新CrackMe160之136 - nago
汇编的程序,直接OD查看源码
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 36050000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 74204000 mov dword ptr ds:[0x402074],eax
0040100C |. 6A 00 push 0x0 ; /Title = NULL
0040100E |. 68 8F204000 push nagoya.0040208F ; |Class = "ASMCLASS32"
00401013 |. E8 C5040000 call <jmp.&USER32.FindWindowA> ; \FindWindowA
00401018 |. 0BC0 or eax,eax
0040101A |. 74 05 je short nagoya.00401021
0040101C |. 90 nop
0040101D |. 90 nop
0040101E |. 90 nop
0040101F |. 90 nop
00401020 |. C3 retn
00401021 |> C705 4C204000>mov dword ptr ds:[0x40204C],0x4003
0040102B |. C705 50204000>mov dword ptr ds:[0x402050],nagoya.WndPr>
00401035 |. C705 54204000>mov dword ptr ds:[0x402054],0x0
0040103F |. C705 58204000>mov dword ptr ds:[0x402058],0x0
00401049 |. A1 74204000 mov eax,dword ptr ds:[0x402074]
0040104E |. A3 5C204000 mov dword ptr ds:[0x40205C],eax
00401053 |. 68 007F0000 push 0x7F00 ; /RsrcName = IDI_APPLICATION
00401058 |. 6A 00 push 0x0 ; |hInst = NULL
0040105A |. E8 A2040000 call <jmp.&USER32.LoadIconA> ; \LoadIconA
0040105F |. A3 60204000 mov dword ptr ds:[0x402060],eax
00401064 |. 68 007F0000 push 0x7F00 ; /RsrcName = IDC_ARROW
00401069 |. 6A 00 push 0x0 ; |hInst = NULL
0040106B |. E8 8B040000 call <jmp.&USER32.LoadCursorA> ; \LoadCursorA
00401070 |. A3 64204000 mov dword ptr ds:[0x402064],eax
00401075 |. C705 68204000>mov dword ptr ds:[0x402068],0x6
0040107F |. C705 6C204000>mov dword ptr ds:[0x40206C],nagoya.00402>; ASCII "MENU"
00401089 |. C705 70204000>mov dword ptr ds:[0x402070],nagoya.00402>; ASCII "ASMCLASS32"
00401093 |. 68 4C204000 push nagoya.0040204C ; /pWndClass = nagoya.0040204C
00401098 |. E8 7C040000 call <jmp.&USER32.RegisterClassA> ; \RegisterClassA
0040109D |. 6A 00 push 0x0 ; /lParam = NULL
0040109F |. FF35 74204000 push dword ptr ds:[0x402074] ; |hInst = NULL
004010A5 |. 6A 00 push 0x0 ; |hMenu = NULL
004010A7 |. 6A 00 push 0x0 ; |hParent = NULL
004010A9 |. 68 00800000 push 0x8000 ; |Height = 8000 (32768.)
004010AE |. 68 00800000 push 0x8000 ; |Width = 8000 (32768.)
004010B3 |. 6A 6E push 0x6E ; |Y = 6E (110.)
004010B5 |. 68 B4000000 push 0xB4 ; |X = B4 (180.)
004010BA |. 68 0000CF00 push 0xCF0000 ; |Style = WS_OVERLAPPED|WS_MINIMIZEBOX|WS_MAXIMIZEBOX|WS_SYSMENU|WS_THICKFRAME|WS_CAPTION
004010BF |. 68 84204000 push nagoya.00402084 ; |WindowName = "Exercise 2"
004010C4 |. 68 8F204000 push nagoya.0040208F ; |Class = "ASMCLASS32"
004010C9 |. 6A 00 push 0x0 ; |ExtStyle = 0
004010CB |. E8 E9030000 call <jmp.&USER32.CreateWindowExA> ; \CreateWindowExA
004010D0 |. A3 00204000 mov dword ptr ds:[0x402000],eax
004010D5 |. 6A 01 push 0x1 ; /ShowState = SW_SHOWNORMAL
004010D7 |. FF35 00204000 push dword ptr ds:[0x402000] ; |hWnd = NULL
004010DD |. E8 A7030000 call <jmp.&USER32.ShowWindow> ; \ShowWindow
004010E2 |. FF35 00204000 push dword ptr ds:[0x402000] ; /hWnd = NULL
004010E8 |. E8 A2030000 call <jmp.&USER32.UpdateWindow> ; \UpdateWindow
004010ED |> 6A 00 /push 0x0 ; /MsgFilterMax = 0x0
004010EF |. 6A 00 |push 0x0 ; |MsgFilterMin = 0x0
004010F1 |. 6A 00 |push 0x0 ; |hWnd = NULL
004010F3 |. 68 34204000 |push nagoya.00402034 ; |pMsg = nagoya.00402034
004010F8 |. E8 F2030000 |call <jmp.&USER32.GetMessageA> ; \GetMessageA
004010FD |. 66:3D 0000 |cmp ax,0x0
00401101 |. 74 1A |je short nagoya.0040111D
00401103 |. 90 |nop
