新CrackMe160之152 - bad_sector - CrackMe#1
汇编程序,直接看源码:
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 42020000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 10244000 mov dword ptr ds:[0x402410],eax
0040100C |. 6A 00 push 0x0 ; /lParam = NULL
0040100E |. 68 29104000 push Crackme1.00401029 ; |DlgProc = Crackme1.00401029
00401013 |. 6A 00 push 0x0 ; |hOwner = NULL
00401015 |. 6A 64 push 0x64 ; |pTemplate = 0x64
00401017 |. FF35 10244000 push dword ptr ds:[0x402410] ; |hInst = NULL
0040101D |. E8 FD010000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401022 |. 6A 00 push 0x0 ; /ExitCode = 0x0
00401024 \. E8 26020000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
00401029 /. C8 000000 enter 0x0,0x0
0040102D |. 53 push ebx
0040102E |. 57 push edi ; Crackme1.<ModuleEntryPoint>
0040102F |. 56 push esi ; Crackme1.<ModuleEntryPoint>
00401030 |. 817D 0C 10010>cmp [arg.2],0x110
00401037 |. 74 25 je short Crackme1.0040105E
00401039 |. 817D 0C 11010>cmp [arg.2],0x111
00401040 |. 74 43 je short Crackme1.00401085
00401042 |. 837D 0C 10 cmp [arg.2],0x10
00401046 |. 74 0F je short Crackme1.00401057
00401048 |. 837D 0C 02 cmp [arg.2],0x2
0040104C |. 74 09 je short Crackme1.00401057
0040104E |. 33C0 xor eax,eax
00401050 |> 5E pop esi ; kernel32.75ABFCC9
00401051 |. 5F pop edi ; kernel32.75ABFCC9
00401052 |. 5B pop ebx ; kernel32.75ABFCC9
00401053 |. C9 leave
00401054 |. C2 1000 retn 0x10
00401057 |> 6A 00 push 0x0 ; /ExitCode = 0x0
00401059 |. E8 F1010000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
0040105E |> 68 E8030000 push 0x3E8 ; /RsrcName = 1000.
00401063 |. FF35 10244000 push dword ptr ds:[0x402410] ; |hInst = NULL
00401069 |. E8 C3010000 call <jmp.&USER32.LoadIconA> ; \LoadIconA
0040106E |. A3 14244000 mov dword ptr ds:[0x402414],eax
00401073 |. 50 push eax ; /lParam = 0x19FFCC
00401074 |. 6A 01 push 0x1 ; |wParam = 0x1
00401076 |. 68 80000000 push 0x80 ; |Message = WM_SETICON
0040107B |. FF75 08 push [arg.1] ; |hWnd = 0x23B000
0040107E |. E8 BA010000 call <jmp.&USER32.SendMessageA> ; \SendMessageA
00401083 |.^ EB CB jmp short Crackme1.00401050
00401085 |> 817D 10 2E010>cmp [arg.3],0x12E
0040108C |. 75 02 jnz short Crackme1.00401090
0040108E |.^ EB C7 jmp short Crackme1.00401057
00401090 |> 817D 10 2D010>cmp [arg.3],0x12D
00401097 |. 75 05 jnz short Crackme1.0040109E
00401099 |. E8 12000000 call Crackme1.004010B0
0040109E |> 817D 10 2C010>cmp [arg.3],0x12C
004010A5 |. 75 05 jnz short Crackme1.004010AC
004010A7 |. E8 8D000000 call Crackme1.00401139
004010AC |> 33C0 xor eax,eax
004010AE \.^ EB A0 jmp short Crackme1.00401050
004010B0 /$ 6A 00 push 0x0 ; /lParam = NULL
004010B2 |. 68 CB104000 push Crackme1.004010CB ; |DlgProc = Crackme1.004010CB
004010B7 |. FF75 08 push [arg.1] ; |hOwner = 0023B000
004010BA |. 68 90010000 push 0x190 ; |pTemplate = 0x190
004010BF |. FF35 10244000 push dword ptr ds:[0x402410] ; |hInst = NULL
004010C5 |. E8 55010000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
004010CA \. C3 retn
004010CB /. C8 000000 enter 0x0,0x0
004010CF |. 817D 0C 10010>cmp [arg.2],0x110
004010D6 |. 74 29 je short Crackme1.00401101
