新CrackMe160之158 - salazan - keygenme#0001
delphi的程序,直接使用IDR可看按键事件源码:
Unit1::TForm1.Button1Click
00456178 push ebp
00456179 mov ebp,esp
0045617B push 0
0045617D push 0
0045617F push 0
00456181 push ebx
00456182 mov ebx,eax
00456184 xor eax,eax
00456186 push ebp
00456187 push 456242
0045618C push dword ptr fs:[eax]
0045618F mov dword ptr fs:[eax],esp
00456192 lea edx,[ebp-4]
00456195 mov eax,dword ptr [ebx+2F8]; TForm1.Edit1:TEdit
0045619B call TControl.GetText
004561A0 mov eax,dword ptr [ebp-4]
004561A3 call @LStrLen
004561A8 cmp eax,3
>004561AB jl 004561C8
004561AD lea edx,[ebp-8]
004561B0 mov eax,dword ptr [ebx+2FC]; TForm1.Edit2:TEdit
004561B6 call TControl.GetText
004561BB mov eax,dword ptr [ebp-8]
004561BE call @LStrLen
004561C3 cmp eax,3
>004561C6 jge 004561D4
004561C8 mov eax,456258; 'Min. 3 char in name/serial!'
004561CD call ShowMessage
>004561D2 jmp 00456227
004561D4 lea edx,[ebp-0C]
004561D7 mov eax,dword ptr [ebx+2FC]; TForm1.Edit2:TEdit
004561DD call TControl.GetText
004561E2 mov eax,dword ptr [ebp-0C]
004561E5 call 00455D18 ;这里是关键算法, 入参是系列号(难道跟用户名没关系?)
004561EA test al,al
>004561EC je 0045620D
004561EE mov eax,dword ptr [ebx+300]; TForm1.sb1:TStatusBar
004561F4 mov eax,dword ptr [eax+208]; TStatusBar.?f208:dword
004561FA xor edx,edx
004561FC call TStatusPanels.GetItem
00456201 mov edx,45627C; 'Congr! You are real cracker!'
00456206 call TStatusPanel.SetText
>0045620B jmp 00456227
0045620D mov eax,dword ptr [ebx+300]; TForm1.sb1:TStatusBar
00456213 mov eax,dword ptr [eax+208]; TStatusBar.?f208:dword
00456219 xor edx,edx
0045621B call TStatusPanels.GetItem
00456220 xor edx,edx
00456222 call TStatusPanel.SetText
00456227 xor eax,eax
00456229 pop edx
0045622A pop ecx
0045622B pop ecx
0045622C mov dword ptr fs:[eax],edx
0045622F push 456249
00456234 lea eax,[ebp-0C]
00456237 mov edx,3
0045623C call @LStrArrayClr
00456241 ret
<00456242 jmp @HandleFinally
<00456247 jmp 00456234
00456249 pop ebx
0045624A mov esp,ebp
0045624C pop ebp
0045624D ret
从上面代码可以看到,程序只有一个关键Call,004561E5, IDR中双击进入这个方法
_Unit55::sub_00455D18
00455D18 push ebp
00455D19 mov ebp,esp
00455D1B mov ecx,4
00455D20 push 0
00455D22 push 0
00455D24 dec ecx
<00455D25 jne 00455D20
00455D27 push ecx
00455D28 push ebx
00455D29 mov dword ptr [ebp-4],eax
00455D2C mov eax,dword ptr [ebp-4]
00455D2F call @LStrAddRef
00455D34 xor eax,eax
00455D36 push ebp
00455D37 push 455EE0
00455D3C push dword ptr fs:[eax]
00455D3F mov dword ptr fs:[eax],esp
00455D42 mov byte ptr [ebp-5],0
00455D46 xor ebx,ebx
00455D48 mov eax,dword ptr [ebp-4]
00455D4B call @LStrLen
00455D50 cmp eax,1D ;长度不等于29就失败
>00455D53 jne 00455EBD
00455D59 lea eax,[ebp-0C]
00455D5C push eax
00455D5D mov ecx,5
00455D62 xor edx,edx
00455D64 mov eax,dword ptr [ebp-4]
00455D67 call @LStrCopy ;str1 = code.substr(0,5)
00455D6C lea eax,[ebp-10]
00455D6F push eax
00455D70 mov ecx,5
00455D75 mov edx,7
00455D7A mov eax,dword ptr [ebp-4]
00455D7D call @LStrCopy ;str2 = code.substr(7,5)
00455D82 lea eax,[ebp-14]
00455D85 push eax
00455D86 mov ecx,5
00455D8B mov edx,0D
00455D90 mov eax,dword ptr [ebp-4]
00455D93 call @LStrCopy ;str3 = code.substr(13,5)
00455D98 lea eax,[ebp-18]
00455D9B push eax
00455D9C mov ecx,5
00455DA1 mov edx,13
00455DA6 mov eax,dword ptr [ebp-4]
00455DA9 call @LStrCopy ;str4 = code.substr(19,5)
00455DAE lea eax,[ebp-1C]