00401104 |. 90 |nop
00401105 |. 90 |nop
00401106 |. 90 |nop
00401107 |. 68 34204000 |push nagoya.00402034 ; /pMsg = WM_NULL
0040110C |. E8 84030000 |call <jmp.&USER32.TranslateMessage> ; \TranslateMessage
00401111 |. 68 34204000 |push nagoya.00402034 ; /pMsg = WM_NULL
00401116 |. E8 B0030000 |call <jmp.&USER32.DispatchMessageA> ; \DispatchMessageA
0040111B |.^ EB D0 \jmp short nagoya.004010ED
0040111D |> FF35 3C204000 push dword ptr ds:[0x40203C] ; /ExitCode = 0x0
00401123 \. E8 0F040000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
00401128 >/$ C8 000000 enter 0x0,0x0
0040112C |. 56 push esi ; nagoya.<ModuleEntryPoint>
0040112D |. 57 push edi ; nagoya.<ModuleEntryPoint>
0040112E |. 53 push ebx
0040112F |. 837D 0C 02 cmp [arg.2],0x2
00401133 |. 74 68 je short nagoya.0040119D
00401135 |. 90 nop
00401136 |. 90 nop
00401137 |. 90 nop
00401138 |. 90 nop
00401139 |. 837D 0C 01 cmp [arg.2],0x1
0040113D |. 74 20 je short nagoya.0040115F
0040113F |. 90 nop
00401140 |. 90 nop
00401141 |. 90 nop
00401142 |. 90 nop
00401143 |. 837D 0C 24 cmp [arg.2],0x24
00401147 |. 74 65 je short nagoya.004011AE
00401149 |. 90 nop
0040114A |. 90 nop
0040114B |. 90 nop
0040114C |. 90 nop
0040114D |. 817D 0C 11010>cmp [arg.2],0x111
00401154 |. 0F84 7D000000 je nagoya.004011D7
0040115A |. EB 2B jmp short nagoya.00401187
0040115C | 90 nop
0040115D | 90 nop
0040115E | 90 nop
0040115F |> 6A 00 push 0x0 ; /lParam = NULL
00401161 |. 68 5E134000 push nagoya.0040135E ; |DlgProc = nagoya.0040135E
00401166 |. FF75 08 push [arg.1] ; |hOwner = 00271000
00401169 |. 68 B3204000 push nagoya.004020B3 ; |pTemplate = "NagScreen"
0040116E |. FF35 74204000 push dword ptr ds:[0x402074] ; |hInst = NULL
00401174 |. E8 4C030000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401179 |. 83F8 02 cmp eax,0x2
0040117C |. 74 1F je short nagoya.0040119D
0040117E |. 90 nop
0040117F |. 90 nop
00401180 |. 90 nop
00401181 |. 90 nop
00401182 |. EB 72 jmp short nagoya.004011F6
00401184 | 90 nop
00401185 | 90 nop
00401186 | 90 nop
00401187 |> FF75 14 push [arg.4] ; /lParam = 0x0
0040118A |. FF75 10 push [arg.3] ; |wParam = 0x0
0040118D |. FF75 0C push [arg.2] ; |Message = MSG(0x3A144462)
00401190 |. FF75 08 push [arg.1] ; |hWnd = 00271000
00401193 |. E8 27030000 call <jmp.&USER32.DefWindowProcA> ; \DefWindowProcA
00401198 |. EB 5C jmp short nagoya.004011F6
0040119A | 90 nop
0040119B | 90 nop
0040119C | 90 nop
0040119D |> 6A 00 push 0x0 ; /ExitCode = 0x0
0040119F |. E8 6F030000 call <jmp.&USER32.PostQuitMessage> ; \PostQuitMessage
004011A4 |. B8 00000000 mov eax,0x0
004011A9 |. EB 4B jmp short nagoya.004011F6
004011AB | 90 nop
004011AC | 90 nop
004011AD | 90 nop
004011AE |> 8B5D 14 mov ebx,[arg.4]
004011B1 |. C743 18 04010>mov dword ptr ds:[ebx+0x18],0x104
004011B8 |. C743 1C 04010>mov dword ptr ds:[ebx+0x1C],0x104
004011BF |. C743 20 04010>mov dword ptr ds:[ebx+0x20],0x104
004011C6 |. C743 24 04010>mov dword ptr ds:[ebx+0x24],0x104
004011CD |. B8 00000000 mov eax,0x0
004011D2 |. EB 22 jmp short nagoya.004011F6
004011D4 | 90 nop
004011D5 | 90 nop
004011D6 | 90 nop
004011D7 |> 837D 10 67 cmp [arg.3],0x67
004011DB |. 74 20 je short nagoya.004011FD
004011DD |. 90 nop
004011DE |. 90 nop
004011DF |. 90 nop
004011E0 |. 90 nop
004011E1 |. 837D 10 65 cmp [arg.3],0x65
004011E5 |.^ 74 B6 je short nagoya.0040119D
004011E7 |. 837D 10 66 cmp [arg.3],0x66
