新CrackMe160之121 - bRaINbuSY - crackme1

Delphi的程序直接使用IDR查看按钮源码:

 Unit1::TForm1.Button1Click
 00458800    push       ebp
 00458801    mov        ebp,esp
 00458803    push       0
 00458805    push       ebx
 00458806    mov        ebx,eax
 00458808    xor        eax,eax
 0045880A    push       ebp
 0045880B    push       458874
 00458810    push       dword ptr fs:[eax]
 00458813    mov        dword ptr fs:[eax],esp
 00458816    call       00458760                                    ; 算法
 0045881B    lea        edx,[ebp-4]
 0045881E    mov        eax,dword ptr [ebx+2D0]; TForm1.Edit2:TEdit ; 注册码
 00458824    call       TControl.GetText
 00458829    mov        eax,dword ptr [ebp-4]
 0045882C    call       StrToInt
 00458831    cmp        eax,dword ptr ds:[45B844]; gvar_0045B844    ; 关键对比
>00458837    jne        00458854
 00458839    mov        eax,458888; 'You cracked the UBC CrackMe#1 ! Please send your solution to ubcrackers@hotmail.com !'
 0045883E    call       ShowMessage
 00458843    mov        edx,4588E8; 'CRACKED'
 00458848    mov        eax,[0045B83C]; gvar_0045B83C:TForm1
 0045884D    call       TControl.SetText
>00458852    jmp        0045885E
 00458854    mov        eax,4588F8; 'Try Again !'
 00458859    call       ShowMessage
 0045885E    xor        eax,eax
 00458860    pop        edx
 00458861    pop        ecx
 00458862    pop        ecx
 00458863    mov        dword ptr fs:[eax],edx
 00458866    push       45887B
 0045886B    lea        eax,[ebp-4]
 0045886E    call       @LStrClr
 00458873    ret
<00458874    jmp        @HandleFinally
<00458879    jmp        0045886B
 0045887B    pop        ebx
 0045887C    pop        ecx
 0045887D    pop        ebp
 0045887E    ret

继续查看算法代码:

 Unit1::sub_00458760
 00458760    push       ebp
 00458761    mov        ebp,esp
 00458763    push       0
 00458765    push       ebx
 00458766    push       esi
 00458767    push       edi
 00458768    mov        ebx,45B844; gvar_0045B844
 0045876D    mov        esi,45B848; gvar_0045B848
 00458772    mov        edi,45B840; gvar_0045B840:AnsiString
 00458777    xor        eax,eax
 00458779    push       ebp
 0045877A    push       4587F3
 0045877F    push       dword ptr fs:[eax]
 00458782    mov        dword ptr fs:[eax],esp
 00458785    lea        edx,[ebp-4]
 00458788    mov        eax,[0045B83C]; gvar_0045B83C:TForm1
 0045878D    mov        eax,dword ptr [eax+2CC]
 00458793    call       TControl.GetText
 00458798    mov        edx,dword ptr [ebp-4]
 0045879B    mov        eax,edi
 0045879D    call       @LStrAsg
 004587A2    xor        eax,eax
 004587A4    mov        dword ptr [ebx],eax
 004587A6    mov        eax,dword ptr [edi]
 004587A8    call       @LStrLen
 004587AD    test       eax,eax
>004587AF    jle        004587CA
 004587B1    mov        dword ptr [esi],1
 004587B7    mov        edx,dword ptr [edi]
 004587B9    mov        ecx,dword ptr [esi]
 004587BB    movzx      edx,byte ptr [edx+ecx-1]
 004587C0    shl        edx,3
 004587C3    add        dword ptr [ebx],edx       ; 循环累加 sum += user[i] << 3
 004587C5    inc        dword ptr [esi]
 004587C7    dec        eax
<004587C8    jne        004587B7
 004587CA    mov        eax,dword ptr [edi]
 004587CC    call       @LStrLen
 004587D1    shl        eax,3
 004587D4    add        dword ptr [ebx],eax       ; sum += len << 3
 004587D6    mov        eax,dword ptr [ebx]
 004587D8    shl        eax,2
 004587DB    mov        dword ptr [ebx],eax       ; sum  = sum << 2
 004587DD    xor        eax,eax
 004587DF    pop        edx
 004587E0    pop        ecx
 004587E1    pop        ecx
 004587E2    mov        dword ptr fs:[eax],edx
 004587E5    push       4587FA
 004587EA    lea        eax,[ebp-4]
 004587ED    call       @LStrClr
 004587F2    ret
<004587F3    jmp        @HandleFinally
<004587F8    jmp        004587EA
 004587FA    pop        edi
 004587FB    pop        esi
 004587FC    pop        ebx
 004587FD    pop        ecx
 004587FE    pop        ebp
 004587FF    ret

示例:
用户名: a
系列号: ((0x61 << 3) + (1 << 3)) << 2 = 0xC40 = 3136

注册机:

#include <stdio.h>
#include <string.h>

int main() {
	char user[51] = {0};
	printf("用户名: ");
	scanf("%s", user); getchar(); //消耗掉多输入的\n 
	int i,len = strlen(user);
	unsigned int sum = 0;
	for(i=0; i<len; i++){
		sum += user[i] << 3;
	}
	sum += len << 3;
	sum = sum << 2;
	printf("注册码: %lu\n", sum);
	getchar(); return 0;
}

运行示例:
用户名: crackme1
注册码: 25056

 
 
本节高手录制的视频,点击前往查看

 
 
 
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~