新人首次发帖，本人是今年才开始接触编程的，25岁了~（早干麻去了？？？）
由于本人思路不清晰，看起来应该会很乱……看的牛牛们可别拿砖头~~~
这个“CrackMe”来自网上，应该不会有人追究我的责任问题吧？要是有的话我再删除好了
好了，正式开始：
我是用IDA打开这个CrackMe的，转到下面的地方
.text:0040137D mov dword ptr [esp], offset aStage1 ; "\n\nSTAGE 1\n"
.text:00401384 call printf
.text:00401389 mov dword ptr [esp], offset asc_4031D3 ; "*******\n\n"
.text:00401390 call printf
.text:00401395 mov dword ptr [esp], offset aEnterPasswordT ; "Enter Password To Continue : "
.text:0040139C call printf
.text:004013A1 lea eax, [ebp+var_28]
.text:004013A4 mov [esp+4], eax
.text:004013A8 mov dword ptr [esp], offset aS ; "%s"
.text:004013AF call scanf
.text:004013B4 lea eax, [ebp+var_28]
.text:004013B7 mov [esp], eax ; char *
.text:004013BA call strlen ;取输入字符串的长度
.text:004013BF cmp eax, 8 ;比较长度是否为8
.text:004013C2 jz short loc_4013C9 ;是就跳走
.text:004013C4 jmp loc_4014F5 ;这里跳到失败
.text:004013C9 ; ---------------------------------------------------------------------------
.text:004013C9
.text:004013C9 loc_4013C9:
.text:004013C9 mov [ebp+var_ecx], 0 ;这里是循环计数器清零
.text:004013D0
.text:004013D0 loc_4013D0:
.text:004013D0 cmp [ebp+var_ecx], 7
.text:004013D4 jg short loc_4013F6 ;大于等于7时跳走
.text:004013D6 lea eax, [ebp+var_8]
.text:004013D9 add eax, [ebp+var_ecx]
.text:004013DC lea edx, [eax-20h]
.text:004013DF lea eax, [ebp+var_8]
.text:004013E2 add eax, [ebp+var_ecx]
.text:004013E5 sub eax, 20h
.text:004013E8 movzx eax, byte ptr [eax]
.text:004013EB inc al
.text:004013ED mov [edx], al
.text:004013EF lea eax, [ebp-0Ch]
.text:004013F2 inc dword ptr [eax] ;这段是把输入的字符的ASCII码加1的循环
.text:004013F4 jmp short loc_4013D0
.text:004013F6 loc_4013F6:
.text:004013F6 lea eax, [ebp+var_38] ;这里是真码做循环后的结果
.text:004013F9 lea edx, [ebp+var_28] ;我们输入字符后循环后的结果
.text:004013FC mov [esp+4], eax ; char *
.text:00401400 mov [esp], edx ; char *
.text:00401403 call strcmp
.text:00401408 test eax, eax
.text:0040140A jnz loc_4014F5 ;比较字串，不相等就跳向失败
.text:00401410 mov dword ptr [esp], offset aStage1Complete ; "\nStage 1 completed!"
.text:00401417 call printf
.text:0040141C mov dword ptr [esp], offset aStage2 ; "\n\n\nSTAGE 2\n"
.text:00401423 call printf
.text:00401428 mov dword ptr [esp], offset asc_4031D3 ; "*******\n\n"
.text:0040142F call printf
.text:00401434 mov dword ptr [esp], offset aName2Chars10 ; "\nName [2<=chars<=10] : "
.text:0040143B call printf
.text:00401440 lea eax, [ebp+var_48]
.text:00401443 mov [esp+4], eax
.text:00401447 mov dword ptr [esp], offset aS ; "%s"
.text:0040144E call scanf
.text:00401453 mov dword ptr [esp], offset aSerial ; "\nSerial : "
.text:0040145A call printf
.text:0040145F lea eax, [ebp+var_50]
.text:00401462 mov [esp+4], eax
.text:00401466 mov dword ptr [esp], offset aD ; "%d"
.text:0040146D call scanf
.text:00401472 mov [ebp+var_ecx], 0
.text:00401479 mov [ebp+var_ecx], 0
.text:00401480 loc_401480:
.text:00401480 lea eax, [ebp+var_48]
.text:00401483 mov [esp], eax ;相当于 push eax？ ;
.text:00401486 call strlen ; 得到 NAME 的长度以便做循环
.text:0040148B cmp [ebp+var_c], eax ;比较循环次数
.text:0040148E ja short loc_4014AA ;大于等于eax的值跳走
.text:00401490 lea eax, [ebp+var_8]
.text:00401493 add eax, [ebp+var_C]
.text:00401496 sub eax, 40h
.text:00401499 movsx eax, byte ptr [eax]
.text:0040149C add eax, [ebp+var_4C]
.text:0040149F dec eax
.text:004014A0 mov [ebp+var_4C], eax
.text:004014A3 lea eax, [ebp+var_C] ;这段是用户名的每个字符相加，再加1，最后再加1
.text:004014A6 inc dword ptr [eax]
.text:004014A8 jmp short loc_40
.text:004014AA loc_4014AA:
.text:004014AA mov eax, [ebp+var_4C] ;我们输入NAME计算出来的正确结果
.text:004014AD cmp eax, [ebp+var_50] ;我们输入的错的Serial算出来的错码
.text:004014B0 jnz short loc_4014F5 ;结果不相等就跳向失败
.text:004014B2 mov dword ptr [esp], offset aStage2Complete ; "\nStage 2 Completed!\n"
.text:004014B9 call printf
.text:004014BE mov dword ptr [esp], offset aStage3 ; "\n\nSTAGE 3\n"
.text:004014C5 call printf
.text:004014CA mov dword ptr [esp], offset asc_4031D3 ; "*******\n\n"
.text:004014D1 call printf
.text:004014D6 mov dword ptr [esp], offset aConsoleNag___L ; "Console nag... lol ...Remove Me!\n"
.text:004014DD call printf
.text:004014E2 call _getch
.text:004014E7 mov dword ptr [esp], offset aStage3Complete ; "\nStage 3 Completed if you don't see nag"...
.text:004014EE call printf
.text:004014F3 jmp short loc_401506 ;此段为提示成功段
到这里基本上是结束了吧？
然后用Delphi写了个注册机，当然，这个水平也非常非常有限，也不知道是不是悟性的问题~~~哈哈~~
[培训]传播安全知识、拓宽行业人脉——看雪讲师团队等你加入！
