新CrackMe160之104 - kaizer - crackme3

这个程序是delphi写的，可以直接使用IDR查看按钮源码：

 crackme2::TForm1.XPButton1Click
 00458814    push       ebp
 00458815    mov        ebp,esp
 00458817    mov        ecx,4
 0045881C    push       0
 0045881E    push       0
 00458820    dec        ecx
<00458821    jne        0045881C
 00458823    push       ecx
 00458824    push       ebx
 00458825    push       esi
 00458826    push       edi
 00458827    mov        ebx,eax
 00458829    xor        eax,eax
 0045882B    push       ebp
 0045882C    push       4589A4
 00458831    push       dword ptr fs:[eax]
 00458834    mov        dword ptr fs:[eax],esp
 00458837    lea        edx,[ebp-4]
 0045883A    mov        eax,dword ptr [ebx+330]; TForm1.XPEdit1:TXPEdit
 00458840    call       TLabel.GetCaption
 00458845    mov        eax,dword ptr [ebp-4]
 00458848    call       @LStrLen
 0045884D    mov        esi,eax
 0045884F    cmp        esi,1       ; 用户名1位以上
>00458852    jge        00458866
 00458854    xor        edx,edx
 00458856    mov        eax,dword ptr [ebx+344]; TForm1.XPEdit3:TXPEdit
 0045885C    call       TLabel.SetCaption
>00458861    jmp        0045896F
 00458866    cmp        esi,63      ; 用户名0x63位以下
>00458869    jle        0045887D
 0045886B    xor        edx,edx
 0045886D    mov        eax,dword ptr [ebx+344]; TForm1.XPEdit3:TXPEdit
 00458873    call       TLabel.SetCaption
>00458878    jmp        0045896F
 0045887D    imul       edi,esi,75    ; edi = len * 0x75
 00458880    add        edi,153E      ; edi = edi + 0x153E
 00458886    sub        edi,1574      ; edi = edi - 0x1574
 0045888C    mov        eax,esi       ; eax = len - 0x22
 0045888E    sub        eax,22
 00458891    imul       eax,eax,11F0  ; eax = eax * 0x11F0
 00458897    add        edi,eax       ; edi = edi + eax
 00458899    add        edi,0E524C    ; edi = edi + 0x0E524C
 0045889F    push       4589BC; '668r9\5233'
 004588A4    lea        edx,[ebp-14]
 004588A7    mov        eax,edi
 004588A9    call       IntToStr      ; edi 转 字符串
 004588AE    push       dword ptr [ebp-14]
 004588B1    push       4589D0; '-'
 004588B6    push       4589DC; 'k329[43}'
 004588BB    lea        eax,[ebp-10]
 004588BE    mov        edx,4
 004588C3    call       @LStrCatN     ; '668r9\5233' + str(edi) + '-' + 'k329[43}'
 004588C8    mov        edx,dword ptr [ebp-10]
 004588CB    mov        eax,dword ptr [ebx+344]; TForm1.XPEdit3:TXPEdit
 004588D1    call       TLabel.SetCaption   ; 结果存到Edit3中 (隐藏的)
 004588D6    test       esi,esi
>004588D8    jle        0045896F
 004588DE    mov        edi,1
 004588E3    mov        eax,dword ptr [ebp-4]
 004588E6    movzx      eax,byte ptr [eax+edi-1]
 004588EB    mov        dword ptr [ebp-0C],eax
 004588EE    lea        ecx,[ebp-8]
 004588F1    mov        edx,2
 004588F6    mov        eax,dword ptr [ebp-0C]
 004588F9    call       IntToHex      ; 取用户名转16进制
 004588FE    lea        edx,[ebp-1C]
 00458901    mov        eax,dword ptr [ebx+344]; TForm1.XPEdit3:TXPEdit
 00458907    call       TLabel.GetCaption
 0045890C    push       dword ptr [ebp-1C]
 0045890F    push       dword ptr [ebp-8]
 00458912    push       4589F0; '$'
 00458917    lea        eax,[ebp-18]
 0045891A    mov        edx,3
 0045891F    call       @LStrCatN     ; Edit3 + 16(user[i]) + '$'
 00458924    mov        edx,dword ptr [ebp-18]
 00458927    mov        eax,dword ptr [ebx+344]; TForm1.XPEdit3:TXPEdit
 0045892D    call       TLabel.SetCaption
 00458932    lea        edx,[ebp-20]
 00458935    mov        eax,dword ptr [ebx+334]; TForm1.XPEdit2:TXPEdit
 0045893B    call       TLabel.GetCaption   ; 取出注册码
 00458940    mov        eax,dword ptr [ebp-20]
 00458943    push       eax
 00458944    lea        edx,[ebp-24]
 00458947    mov        eax,dword ptr [ebx+344]; TForm1.XPEdit3:TXPEdit
 0045894D    call       TLabel.GetCaption
 00458952    mov        edx,dword ptr [ebp-24]
 00458955    pop        eax
 00458956    call       @LStrCmp      ; 注册码与Edit3对比
>0045895B    jne        00458967
 0045895D    mov        eax,4589FC; 'Very good! You solved this crackme! Mail me!'
 00458962    call       0042CAF8
 00458967    inc        edi
 00458968    dec        esi
<00458969    jne        004588E3
 0045896F    xor        eax,eax
 00458971    pop        edx
 00458972    pop        ecx
 00458973    pop        ecx
 00458974    mov        dword ptr fs:[eax],edx
 00458977    push       4589AB
 0045897C    lea        eax,[ebp-24]
 0045897F    mov        edx,4
 00458984    call       @LStrArrayClr
 00458989    lea        eax,[ebp-14]
 0045898C    mov        edx,2
 00458991    call       @LStrArrayClr
 00458996    lea        eax,[ebp-8]
 00458999    mov        edx,2
 0045899E    call       @LStrArrayClr
 004589A3    ret
<004589A4    jmp        @HandleFinally
<004589A9    jmp        0045897C
 004589AB    pop        edi
 004589AC    pop        esi
 004589AD    pop        ebx
 004589AE    mov        esp,ebp
 004589B0    pop        ebp
 004589B1    ret

由上面代码分析可得具体算法，还是比较简单的，如下（设用户名为：abc，则len=3）
1). edi = len * 0x75 + 0x153E - 0x1574 + (len - 0x22) * 0x11F0 + 0xE524C = 0xC2765 = 796517
2). edit3 = '668r9\5233' + str(edi) + '-' + 'k329[43}' = "668r9\5233796517-k329[43}"
3). edit3 = edit3 + 16(user[i]) + '$' = "668r9\5233796517-k329[43}61$"
4). edit3与注册码对比
所以可得注册码为：
668r9\5233796517-k329[43}61$
668r9\5233796517-k329[43}61$62$
668r9\5233796517-k329[43}61$62$63$
这三个都是可以的，可见，用户名有几位，注册码就可以有几种，可直接用计算器计算，不再写注册机

 
 
本节高手录制的视频,点击前往查看

 
 
 
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~