004011EB |. 74 2C je short nagoya.00401219
004011ED |. 90 nop
004011EE |. 90 nop
004011EF |. 90 nop
004011F0 |. 90 nop
004011F1 |. EB 03 jmp short nagoya.004011F6
004011F3 | 90 nop
004011F4 | 90 nop
004011F5 | 90 nop
004011F6 |> 5B pop ebx ; kernel32.7741FCC9
004011F7 |. 5F pop edi ; kernel32.7741FCC9
004011F8 |. 5E pop esi ; kernel32.7741FCC9
004011F9 |. C9 leave
004011FA |. C2 1000 retn 0x10
004011FD |> 6A 00 push 0x0 ; /lParam = NULL
004011FF |. 68 0F134000 push nagoya.0040130F ; |DlgProc = nagoya.0040130F
00401204 |. FF75 08 push [arg.1] ; |hOwner = 00271000
00401207 |. 68 A9204000 push nagoya.004020A9 ; |pTemplate = "DLG_ABOUT"
0040120C |. FF35 74204000 push dword ptr ds:[0x402074] ; |hInst = NULL
00401212 |. E8 AE020000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401217 |.^ EB DD jmp short nagoya.004011F6
00401219 |> 6A 00 push 0x0 ; /lParam = NULL
0040121B |. 68 68124000 push nagoya.00401268 ; |DlgProc = nagoya.00401268
00401220 |. FF75 08 push [arg.1] ; |hOwner = 00271000
00401223 |. 68 9F204000 push nagoya.0040209F ; |pTemplate = "DLG_REGIS"
00401228 |. FF35 74204000 push dword ptr ds:[0x402074] ; |hInst = NULL
0040122E |. E8 92020000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401233 |. 83F8 00 cmp eax,0x0
00401236 |.^ 74 BE je short nagoya.004011F6
00401238 |. 68 05214000 push nagoya.00402105 ; ASCII "????????????????????????????????"
0040123D |. 68 25214000 push nagoya.00402125
00401242 |. E8 C9010000 call nagoya.00401410
00401247 |. 83C4 08 add esp,0x8
0040124A |. A1 25214000 mov eax,dword ptr ds:[0x402125]
0040124F |. 3D 39300000 cmp eax,0x3039
00401254 |. 74 0B je short nagoya.00401261
00401256 |. 90 nop
00401257 |. 90 nop
00401258 |. 90 nop
00401259 |. 90 nop
0040125A |. E8 08020000 call nagoya.00401467
0040125F |.^ EB 95 jmp short nagoya.004011F6
00401261 |> E8 E5010000 call nagoya.0040144B
00401266 \.^ EB 8E jmp short nagoya.004011F6
00401268 /. C8 000000 enter 0x0,0x0
0040126C |. 53 push ebx
0040126D |. 56 push esi ; nagoya.<ModuleEntryPoint>
0040126E |. 57 push edi ; nagoya.<ModuleEntryPoint>
0040126F |. 817D 0C 10010>cmp [arg.2],0x110
00401276 |. 74 27 je short nagoya.0040129F
00401278 |. 90 nop
00401279 |. 90 nop
0040127A |. 90 nop
0040127B |. 90 nop
0040127C |. 817D 0C 11010>cmp [arg.2],0x111
00401283 |. 74 24 je short nagoya.004012A9
00401285 |. 90 nop
00401286 |. 90 nop
00401287 |. 90 nop
00401288 |. 90 nop
00401289 |. 837D 0C 10 cmp [arg.2],0x10
0040128D |. 74 70 je short nagoya.004012FF
0040128F |. 90 nop
00401290 |. 90 nop
00401291 |. 90 nop
00401292 |. 90 nop
00401293 |. B8 00000000 mov eax,0x0
00401298 |> 5F pop edi ; kernel32.7741FCC9
00401299 |. 5E pop esi ; kernel32.7741FCC9
0040129A |. 5B pop ebx ; kernel32.7741FCC9
0040129B |. C9 leave
0040129C |. C2 1000 retn 0x10
0040129F |> FF75 08 push [arg.1] ; /hWnd = 00271000
004012A2 |. E8 78020000 call <jmp.&USER32.SetFocus> ; \SetFocus
004012A7 |.^ EB EF jmp short nagoya.00401298
004012A9 |> 33C0 xor eax,eax
004012AB |. 817D 10 EB030>cmp [arg.3],0x3EB
004012B2 |. 74 4B je short nagoya.004012FF
004012B4 |. 90 nop
004012B5 |. 90 nop
004012B6 |. 90 nop
004012B7 |. 90 nop
004012B8 |. 817D 10 EA030>cmp [arg.3],0x3EA
004012BF |. 75 37 jnz short nagoya.004012F8
004012C1 |. 90 nop
004012C2 |. 90 nop
004012C3 |. 90 nop
004012C4 |. 90 nop
004012C5 |. 6A 0B push 0xB ; /Count = B (11.)
