eax],esp
00459F1A push edi
00459F1B mov esi,45A428
00459F20 lea edi,[ebp-44]
00459F23 mov ecx,8
00459F28 rep movs dword ptr [edi],dword ptr [esi]
00459F2A pop edi
00459F2B push edi
00459F2C mov esi,45A448
00459F31 lea edi,[ebp-64]
00459F34 mov ecx,8
00459F39 rep movs dword ptr [edi],dword ptr [esi]
00459F3B pop edi
00459F3C lea edx,[ebp-4]
00459F3F mov eax,dword ptr [edi+2F8]; TForm1.FlatEdit1:TFlatEdit
00459F45 call TControl.GetText
00459F4A mov eax,dword ptr [ebp-4] ; 用户名
00459F4D call @LStrLen
00459F52 mov dword ptr [ebp-18],eax
00459F55 cmp dword ptr [ebp-18],4 ; 用户名长度4位以上
>00459F59 jl 0045A3F0
00459F5F cmp dword ptr [ebp-18],0F ; 用户名长度15位以下
>00459F63 jg 0045A3F0
00459F69 mov ebx,dword ptr [ebp-18]
00459F6C test ebx,ebx
>00459F6E jle 00459F9F
00459F70 mov esi,1
00459F75 mov eax,dword ptr [ebp-4]
00459F78 dec esi
00459F79 test eax,eax
>00459F7B je 00459F82
00459F7D cmp esi,dword ptr [eax-4]
>00459F80 jb 00459F87
00459F82 call @BoundErr
00459F87 inc esi
00459F88 mov al,byte ptr [eax+esi-1]
00459F8C and eax,0FF
00459F91 bt dword ptr [ebp-44],eax ; 如果不是0~9A~Za~z则失败
>00459F95 jae 0045A3F0
00459F9B inc esi
00459F9C dec ebx
<00459F9D jne 00459F75
00459F9F mov esi,1
00459FA4 mov eax,dword ptr [ebp-4]
00459FA7 dec esi
00459FA8 test eax,eax
>00459FAA je 00459FB1
00459FAC cmp esi,dword ptr [eax-4]
>00459FAF jb 00459FB6
00459FB1 call @BoundErr
00459FB6 inc esi
00459FB7 mov al,byte ptr [eax+esi-1]
00459FBB and eax,0FF
00459FC0 bt dword ptr [ebp-64],eax
>00459FC4 jae 0045A3F0
00459FCA inc esi
00459FCB cmp esi,4
<00459FCE jne 00459FA4
00459FD0 lea edx,[ebp-8]
00459FD3 mov eax,dword ptr [edi+2FC]; TForm1.FlatEdit2:TFlatEdit
00459FD9 call TControl.GetText
00459FDE mov eax,dword ptr [ebp-8] ; 注册码
00459FE1 call @LStrLen
00459FE6 mov dword ptr [ebp-1C],eax ; 长度
00459FE9 cmp dword ptr [ebp-8],0
>00459FED je 0045A3F0
00459FF3 mov eax,dword ptr [ebp-8]
00459FF6 call @LStrLen
00459FFB mov ebx,eax
00459FFD test ebx,ebx
>00459FFF jle 0045A030
0045A001 mov esi,1
0045A006 mov eax,dword ptr [ebp-8]
0045A009 dec esi
0045A00A test eax,eax
>0045A00C je 0045A013
0045A00E cmp esi,dword ptr [eax-4]
>0045A011 jb 0045A018
0045A013 call @BoundErr
0045A018 inc esi
0045A019 mov al,byte ptr [eax+esi-1]
0045A01D and eax,0FF
0045A022 bt dword ptr [ebp-44],eax ; 如果不是0~9A~Za~z则失败
>0045A026 jae 0045A3F0
0045A02C inc esi
0045A02D dec ebx
<0045A02E jne 0045A006
0045A030 mov dword ptr [ebp-14],1
0045A037 mov ebx,dword ptr [ebp-18]
0045A03A test ebx,ebx
>0045A03C jle 0045A0DD
0045A042 mov esi,1
