新CrackMe160之107 - s_crackme

OD载入程序,搜索界面可直接定位到成功关键词0040120E, 上面就是关键算法,需要验证文件keyfile.qwg
IDA查看源码:

int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
  int result; // eax@2
  char v5; // [sp+Ch] [bp-70h]@1
  char v6[10]; // [sp+40h] [bp-3Ch]@16
  char v7[2]; // [sp+4Ah] [bp-32h]@12
  LPVOID lpBuffer; // [sp+4Ch] [bp-30h]@6
  int v9; // [sp+50h] [bp-2Ch]@1
  int v10; // [sp+54h] [bp-28h]@1
  __int16 v11; // [sp+58h] [bp-24h]@1
  int v12; // [sp+5Ch] [bp-20h]@1
  int v13; // [sp+60h] [bp-1Ch]@1
  __int16 v14; // [sp+64h] [bp-18h]@1
  int v15; // [sp+68h] [bp-14h]@1
  DWORD nNumberOfBytesToRead; // [sp+6Ch] [bp-10h]@3
  int i; // [sp+70h] [bp-Ch]@6
  HANDLE hFile; // [sp+74h] [bp-8h]@1
  DWORD NumberOfBytesRead; // [sp+78h] [bp-4h]@6

  memset(&v5, 0xCCu, 0x70u);
  v15 = 0;
  v12 = 1650947953;
  v13 = 808614255;
  v14 = 12336;
  v10 = 1095128656;
  v11 = 22606;
  v9 = 1819242339;
  hFile = CreateFileA("keyfile.qwg", 0x80000000, 1u, 0, 3u, 0x80u, 0);
  if ( hFile == (HANDLE)-1 )
  {
    MessageBoxA(0, "很遗憾验证失败了！", "失败", 0x10u);
    result = 0;
  }
  else
  {
    nNumberOfBytesToRead = GetFileSize(hFile, 0);
    if ( nNumberOfBytesToRead == -1 )
      MessageBoxA(0, "读文件时发生未知错误！", "出错了", 0x10u);
    if ( nNumberOfBytesToRead == 20 )
    {
      lpBuffer = malloc(0x16u);
      ReadFile(hFile, lpBuffer, nNumberOfBytesToRead, &NumberOfBytesRead, 0);
      CloseHandle(hFile);
      *((_BYTE *)lpBuffer + nNumberOfBytesToRead) = 0;
      *((_BYTE *)lpBuffer + nNumberOfBytesToRead + 1) = 0;
      for ( i = 0; i < 10; ++i )
      {
        if ( *((_BYTE *)lpBuffer + i) == *((_BYTE *)&v12 + i) ) //前10位等于某个固定串, OD调试可知是: qwgboy2000
          ++v15;
      }
      while ( i < 16 )
      {
        if ( *((_BYTE *)lpBuffer + i) == *((_BYTE *)&v9 + i + 2) - v7[i] ) //6个与这个有关: PVFANX
          ++v15;
        ++i;
      }
      while ( i < 20 )
      {
        if ( *((_BYTE *)lpBuffer + i) == v6[i] )  // 4个为: cool
          ++v15;
        ++i;
      }
      if ( v15 == 20 )
        MessageBoxA(0, "哇！你真是太厉害了!", "成功了！", 0x40u);
      else
        MessageBoxA(0, "继续努力，你会成功的!", "加油", 0x40u);
    }
    else
    {
      MessageBoxA(0, "继续努力，你会成功的!", "加油", 0x40u);
    }
    result = 0;
  }
  return result;
}

OD跟踪可得
前10个为: qwgboy2000
中间6个为: qwgboy - PVFANX = !!!!!!
后4个为: cool
那文件内容就是固定的: qwgboy2000!!!!!!cool

 
 
本节高手录制的视频,点击前往查看

 
 
 
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~