新CrackMe160之149 - b2c_2k5_1
汇编程序写的,所以直接看源码:
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 41040000 call <jmp.&kernel32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 04304000 mov dword ptr ds:[0x403004],eax
0040100C |. E8 31040000 call <jmp.&kernel32.GetCommandLineA> ; [GetCommandLineA
00401011 |. E8 50040000 call <jmp.&comctl32.InitCommonControls> ; [InitCommonControls
00401016 |. A3 08304000 mov dword ptr ds:[0x403008],eax
0040101B |. 6A 0A push 0xA
0040101D |. FF35 08304000 push dword ptr ds:[0x403008]
00401023 |. 6A 00 push 0x0
00401025 |. FF35 04304000 push dword ptr ds:[0x403004]
0040102B |. E8 06000000 call b2c_2k5.00401036
00401030 |. 50 push eax ; /ExitCode = 0x19FFCC
00401031 \. E8 06040000 call <jmp.&kernel32.ExitProcess> ; \ExitProcess
00401036 /$ 55 push ebp
00401037 |. 8BEC mov ebp,esp
00401039 |. 83C4 B4 add esp,-0x4C
0040103C |. C745 D0 30000>mov [local.12],0x30
00401043 |. C745 D4 03000>mov [local.11],0x3
0040104A |. C745 D8 03114>mov [local.10],b2c_2k5.00401103
00401051 |. C745 DC 00000>mov [local.9],0x0
00401058 |. C745 E0 1E000>mov [local.8],0x1E
0040105F |. FF75 08 push [arg.1]
00401062 |. 8F45 E4 pop [local.7] ; kernel32.75ABFCC9
00401065 |. C745 F0 10000>mov [local.4],0x10
0040106C |. C745 F4 00000>mov [local.3],0x0
00401073 |. C745 F8 7C204>mov [local.2],b2c_2k5.0040207C ; ASCII "DLGCLASS"
0040107A |. 68 F6010000 push 0x1F6 ; /RsrcName = 502.
0040107F |. 6A 00 push 0x0 ; |hInst = NULL
00401081 |. E8 86030000 call <jmp.&user32.LoadIconA> ; \LoadIconA
00401086 |. 8945 E8 mov [local.6],eax
00401089 |. 8945 FC mov [local.1],eax
0040108C |. 68 007F0000 push 0x7F00 ; /RsrcName = IDC_ARROW
00401091 |. 6A 00 push 0x0 ; |hInst = NULL
00401093 |. E8 6E030000 call <jmp.&user32.LoadCursorA> ; \LoadCursorA
00401098 |. 8945 EC mov [local.5],eax
0040109B |. 8D45 D0 lea eax,[local.12]
0040109E |. 50 push eax ; /pWndClassEx = 0019FFCC
0040109F |. E8 7A030000 call <jmp.&user32.RegisterClassExA> ; \RegisterClassExA
004010A4 |. 6A 00 push 0x0 ; /lParam = 0x0
004010A6 |. 68 03114000 push b2c_2k5.00401103 ; |pDlgProc = b2c_2k5.00401103
004010AB |. 6A 00 push 0x0 ; |hOwner = NULL
004010AD |. 68 E8030000 push 0x3E8 ; |pTemplate = 0x3E8
004010B2 |. FF35 04304000 push dword ptr ds:[0x403004] ; |hInst = NULL
004010B8 |. E8 0D030000 call <jmp.&user32.CreateDialogParamA> ; \CreateDialogParamA
004010BD |. 6A 01 push 0x1 ; /ShowState = SW_SHOWNORMAL
004010BF |. FF35 0C304000 push dword ptr ds:[0x40300C] ; |hWnd = NULL
004010C5 |. E8 60030000 call <jmp.&user32.ShowWindow> ; \ShowWindow
004010CA |. FF35 0C304000 push dword ptr ds:[0x40300C] ; /hWnd = NULL
004010D0 |. E8 61030000 call <jmp.&user32.UpdateWindow> ; \UpdateWindow
004010D5 |> 6A 00 /push 0x0 ; /MsgFilterMax = 0x0
004010D7 |. 6A 00 |push 0x0 ; |MsgFilterMin = 0x0
004010D9 |. 6A 00 |push 0x0 ; |hWnd = NULL