0045A047 imul edx,dword ptr [ebp-18],3 ; 算法循环开始 len*3 = 4*3
>0045A04B jno 0045A052
0045A04D call @IntOver
0045A052 imul eax,esi,2 ; i*2 = 1*2
>0045A055 jno 0045A05C
0045A057 call @IntOver
0045A05C sub edx,eax ; len * 3 - i * 2 = 10
>0045A05E jno 0045A065
0045A060 call @IntOver
0045A065 sub edx,14 ; len*3 - i*2 - 0x14 = -10
>0045A068 jno 0045A06F
0045A06A call @IntOver
0045A06F mov eax,dword ptr [ebp-4]
0045A072 dec esi
0045A073 test eax,eax
>0045A075 je 0045A07C
0045A077 cmp esi,dword ptr [eax-4]
>0045A07A jb 0045A081
0045A07C call @BoundErr
0045A081 inc esi
0045A082 movzx eax,byte ptr [eax+esi-1]
0045A087 add eax,edx ; user[i] + -10
>0045A089 jno 0045A090
0045A08B call @IntOver
0045A090 mov edx,eax
0045A092 and edx,0FF
0045A098 bt dword ptr [ebp-44],edx
>0045A09C jae 0045A0D5
0045A09E mov edx,dword ptr [ebp-14]
0045A0A1 cmp edx,dword ptr [ebp-1C]
>0045A0A4 jg 0045A3F0
0045A0AA mov edx,dword ptr [ebp-14]
0045A0AD mov ecx,dword ptr [ebp-8]
0045A0B0 dec edx
0045A0B1 test ecx,ecx
>0045A0B3 je 0045A0BA
0045A0B5 cmp edx,dword ptr [ecx-4]
>0045A0B8 jb 0045A0BF
0045A0BA call @BoundErr
0045A0BF inc edx
0045A0C0 cmp al,byte ptr [ecx+edx-1] ; user[i] - 10 ?= code[i]
>0045A0C4 jne 0045A3F0
0045A0CA add dword ptr [ebp-14],1
>0045A0CE jno 0045A0D5
0045A0D0 call @IntOver
0045A0D5 inc esi
0045A0D6 dec ebx
<0045A0D7 jne 0045A047 ; 算法循环结束
0045A0DD mov eax,dword ptr [ebp-4]
0045A0E0 call @LStrToPChar
0045A0E5 lea edx,[ebp-0C]
0045A0E8 call 00459E38 ; 用户名倒序
0045A0ED mov ebx,dword ptr [ebp-18]
0045A0F0 test ebx,ebx
>0045A0F2 jle 0045A193
0045A0F8 mov esi,1
0045A0FD imul edx,dword ptr [ebp-18],3 ; 循环算法开始 len*3 = 4*3
>0045A101 jno 0045A108
0045A103 call @IntOver
0045A108 imul eax,esi,3 ; i*3 = 1*3
>0045A10B jno 0045A112
0045A10D call @IntOver
0045A112 sub edx,eax ; len * 3 - i * 3 = 9
>0045A114 jno 0045A11B
0045A116 call @IntOver
0045A11B sub edx,14 ; len*3 - i*3 - 0x14 = -11
>0045A11E jno 0045A125
0045A120 call @IntOver
0045A125 mov eax,dword ptr [ebp-0C]
0045A128 dec esi
0045A129 test eax,eax
>0045A12B je 0045A132
0045A12D cmp esi,dword ptr [eax-4]
>0045A130 jb 0045A137
0045A132 call @BoundErr
0045A137 inc esi
0045A138 movzx eax,byte ptr [eax+esi-1]
0045A13D add eax,edx ; user[i] + -11
>0045A13F jno 0045A146
0045A141 call @IntOver
0045A146 mov edx,eax
0045A148 and edx,0FF
0045A14E bt dword ptr [ebp-44],edx
>0045A152 jae 0045A18B
0045A154 mov edx,dword ptr [ebp-14]
0045A157 cmp edx,dword ptr [ebp-1C]
>0045A15A jg 0045A3F0
0045A160 mov edx,dword ptr [ebp-14]
0045A163 mov ecx,dword ptr [ebp-8]
