新CrackMe160之119 - BBG - crackme3
delphi的程序,直接用IDR查看按钮事件源码, 代码变量比较多,需要结合OD一起分析
Unit1::TForm1.SpeedButton1Click
0044635C push ebp
0044635D mov ebp,esp
0044635F mov ecx,45
00446364 push 0
00446366 push 0
00446368 dec ecx
<00446369 jne 00446364
0044636B push ecx
0044636C push ebx
0044636D mov ebx,eax
0044636F xor eax,eax
00446371 push ebp
00446372 push 446730
00446377 push dword ptr fs:[eax]
0044637A mov dword ptr fs:[eax],esp
0044637D lea eax,[ebp-14]
00446380 mov edx,446744; 'N' ; 将各个字符存到内存变量中
00446385 call @LStrLAsg
0044638A lea eax,[ebp-18]
0044638D mov edx,446750; 'u'
00446392 call @LStrLAsg
00446397 lea eax,[ebp-1C]
0044639A mov edx,44675C; 'l'
0044639F call @LStrLAsg
004463A4 lea eax,[ebp-20]
004463A7 mov edx,446768; 'a'
004463AC call @LStrLAsg
004463B1 lea eax,[ebp-18]
004463B4 mov edx,446750; 'u'
004463B9 call @LStrLAsg
004463BE lea eax,[ebp-24]
004463C1 mov edx,446774; '?
004463C6 call @LStrLAsg
004463CB lea eax,[ebp-28]
004463CE mov edx,446780; 'e'
004463D3 call @LStrLAsg
004463D8 lea eax,[ebp-2C]
004463DB mov edx,44678C; 'i'
004463E0 call @LStrLAsg
004463E5 lea eax,[ebp-30]
004463E8 mov edx,446798; ' '
004463ED call @LStrLAsg
004463F2 lea eax,[ebp-34]
004463F5 mov edx,4467A4; 't'
004463FA call @LStrLAsg
004463FF lea eax,[ebp-38]
00446402 mov edx,4467B0; 'm'
00446407 call @LStrLAsg
0044640C lea eax,[ebp-4]
0044640F mov edx,4467BC; 'p'
00446414 call @LStrLAsg
00446419 lea eax,[ebp-3C]
0044641C mov edx,4467C8; 'c'
00446421 call @LStrLAsg
00446426 lea eax,[ebp-8]
00446429 mov edx,4467D4; ':'
0044642E call @LStrLAsg
00446433 lea eax,[ebp-0C]
00446436 mov edx,4467E0; '\\'
0044643B call @LStrLAsg
00446440 lea eax,[ebp-10]
00446443 mov edx,4467EC; '.'
00446448 call @LStrLAsg
0044644D lea eax,[ebp-40]
00446450 mov edx,4467F8; '!'
00446455 call @LStrLAsg
0044645A lea edx,[ebp-210]
00446460 mov eax,dword ptr [ebx+2D8]; TForm1.Edit1:TEdit
00446466 call TControl.GetText
0044646B cmp dword ptr [ebp-210],0
>00446472 je 004466C9
00446478 lea edx,[ebp-214]
0044647E mov eax,dword ptr [ebx+2DC]; TForm1.Edit2:TEdit
00446484 call TControl.GetText
00446489 cmp dword ptr [ebp-214],0
>00446490 je 004466C9
00446496 push dword ptr [ebp-3C] ; 'c'
00446499 push dword ptr [ebp-8] ; ':'
0044649C push dword ptr [ebp-0C] ; '\'
0044649F push dword ptr [ebp-34] ; 't'
004464A2 push dword ptr [ebp-38] ; 'm'
004464A5 push dword ptr [ebp-4] ; 'p'
004464A8 push dword ptr [ebp-10] ; '.'
004464AB push dword ptr [ebp-34] ; 't'
004464AE push dword ptr [ebp-38] ; 'm'
004464B1 push dword ptr [ebp-4] ; 'p'
004464B4 lea eax,[ebp-218]
004464BA mov edx,0A
004464BF call @LStrCatN
004464C4 mov edx,dword ptr [ebp-218] ; 得到字符串"c:\tmp.tmp"
004464CA lea eax,[ebp-20C]
004464D0 call @Assign
004464D5 lea eax,[ebp-20C]
004464DB call @RewritText
004464E0 call @_IOTest
004464E5 lea edx,[ebp-21C]
004464EB mov eax,dword ptr [ebx+2D8]; TForm1.Edit1:TEdit ; 用户名
004464F1 call TControl.GetText
004464F6 mov edx,dword ptr [ebp-21C]
004464FC lea eax,[ebp-20C]
00446502 call @Write0Bool
00446507 call @WriteLn ; 将用户名写入文件,注意写入文件再读取后会多出\r\n
0044650C call @_IOTest
00446511 lea eax,[ebp-20C]
00446517 call @Close
0044651C call @_IOTest
00446521 push dword ptr [ebp-3C]
00446524 push dword ptr [ebp-8]
00446527 push dword ptr [ebp-0C]
0044652A push dword ptr [ebp-34]
0044652D push dword ptr [ebp-38]
00446530 push dword ptr [ebp-4]
00446533 push dword ptr [ebp-10]
00446536 push dword ptr [ebp-34]
00446539 push dword ptr [ebp-38]
0044653C push dword ptr [ebp-4]
0044653F lea eax,[ebp-220]
00446545 mov edx,0A
0044654A call @LStrCatN
0044654F mov edx,dword ptr [ebp-220]
00446555 lea eax,[ebp-20C]
0044655B call @Assign
00446560 lea eax,[ebp-20C]
00446566 call @ResetText
0044656B call @_IOTest
00446570 xor eax,eax
00446572 mov [00448830],eax; gvar_00448830
>00446577 jmp 00446594
00446579 lea eax,[ebp-20C] ; 循环开始
