新CrackMe160之117 - delphi - crackme

delphi的程序直接用IDR看按钮事件源码:

 Unit1::TForm1.Button1Click
 004537EC    push       ebp
 004537ED    mov        ebp,esp
 004537EF    xor        ecx,ecx
 004537F1    push       ecx
 004537F2    push       ecx
 004537F3    push       ecx
 004537F4    push       ecx
 004537F5    push       ecx
 004537F6    push       ecx
 004537F7    push       ebx
 004537F8    push       esi
 004537F9    mov        ebx,eax
 004537FB    xor        eax,eax
 004537FD    push       ebp
 004537FE    push       4538BE
 00453803    push       dword ptr fs:[eax]
 00453806    mov        dword ptr fs:[eax],esp
 00453809    lea        edx,[ebp-8]
 0045380C    mov        eax,dword ptr [ebx+300]; TForm1.Edit2:TEdit   ; 用户名
 00453812    call       TControl.GetText
 00453817    mov        eax,dword ptr [ebp-8]
 0045381A    movzx      eax,byte ptr [eax]                            ; 取出第一位 ^ 0xE = num
 0045381D    xor        eax,0E
 00453820    mov        dword ptr [ebp-4],eax
 00453823    lea        esi,[ebp-4]
 00453826    lea        edx,[ebp-0C]
 00453829    mov        eax,dword ptr [ebx+2F8]; TForm1.Edit1:TEdit   ; 注册码
 0045382F    call       TControl.GetText
 00453834    mov        eax,dword ptr [ebp-0C]
 00453837    push       eax
 00453838    lea        edx,[ebp-10]
 0045383B    mov        eax,dword ptr [esi]
 0045383D    call       IntToStr                                       ; num转字符串 = numStr
 00453842    lea        eax,[ebp-10]
 00453845    push       eax
 00453846    lea        edx,[ebp-18]
 00453849    mov        eax,dword ptr [ebx+300]; TForm1.Edit2:TEdit
 0045384F    call       TControl.GetText
 00453854    mov        eax,dword ptr [ebp-18]
 00453857    call       @LStrLen
 0045385C    lea        edx,[ebp-14]
 0045385F    call       IntToStr                                       ; 用户名长度转字符串 = lenStr
 00453864    mov        edx,dword ptr [ebp-14]
 00453867    pop        eax
 00453868    call       @LStrCat                                       ; 连接两个串 = numStr + lenStr
 0045386D    mov        edx,dword ptr [ebp-10]
 00453870    pop        eax
 00453871    call       @LStrCmp                                       ; 与系列号对比
>00453876    jne        00453884
 00453878    mov        eax,4538D4; '恭喜你!'
 0045387D    call       ShowMessage
>00453882    jmp        0045388E
 00453884    mov        eax,4538E4; '加油!'
 00453889    call       ShowMessage
 0045388E    xor        eax,eax
 00453890    pop        edx
 00453891    pop        ecx
 00453892    pop        ecx
 00453893    mov        dword ptr fs:[eax],edx
 00453896    push       4538C5
 0045389B    lea        eax,[ebp-18]
 0045389E    call       @LStrClr
 004538A3    lea        eax,[ebp-14]
 004538A6    mov        edx,2
 004538AB    call       @LStrArrayClr
 004538B0    lea        eax,[ebp-0C]
 004538B3    mov        edx,2
 004538B8    call       @LStrArrayClr
 004538BD    ret
<004538BE    jmp        @HandleFinally
<004538C3    jmp        0045389B
 004538C5    pop        esi
 004538C6    pop        ebx
 004538C7    mov        esp,ebp
 004538C9    pop        ebp
 004538CA    ret

以上代码分析完,算法就出来了: int2str(user[0] ^ 0xE) + int2str(len(user)) = code
示例:
用户名: abc
注册码: ('a' ^ 0xE) + '3' = '1113'

 
 
本节高手录制的视频,点击前往查看

 
 
 
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~