新CrackMe160之125 - k4n6
delphi的程序直接使用IDR查看按钮源码:
Unit1::TForm1.Button1Click
0044435C push ebp
0044435D mov ebp,esp
0044435F xor ecx,ecx
00444361 push ecx
00444362 push ecx
00444363 push ecx
00444364 push ecx
00444365 push ecx
00444366 push ecx
00444367 push ecx
00444368 push ecx
00444369 push ebx
0044436A push esi
0044436B push edi
0044436C mov ebx,eax
0044436E xor eax,eax
00444370 push ebp
00444371 push 44450D
00444376 push dword ptr fs:[eax]
00444379 mov dword ptr fs:[eax],esp
0044437C lea edx,[ebp-1C]
0044437F mov eax,dword ptr [ebx+2D8]; TForm1.Edit3:TEdit
00444385 call TControl.GetText
0044438A mov eax,dword ptr [ebp-1C]
0044438D call @LStrLen
00444392 dec eax
>00444393 jl 004444E5
00444399 lea edx,[ebp-18]
0044439C mov eax,dword ptr [ebx+2D8]; TForm1.Edit3:TEdit ; 系列号
004443A2 call TControl.GetText
004443A7 lea edx,[ebp-10]
004443AA mov eax,dword ptr [ebx+2D0]; TForm1.Edit1:TEdit ; 用户名
004443B0 call TControl.GetText
004443B5 lea edx,[ebp-14]
004443B8 mov eax,dword ptr [ebx+2D4]; TForm1.Edit2:TEdit ; 公司名
004443BE call TControl.GetText
004443C3 mov eax,dword ptr [ebp-10]
004443C6 call @LStrLen
004443CB cmp eax,4 ; 用户名4位以上
>004443CE jl 004444E5
004443D4 mov eax,dword ptr [ebp-14]
004443D7 call @LStrLen
004443DC cmp eax,3 ; 公司名3位以上
>004443DF jl 004444E5
004443E5 mov eax,dword ptr [ebp-10]
004443E8 movzx eax,byte ptr [eax] ; 用户[0]
004443EB movzx eax,byte ptr [eax+4459DF] ; 对应值
004443F2 mov dword ptr [ebp-0C],eax
004443F5 mov eax,dword ptr [ebp-10]
004443F8 movzx eax,byte ptr [eax+2] ; 用户[2]
004443FC movzx esi,byte ptr [eax+4459DF] ; 对应值
00444403 mov eax,dword ptr [ebp-14]
00444406 call @LStrLen
0044440B mov edx,dword ptr [ebp-14]
0044440E movzx eax,byte ptr [edx+eax-2] ; 公司[len-2]
00444413 movzx edi,byte ptr [eax+4459DF] ; 对应值
0044441A mov eax,dword ptr [ebp-14]
0044441D call @LStrLen
00444422 mov edx,dword ptr [ebp-14]
00444425 movzx eax,byte ptr [edx+eax-1] ; 公司[len-1]
0044442A movzx eax,byte ptr [eax+4459DF] ; 对应值
00444431 mov edx,dword ptr [ebp-10]
00444434 movzx edx,byte ptr [edx+3] ; 用户[3]
00444438 movzx edx,byte ptr [edx+4459DF] ; 对应值
0044443F mov ecx,dword ptr [ebp-14]
00444442 movzx ecx,byte ptr [ecx+2] ; 公司[2]
00444446 movzx ecx,byte ptr [ecx+4459DF] ; 对应值
0044444D imul edx,ecx ; rlt = 用户[3]值 * 公司[2]值
00444450 mov dword ptr [ebp-8],edx ; rlt0 = rlt 存起来
00444453 mov edx,dword ptr [ebp-0C]
00444456 imul edx,esi
00444459 imul edx,edi
0044445C imul edx,eax
0044445F add edx,dword ptr [ebp-8] ; rlt = 用户[0]值 * 用户[2]值 * 公司[len-2]值 * 公司[len-1]值 + rlt
00444462 mov dword ptr [ebp-4],edx
00444465 mov eax,dword ptr [ebp-4]
00444468 xor eax,28D8 ; rlt = rlt ^ 0x28D8
0044446D add eax,288D4A7D ; rlt = rlt + 0x288D4A7D
00444472 mov dword ptr [ebp-4],eax
00444475 mov eax,dword ptr [ebp-4]
00444478 mov ecx,3039
0044447D rol ecx,6
00444480 xor eax,9714 ; rlt = rlt ^ 0x9714
00444485 ror eax,2 ; rlt = ror(rlt, 2)
00444488 sar eax,3 ; rlt = rlt >> 3
0044448B add eax,ecx ; rlt = rlt + rol(0x3039, 6)
0044448D add eax,dword ptr [ebp-8] ; rlt = rlt + rlt0
00444490 inc eax ; rlt = rlt + 1
00444491 not ax ; rlt低位取反
00444494 or ecx,eax
00444496 add eax,29A ; rlt = rlt + 0x29A
0044449B mov dword ptr [ebp-4],eax
0044449E xor eax,eax
004444A0 push ebp
004444A1 push 4444DB
004444A6 push dword ptr fs:[eax]
004444A9 mov dword ptr fs:[eax],esp
004444AC lea edx,[ebp-20]
004444AF mov eax,dword ptr [ebx+2D8]; TForm1.Edit3:TEdit
004444B5 call TControl.GetText
004444BA mov eax,dword ptr [ebp-20]
004444BD call StrToInt
004444C2 cmp eax,dword ptr [ebp-4] ; rlt与系列号对比
>004444C5 jne 004444D1
004444C7 mov eax,444524; 'good , this number Come from your keygen ?'