004012C7 |. 68 05214000 push nagoya.00402105 ; |Buffer = nagoya.00402105
004012CC |. A1 80204000 mov eax,dword ptr ds:[0x402080] ; |
004012D1 |. 50 push eax ; |ControlID = 19FFCC (1703884.)
004012D2 |. FF75 08 push [arg.1] ; |hWnd = 00271000
004012D5 |. E8 0F020000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
004012DA |. 6A 0B push 0xB ; /Count = B (11.)
004012DC |. 68 15214000 push nagoya.00402115 ; |Buffer = nagoya.00402115
004012E1 |. 68 E8030000 push 0x3E8 ; |ControlID = 3E8 (1000.)
004012E6 |. FF75 08 push [arg.1] ; |hWnd = 00271000
004012E9 |. E8 FB010000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
004012EE |. B8 01000000 mov eax,0x1
004012F3 |. EB 0A jmp short nagoya.004012FF
004012F5 | 90 nop
004012F6 | 90 nop
004012F7 | 90 nop
004012F8 |> B8 00000000 mov eax,0x0
004012FD |.^ EB 99 jmp short nagoya.00401298
004012FF |> 50 push eax ; /Result = 19FFCC (1703884.)
00401300 |. FF75 08 push [arg.1] ; |hWnd = 00271000
00401303 |. E8 C9010000 call <jmp.&USER32.EndDialog> ; \EndDialog
00401308 |. B8 01000000 mov eax,0x1
0040130D \.^ EB 89 jmp short nagoya.00401298
0040130F /. C8 000000 enter 0x0,0x0
00401313 |. 53 push ebx
00401314 |. 56 push esi ; nagoya.<ModuleEntryPoint>
00401315 |. 57 push edi ; nagoya.<ModuleEntryPoint>
00401316 |. 817D 0C 11010>cmp [arg.2],0x111
0040131D |. 74 1A je short nagoya.00401339
0040131F |. 90 nop
00401320 |. 90 nop
00401321 |. 90 nop
00401322 |. 90 nop
00401323 |. 837D 0C 10 cmp [arg.2],0x10
00401327 |. 74 1D je short nagoya.00401346
00401329 |. 90 nop
0040132A |. 90 nop
0040132B |. 90 nop
0040132C |. 90 nop
0040132D |. B8 00000000 mov eax,0x0
00401332 |> 5F pop edi ; kernel32.7741FCC9
00401333 |. 5E pop esi ; kernel32.7741FCC9
00401334 |. 5B pop ebx ; kernel32.7741FCC9
00401335 |. C9 leave
00401336 |. C2 1000 retn 0x10
00401339 |> 817D 10 F2030>cmp [arg.3],0x3F2
00401340 |. 75 15 jnz short nagoya.00401357
00401342 |. 90 nop
00401343 |. 90 nop
00401344 |. 90 nop
00401345 |. 90 nop
00401346 |> 6A 00 push 0x0 ; /Result = 0x0
00401348 |. FF75 08 push [arg.1] ; |hWnd = 00271000
0040134B |. E8 81010000 call <jmp.&USER32.EndDialog> ; \EndDialog
00401350 |. B8 01000000 mov eax,0x1
00401355 |.^ EB DB jmp short nagoya.00401332
00401357 |> B8 00000000 mov eax,0x0
0040135C \.^ EB D4 jmp short nagoya.00401332
0040135E . C8 000000 enter 0x0,0x0
00401362 . 53 push ebx
00401363 . 56 push esi ; nagoya.<ModuleEntryPoint>
00401364 . 57 push edi ; nagoya.<ModuleEntryPoint>
00401365 . 817D 0C 11010>cmp dword ptr ss:[ebp+0xC],0x111
0040136C . 74 2C je short nagoya.0040139A
0040136E . 90 nop
0040136F . 90 nop
00401370 . 90 nop
00401371 . 90 nop
00401372 . 817D 0C 10010>cmp dword ptr ss:[ebp+0xC],0x110
00401379 . 74 4F je short nagoya.004013CA
0040137B . 90 nop
0040137C . 90 nop
0040137D . 90 nop
0040137E . 90 nop
0040137F . 837D 0C 10 cmp dword ptr ss:[ebp+0xC],0x10