0045A166 dec edx
0045A167 test ecx,ecx
>0045A169 je 0045A170
0045A16B cmp edx,dword ptr [ecx-4]
>0045A16E jb 0045A175
0045A170 call @BoundErr
0045A175 inc edx
0045A176 cmp al,byte ptr [ecx+edx-1] ; user[i] - 11 ?= code[i+4]
>0045A17A jne 0045A3F0
0045A180 add dword ptr [ebp-14],1
>0045A184 jno 0045A18B
0045A186 call @IntOver
0045A18B inc esi
0045A18C dec ebx
<0045A18D jne 0045A0FD ; 循环结束
0045A193 mov eax,dword ptr [ebp-0C]
0045A196 call @LStrLen
0045A19B add eax,1
>0045A19E jno 0045A1A5
0045A1A0 call @IntOver
0045A1A5 push eax
0045A1A6 lea eax,[ebp-24]
0045A1A9 mov ecx,1
0045A1AE mov edx,dword ptr ds:[459ECC]; _DynArr_65_3
0045A1B4 call @DynArraySetLength
0045A1B9 add esp,4
0045A1BC mov ebx,dword ptr [ebp-18]
0045A1BF test ebx,ebx
>0045A1C1 jle 0045A1F7
0045A1C3 mov esi,1
0045A1C8 mov eax,dword ptr [ebp-4] ; 循环开始
0045A1CB dec esi
0045A1CC test eax,eax
>0045A1CE je 0045A1D5
0045A1D0 cmp esi,dword ptr [eax-4]
>0045A1D3 jb 0045A1DA
0045A1D5 call @BoundErr
0045A1DA inc esi
0045A1DB mov al,byte ptr [eax+esi-1]
0045A1DF mov edx,dword ptr [ebp-24]
0045A1E2 test edx,edx
>0045A1E4 je 0045A1EB
0045A1E6 cmp esi,dword ptr [edx-4]
>0045A1E9 jb 0045A1F0
0045A1EB call @BoundErr
0045A1F0 mov byte ptr [edx+esi],al ; 用户名存到内存中
0045A1F3 inc esi
0045A1F4 dec ebx
<0045A1F5 jne 0045A1C8 ; 循环结束 OD中是jnz
0045A1F7 mov esi,1
0045A1FC mov byte ptr [ebp-1D],1 ; 循环开始 将用户名从小到大排序
0045A200 mov ebx,dword ptr [ebp-18]
0045A203 sub ebx,esi
>0045A205 jno 0045A20C
0045A207 call @IntOver
0045A20C test ebx,ebx
>0045A20E jle 0045A2DB
0045A214 mov eax,1
0045A219 mov edx,dword ptr [ebp-24] ; 子循环开始
0045A21C test edx,edx
>0045A21E je 0045A225
0045A220 cmp eax,dword ptr [edx-4]
>0045A223 jb 0045A22A
0045A225 call @BoundErr
0045A22A mov dl,byte ptr [edx+eax]
0045A22D mov ecx,eax
0045A22F add ecx,1
>0045A232 jno 0045A239
0045A234 call @IntOver
0045A239 mov edi,dword ptr [ebp-24]
0045A23C test edi,edi
>0045A23E je 0045A245
0045A240 cmp ecx,dword ptr [edi-4]
>0045A243 jb 0045A24A
0045A245 call @BoundErr
0045A24A cmp dl,byte ptr [edi+ecx]
>0045A24D jbe 0045A2D3
0045A253 mov edx,eax
0045A255 add edx,1
>0045A258 jno 0045A25F
0045A25A call @IntOver
0045A25F mov ecx,dword ptr [ebp-24]
0045A262 test ecx,ecx
>0045A264 je 0045A26B
0045A266 cmp edx,dword ptr [ecx-4]
>0045A269 jb 0045A270
0045A26B call @BoundErr
0045A270 movzx edx,byte ptr [ecx+edx]
0045A274 mov ecx,dword ptr [ebp-24]
0045A277 test ecx,ecx
>0045A279 je 0045A280
0045A27B cmp eax,dword ptr [ecx-4]
>0045A27E jb 0045A285
0045A280 call @BoundErr