004010DB |. 8D45 B4 |lea eax,[local.19] ; |
004010DE |. 50 |push eax ; |pMsg = 0019FFCC
004010DF |. E8 10030000 |call <jmp.&user32.GetMessageA> ; \GetMessageA
004010E4 |. 0BC0 |or eax,eax
004010E6 |. 74 14 |je short b2c_2k5.004010FC
004010E8 |. 8D45 B4 |lea eax,[local.19]
004010EB |. 50 |push eax ; /pMsg = MSG(0x7753B360) hw = 19FFE4 wParam = 0x233073D9 lParam = 0x0
004010EC |. E8 3F030000 |call <jmp.&user32.TranslateMessage> ; \TranslateMessage
004010F1 |. 8D45 B4 |lea eax,[local.19]
004010F4 |. 50 |push eax ; /pMsg = MSG(0x7753B360) hw = 19FFE4 wParam = 0x233073D9 lParam = 0x0
004010F5 |. E8 E2020000 |call <jmp.&user32.DispatchMessageA> ; \DispatchMessageA
004010FA |.^ EB D9 \jmp short b2c_2k5.004010D5
004010FC |> 8B45 BC mov eax,[local.17]
004010FF |. C9 leave
00401100 \. C2 1000 retn 0x10
00401103 . 55 push ebp
00401104 . 8BEC mov ebp,esp
00401106 . 8B45 0C mov eax,dword ptr ss:[ebp+0xC]
00401109 . 3D 10010000 cmp eax,0x110 ; Switch (cases F..111)
0040110E . 75 57 jnz short b2c_2k5.00401167
00401110 . FF75 08 push dword ptr ss:[ebp+0x8] ; Case 110 (WM_INITDIALOG) of switch 00401109
00401113 . 8F05 0C304000 pop dword ptr ds:[0x40300C] ; kernel32.75ABFCC9
00401119 . 68 F4010000 push 0x1F4 ; /RsrcName = 500.
0040111E . FF35 04304000 push dword ptr ds:[0x403004] ; |hInst = NULL
00401124 . E8 D7020000 call <jmp.&user32.LoadBitmapA> ; \LoadBitmapA
00401129 . A3 18304000 mov dword ptr ds:[0x403018],eax
0040112E . 68 E9030000 push 0x3E9 ; /ControlID = 3E9 (1001.)
00401133 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 00234000
00401136 . E8 AD020000 call <jmp.&user32.GetDlgItem> ; \GetDlgItem
0040113B . A3 6C304000 mov dword ptr ds:[0x40306C],eax
00401140 . 68 F3030000 push 0x3F3 ; /ControlID = 3F3 (1011.)
00401145 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 00234000
00401148 . E8 9B020000 call <jmp.&user32.GetDlgItem> ; \GetDlgItem
0040114D . A3 00304000 mov dword ptr ds:[0x403000],eax
00401152 . 68 1C304000 push b2c_2k5.0040301C ; /pRect = b2c_2k5.0040301C
00401157 . FF35 6C304000 push dword ptr ds:[0x40306C] ; |hWnd = NULL
0040115D . E8 98020000 call <jmp.&user32.GetWindowRect> ; \GetWindowRect
00401162 . E9 1B010000 jmp b2c_2k5.00401282
00401167 > 3D 11010000 cmp eax,0x111
0040116C . 75 53 jnz short b2c_2k5.004011C1
0040116E . 8B45 10 mov eax,dword ptr ss:[ebp+0x10] ; Case 111 (WM_COMMAND) of switch 00401109
00401171 . 25 FFFF0000 and eax,0xFFFF
00401176 . 3D F2030000 cmp eax,0x3F2 ; Switch (cases 3F0..3F2)
0040117B . 75 1C jnz short b2c_2k5.00401199
0040117D . 68 40100000 push 0x1040 ; /Style = MB_OK|MB_ICONASTERISK|MB_SYSTEMMODAL; Case 3F2 of switch 00401176
00401182 . 68 40224000 push b2c_2k5.00402240 ; |Title = "Keygen Me - b2c_2k5"
00401187 . 68 88204000 push b2c_2k5.00402088 ; |Text = " - Keygen Me -
Find the protection, reverse
code a keygen and write a tute.