00401383 . B8 02000000 mov eax,0x2
00401388 . 74 4E je short nagoya.004013D8
0040138A . 90 nop
0040138B . 90 nop
0040138C . 90 nop
0040138D . 90 nop
0040138E . B8 00000000 mov eax,0x0
00401393 > 5F pop edi ; kernel32.7741FCC9
00401394 . 5E pop esi ; kernel32.7741FCC9
00401395 . 5B pop ebx ; kernel32.7741FCC9
00401396 . C9 leave
00401397 . C2 1000 retn 0x10
0040139A > B8 02000000 mov eax,0x2
0040139F . 817D 10 FD030>cmp dword ptr ss:[ebp+0x10],0x3FD
004013A6 . 74 30 je short nagoya.004013D8
004013A8 . 90 nop
004013A9 . 90 nop
004013AA . 90 nop
004013AB . 90 nop
004013AC . 817D 10 FC030>cmp dword ptr ss:[ebp+0x10],0x3FC
004013B3 . 75 0E jnz short nagoya.004013C3
004013B5 . 90 nop
004013B6 . 90 nop
004013B7 . 90 nop
004013B8 . 90 nop
004013B9 . B8 01000000 mov eax,0x1
004013BE . EB 18 jmp short nagoya.004013D8
004013C0 90 nop
004013C1 90 nop
004013C2 90 nop
004013C3 > B8 00000000 mov eax,0x0
004013C8 .^ EB C9 jmp short nagoya.00401393
004013CA > BE 80204000 mov esi,nagoya.00402080
004013CF . FF06 inc dword ptr ds:[esi]
004013D1 . B8 01000000 mov eax,0x1
004013D6 .^ EB BB jmp short nagoya.00401393
004013D8 > 50 push eax ; /Result = 19FFCC (1703884.)
004013D9 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 00271000
004013DC . E8 F0000000 call <jmp.&USER32.EndDialog> ; \EndDialog
004013E1 . B8 01000000 mov eax,0x1
004013E6 .^ EB AB jmp short nagoya.00401393
004013E8 /$ 55 push ebp
004013E9 |. 8BEC mov ebp,esp
004013EB |. 56 push esi ; nagoya.<ModuleEntryPoint>
004013EC |. 8B75 08 mov esi,[arg.1]
004013EF |. 8BFE mov edi,esi ; nagoya.<ModuleEntryPoint>
004013F1 |. 33C0 xor eax,eax
004013F3 |> 8A06 /mov al,byte ptr ds:[esi]
004013F5 |. 46 |inc esi ; nagoya.<ModuleEntryPoint>
004013F6 |. 84C0 |test al,al
004013F8 |. 75 09 |jnz short nagoya.00401403
004013FA |. 90 |nop
004013FB |. 90 |nop
004013FC |. 90 |nop
004013FD |. 90 |nop
004013FE |. 8807 |mov byte ptr ds:[edi],al
00401400 |. 5E |pop esi ; kernel32.7741FCC9
00401401 |. 5D |pop ebp ; kernel32.7741FCC9
00401402 |. C3 |retn
00401403 |> 3C 39 |cmp al,0x39
00401405 |.^ 7F EC |jg short nagoya.004013F3
00401407 |. 2C 30 |sub al,0x30
00401409 |.^ 72 E8 |jb short nagoya.004013F3
0040140B |. 8807 |mov byte ptr ds:[edi],al
0040140D |. 47 |inc edi ; nagoya.<ModuleEntryPoint>
0040140E \.^ EB E3 \jmp short nagoya.004013F3
00401410 /$ 55 push ebp
00401411 |. 8BEC mov ebp,esp
00401413 |. 56 push esi ; nagoya.<ModuleEntryPoint>
00401414 |. 8B75 0C mov esi,[arg.2]
00401417 |. 56 push esi ; nagoya.<ModuleEntryPoint>
00401418 |. E8 CBFFFFFF call nagoya.004013E8
0040141D |. 83C4 04 add esp,0x4
00401420 |. 56 push esi ; /String = "j"
00401421 |. E8 0B010000 call <jmp.&KERNEL32.lstrlen> ; \lstrlenA
00401426 |. 85C0 test eax,eax
00401428 |. 74 19 je short nagoya.00401443
0040142A |. 90 nop
0040142B |. 90 nop
0040142C |. 90 nop
0040142D |. 90 nop
