新CrackMe160之109 - Jony - crackme
Delphi的程序,Dos界面,IDR查看源码:
EntryPoint
004084B8 push ebp
004084B9 mov ebp,esp
004084BB add esp,0FFFFFFE0
004084BE push ebx
004084BF xor eax,eax
004084C1 mov dword ptr [ebp-14],eax
004084C4 mov dword ptr [ebp-20],eax
004084C7 mov eax,[004093B0]; ^IsConsole:Boolean
004084CC mov byte ptr [eax],1
004084CF mov eax,408478
004084D4 call @InitExe
004084D9 mov ebx,dword ptr ds:[409304]; ^Output:Text
004084DF xor eax,eax
004084E1 push ebp
004084E2 push 4086CF
004084E7 push dword ptr fs:[eax]
004084EA mov dword ptr fs:[eax],esp
004084ED mov eax,ebx
004084EF mov edx,4086E4; '---------------------------'
004084F4 call @Write0Bool
004084F9 call @WriteLn
004084FE call @_IOTest
00408503 mov eax,ebx
00408505 mov edx,408708; ' 俺的第一个CrackMe'
0040850A call @Write0Bool
0040850F call @WriteLn
00408514 call @_IOTest
00408519 mov eax,ebx
0040851B mov edx,408724; ' 作者：Jony[E.S.T]'
00408520 call @Write0Bool
00408525 call @WriteLn
0040852A call @_IOTest
0040852F mov eax,ebx
00408531 mov edx,408740; ' 示例：user/123'
00408536 call @Write0Bool
0040853B call @WriteLn
00408540 call @_IOTest
00408545 mov eax,ebx
00408547 mov edx,4086E4; '---------------------------'
0040854C call @Write0Bool
00408551 call @WriteLn
00408556 call @_IOTest
0040855B mov eax,ebx
0040855D mov edx,40875C; '请输入您的用户名：'
00408562 call @Write0Bool
00408567 call @WriteLn
0040856C call @_IOTest
00408571 mov edx,40A798; gvar_0040A798:AnsiString
00408576 mov eax,[00409370]; ^Input:Text
0040857B call @ReadLString
00408580 mov eax,[00409370]; ^Input:Text
00408585 call @ReadLn
0040858A call @_IOTest
0040858F mov eax,[0040A798]; gvar_0040A798:AnsiString
00408594 call @LStrLen
00408599 cmp eax,2
>0040859C jge 004085D7
0040859E mov eax,ebx
004085A0 mov edx,408778; '用户名不能少于两位！'
004085A5 call @Write0Bool
004085AA call @WriteLn
004085AF call @_IOTest
004085B4 mov edx,40A798; gvar_0040A798:AnsiString
004085B9 mov eax,[00409370]; ^Input:Text
004085BE call @ReadLString
004085C3 mov eax,[00409370]; ^Input:Text
004085C8 call @ReadLn
004085CD call @_IOTest
>004085D2 jmp 004086B1
004085D7 mov eax,ebx
004085D9 mov edx,408798; '请输入您的注册码：'
004085DE call @Write0Bool
004085E3 call @WriteLn
004085E8 call @_IOTest
004085ED mov edx,40A79C; gvar_0040A79C:AnsiString
004085F2 mov eax,[00409370]; ^Input:Text
004085F7 call @ReadLString
004085FC mov eax,[00409370]; ^Input:Text
00408601 call @ReadLn
00408606 call @_IOTest
0040860B lea eax,[ebp-14]
0040860E push eax
0040860F lea edx,[ebp-20]
00408612 mov eax,[0040A798]; gvar_0040A798:AnsiString
00408617 call 00408388 ; 关键算法
0040861C mov eax,dword ptr [ebp-20]
0040861F movzx eax,byte ptr [eax]
00408622 mov dword ptr [ebp-1C],eax
00408625 mov byte ptr [ebp-18],0
00408629 lea edx,[ebp-1C]
0040862C xor ecx,ecx
0040862E mov eax,4087B4; '%d' ; 结果转数字
00408633 call Format
00408638 mov edx,dword ptr [ebp-14]
0040863B mov eax,[0040A79C]; gvar_0040A79C:AnsiString
00408640 call @LStrCmp ; 关键对比
>00408645 jne 0040867D
00408647 mov eax,ebx
00408649 mov edx,4087C0; '恭喜您，注册成功！'
0040864E call @Write0Bool
00408653 call @WriteLn
00408658 call @_IOTest
0040865D mov edx,40A7A0; gvar_0040A7A0:AnsiString