0045A285 mov cl,byte ptr [ecx+eax]
0045A288 push ecx
0045A289 mov ecx,eax
0045A28B add ecx,1
>0045A28E jno 0045A295
0045A290 call @IntOver
0045A295 mov edi,dword ptr [ebp-24]
0045A298 test edi,edi
>0045A29A je 0045A2A1
0045A29C cmp ecx,dword ptr [edi-4]
>0045A29F jb 0045A2A6
0045A2A1 call @BoundErr
0045A2A6 add edi,ecx
0045A2A8 pop ecx
0045A2A9 mov byte ptr [edi],cl
0045A2AB mov ecx,dword ptr [ebp-24]
0045A2AE test ecx,ecx
>0045A2B0 je 0045A2B7
0045A2B2 cmp eax,dword ptr [ecx-4]
>0045A2B5 jb 0045A2BC
0045A2B7 call @BoundErr
0045A2BC add ecx,eax
0045A2BE push ecx
0045A2BF cmp edx,0FF
>0045A2C5 jbe 0045A2CC
0045A2C7 call @BoundErr
0045A2CC pop ecx
0045A2CD mov byte ptr [ecx],dl
0045A2CF mov byte ptr [ebp-1D],0
0045A2D3 inc eax
0045A2D4 dec ebx
<0045A2D5 jne 0045A219 ; 子循环结束
0045A2DB add esi,1
>0045A2DE jno 0045A2E5 ; 循环结束
0045A2E0 call @IntOver
0045A2E5 cmp byte ptr [ebp-1D],0
<0045A2E9 je 0045A1FC
0045A2EF lea eax,[ebp-10]
0045A2F2 mov edx,dword ptr [ebp-18]
0045A2F5 call @LStrSetLength
0045A2FA mov ebx,dword ptr [ebp-18]
0045A2FD test ebx,ebx
>0045A2FF jle 0045A33A
0045A301 mov esi,1
0045A306 lea eax,[ebp-10]
0045A309 call @UniqueStringA
0045A30E dec esi
0045A30F test eax,eax
>0045A311 je 0045A318
0045A313 cmp esi,dword ptr [eax-4]
>0045A316 jb 0045A31D
0045A318 call @BoundErr
0045A31D inc esi
0045A31E mov edx,dword ptr [ebp-24]
0045A321 test edx,edx
>0045A323 je 0045A32A
0045A325 cmp esi,dword ptr [edx-4]
>0045A328 jb 0045A32F
0045A32A call @BoundErr
0045A32F mov dl,byte ptr [edx+esi]
0045A332 mov byte ptr [eax+esi-1],dl
0045A336 inc esi
0045A337 dec ebx
<0045A338 jne 0045A306
0045A33A mov ebx,dword ptr [ebp-18]
0045A33D test ebx,ebx
>0045A33F jle 0045A3E6
0045A345 mov esi,1
0045A34A mov eax,dword ptr [ebp-18] ; 循环开始 eax = len
0045A34D sub eax,3 ; eax = 4-3 = 1
>0045A350 jno 0045A357
0045A352 call @IntOver
0045A357 mov edx,eax
0045A359 imul edx,eax ; edx = eax * eax = 1
>0045A35C jno 0045A363
0045A35E call @IntOver
0045A363 imul eax,esi,2 ; eax = i * 2 = 2
>0045A366 jno 0045A36D
0045A368 call @IntOver
0045A36D sub edx,eax ; edx = edx - eax = -1
>0045A36F jno 0045A376
0045A371 call @IntOver
0045A376 sub edx,14 ; edx = edx - 0x14 = -21
>0045A379 jno 0045A380
0045A37B call @IntOver
0045A380 mov eax,dword ptr [ebp-10]
0045A383 dec esi
0045A384 test eax,eax
>0045A386 je 0045A38D
0045A388 cmp esi,dword ptr [eax-4]
>0045A38B jb 0045A392
0045A38D call @BoundErr
0045A392 inc esi
0045A393 movzx eax,byte ptr [eax+esi-1]
0045A398 add eax,edx ; user[i] + -21
>0045A39A jno 0045A3A1