0040142E |. 8BC8 mov ecx,eax
00401430 |. 33C0 xor eax,eax
00401432 |. 33DB xor ebx,ebx
00401434 |> D1E0 /shl eax,1
00401436 |. 8BD8 |mov ebx,eax
00401438 |. D1E0 |shl eax,1
0040143A |. D1E0 |shl eax,1
0040143C |. 021E |add bl,byte ptr ds:[esi]
0040143E |. 03C3 |add eax,ebx
00401440 |. 46 |inc esi ; nagoya.<ModuleEntryPoint>
00401441 |.^ E2 F1 \loopd short nagoya.00401434
00401443 |> 8B75 08 mov esi,[arg.1]
00401446 |. 8906 mov dword ptr ds:[esi],eax
00401448 |. 5E pop esi ; kernel32.7741FCC9
00401449 |. 5D pop ebp ; kernel32.7741FCC9
0040144A \. C3 retn
0040144B /$ 6A 00 push 0x0 ; /BeepType = MB_OK
0040144D |. E8 B5000000 call <jmp.&USER32.MessageBeep> ; \MessageBeep
00401452 |. 6A 30 push 0x30 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL
00401454 |. 68 BD204000 push nagoya.004020BD ; |Title = "Congratulations!!!"
00401459 |. 68 D6204000 push nagoya.004020D6 ; |Text = "You have cracked this
scheme. "
0040145E |. FF75 08 push [arg.1] ; |hOwner = 00271000
00401461 |. E8 A7000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401466 \. C3 retn
00401467 /$ 6A 00 push 0x0 ; /BeepType = MB_OK
00401469 |. E8 99000000 call <jmp.&USER32.MessageBeep> ; \MessageBeep
0040146E |. 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
00401470 |. 68 D0204000 push nagoya.004020D0 ; |Title = "Sorry"
00401475 |. 68 F6204000 push nagoya.004020F6 ; |Text = "Try it again!!"
0040147A |. FF75 08 push [arg.1] ; |hOwner = 00271000
0040147D |. E8 8B000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401482 \. C3 retn
00401483 .- FF25 E4304000 jmp dword ptr ds:[<&USER32.TrackPopupMen>; user32.TrackPopupMenu
00401489 $- FF25 E8304000 jmp dword ptr ds:[<&USER32.ShowWindow>] ; user32.ShowWindow
0040148F $- FF25 EC304000 jmp dword ptr ds:[<&USER32.UpdateWindow>>; user32.UpdateWindow
00401495 $- FF25 F0304000 jmp dword ptr ds:[<&USER32.TranslateMess>; user32.TranslateMessage
0040149B .- FF25 F4304000 jmp dword ptr ds:[<&USER32.AppendMenuA>] ; user32.AppendMenuA
004014A1 .- FF25 F8304000 jmp dword ptr ds:[<&USER32.BeginPaint>] ; user32.BeginPaint
004014A7 .- FF25 FC304000 jmp dword ptr ds:[<&USER32.ClientToScree>; user32.ClientToScreen
004014AD .- FF25 00314000 jmp dword ptr ds:[<&USER32.CreateDialogP>; user32.CreateDialogParamA
004014B3 .- FF25 04314000 jmp dword ptr ds:[<&USER32.CreatePopupMe>; user32.CreatePopupMenu
004014B9 $- FF25 08314000 jmp dword ptr ds:[<&USER32.CreateWindowE>; user32.CreateWindowExA
004014BF $- FF25 0C314000 jmp dword ptr ds:[<&USER32.DefWindowProc>; ntdll.NtdllDefWindowProc_A
004014C5 $- FF25 10314000 jmp dword ptr ds:[<&USER32.DialogBoxPara>; user32.DialogBoxParamA
004014CB $- FF25 14314000 jmp dword ptr ds:[<&USER32.DispatchMessa>; user32.DispatchMessageA
004014D1 $- FF25 18314000 jmp dword ptr ds:[<&USER32.EndDialog>] ; user32.EndDialog
004014D7 .- FF25 1C314000 jmp dword ptr ds:[<&USER32.EndPaint>] ; user32.EndPaint