PS: A invalid serial may cause
a program error.
"...
0040118C . FF75 08 push dword ptr ss:[ebp+0x8] ; |hOwner = 00234000
0040118F . E8 7E020000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00401194 . E9 E9000000 jmp b2c_2k5.00401282
00401199 > 3D F1030000 cmp eax,0x3F1
0040119E . 75 0C jnz short b2c_2k5.004011AC
004011A0 . 6A 00 push 0x0 ; /ExitCode = 0x0; Case 3F1 of switch 00401176
004011A2 . E8 95020000 call <jmp.&kernel32.ExitProcess> ; \ExitProcess
004011A7 . E9 D6000000 jmp b2c_2k5.00401282
004011AC > 3D F0030000 cmp eax,0x3F0
004011B1 . 0F85 CB000000 jnz b2c_2k5.00401282
004011B7 . E8 CC000000 call b2c_2k5.00401288 ; Case 3F0 of switch 00401176
004011BC . E9 C1000000 jmp b2c_2k5.00401282
004011C1 > 83F8 0F cmp eax,0xF
004011C4 . 0F85 85000000 jnz b2c_2k5.0040124F
004011CA . FF75 14 push dword ptr ss:[ebp+0x14] ; /lParam = 0x0; Case F (WM_PAINT) of switch 00401109
004011CD . FF75 10 push dword ptr ss:[ebp+0x10] ; |wParam = 0x0
004011D0 . FF75 0C push dword ptr ss:[ebp+0xC] ; |Message = MSG(0x547545ED)
004011D3 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 00234000
004011D6 . E8 F5010000 call <jmp.&user32.DefWindowProcA> ; \DefWindowProcA
004011DB . FF75 08 push dword ptr ss:[ebp+0x8] ; /hWnd = 00234000
004011DE . E8 FF010000 call <jmp.&user32.GetDC> ; \GetDC
004011E3 . A3 14304000 mov dword ptr ds:[0x403014],eax
004011E8 . FF35 14304000 push dword ptr ds:[0x403014] ; /hDC = NULL
004011EE . E8 61020000 call <jmp.&gdi32.CreateCompatibleDC> ; \CreateCompatibleDC
004011F3 . A3 10304000 mov dword ptr ds:[0x403010],eax
004011F8 . FF35 18304000 push dword ptr ds:[0x403018] ; /hObject = NULL
004011FE . FF35 10304000 push dword ptr ds:[0x403010] ; |hDC = NULL
00401204 . E8 57020000 call <jmp.&gdi32.SelectObject> ; \SelectObject
00401209 . 68 2000CC00 push 0xCC0020 ; /ROP = SRCCOPY
0040120E . 6A 00 push 0x0 ; |YSrc = 0x0
00401210 . 6A 00 push 0x0 ; |XSrc = 0x0
00401212 . FF35 10304000 push dword ptr ds:[0x403010] ; |hSrcDC = NULL
00401218 . 68 C8000000 push 0xC8 ; |Height = C8 (200.)
0040121D . 68 2C010000 push 0x12C ; |Width = 12C (300.)
00401222 . 6A 0A push 0xA ; |YDest = A (10.)
00401224 . 6A 0D push 0xD ; |XDest = D (13.)