00455DB1 push eax
00455DB2 mov ecx,5
00455DB7 mov edx,19
00455DBC mov eax,dword ptr [ebp-4]
00455DBF call @LStrCopy ;str5 = code.substr(25,5)
00455DC4 mov eax,dword ptr [ebp-0C] ;str1
00455DC7 call @LStrLen
00455DCC test eax,eax
>00455DCE jl 00455DE1
00455DD0 inc eax
00455DD1 xor edx,edx
00455DD3 mov ecx,dword ptr [ebp-0C] ;循环累加str1
00455DD6 movzx ecx,byte ptr [ecx+edx-1]
00455DDB add ebx,ecx
00455DDD inc edx
00455DDE dec eax
<00455DDF jne 00455DD3
00455DE1 cmp ebx,18D ;累加值是否为0x18D
>00455DE7 jne 00455DED
00455DE9 mov byte ptr [ebp-1D],1
00455DED xor ebx,ebx
00455DEF mov eax,dword ptr [ebp-10]
00455DF2 call @LStrLen
00455DF7 test eax,eax
>00455DF9 jl 00455E0C
00455DFB inc eax
00455DFC xor edx,edx
00455DFE mov ecx,dword ptr [ebp-10] ;循环累加str2
00455E01 movzx ecx,byte ptr [ecx+edx-1]
00455E06 add ebx,ecx
00455E08 inc edx
00455E09 dec eax
<00455E0A jne 00455DFE
00455E0C cmp ebx,18C ;累加值是否为0x18C
>00455E12 jne 00455E18
00455E14 mov byte ptr [ebp-1E],1
00455E18 xor ebx,ebx
00455E1A mov eax,dword ptr [ebp-14]
00455E1D call @LStrLen
00455E22 test eax,eax
>00455E24 jl 00455E37
00455E26 inc eax
00455E27 xor edx,edx
00455E29 mov ecx,dword ptr [ebp-14] ;循环累加str3
00455E2C movzx ecx,byte ptr [ecx+edx-1]
00455E31 add ebx,ecx
00455E33 inc edx
00455E34 dec eax
<00455E35 jne 00455E29
00455E37 cmp ebx,190 ;累加值是否为0x190
>00455E3D jne 00455E43
00455E3F mov byte ptr [ebp-1F],1
00455E43 xor ebx,ebx
00455E45 mov eax,dword ptr [ebp-18]
00455E48 call @LStrLen
00455E4D test eax,eax
>00455E4F jl 00455E62
00455E51 inc eax
00455E52 xor edx,edx
00455E54 mov ecx,dword ptr [ebp-18] ;循环累加str4
00455E57 movzx ecx,byte ptr [ecx+edx-1]
00455E5C add ebx,ecx
00455E5E inc edx
00455E5F dec eax
<00455E60 jne 00455E54
00455E62 cmp ebx,188 ;累加值是否为0x188
>00455E68 jne 00455E6E
00455E6A mov byte ptr [ebp-20],1
00455E6E xor ebx,ebx
00455E70 mov eax,dword ptr [ebp-1C]
00455E73 call @LStrLen
00455E78 test eax,eax
>00455E7A jl 00455E8D
00455E7C inc eax
00455E7D xor edx,edx
00455E7F mov ecx,dword ptr [ebp-1C] ;循环累加str5
00455E82 movzx ecx,byte ptr [ecx+edx-1]
00455E87 add ebx,ecx
00455E89 inc edx
00455E8A dec eax
<00455E8B jne 00455E7F
00455E8D cmp ebx,186 ;累加值是否为0x186
>00455E93 jne 00455E99
00455E95 mov byte ptr [ebp-21],1
00455E99 mov al,byte ptr [ebp-1D]
00455E9C and al,byte ptr [ebp-1E]
>00455E9F je 00455EB9
00455EA1 cmp byte ptr [ebp-1F],0
>00455EA5 je 00455EB9
00455EA7 cmp byte ptr [ebp-20],0
>00455EAB je 00455EB9
00455EAD cmp byte ptr [ebp-21],0
>00455EB1 je 00455EB9
00455EB3 mov byte ptr [ebp-5],1 ;到这里才成功,所以上面5个都要为1
>00455EB7 jmp 00455EBD
00455EB9 mov byte ptr [ebp-5],0
00455EBD xor eax,eax
00455EBF pop edx
00455EC0 pop ecx
00455EC1 pop ecx
00455EC2 mov dword ptr fs:[eax],edx
00455EC5 push 455EE7
00455ECA lea eax,[ebp-1C]
00455ECD mov edx,5
00455ED2 call @LStrArrayClr
00455ED7 lea eax,[ebp-4]
00455EDA call @LStrClr
00455EDF ret
<00455EE0 jmp @HandleFinally
<00455EE5 jmp 00455ECA
00455EE7 mov al,byte ptr [ebp-5]
00455EEA pop ebx
00455EEB mov esp,ebp
00455EED pop ebp
00455EEE ret
上面分析可得:
sum(1~5) = 0x18D = "OOOOQ"
sum(7~11) = 0x18C = "OOOOP"
sum(13~17) = 0x190 = "OOOOT"
sum(19~23) = 0x188 = "NNNNP"
sum(25~29) = 0x186 = "NNNNN"
即: OOOOQ-OOOOP-OOOOT-NNNNP-NNNNN
输入验证:
用户名: abc (3位以上任意)
系列号: OOOOQ-OOOOP-OOOOT-NNNNP-NNNNN (可随机生成,其中-号可任意符号)
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号