-
-
[原创]小菜对一crackme的简单算法分析和注册码...牛人过
-
发表于: 2010-4-26 05:20
-
差不多一晚上..解决的一个注册http://bbs.pediy.com/showthread.php?t=111376;
以前喜欢爆破..第一次自己分析,写注册码,感觉不一样,哈哈,好好加油..
希望和大家一起努力.- =..写这,主要是提高自己自信
0040115F |. F2:AE repne scas byte ptr es:[edi]
00401161 |. F7D1 not ecx
00401163 |. 49 dec ecx
00401164 |. 85ED test ebp, ebp
00401166 |. 8BF9 mov edi, ecx
00401168 |. 7E 47 jle short 004011B1 ; 这里对Name,变换
0040116A |> 0FBE041E /movsx eax, byte ptr [esi+ebx]
0040116E |. C1F8 06 |sar eax, 6 ; eax/64;
00401171 |. 6A 00 |push 0
00401173 |. 50 |push eax
00401174 |. E8 B7000000 |call 00401230
00401179 |. 8A0C1E |mov cl, byte ptr [esi+ebx]
0040117C |. 6A 00 |push 0
0040117E |. C1F9 04 |sar ecx, 4 ; eax/16
00401181 |. 83E1 03 |and ecx, 3 ; (eax/16)%4
00401184 |. 51 |push ecx
00401185 |. E8 A6000000 |call 00401230
0040118A |. 8A141E |mov dl, byte ptr [esi+ebx]
0040118D |. 6A 00 |push 0
0040118F |. C1FA 02 |sar edx, 2 ; (eax/4)%4
00401192 |. 83E2 03 |and edx, 3
00401195 |. 52 |push edx
00401196 |. E8 95000000 |call 00401230
0040119B |. 8A041E |mov al, byte ptr [esi+ebx]
0040119E |. 6A 00 |push 0
004011A0 |. 83E0 03 |and eax, 3 ; eax%4
004011A3 |. 50 |push eax
004011A4 |. E8 87000000 |call 00401230
004011A9 |. 83C4 20 |add esp, 20
004011AC |. 46 |inc esi
004011AD |. 3BF5 |cmp esi, ebp
004011AF |.^ 7C B9 \jl short 0040116A
004011B1 |> 33F6 xor esi, esi
004011B3 |. 85FF test edi, edi
004011B5 |. 7E 29 jle short 004011E0 ; 这里对serial变化
004011B7 |> 8B4C24 18 /mov ecx, dword ptr [esp+18]
004011BB |. 6A 01 |push 1
004011BD |. 0FBE140E |movsx edx, byte ptr [esi+ecx]
004011C1 |. 81E2 03000080 |and edx, 80000003
004011C7 |. 79 05 |jns short 004011CE
004011C9 |. 4A |dec edx
004011CA |. 83CA FC |or edx, FFFFFFFC
004011CD |. 42 |inc edx
004011CE |> 52 |push edx
004011CF |. E8 5C000000 |call 00401230
004011D4 |. 83C4 08 |add esp, 8
004011D7 85C0 |test eax, eax
004011D9 74 39 |je short 00401214
004011DB 46 |inc esi
004011DC |. 3BF7 |cmp esi, edi
004011DE |.^ 7C D7 \jl short 004011B7
004011E0 |> B8 01000000 mov eax, 1
004011E5 |> 8A88 30604000 /mov cl, byte ptr [eax+406030] ; 判断,406030,是否按0,1,2,3,4,5,6,7,8排列
004011EB |. 8A90 2F604000 |mov dl, byte ptr [eax+40602F]
004011F1 |. 3ACA |cmp cl, dl
004011F3 |. 7C 1F |jl short 00401214
004011F5 |. 40 |inc eax
004011F6 |. 83F8 09 |cmp eax, 9
004011F9 |.^ 7C EA \jl short 004011E5
call 00401230 是算法..