00401226 . FF35 14304000 push dword ptr ds:[0x403014] ; |hDestDC = NULL
0040122C . E8 1D020000 call <jmp.&gdi32.BitBlt> ; \BitBlt
00401231 . FF35 10304000 push dword ptr ds:[0x403010] ; /hDC = NULL
00401237 . E8 1E020000 call <jmp.&gdi32.DeleteDC> ; \DeleteDC
0040123C . FF35 14304000 push dword ptr ds:[0x403014] ; /hDC = NULL
00401242 . FF35 6C304000 push dword ptr ds:[0x40306C] ; |hWnd = NULL
00401248 . E8 D7010000 call <jmp.&user32.ReleaseDC> ; \ReleaseDC
0040124D . EB 33 jmp short b2c_2k5.00401282
0040124F > 83F8 10 cmp eax,0x10
00401252 . 75 0A jnz short b2c_2k5.0040125E
00401254 . FF75 08 push dword ptr ss:[ebp+0x8] ; /hWnd = 00234000; Case 10 (WM_CLOSE) of switch 00401109
00401257 . E8 7A010000 call <jmp.&user32.DestroyWindow> ; \DestroyWindow
0040125C . EB 24 jmp short b2c_2k5.00401282
0040125E > 837D 0C 02 cmp dword ptr ss:[ebp+0xC],0x2 ; Default case of switch 00401109
00401262 . 75 09 jnz short b2c_2k5.0040126D
00401264 . 6A 00 push 0x0 ; /ExitCode = 0x0
00401266 . E8 AD010000 call <jmp.&user32.PostQuitMessage> ; \PostQuitMessage
0040126B . EB 15 jmp short b2c_2k5.00401282
0040126D > FF75 14 push dword ptr ss:[ebp+0x14] ; /lParam = 0x0
00401270 . FF75 10 push dword ptr ss:[ebp+0x10] ; |wParam = 0x0
00401273 . FF75 0C push dword ptr ss:[ebp+0xC] ; |Message = MSG(0x547545ED)
00401276 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 00234000
00401279 . E8 52010000 call <jmp.&user32.DefWindowProcA> ; \DefWindowProcA
0040127E . C9 leave
0040127F . C2 1000 retn 0x10
00401282 > 33C0 xor eax,eax ; Default case of switch 00401176
00401284 . C9 leave
00401285 . C2 1000 retn 0x10
00401288 /$ 55 push ebp
00401289 |. 8BEC mov ebp,esp
0040128B |. 81C4 FCFEFFFF add esp,-0x104
00401291 |. C785 FCFEFFFF>mov [local.65],0x0
0040129B |. 68 80000000 push 0x80 ; /Count = 80 (128.)
004012A0 |. 8D45 80 lea eax,[local.32] ; |
004012A3 |. 50 push eax ; |Buffer = 0019FFCC
004012A4 |. 68 ED030000 push 0x3ED ; |ControlID = 3ED (1005.)
004012A9 |. FF35 0C304000 push dword ptr ds:[0x40300C] ; |hWnd = NULL
004012AF |. E8 3A010000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
004012B4 |. 83F8 05 cmp eax,0x5
004012B7 |. 0F82 C7000000 jb b2c_2k5.00401384
004012BD |. 68 80000000 push 0x80 ; /Count = 80 (128.)
004012C2 |. 8D85 00FFFFFF lea eax,[local.64] ; |
004012C8 |. 50 push eax ; |Buffer = 0019FFCC
004012C9 |. 68 EE030000 push 0x3EE ; |ControlID = 3EE (1006.)