004010D8 |. 817D 0C 11010>cmp [arg.2],0x111
004010DF |. 74 49 je short Crackme1.0040112A
004010E1 |. 837D 0C 10 cmp [arg.2],0x10
004010E5 |. 74 0C je short Crackme1.004010F3
004010E7 |. 837D 0C 02 cmp [arg.2],0x2
004010EB |. 74 06 je short Crackme1.004010F3
004010ED |. 33C0 xor eax,eax
004010EF |> C9 leave
004010F0 |. C2 1000 retn 0x10
004010F3 |> 6A 00 push 0x0 ; /Result = 0x0
004010F5 |. FF75 08 push [arg.1] ; |hWnd = 0023B000
004010F8 |. E8 28010000 call <jmp.&USER32.EndDialog> ; \EndDialog
004010FD |. C9 leave
004010FE |. C2 1000 retn 0x10
00401101 |> FF35 14244000 push dword ptr ds:[0x402414] ; /lParam = 0x0
00401107 |. 6A 01 push 0x1 ; |wParam = 0x1
00401109 |. 68 80000000 push 0x80 ; |Message = WM_SETICON
0040110E |. FF75 08 push [arg.1] ; |hWnd = 0x23B000
00401111 |. E8 27010000 call <jmp.&USER32.SendMessageA> ; \SendMessageA
00401116 |. 68 00204000 push Crackme1.00402000 ; /Text = "As this is my first CrackMe it's very easy and should be no problem for anyone to keygen it. Send your comments (not solutions - too easy :)) ) to bsector@iname.com
Compiled 1.12.2003 with TASM 5"
0040111B |. 68 92010000 push 0x192 ; |ControlID = 192 (402.)
00401120 |. FF75 08 push [arg.1] ; |hWnd = 0023B000
00401123 |. E8 1B010000 call <jmp.&USER32.SetDlgItemTextA> ; \SetDlgItemTextA
00401128 |.^ EB C5 jmp short Crackme1.004010EF
0040112A |> 817D 10 91010>cmp [arg.3],0x191
00401131 |. 75 02 jnz short Crackme1.00401135
00401133 |.^ EB BE jmp short Crackme1.004010F3
00401135 |> 33C0 xor eax,eax
00401137 \.^ EB B6 jmp short Crackme1.004010EF
00401139 $ 6A 32 push 0x32 ; /Count = 32 (50.)
0040113B . 68 F3204000 push Crackme1.004020F3 ; |Buffer = Crackme1.004020F3
00401140 . 68 C8000000 push 0xC8 ; |ControlID = C8 (200.)
00401145 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 0023B000
00401148 . E8 DE000000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
0040114D . 83F8 00 cmp eax,0x0
00401150 . 0F84 99000000 je Crackme1.004011EF
00401156 . 83F8 04 cmp eax,0x4
00401159 . 0F82 90000000 jb Crackme1.004011EF
0040115F . 33C9 xor ecx,ecx ; Crackme1.<ModuleEntryPoint>
00401161 . 33DB xor ebx,ebx
00401163 . 33F6 xor esi,esi ; Crackme1.<ModuleEntryPoint>
00401165 . 8945 FC mov dword ptr ss:[ebp-0x4],eax
00401168 > 0FBE81 F32040>movsx eax,byte ptr ds:[ecx+0x4020F3]
0040116F . 83F8 20 cmp eax,0x20
00401172 . 74 07 je short Crackme1.0040117B
00401174 . 6BC0 04 imul eax,eax,0x4
00401177 . 03D8 add ebx,eax
00401179 . 8BF3 mov esi,ebx
0040117B > 41 inc ecx ; Crackme1.<ModuleEntryPoint>
0040117C . 3B4D FC cmp ecx,dword ptr ss:[ebp-0x4] ; kernel32.BaseThreadInitThunk
0040117F .^ 75 E7 jnz short Crackme1.00401168
00401181 . 83FE 00 cmp esi,0x0
00401184 . 74 69 je short Crackme1.004011EF
00401186 . BB 89476500 mov ebx,0x654789
0040118B > 0FBE81 F22040>movsx eax,byte ptr ds:[ecx+0x4020F2]
00401192 . 4B dec ebx
00401193 . 6BC3 02 imul eax,ebx,0x2
00401196 . 03D8 add ebx,eax
00401198 . 4B dec ebx
00401199 . 49 dec ecx ; Crackme1.<ModuleEntryPoint>
0040119A .^ 75 EF jnz short Crackme1.0040118B
0040119C . 56 push esi ; /<%lu> = 401000 (4198400.)