00401230 /$ 8B4424 04 mov eax, dword ptr [esp+4] ; 把刚才的值给eax
00401234 |. 53 push ebx ; 保存name
00401235 |. 83F8 03 cmp eax, 3 ; Switch (cases 0..3)
00401238 |. 56 push esi
00401239 |. 0F87 B5000000 ja 004012F4
0040123F |. FF2485 541340>jmp dword ptr [eax*4+401354]
00401246 |> 8A0D 3B604000 mov cl, byte ptr [40603B] ; Case 0 of switch 00401235
0040124C |. 80F9 03 cmp cl, 3 ; 判断,是否大于3,也就是a[2]
0040124F |. 0F8E A2000000 jle 004012F7
00401255 |. 0FBEC1 movsx eax, cl
00401258 |. 80C1 FD add cl, 0FD
0040125B |. 5E pop esi
0040125C |. 0FBE90 306040>movsx edx, byte ptr [eax+406030] ; a[n]和a[n-3],交换,并把n-=3;
00401263 |. 8A98 2D604000 mov bl, byte ptr [eax+40602D]
00401269 |. 880D 3B604000 mov byte ptr [40603B], cl
0040126F |. 8898 30604000 mov byte ptr [eax+406030], bl
00401275 |. 8890 2D604000 mov byte ptr [eax+40602D], dl
0040127B |. B8 01000000 mov eax, 1
00401280 |. 5B pop ebx
00401281 |. C3 retn
00401282 |> 8A0D 3B604000 mov cl, byte ptr [40603B] ; Case 1 of switch 00401235
00401288 |. 80F9 07 cmp cl, 7 ; 判断,是否大于7,也就是a[6]
0040128B |. 7D 6A jge short 004012F7
0040128D |. 0FBEC1 movsx eax, cl
00401290 |. 80C1 03 add cl, 3
00401293 |. 5E pop esi
00401294 |. 0FBE90 306040>movsx edx, byte ptr [eax+406030] ; a[n]和a[n+3]交换,并把n+=3
0040129B |. 8A98 33604000 mov bl, byte ptr [eax+406033]
004012A1 |. 880D 3B604000 mov byte ptr [40603B], cl
004012A7 |. 8898 30604000 mov byte ptr [eax+406030], bl
004012AD |. 8890 33604000 mov byte ptr [eax+406033], dl
004012B3 |. B8 01000000 mov eax, 1
004012B8 |. 5B pop ebx
004012B9 |. C3 retn
004012BA |> 0FBE0D 3B6040>movsx ecx, byte ptr [40603B] ; Case 2 of switch 00401235
004012C1 |. 8BC1 mov eax, ecx
004012C3 |. BE 03000000 mov esi, 3
004012C8 |. 99 cdq
004012C9 |. F7FE idiv esi
004012CB |. 83FA 01 cmp edx, 1 ; 条件,a[n],(n+1)%3!=1,不进行下列变化
004012CE |. 74 27 je short 004012F7
004012D0 |. 0FBE81 306040>movsx eax, byte ptr [ecx+406030] ; a[n]和a[n-1],交换,n-=1
004012D7 |. 8A91 2F604000 mov dl, byte ptr [ecx+40602F]
004012DD |. 8891 30604000 mov byte ptr [ecx+406030], dl
004012E3 |. 8881 2F604000 mov byte ptr [ecx+40602F], al
004012E9 |. FE0D 3B604000 dec byte ptr [40603B]
004012EF |> B8 01000000 mov eax, 1
004012F4 |> 5E pop esi ; Default case of switch 00401235
004012F5 |. 5B pop ebx
004012F6 |. C3 retn
004012F7 |> 8B4424 10 mov eax, dword ptr [esp+10]
004012FB |. 85C0 test eax, eax
004012FD |.^ 74 F0 je short 004012EF
004012FF |. 5E pop esi
00401300 |. 33C0 xor eax, eax
00401302 |. 5B pop ebx
00401303 |. C3 retn
00401304 |> 0FBE0D 3B6040>movsx ecx, byte ptr [40603B] ; Case 3 of switch 00401235
0040130B |. 8BC1 mov eax, ecx
0040130D |. BE 03000000 mov esi, 3
00401312 |. 99 cdq
00401313 |. F7FE idiv esi
00401315 |. 85D2 test edx, edx ; (n+1)%3!=0
00401317 |. 74 2D je short 00401346
00401319 |. 0FBE81 306040>movsx eax, byte ptr [ecx+406030] ; a[n]和a[n+1],交换,n=n+1
00401320 |. 8A91 31604000 mov dl, byte ptr [ecx+406031]
00401326 |. 5E pop esi
00401327 |. 8891 30604000 mov byte ptr [ecx+406030], dl
0040132D |. 8881 31604000 mov byte ptr [ecx+406031], al
00401333 |. A0 3B604000 mov al, byte ptr [40603B]
00401338 |. 5B pop ebx
00401339 |. FEC0 inc al
0040133B |. A2 3B604000 mov byte ptr [40603B], al
00401340 |. B8 01000000 mov eax, 1
00401345 |. C3 retn
00401346 |> 8B4424 10 mov eax, dword ptr [esp+10]
0040134A |. 85C0 test eax, eax
0040134C |.^ 74 A1 je short 004012EF
0040134E |. 5E pop esi
0040134F |. 33C0 xor eax, eax
00401351 |. 5B pop ebx
00401352 \. C3 retn
这是我的注册码,不过这个程序,第一次确定后,a[n]会改变,导致,不成立,所以..每次重启,才能成立
#include <iostream>
#include <string>
#include <vector>
using namespace std;
int a[9]={1,2,3,4,5,6,7,8,0},a1;
int n=8;
vector<int> v;
void fun(int i)
{
switch(i)
{
case 2:
{
if((n+1)%3==1) break;
else
{
a1=a[n];
a[n]=a[n-1];
a[n-1]=a1;n=n-1;
v.push_back(3);
cout<<'2'<<endl;
}
break;
}
case 1:
{ if(n>=6) break;
else
{
cout<<'1'<<endl;
a1=a[n];
a[n]=a[n+3];
a[n+3]=a1;
n=n+3;
v.push_back(0);
}
break;
}
case 3:
{
if((n+1)%3) {
a1=a[n+1];
a[n+1]=a[n];
a[n]=a1;
n++;
v.push_back(2);
cout<<'3'<<endl;
}
break;
}
case 0:
{
if(n>=3)
{
a1=a[n];
a[n]=a[n-3];
a[n-3]=a1;
n=n-3;
v.push_back(1);
cout<<'0'<<endl;
}
break;
}
}
}
void main()
{
v.clear();
string s;
cin>>s;
for(int i=0;i<s.size();i++)
{
int j=int(s[i]);
fun(1);
fun((j/16)%4);
fun((j/4)%4);
fun(j%4);
}
for(i=v.size()-1;i>=0;i--)
cout<<v[i];
cout<<endl;
}
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
pentnt兄,你谦虚了..像你这样的高手..应该是没心情分析..小弟要好好向你们学习..
 eek:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
我晕。这还是菜鸟啊。
|