004012CE |. FF35 0C304000 push dword ptr ds:[0x40300C] ; |hWnd = NULL
004012D4 |. E8 15010000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
004012D9 |. 83F8 08 cmp eax,0x8
004012DC |. 0F85 A2000000 jnz b2c_2k5.00401384
004012E2 |. 8D95 00FFFFFF lea edx,[local.64]
004012E8 |. 52 push edx ; b2c_2k5.<ModuleEntryPoint>
004012E9 |. E8 82010000 call b2c_2k5.00401470 ; 获取系列号
004012EE |. 50 push eax
004012EF |. E8 92000000 call b2c_2k5.00401386 ; 系列号转数字
004012F4 |. 83F8 00 cmp eax,0x0
004012F7 |. 0F84 87000000 je b2c_2k5.00401384
004012FD |. 33D2 xor edx,edx ; b2c_2k5.<ModuleEntryPoint>
004012FF |. 35 33644752 xor eax,0x52476433
00401304 |. 35 56244752 xor eax,0x52472456
00401309 |. 2D 00000004 sub eax,0x4000000
0040130E |. BB 01000000 mov ebx,0x1
00401313 |. C1C3 10 rol ebx,0x10
00401316 |. 8D75 80 lea esi,[local.32]
00401319 |> 803E 00 /cmp byte ptr ds:[esi],0x0
0040131C |. 74 0D |je short b2c_2k5.0040132B
0040131E |. 0FB616 |movzx edx,byte ptr ds:[esi]
00401321 |. C1C2 10 |rol edx,0x10
00401324 |. 03C2 |add eax,edx ; b2c_2k5.<ModuleEntryPoint>
00401326 |. 2BC3 |sub eax,ebx
00401328 |. 46 |inc esi ; b2c_2k5.<ModuleEntryPoint>
00401329 |.^ EB EE \jmp short b2c_2k5.00401319
0040132B |> 8BD8 mov ebx,eax
0040132D |. C1CB 10 ror ebx,0x10
00401330 |. 66:81FB 90C3 cmp bx,0xC390
00401335 |. 75 4D jnz short b2c_2k5.00401384
00401337 |. 8985 FCFEFFFF mov [local.65],eax
0040133D |. B9 04000000 mov ecx,0x4
00401342 |. 33D2 xor edx,edx ; b2c_2k5.<ModuleEntryPoint>
00401344 |. 33DB xor ebx,ebx
00401346 |> 83F9 00 /cmp ecx,0x0
00401349 |. 74 0A |je short b2c_2k5.00401355
0040134B |. 8AD8 |mov bl,al
0040134D |. 03D3 |add edx,ebx
0040134F |. C1C8 08 |ror eax,0x8
00401352 |. 49 |dec ecx ; b2c_2k5.<ModuleEntryPoint>
00401353 |.^ EB F1 \jmp short b2c_2k5.00401346
00401355 |> 81FA 85020000 cmp edx,0x285
0040135B |. 75 27 jnz short b2c_2k5.00401384
0040135D |. 8D9D FCFEFFFF lea ebx,[local.65]
00401363 |. FFD3 call ebx
00401365 |. 83FF 00 cmp edi,0x0
00401368 |. 75 1A jnz short b2c_2k5.00401384
0040136A |. 68 40100000 push 0x1040 ; /Style = MB_OK|MB_ICONASTERISK|MB_SYSTEMMODAL
0040136F |. 68 40224000 push b2c_2k5.00402240 ; |Title = "Keygen Me - b2c_2k5"
00401374 |. 68 54224000 push b2c_2k5.00402254 ; |Text = "Congrats u did it :)
Now code me a keygen and write a tut as always.
Post the tute on crackmes.de :) c ya
"
00401379 |. FF35 0C304000 push dword ptr ds:[0x40300C] ; |hOwner = NULL
0040137F |. E8 8E000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00401384 |> C9 leave
00401385 \. C3 retn
00401386 /$ 55 push ebp
00401387 |. 8BEC mov ebp,esp
00401389 |. 53 push ebx
0040138A |. 52 push edx ; b2c_2k5.<ModuleEntryPoint>
0040138B |. 8B45 08 mov eax,[arg.1]
0040138E |. 33DB xor ebx,ebx
00401390 |. 33D2 xor edx,edx ; b2c_2k5.<ModuleEntryPoint>