004444CC call ShowMessage
004444D1 xor eax,eax
004444D3 pop edx
004444D4 pop ecx
004444D5 pop ecx
004444D6 mov dword ptr fs:[eax],edx
>004444D9 jmp 004444E5
<004444DB jmp @HandleAnyException
004444E0 call @DoneExcept
004444E5 xor eax,eax
004444E7 pop edx
004444E8 pop ecx
004444E9 pop ecx
004444EA mov dword ptr fs:[eax],edx
004444ED push 444514
004444F2 lea eax,[ebp-20]
004444F5 mov edx,2
004444FA call @LStrArrayClr
004444FF lea eax,[ebp-18]
00444502 mov edx,3
00444507 call @LStrArrayClr
0044450C ret
<0044450D jmp @HandleFinally
<00444512 jmp 004444F2
00444514 pop edi
00444515 pop esi
00444516 pop ebx
00444517 mov esp,ebp
00444519 pop ebp
0044451A ret
注册机如下:
#include <stdio.h>
#include <string.h>
int ror(unsigned int num, unsigned char i);
int rol(unsigned int num, unsigned char i);
int main() {
int str[0x80] = {
0x00,0x10,0x39,0x44,0x00,0x24,0x39,0x44,0x00,0x0C,0xAF,0x40,0x00,0x14,0xAF,0x40,
0x00,0x1C,0xAF,0x40,0x00,0x24,0xAF,0x40,0x00,0x34,0xAF,0x40,0x00,0x3C,0xAF,0x40,
0x00,0x44,0xAF,0x40,0x00,0x4C,0xAF,0x40,0x00,0x54,0xAF,0x40,0x00,0x5C,0xAF,0x40,
0x00,0x2C,0xAF,0x40,0x00,0x06,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x01,0x00,0x00,
0x00,0x02,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x05,0x00,0x00,
0x00,0x08,0x00,0x00,0x00,0x09,0x00,0x00,0x00,0x0A,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x2C,0x61,0x23,0x47,0x0E,0x26,0x61,0x20,0x31,0x49,0x36,0x24,0x2B,0x42,0x31,
0x63,0x0E,0x29,0x5E,0x30,0x4B,0x38,0x2A,0x33,0x44,0x3D,0x8B,0xC0,0xAC,0x6B,0x40
};
char user[33] = {0};
char comp[33] = {0};
printf("用户名: ");
scanf("%s", user); getchar(); //消耗掉多输入的\n
printf("公司名: ");
scanf("%s", comp); getchar(); //消耗掉多输入的\n
int lenu = strlen(user);
int lenc = strlen(comp);
unsigned int i, code = 0;
code = str[user[3]] * str[comp[2]] + str[user[0]] * str[user[2]] * str[comp[lenc-2]] * str[comp[lenc-1]];
code = (code ^ 0x28D8) + 0x288D4A7D;
code = (ror((code ^ 0x9714), 2) >> 3) + rol(0x3039, 6);
code = code + str[user[3]] * str[comp[2]] + 1;
code = (code >> 16 << 16) + ((~(code << 16 >> 16)) & 0xFFFF);
code = code + 0x29A;
printf("系列号: %lu\n", code);
getchar(); return 0;
}
int ror(unsigned int num, unsigned char i){
return (num >> i) | (num << (sizeof(int) * 8 - i));
}
int rol(unsigned int num, unsigned char i){
return (num << i) | (num >> (sizeof(int) * 8 - i));
}
运行示例:
用户名: k4n6
公司名: k4n6
系列号: 156271926
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号