004014DD $- FF25 20314000 jmp dword ptr ds:[<&USER32.FindWindowA>] ; user32.FindWindowA
004014E3 .- FF25 24314000 jmp dword ptr ds:[<&USER32.GetCursorPos>>; user32.GetPhysicalCursorPos
004014E9 $- FF25 28314000 jmp dword ptr ds:[<&USER32.GetDlgItemTex>; user32.GetDlgItemTextA
004014EF $- FF25 2C314000 jmp dword ptr ds:[<&USER32.GetMessageA>] ; user32.GetMessageA
004014F5 .- FF25 30314000 jmp dword ptr ds:[<&USER32.InvalidateRec>; user32.InvalidateRect
004014FB $- FF25 34314000 jmp dword ptr ds:[<&USER32.LoadCursorA>] ; user32.LoadCursorA
00401501 $- FF25 38314000 jmp dword ptr ds:[<&USER32.LoadIconA>] ; user32.LoadIconA
00401507 $- FF25 3C314000 jmp dword ptr ds:[<&USER32.MessageBeep>] ; user32.MessageBeep
0040150D $- FF25 40314000 jmp dword ptr ds:[<&USER32.MessageBoxA>] ; user32.MessageBoxA
00401513 $- FF25 44314000 jmp dword ptr ds:[<&USER32.PostQuitMessa>; user32.PostQuitMessage
00401519 $- FF25 48314000 jmp dword ptr ds:[<&USER32.RegisterClass>; user32.RegisterClassA
0040151F $- FF25 4C314000 jmp dword ptr ds:[<&USER32.SetFocus>] ; user32.SetFocus
00401525 .- FF25 50314000 jmp dword ptr ds:[<&USER32.SetMenu>] ; user32.SetMenu
0040152B .- FF25 54314000 jmp dword ptr ds:[<&USER32.SetWindowPos>>; user32.SetWindowPos
00401531 $- FF25 5C314000 jmp dword ptr ds:[<&KERNEL32.lstrlen>] ; kernel32.lstrlenA
00401537 .- FF25 60314000 jmp dword ptr ds:[<&KERNEL32.ExitProcess>; kernel32.ExitProcess
0040153D $- FF25 64314000 jmp dword ptr ds:[<&KERNEL32.GetModuleHa>; kernel32.GetModuleHandleA
00401543 .- FF25 6C314000 jmp dword ptr ds:[<&GDI32.TextOutA>] ; gdi32.TextOutA
00401549 .- FF25 70314000 jmp dword ptr ds:[<&GDI32.GetStockObject>; gdi32.GetStockObject
0040154F 00 db 00
-
去NAG
搜索界面看到了弹框标题"NagScreen"定位到00401169,看到了DialogBoxParamA(00401174)将这行nop掉即可跳过弹框 -
继续去NAG
进入主界面后发现还要继续点菜单的注册才能出来注册界面,能不能运行程序直接显示注册界面而不显示主界面呢? 肯定是可以的,现在我们把主界面也当成NAG界面给去掉
点击菜单的注册按钮后,弹出注册界面,这里点OD的暂停,可以在堆栈界面中看到弹框的调用是在0040122E处,把上面push的参数全部搬到第一个NAG弹框中去,就是把第一个弹框换成注册框
修改如下(比较多,认真对比),将:
00401133 |. /74 68 je short nagoya.0040119D ; 这块没用空间比较多,所以把空的整理出来给弹框事件用
00401135 |90 nop
00401136 |90 nop
00401137 |90 nop
00401138 |90 nop
00401139 |837D 0C 01 cmp dword ptr ss:[ebp+0xC],0x1
0040113D |74 20 je short nagoya.0040115F
0040113F |90 nop
00401140 |90 nop
00401141 |90 nop
00401142 |90 nop
00401143 |837D 0C 24 cmp dword ptr ss:[ebp+0xC],0x24
00401147 |74 65 je short nagoya.004011AE
00401149 |90 nop
0040114A |90 nop
0040114B |90 nop
0040114C |90 nop
0040114D |817D 0C 11010>cmp dword ptr ss:[ebp+0xC],0x111
00401154 |0F84 7D000000 je nagoya.004011D7
0040115A |EB 2B jmp short nagoya.00401187
0040115C |90 nop
0040115D |90 nop
0040115E |90 nop
0040115F |> |6A 00 push 0x0 ; /lParam = NULL
00401161 |. |68 68124000 push nagoya.00401268 ; |DlgProc = nagoya.00401268
00401166 |. |FF75 08 push [arg.1] ; |hOwner = 002D2000