0044657F call @ReadChar
00446584 call @_IOTest
00446589 and eax,0FF
0044658E add dword ptr ds:[448830],eax; gvar_00448830 ; 用户名累加 sum
00446594 lea eax,[ebp-20C]
0044659A call @EofText
0044659F call @_IOTest
004465A4 test al,al
<004465A6 je 00446579 ; 循环结束
004465A8 lea eax,[ebp-20C]
004465AE call @Close
004465B3 call @_IOTest
004465B8 lea eax,[ebp-20C]
004465BE call @Erase
004465C3 call @_IOTest
004465C8 xor eax,eax
004465CA mov [00448834],eax; gvar_00448834
004465CF xor eax,eax
004465D1 mov [00448838],eax; gvar_00448838
004465D6 xor eax,eax
004465D8 mov [0044883C],eax; gvar_0044883C:Integer
004465DD xor eax,eax
004465DF mov [00448840],eax; gvar_00448840
004465E4 mov eax,[00448830]; gvar_00448830
004465E9 add eax,246 ; sum += 0x246
004465EE mov [00448834],eax; gvar_00448834
004465F3 mov eax,[00448834]; gvar_00448834
004465F8 sar eax,1 ; sum = sum >> 1
>004465FA jns 004465FF
004465FC adc eax,0
004465FF mov [00448838],eax; gvar_00448838
00446604 mov eax,[00448838]; gvar_00448838
00446609 imul dword ptr ds:[448838]; gvar_00448838 ; sum = sum * sum
0044660F mov [0044883C],eax; gvar_0044883C:Integer
00446614 mov eax,[0044883C]; gvar_0044883C:Integer
00446619 sub eax,1E5B ; sum -= 0x1E5B
0044661E mov [00448840],eax; gvar_00448840
00446623 lea edx,[ebp-224]
00446629 mov eax,dword ptr [ebx+2DC]; TForm1.Edit2:TEdit ; 系列号
0044662F call TControl.GetText
00446634 mov eax,dword ptr [ebp-224]
0044663A call 0044626C
0044663F cmp al,1
>00446641 jne 004466C9
00446647 lea edx,[ebp-228]
0044664D mov eax,dword ptr [ebx+2DC]; TForm1.Edit2:TEdit ; 系列号转整数, 说明系列号得是全数字
00446653 call TControl.GetText
00446658 mov eax,dword ptr [ebp-228]
0044665E call StrToInt
00446663 cmp eax,dword ptr ds:[448840]; gvar_00448840 ; 关键对比
>00446669 jne 004466C9
0044666B push dword ptr [ebp-14]
0044666E push dword ptr [ebp-18]
00446671 push dword ptr [ebp-1C]
00446674 push dword ptr [ebp-20]
00446677 push dword ptr [ebp-18]
0044667A push dword ptr [ebp-24]
0044667D push dword ptr [ebp-28]
00446680 push dword ptr [ebp-2C]
00446683 push dword ptr [ebp-30]
00446686 push dword ptr [ebp-40]
00446689 lea eax,[ebp-22C]
0044668F mov edx,0A
00446694 call @LStrCatN
00446699 mov edx,dword ptr [ebp-22C]
0044669F mov eax,[0044882C]; gvar_0044882C:TForm1
004466A4 mov eax,dword ptr [eax+2E8]
004466AA call TControl.SetText
004466AF xor edx,edx
004466B1 mov eax,dword ptr [ebx+2E0]; TForm1.SpeedButton1:TSpeedButton
004466B7 mov ecx,dword ptr [eax]
004466B9 call dword ptr [ecx+5C]; TControl.SetEnabled
004466BC xor edx,edx
004466BE mov eax,dword ptr [ebx+2E4]; TForm1.SpeedButton2:TSpeedButton
004466C4 mov ecx,dword ptr [eax]
004466C6 call dword ptr [ecx+5C]; TControl.SetEnabled
004466C9 xor eax,eax
004466CB pop edx
004466CC pop ecx
004466CD pop ecx
004466CE mov dword ptr fs:[eax],edx
004466D1 push 446737
004466D6 lea eax,[ebp-22C]
004466DC call @LStrClr
004466E1 lea eax,[ebp-228]
004466E7 mov edx,2
004466EC call @LStrArrayClr
004466F1 lea eax,[ebp-220]
004466F7 call @LStrClr
004466FC lea eax,[ebp-21C]
00446702 call @LStrClr
00446707 lea eax,[ebp-218]
0044670D call @LStrClr
00446712 lea eax,[ebp-214]
00446718 mov edx,2
0044671D call @LStrArrayClr
00446722 lea eax,[ebp-40]
00446725 mov edx,10
0044672A call @LStrArrayClr
0044672F ret
<00446730 jmp @HandleFinally
<00446735 jmp 004466D6
00446737 pop ebx
00446738 mov esp,ebp
0044673A pop ebp
0044673B ret
分析完算法, 接着便可以写注册机了:
#include <stdio.h>
#include <string.h>
int main() {
char user[51] = {0};
printf("用户名: ");
scanf("%s", user); getchar(); //消耗掉多输入的\n
int i,len = strlen(user);
unsigned int sum = 0;
for(i=0; i<len; i++){
sum += user[i];;
}
sum += 0xD + 0xA; //\r\n
sum += 0x246;
sum = sum >> 1;
sum *= sum;
sum -= 0x1E5B;
printf("系列号: %lu\n", sum);
getchar(); return 0;
}
运行示例:
用户名: crackme30
系列号: 503454
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号