00401392 |> 8038 00 /cmp byte ptr ds:[eax],0x0
00401395 |. 74 2B |je short b2c_2k5.004013C2
00401397 |. 0FB618 |movzx ebx,byte ptr ds:[eax]
0040139A |. 83FB 30 |cmp ebx,0x30
0040139D |. 72 1F |jb short b2c_2k5.004013BE
0040139F |. 83FB 46 |cmp ebx,0x46
004013A2 |. 7F 1A |jg short b2c_2k5.004013BE
004013A4 |. 83FB 39 |cmp ebx,0x39
004013A7 |. 7F 05 |jg short b2c_2k5.004013AE
004013A9 |. 83EB 30 |sub ebx,0x30
004013AC |. EB 08 |jmp short b2c_2k5.004013B6
004013AE |> 83FB 41 |cmp ebx,0x41
004013B1 |. 72 0B |jb short b2c_2k5.004013BE
004013B3 |. 83EB 37 |sub ebx,0x37
004013B6 |> C1C2 04 |rol edx,0x4
004013B9 |. 03D3 |add edx,ebx
004013BB |. 40 |inc eax
004013BC |.^ EB D4 \jmp short b2c_2k5.00401392
004013BE |> 33C0 xor eax,eax
004013C0 |. EB 02 jmp short b2c_2k5.004013C4
004013C2 |> 8BC2 mov eax,edx ; b2c_2k5.<ModuleEntryPoint>
004013C4 |> 5A pop edx ; kernel32.75ABFCC9
004013C5 |. 5B pop ebx ; kernel32.75ABFCC9
004013C6 |. C9 leave
004013C7 \. C2 0400 retn 0x4
004013CA $- FF25 6C204000 jmp dword ptr ds:[<&user32.CreateDialogP>; user32.CreateDialogParamA
004013D0 $- FF25 70204000 jmp dword ptr ds:[<&user32.DefWindowProc>; ntdll.NtdllDefWindowProc_A
004013D6 $- FF25 68204000 jmp dword ptr ds:[<&user32.DestroyWindow>; apphelp.752C7710
004013DC $- FF25 64204000 jmp dword ptr ds:[<&user32.DispatchMessa>; user32.DispatchMessageA
004013E2 $- FF25 60204000 jmp dword ptr ds:[<&user32.GetDC>] ; apphelp.752BB0B0
004013E8 $- FF25 58204000 jmp dword ptr ds:[<&user32.GetDlgItem>] ; user32.GetDlgItem
004013EE $- FF25 5C204000 jmp dword ptr ds:[<&user32.GetDlgItemTex>; user32.GetDlgItemTextA
004013F4 $- FF25 54204000 jmp dword ptr ds:[<&user32.GetMessageA>] ; user32.GetMessageA
004013FA $- FF25 50204000 jmp dword ptr ds:[<&user32.GetWindowRect>; user32.GetWindowRect
00401400 $- FF25 3C204000 jmp dword ptr ds:[<&user32.LoadBitmapA>] ; user32.LoadBitmapA
00401406 $- FF25 2C204000 jmp dword ptr ds:[<&user32.LoadCursorA>] ; user32.LoadCursorA
0040140C $- FF25 30204000 jmp dword ptr ds:[<&user32.LoadIconA>] ; user32.LoadIconA
00401412 $- FF25 34204000 jmp dword ptr ds:[<&user32.MessageBoxA>] ; user32.MessageBoxA
00401418 $- FF25 38204000 jmp dword ptr ds:[<&user32.PostQuitMessa>; user32.PostQuitMessage
0040141E $- FF25 74204000 jmp dword ptr ds:[<&user32.RegisterClass>; user32.RegisterClassExA
00401424 $- FF25 40204000 jmp dword ptr ds:[<&user32.ReleaseDC>] ; apphelp.752BAFC0
0040142A $- FF25 44204000 jmp dword ptr ds:[<&user32.ShowWindow>] ; user32.ShowWindow
00401430 $- FF25 48204000 jmp dword ptr ds:[<&user32.TranslateMess>; user32.TranslateMessage
00401436 $- FF25 4C204000 jmp dword ptr ds:[<&user32.UpdateWindow>>; user32.UpdateWindow
0040143C .- FF25 20204000 jmp dword ptr ds:[<&kernel32.ExitProcess>; kernel32.ExitProcess