0040119D . 53 push ebx ; |<%lX> = 0x23B000
0040119E . 68 C7204000 push Crackme1.004020C7 ; |Format = "BS-%lX-%lu"
004011A3 . 68 BB214000 push Crackme1.004021BB ; |s = Crackme1.004021BB
004011A8 . E8 6C000000 call <jmp.&USER32.wsprintfA> ; \wsprintfA
004011AD . 58 pop eax ; kernel32.75ABFCC9
004011AE . 58 pop eax ; kernel32.75ABFCC9
004011AF . 58 pop eax ; kernel32.75ABFCC9
004011B0 . 58 pop eax ; kernel32.75ABFCC9
004011B1 . E8 01000000 call Crackme1.004011B7
004011B6 . C3 retn
004011B7 $ 33C9 xor ecx,ecx ; Crackme1.<ModuleEntryPoint>
004011B9 . 6A 32 push 0x32 ; /Count = 32 (50.)
004011BB . 68 57214000 push Crackme1.00402157 ; |Buffer = Crackme1.00402157
004011C0 . 68 C9000000 push 0xC9 ; |ControlID = C9 (201.)
004011C5 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 0023B000
004011C8 . E8 5E000000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
004011CD . 83F8 00 cmp eax,0x0
004011D0 . 74 1D je short Crackme1.004011EF
004011D2 . 33C9 xor ecx,ecx ; Crackme1.<ModuleEntryPoint>
004011D4 > 0FBE81 572140>movsx eax,byte ptr ds:[ecx+0x402157]
004011DB . 0FBE99 BB2140>movsx ebx,byte ptr ds:[ecx+0x4021BB]
004011E2 . 3BC3 cmp eax,ebx
004011E4 . 75 09 jnz short Crackme1.004011EF
004011E6 . 83F8 00 cmp eax,0x0
004011E9 . 74 19 je short Crackme1.00401204
004011EB . 41 inc ecx ; Crackme1.<ModuleEntryPoint>
004011EC .^ EB E6 jmp short Crackme1.004011D4
004011EE . C3 retn
004011EF > 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
004011F1 . 68 E4204000 push Crackme1.004020E4 ; |Title = "Nope"
004011F6 . 68 E9204000 push Crackme1.004020E9 ; |Text = "Try again"
004011FB . FF75 08 push dword ptr ss:[ebp+0x8] ; |hOwner = 0023B000
004011FE . E8 34000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401203 . C3 retn
00401204 > 6A 40 push 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
00401206 . 68 D2204000 push Crackme1.004020D2 ; |Title = "Solved"
0040120B . 68 D9204000 push Crackme1.004020D9 ; |Text = "Well done."
00401210 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hOwner = 0023B000
00401213 . E8 1F000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401218 . C3 retn
00401219 $- FF25 6C304000 jmp dword ptr ds:[<&USER32.wsprintfA>] ; user32.wsprintfA
0040121F $- FF25 70304000 jmp dword ptr ds:[<&USER32.DialogBoxPara>; user32.DialogBoxParamA
00401225 $- FF25 74304000 jmp dword ptr ds:[<&USER32.EndDialog>] ; user32.EndDialog
0040122B $- FF25 78304000 jmp dword ptr ds:[<&USER32.GetDlgItemTex>; user32.GetDlgItemTextA
00401231 $- FF25 7C304000 jmp dword ptr ds:[<&USER32.LoadIconA>] ; user32.LoadIconA
00401237 $- FF25 80304000 jmp dword ptr ds:[<&USER32.MessageBoxA>] ; user32.MessageBoxA
0040123D $- FF25 84304000 jmp dword ptr ds:[<&USER32.SendMessageA>>; user32.SendMessageA
00401243 $- FF25 88304000 jmp dword ptr ds:[<&USER32.SetDlgItemTex>; user32.SetDlgItemTextA
00401249 $- FF25 90304000 jmp dword ptr ds:[<&KERNEL32.GetModuleHa>; kernel32.GetModuleHandleA
0040124F .- FF25 94304000 jmp dword ptr ds:[<&KERNEL32.ExitProcess>; kernel32.ExitProcess
00401255 00 db 00
00401256 00 db 00
100多行直接看一遍就可以知道算法在哪里了, 00401168 ~ 0040119A 得到两个数ebx, esi再与"BS"用"-"连起来
直接看注册机:
#include <stdio.h>
#include <string.h>
int main() {
int i, len, ebx = 0x654789, esi = 0;
char user[30] = {0};
printf("用户名: "); scanf("%s", user); getchar();
len = strlen(user);
for(i=0; i<len; i++){
ebx = (ebx - 1) * 3 - 1;
if(user[i] == 0x20) continue;
esi += user[i] * 4;
}
printf("系列号: BS-%X-%d\n", ebx, esi);
getchar();
return 0;
}
运行示例:
用户名: Crackme1
系列号: BS-23AE2AE9-2972
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号