新CrackMe160之122 - DFCG - crackme

Delphi的程序,使用IDR查看按钮事件源码:

 CrackMeNo3::TForm1.Button1Click
 00459938    push       ebp
 00459939    mov        ebp,esp
 0045993B    xor        ecx,ecx
 0045993D    push       ecx
 0045993E    push       ecx
 0045993F    push       ecx
 00459940    push       ecx
 00459941    push       ecx
 00459942    push       ecx
 00459943    push       ecx
 00459944    push       ebx
 00459945    push       esi
 00459946    mov        dword ptr [ebp-4],eax
 00459949    xor        eax,eax
 0045994B    push       ebp
 0045994C    push       459A8E
 00459951    push       dword ptr fs:[eax]
 00459954    mov        dword ptr fs:[eax],esp
 00459957    lea        edx,[ebp-14]
 0045995A    mov        eax,dword ptr [ebp-4]
 0045995D    mov        eax,dword ptr [eax+300]; TForm1.Edit1:TEdit
 00459963    call       TControl.GetText
 00459968    mov        eax,dword ptr [ebp-14]
 0045996B    call       @LStrLen
 00459970    mov        esi,eax
 00459972    xor        ebx,ebx
 00459974    mov        eax,esi
 00459976    test       eax,eax
>00459978    jle        0045999B
 0045997A    mov        edx,1
 0045997F    imul       ecx,esi,21C6918E          ; 循环用户名 sum += len * 0x21C6918E + user[i] * 0x2CE
 00459985    add        ebx,ecx
 00459987    mov        ecx,dword ptr [ebp-14]
 0045998A    movzx      ecx,byte ptr [ecx+edx-1]
 0045998F    imul       ecx,ecx,2CE
 00459995    add        ebx,ecx
 00459997    inc        edx
 00459998    dec        eax
<00459999    jne        0045997F
 0045999B    mov        eax,ebx
 0045999D    cdq                    ; 当eax>=0x80000000时(即eax最高位为1时) edx=0xFFFFFFFF,否则edx=0
 0045999E    xor        eax,edx     ; sum = sum ^ edx
 004599A0    sub        eax,edx     ; sum = sum - edx
 004599A2    lea        edx,[ebp-8]
 004599A5    call       IntToStr
 004599AA    mov        eax,esi
 004599AC    test       eax,eax
>004599AE    jle        004599D1
 004599B0    mov        edx,1
 004599B5    mov        ecx,dword ptr [ebp-14]
 004599B8    movzx      ecx,byte ptr [ecx+edx-1]      ; sum1 += user[i] * 0x21C6918E * 0x7BC - len
 004599BD    imul       ecx,ecx,21C6918E
 004599C3    imul       ecx,ecx,7BC
 004599C9    add        ebx,ecx
 004599CB    sub        ebx,esi
 004599CD    inc        edx
 004599CE    dec        eax
<004599CF    jne        004599B5
 004599D1    mov        eax,ebx
 004599D3    cdq
 004599D4    xor        eax,edx     ; sum = sum ^ edx
 004599D6    sub        eax,edx     ; sum = sum - edx
 004599D8    lea        edx,[ebp-0C]
 004599DB    call       IntToStr
 004599E0    mov        eax,esi
 004599E2    test       eax,eax
>004599E4    jle        00459A04
 004599E6    mov        edx,1
 004599EB    mov        ecx,dword ptr [ebp-14]
 004599EE    movzx      ecx,byte ptr [ecx+edx-1]    ; sum2 += user[i] * len * 0x4C6 + len
 004599F3    imul       ecx,esi
 004599F6    imul       ecx,ecx,4C6
 004599FC    add        ebx,ecx
 004599FE    add        ebx,esi
 00459A00    inc        edx
 00459A01    dec        eax
<00459A02    jne        004599EB
 00459A04    add        ebx,21C6918E
 00459A0A    mov        eax,ebx
 00459A0C    cdq
 00459A0D    xor        eax,edx     ; sum = sum ^ edx
 00459A0F    sub        eax,edx     ; sum = sum - edx
 00459A11    lea        edx,[ebp-10]
 00459A14    call       IntToStr
 00459A19    lea        edx,[ebp-18]
 00459A1C    mov        eax,dword ptr [ebp-4]
 00459A1F    mov        eax,dword ptr [eax+304]; TForm1.Edit3:TEdit
 00459A25    call       TControl.GetText
 00459A2A    mov        eax,dword ptr [ebp-18]
 00459A2D    push       eax
 00459A2E    push       dword ptr [ebp-8]     ; sum + '-' + sum1 + '-' + sum2
 00459A31    push       459AA4; '-'
 00459A36    push       dword ptr [ebp-0C]
 00459A39    push       459AA4; '-'
 00459A3E    push       dword ptr [ebp-10]
 00459A41    lea        eax,[ebp-1C]
 00459A44    mov        edx,5
 00459A49    call       @LStrCatN
 00459A4E    mov        edx,dword ptr [ebp-1C]
 00459A51    pop        eax
 00459A52    call       @LStrCmp            ; 与系列号对比
>00459A57    jne        00459A63
 00459A59    mov        eax,459AB0; '恭喜你!完全正确。'
 00459A5E    call       ShowMessage
 00459A63    xor        eax,eax
 00459A65    pop        edx
 00459A66    pop        ecx
 00459A67    pop        ecx
 00459A68    mov        dword ptr fs:[eax],edx
 00459A6B    push       459A95
 00459A70    lea        eax,[ebp-1C]
 00459A73    call       @LStrClr
 00459A78    lea        eax,[ebp-18]
 00459A7B    call       @LStrClr
 00459A80    lea        eax,[ebp-14]
 00459A83    mov        edx,4
 00459A88    call       @LStrArrayClr
 00459A8D    ret
<00459A8E    jmp        @HandleFinally
<00459A93    jmp        00459A70
 00459A95    pop        esi
 00459A96    pop        ebx
 00459A97    mov        esp,ebp
 00459A99    pop        ebp
 00459A9A    ret

注册机:

#include <stdio.h>
#include <string.h>

int main() {
	char user[51] = {0};
	printf("用户名: ");
	scanf("%s", user); getchar(); //消耗掉多输入的\n 
	int i,len = strlen(user);
	unsigned int sum0 = 0, sum1 = 0, sum2 = 0;
	for(i=0; i<len; i++){
		sum0 += user[i] * 0x2CE + len * 0x21C6918E;
		sum1 += user[i] * 0x21C6918E * 0x7BC - len;
		sum2 += user[i] * len * 0x4C6 + len;
	}
	sum1 += sum0;
	sum2 += sum1 + 0x21C6918E;
	if(sum0 >= 0x80000000) sum0 = (sum0 ^ 0xFFFFFFFF) - 0xFFFFFFFF;
	if(sum1 >= 0x80000000) sum1 = (sum1 ^ 0xFFFFFFFF) - 0xFFFFFFFF;
	if(sum2 >= 0x80000000) sum2 = (sum2 ^ 0xFFFFFFFF) - 0xFFFFFFFF;
	printf("系列号: %lu-%lu-%lu\n", sum0,sum1,sum2);
	getchar(); return 0;
}

运行示例:
用户名: CrackMeNo3_1
系列号: 4369004-1518698292-2100698498

 
 
本节高手录制的视频,点击前往查看

 
 
 
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~