0045A39C call @IntOver
0045A3A1 mov edx,eax
0045A3A3 and edx,0FF
0045A3A9 bt dword ptr [ebp-44],edx ; 如果不是0~9A~Za~z则跳过
>0045A3AD jae 0045A3DE
0045A3AF mov edx,dword ptr [ebp-14]
0045A3B2 cmp edx,dword ptr [ebp-1C]
>0045A3B5 jg 0045A3F0
0045A3B7 mov edx,dword ptr [ebp-14]
0045A3BA mov ecx,dword ptr [ebp-8]
0045A3BD dec edx
0045A3BE test ecx,ecx
>0045A3C0 je 0045A3C7
0045A3C2 cmp edx,dword ptr [ecx-4]
>0045A3C5 jb 0045A3CC
0045A3C7 call @BoundErr
0045A3CC inc edx
0045A3CD cmp al,byte ptr [ecx+edx-1] ; user[i] - 21 ?= code[i+8]
>0045A3D1 jne 0045A3F0
0045A3D3 add dword ptr [ebp-14],1
>0045A3D7 jno 0045A3DE
0045A3D9 call @IntOver
0045A3DE inc esi
0045A3DF dec ebx
<0045A3E0 jne 0045A34A ; 循环结束
0045A3E6 mov eax,45A470; '太棒了，你成功了！'
0045A3EB call ShowMessage
0045A3F0 xor eax,eax
0045A3F2 pop edx
0045A3F3 pop ecx
0045A3F4 pop ecx
0045A3F5 mov dword ptr fs:[eax],edx
0045A3F8 push 45A420
0045A3FD lea eax,[ebp-24]
0045A400 mov edx,dword ptr ds:[459ECC]; _DynArr_65_3
0045A406 call @DynArrayClear
0045A40B lea eax,[ebp-10]
0045A40E mov edx,4
0045A413 call @LStrArrayClr
0045A418 ret
<0045A419 jmp @HandleFinally
<0045A41E jmp 0045A3FD
0045A420 pop edi
0045A421 pop esi
0045A422 pop ebx
0045A423 mov esp,ebp
0045A425 pop ebp
0045A426 ret
上面分析算法完成后,便可以开始写注册机了
#include <stdio.h>
#include <string.h>
int indexOf(int chr);
int orderUser(char *user);
int main() {
char user[16] = {0};
char code[61] = {0};
printf("用户名: ");
fgets(user, sizeof(user), stdin);
int i, j = 0, len = strlen(user) - 1, sum = 0;
if(len < 4 || len > 15) { printf("用户名4~15位"); return 0; }
user[len] = 0;
for(i=0; i<len; i++){
sum = user[i] + len * 3 - (i + 1) * 2 - 0x14;
if(indexOf(sum) > 0) code[j++] = sum;
}
for(i=0; i<len; i++){
sum = user[len - 1 - i] + len * 3 - (i + 1) * 3 - 0x14;
if(indexOf(sum) > 0) code[j++] = sum;
}
i = orderUser(user);
for(i=0; i<len; i++){
sum = user[i] + (len - 3) * (len - 3) - (i + 1) * 2 - 0x14;
if(indexOf(sum) > 0) code[j++] = sum;
}
printf("注册码: %s", code);
getchar();
return 0;
}
int indexOf(int chr){
char *str = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
int i, len = strlen(str);
for(i=0; i<len; i++){
if(str[i] == chr) return i;
}
return -1;
}
int orderUser(char *user){ //排序
int i, j, len=strlen(user), v=-1, tj=-1;
while(1 == 1){
v = -1;
for(j=0;j<len;j++){
if(user[j] > v){
tj = j;
v = user[j];
}
}
user[tj] = user[len-1];
user[len-1] = v;
len--;
if(len <= 1) break;
}
return 0;
}
运行示例：
用户名: crackme11
注册码: hubbhh52chcXSaOkkiimmp
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号