00401169 |. |68 9F204000 push nagoya.0040209F ; |pTemplate = "DLG_REGIS"
0040116E |. |FF35 74204000 push dword ptr ds:[0x402074] ; |hInst = NULL
00401174 |. |E8 4C030000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401179 |83F8 00 cmp eax,0x0
0040117C ^|74 9F je short nagoya.0040111D
0040117E |E9 B5000000 jmp nagoya.00401238
00401183 |90 nop
00401184 |90 nop
00401185 |90 nop
00401186 |90 nop
修改为:
00401133 . /74 68 je short nagoya.0040119D
00401135 . |837D 0C 01 cmp dword ptr ss:[ebp+0xC],0x1
00401139 . |74 24 je short nagoya.0040115F
0040113B . |837D 0C 24 cmp dword ptr ss:[ebp+0xC],0x24
0040113F . |74 6D je short nagoya.004011AE
00401141 . |817D 0C 11010>cmp dword ptr ss:[ebp+0xC],0x111
00401148 . |0F84 89000000 je nagoya.004011D7
0040114E . |EB 37 jmp short nagoya.00401187
00401150 |90 nop
00401151 > |3D 68124000 cmp eax,nagoya.00401268 ; 新增的事件判断,窗体关闭x事件,直接退出程序
00401156 .^|74 C5 je short nagoya.0040111D
00401158 . |83F8 00 cmp eax,0x0 ; not now按钮事件,也是退出程序
0040115B .^|74 C0 je short nagoya.0040111D
0040115D . |EB 1F jmp short nagoya.0040117E ; 不够空间了,用近跳跳回原来位置
0040115F > |6A 00 push 0x0 ; /lParam = NULL
00401161 . |68 68124000 push nagoya.00401268 ; |DlgProc = nagoya.00401268
00401166 . |FF75 08 push dword ptr ss:[ebp+0x8] ; |hOwner = 00352000
00401169 . |68 9F204000 push nagoya.0040209F ; |pTemplate = "DLG_REGIS"
0040116E . |FF35 74204000 push dword ptr ds:[0x402074] ; |hInst = NULL
00401174 . |E8 4C030000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401179 .^|EB D6 jmp short nagoya.00401151
0040117B |90 nop
0040117C |90 nop
0040117D |90 nop
0040117E > |E9 B5000000 jmp nagoya.00401238 ; 远跳到原注册界面事件
00401183 |90 nop
00401184 |90 nop
00401185 |90 nop
00401186 |90 nop
继续将:
00401254 /74 0B je short nagoya.00401261
00401256 |90 nop
00401257 |90 nop
00401258 |90 nop
00401259 |90 nop
0040125A |E8 08020000 call nagoya.00401467
0040125F ^|EB 95 jmp short nagoya.004011F6
00401261 \E8 E5010000 call nagoya.0040144B
00401266 ^ EB 8E jmp short nagoya.004011F6
00401268 C8 000000 enter 0x0,0x0
修改为:
00401254 /74 07 je short nagoya.0040125D
00401256 |E8 0C020000 call nagoya.00401467 ; 失败提示,下面远跳到退出程序空间不够,把这个call上移
0040125B ^|EB 99 jmp short nagoya.004011F6 ; 验证时不退出程序
0040125D \E8 E9010000 call nagoya.0040144B ; 成功提示
00401262 ^ EB 92 jmp short nagoya.004011F6 ; 验证时不退出程序
00401264 90 nop
00401265 90 nop
00401266 90 nop
00401267 90 nop
00401268 C8 000000 enter 0x0,0x0
继续将:
004012F3 /EB 0A jmp short nagoya.004012FF
004012F5 |90 nop
004012F6 |90 nop
004012F7 |90 nop
修改为:
004012F3 ^\E9 81FEFFFF jmp nagoya.00401179 ; 跳过关闭界面,就是验证时不关闭界面,可以继续操作
到此, 这个程序变得很干净了,只有一个注册界面了, 完美~
- 正常破解
OD重新载入第2次去NAG的程序,只有注册界面这个,方便调试,不用每次都点注册菜单
由上一步分析可知注册事件入口在00401242处,下好断点,开始分析算法
00401403处可知用户名得是数字
00401434 ~ 00401441处可得 用户名转数字"123"=>123
0040124F处与0x3039对比,即"12345"
注册码无验证, 可不填
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号