00408662 mov eax,[00409370]; ^Input:Text
00408667 call @ReadLString
0040866C mov eax,[00409370]; ^Input:Text
00408671 call @ReadLn
00408676 call @_IOTest
>0040867B jmp 004086B1
0040867D mov eax,ebx
0040867F mov edx,4087DC; '继续努力！'
00408684 call @Write0Bool
00408689 call @WriteLn
0040868E call @_IOTest
00408693 mov edx,40A798; gvar_0040A798:AnsiString
00408698 mov eax,[00409370]; ^Input:Text
0040869D call @ReadLString
004086A2 mov eax,[00409370]; ^Input:Text
004086A7 call @ReadLn
004086AC call @_IOTest
004086B1 xor eax,eax
004086B3 pop edx
004086B4 pop ecx
004086B5 pop ecx
004086B6 mov dword ptr fs:[eax],edx
004086B9 push 4086D6
004086BE lea eax,[ebp-20]
004086C1 call @LStrClr
004086C6 lea eax,[ebp-14]
004086C9 call @LStrClr
004086CE ret
<004086CF jmp @HandleFinally
<004086D4 jmp 004086BE
004086D6 pop ebx
004086D7 call @Halt0
关键算法:
CrackMe::sub_00408388
00408388 push ebp
00408389 mov ebp,esp
0040838B add esp,0FFFFFFF4
0040838E push ebx
0040838F push esi
00408390 push edi
00408391 xor ecx,ecx
00408393 mov dword ptr [ebp-0C],ecx
00408396 mov dword ptr [ebp-8],edx
00408399 mov dword ptr [ebp-4],eax
0040839C mov eax,dword ptr [ebp-4]
0040839F call @LStrAddRef
004083A4 xor eax,eax
004083A6 push ebp
004083A7 push 408441
004083AC push dword ptr fs:[eax]
004083AF mov dword ptr fs:[eax],esp
004083B2 mov eax,dword ptr [ebp-4]
004083B5 call @LStrToPChar
004083BA call StrLen
004083BF mov ebx,eax
004083C1 shr ebx,1
004083C3 dec ebx
004083C4 mov eax,dword ptr [ebp-8]
004083C7 call @LStrClr
004083CC mov edi,ebx
004083CE test edi,edi
>004083D0 jl 00408423
004083D2 inc edi
004083D3 xor esi,esi
004083D5 mov eax,dword ptr [ebp-4]
004083D8 call @LStrToPChar
004083DD mov edx,esi
004083DF xor edx,2
004083E2 mov bl,byte ptr [eax+edx] ; 取第3位
004083E5 mov eax,dword ptr [ebp-4]
004083E8 call @LStrToPChar
004083ED mov edx,esi
004083EF xor edx,2
004083F2 mov al,byte ptr [eax+edx-1] ; 取第2位
004083F6 or bl,al
004083F8 mov eax,dword ptr [ebp-4]
004083FB call @LStrToPChar
00408400 call StrLen ; 取长度
00408405 add bl,al ; 结果 = (第3位 or 第2位) + len, 再转10进制
00408407 lea eax,[ebp-0C]
0040840A mov edx,ebx
0040840C call @LStrFromChar
00408411 mov edx,dword ptr [ebp-0C]
00408414 mov eax,dword ptr [ebp-8]
00408417 call @LStrCat
0040841C mov eax,dword ptr [ebp-8]
0040841F inc esi
00408420 dec edi
<00408421 jne 004083D5
00408423 xor eax,eax
00408425 pop edx
00408426 pop ecx
00408427 pop ecx
00408428 mov dword ptr fs:[eax],edx
0040842B push 408448
00408430 lea eax,[ebp-0C]
00408433 call @LStrClr
00408438 lea eax,[ebp-4]
0040843B call @LStrClr
00408440 ret
<00408441 jmp @HandleFinally
<00408446 jmp 00408430
00408448 pop edi
00408449 pop esi
0040844A pop ebx
0040844B mov esp,ebp
0040844D pop ebp
0040844E ret
所以用户名最少要3位, 算法中可知,只会用到第2,3位,与及用户名长度
#include <stdio.h>
#include <string.h>
int main() {
char user[15] = {0};
printf("用户名: ");
scanf("%s", user); getchar(); //消耗掉多输入的\n
int i,len = strlen(user), sum = 0;
if(len<3){
printf("用户名3位以上");
getchar(); return;
}
sum = (user[2] | user[1]) + len;
printf("系列号: %d\n", sum);
getchar(); return 0;
}
运行示例:
用户名: CrackMe
系列号: 122
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号