00401442 $- FF25 1C204000 jmp dword ptr ds:[<&kernel32.GetCommandL>; kernel32.GetCommandLineA
00401448 $- FF25 24204000 jmp dword ptr ds:[<&kernel32.GetModuleHa>; kernel32.GetModuleHandleA
0040144E $- FF25 10204000 jmp dword ptr ds:[<&gdi32.BitBlt>] ; apphelp.752C5CC0
00401454 $- FF25 0C204000 jmp dword ptr ds:[<&gdi32.CreateCompatib>; apphelp.752C5BC0
0040145A $- FF25 08204000 jmp dword ptr ds:[<&gdi32.DeleteDC>] ; gdi32.DeleteDC
00401460 $- FF25 14204000 jmp dword ptr ds:[<&gdi32.SelectObject>] ; gdi32.SelectObject
00401466 $- FF25 00204000 jmp dword ptr ds:[<&comctl32.InitCommonC>; comctl32.InitCommonControls
0040146C CC int3
0040146D CC int3
0040146E CC int3
0040146F CC int3
00401470 /$ 55 push ebp
00401471 |. 8BEC mov ebp,esp
00401473 |. 8B45 08 mov eax,[arg.1]
00401476 |. 48 dec eax
00401477 |> 83C0 01 /add eax,0x1
0040147A |. 8038 00 |cmp byte ptr ds:[eax],0x0
0040147D |. 74 0F |je short b2c_2k5.0040148E
0040147F |. 8038 61 |cmp byte ptr ds:[eax],0x61
00401482 |.^ 72 F3 |jb short b2c_2k5.00401477
00401484 |. 8038 7A |cmp byte ptr ds:[eax],0x7A
00401487 |.^ 77 EE |ja short b2c_2k5.00401477
00401489 |. 8028 20 |sub byte ptr ds:[eax],0x20
0040148C |.^ EB E9 \jmp short b2c_2k5.00401477
0040148E |> 8B45 08 mov eax,[arg.1]
00401491 |. C9 leave
00401492 \. C2 0400 retn 0x4
00401495 00 db 00
00401496 00 db 00
最后面就看到了成功提示关键词00401374, 所以上面一点就是关键算法了
用户名5位以上,系列号8位以上, 单步分析算法可得:
eax = code ^ 0x4065
eax -= 0x4000000
ebx = 1 << 0x10
for(i=0; i<len; i++){
eax += (user[i] << 0x10) - ebx
}
ebx = eax >>> 0x10;
ebx & 0xFFFF == 0xC390;
edx = eax[0] + eax[1] + eax[2] + eax[3];
edx == 0x285;
从上面代码看可以得知: eax的前4位为用户名总和为0xC390, 后4位为系列号后4位, 每2位的值加起来是0x285
已知: eax[2] + eax[3] = C3 + 90, 所以: eax[0] + eax[1] = 0x132 = 0x55 + 0xDD (55是一个寄存器的命令,优先想到这个值)
设用户名为: zzzzz => (user[i] << 0x10) - ebx = 0x25D0000,
那code = (0xC39055DD - 0x25D0000 + 0x4000000) ^ 0x52476433 ^ 0x52472456 = 0xC53355DD
将zzzzz 与 C53355DD 输入程序验证, 程序顺利来到00401363 call ebx这行, 按enter进入方法可以看到:
0019F9AC 55 push ebp
0019F9AD 55 push ebp
0019F9AE 90 nop
0019F9AF C3 retn
这4行代码对应的值就是eax的值,最后C3是返回,程序 下一行是判断 edi是否为0, 但当前edi值不为0, 就将会跳转到失败, 所以这4行里必须实现edi=0的操作
各种尝试后,只有这种情况是符合条件的, 就是:
0019F9AC 33FF xor edi,edi
0019F9AE 90 nop
0019F9AF C3 retn
也刚好值是4位数, 也实现了edi=0的操作, 0x33 + 0xFF = 0x132也是刚好的
所以最终eax的值得为: C390FF33
所以又可得code的后4位必须为0xFF33 ^ 0x4065 = 0xBF56
输入zzzzz和C533BF56 顺利看到了成功提示框
注册机:
#include <stdio.h>
#include <string.h>
int main() {
int i, len, sum = 0xC390;
char user[30] = {0};
printf("用户名: "); scanf("%s", user); getchar();
len = strlen(user);
for(i=0; i<len; i++){
sum -= user[i] - 1;
}
sum += 0x400;
printf("系列号: %04XBF56\n", sum);
getchar();
return 0;
}
运行示例:
用户名: b2c_2k5
系列号: C56FBF56
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号