新CrackMe160之142 - xyzero - keygenme2
OD载入程序,搜索界面可定位到成功关键词Good job %s 0040135B, 向上可以找到方法入口为0040112E, C++的程序,在IDA中查看对应源码为:
...
v49 = 24711447;
nSize = 255;
pcbBuffer = 255;
GetDlgItemTextA(hDlg, 1000, &String, 24);
v1 = strlen(&String);
v45 = v1;
if ( v1 >= 4 )
{
v2 = 0;
if ( v1 )
{
do
i += v49++ + *(&String + v2++);
while ( v2 < v1 );
}
v3 = v49 + i * v1;
GetComputerNameA(&Buffer, &nSize);
wsprintfA(&String1, aS, &Buffer);
GetUserNameA(&v25, &pcbBuffer);
wsprintfA(&String2, aS, &v25);
lstrcatA(&String1, &String2);
v4 = strlen(&String1);
v5 = 0;
if ( v4 )
{
v6 = &v11 + v4;
do
*(&String2 + v5++) = *v6--;
while ( v5 < v4 );
}
CharUpperA(&String2);
if ( v4 )
{
v7 = 32;
v8 = (int)&v14;
for ( i = (int)&v14; ; v8 = i )
{
v48 += v45 * (v7 ^ *(_BYTE *)(v8 + v7));
++v7;
if ( v7 - 32 >= v4 )
break;
}
}
GetDlgItemTextA(hDlg, 1001, &Str, 36);
v9 = atol(&Str);
if ( v3 + v48 == (v48 ^ v9) )
{
wsprintfA(&Text, aGoodJobS, &String);
MessageBoxA(hDlg, &Text, aOk, 0);
}
else
{
SetDlgItemTextA(hDlg, 1001, 0);
}
}
else
{
SetDlgItemTextA(hDlg, 1001, 0);
SetDlgItemTextA(hDlg, 1000, &::String);
}
...
算法都在上面了,直接翻译:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main() {
char user[256] = {0};
printf("用户名: ");
scanf("%s", user); getchar();
int lenu = strlen(user), lens;
if(lenu < 4){
printf("用户名4位以上");
getchar(); return 0;
}
int i = 0, v49 = 24711447, nSize = 255;
unsigned int sum = 0, sum1 = 0;
char cn[256]={0}, cu[256]={0};
do
sum += v49++ + user[i++];
while ( i < lenu );
sum = v49 + sum * lenu;
GetComputerNameA(cn, &nSize);
GetUserNameA(cu, &nSize);
lstrcatA(cn, cu);
lens = strlen(cn);
i = 0;
do
cu[i] = cn[lens-1-i];
while ( ++i < lens );
CharUpperA(cu);
for (i=0; i<lens; i++)
{
sum1 += lenu * ((i+32) ^ cu[i]);
}
sum = (sum + sum1) ^ sum1;
printf("系列号: %lu", sum);
getchar(); return 0;
}
运行示例:
用户名: keygenme2
系列号: 2026399486
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~


浙公网安备 33010602011771号