首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 峰会 看雪商城 证书查询
  1. 社区
  2. 付费问答
    3. 发新帖
[旧帖] 帮忙看看这关键找对了没 0.00雪花
发表于: 2012-1-31 15:55 1243

[旧帖] 帮忙看看这关键找对了没 0.00雪花

Asfy 活跃值
2012-1-31 15:55
1243
004012AA  |> \6A 0A         push 0xA                                 ; /Count = A (10.); Case 1 of switch 0040128D
004012AC  |.  8D45 EC       lea eax,[local.5]                        ; |
004012AF  |.  50            push eax                                 ; |Buffer
004012B0  |.  6A 65         push 0x65                                ; |ControlID = 65 (101.)
004012B2  |.  FF75 08       push [arg.1]                             ; |hWnd
004012B5  |.  E8 F2010000   call <jmp.&USER32.GetDlgItemTextA>       ; \GetDlgItemTextA
004012BA  |.  6A 0A         push 0xA                                 ; /Count = A (10.)
004012BC  |.  8D45 F6       lea eax,dword ptr ss:[ebp-0xA]           ; |
004012BF  |.  50            push eax                                 ; |Buffer
004012C0  |.  6A 66         push 0x66                                ; |ControlID = 66 (102.)
004012C2  |.  FF75 08       push [arg.1]                             ; |hWnd
004012C5  |.  E8 E2010000   call <jmp.&USER32.GetDlgItemTextA>       ; \GetDlgItemTextA
004012CA  |.  8D45 F6       lea eax,dword ptr ss:[ebp-0xA]
004012CD  |.  50            push eax
004012CE  |.  8D45 EC       lea eax,[local.5]
004012D1  |.  50            push eax
004012D2  |.  E8 73000000   call zebrone.0040134A              ;这是关键call吗????
004012D7  |.  83C4 08       add esp,0x8
004012DA      09C0          or eax,eax
004012DC      74 16         je Xzebrone.004012F4                     ;  je(jmp zero)关键跳,不然就挂
004012DE      6A 00         push 0x0
004012E0  |.  68 26324000   push zebrone.00403226                    ; |Great !!!
004012E5  |.  68 30324000   push zebrone.00403230                    ; |Congratulations, you have cracked the Zebra Crackme ver 1.1
004012EA  |.  FF75 08       push [arg.1]                             ; |hOwner
004012ED  |.  E8 C6010000   call <jmp.&USER32.MessageBoxA>           ; \MessageBoxA
004012F2  |.  EB 14         jmp Xzebrone.00401308
004012F4  |>  6A 00         push 0x0                                 ; /Style = MB_OK|MB_APPLMODAL
004012F6  |.  68 F8314000   push zebrone.004031F8                    ; |Hmmmm :P
004012FB  |.  68 01324000   push zebrone.00403201                    ; |Text = "Sorry... The Serial isn't correct :?
00401300  |.  FF75 08       push [arg.1]                             ; |hOwner
00401303  |.  E8 B0010000   call <jmp.&USER32.MessageBoxA>           ; \MessageBoxA
00401308  |>  31C0          xor eax,eax
0040130A  |.  40            inc eax

这一句
004012D2  |.  E8 73000000   call zebrone.0040134A              ;这是关键call吗????
点进去这个call是一大片c语言函数的call
晕
我把这个crack传上来

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！

上传的附件：
收藏
免费 ・0
支持
分享
最新回复 (2)
达文西
雪    币： 1632
活跃值： (13)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
2 楼
是的，你找对了。

浮点运算。
2012-1-31 16:40
0
Asfy
雪    币： 6
活跃值： (10)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
3 楼 
0040134A  /$  55            push ebp
0040134B  |.  89E5          mov ebp,esp
0040134D  |.  83EC 68       sub esp,0x68                             ;  esp-68
00401350  |.  FF75 08       push [arg.1]                             ; /s
00401353  |.  E8 78010000   call <jmp.&CRTDLL.atof>                  ; \atof
00401358  |.  DD55 E8       fst qword ptr ss:[ebp-0x18]
0040135B  |.  83EC 08       sub esp,0x8
0040135E  |.  DD1C24        fstp qword ptr ss:[esp]
00401361  |.  E8 82010000   call <jmp.&CRTDLL.floor>
00401366  |.  DD5D F8       fstp qword ptr ss:[ebp-0x8]
00401369  |.  FF75 0C       push [arg.2]                             ; /s
0040136C  |.  E8 5F010000   call <jmp.&CRTDLL.atof>                  ; \atof
00401371  |.  DD55 D8       fst qword ptr ss:[ebp-0x28]
00401374  |.  83EC 08       sub esp,0x8
00401377  |.  DD1C24        fstp qword ptr ss:[esp]
0040137A  |.  E8 69010000   call <jmp.&CRTDLL.floor>
0040137F  |.  83C4 18       add esp,0x18
00401382  |.  DD55 F0       fst qword ptr ss:[ebp-0x10]
00401385  |.  DC4D F8       fmul qword ptr ss:[ebp-0x8]
00401388  |.  D9EE          fldz
0040138A  |.  DED9          fcompp
0040138C  |.  DFE0          fstsw ax
0040138E  |.  9E            sahf
0040138F  |.  75 07         jnz Xzebrone.00401398
00401391  |.  31C0          xor eax,eax
00401393  |.  E9 96000000   jmp zebrone.0040142E
00401398  |>  DD45 F8       fld qword ptr ss:[ebp-0x8]
0040139B  |.  DC5D F0       fcomp qword ptr ss:[ebp-0x10]
0040139E  |.  DFE0          fstsw ax
004013A0  |.  9E            sahf
004013A1  |.  75 07         jnz Xzebrone.004013AA
004013A3  |.  31C0          xor eax,eax
004013A5  |.  E9 84000000   jmp zebrone.0040142E
004013AA  |>  DD45 F8       fld qword ptr ss:[ebp-0x8]
004013AD  |.  DD5D C8       fstp qword ptr ss:[ebp-0x38]
004013B0  |.  D9E8          fld1
004013B2  |.  DD55 C0       fst qword ptr ss:[ebp-0x40]
004013B5  |.  DC5D C8       fcomp qword ptr ss:[ebp-0x38]
004013B8  |.  DFE0          fstsw ax
004013BA  |.  9E            sahf
004013BB  |.  77 2D         ja Xzebrone.004013EA
004013BD  |.  DF2D 38304000 fild qword ptr ds:[0x403038]
004013C3  |.  DD55 B8       fst qword ptr ss:[ebp-0x48]
004013C6  |.  DC5D C8       fcomp qword ptr ss:[ebp-0x38]
004013C9  |.  DFE0          fstsw ax
004013CB  |.  9E            sahf
004013CC  |.  72 1C         jb Xzebrone.004013EA
004013CE  |.  DD45 F0       fld qword ptr ss:[ebp-0x10]
004013D1  |.  DD5D B0       fstp qword ptr ss:[ebp-0x50]
004013D4  |.  DD45 C0       fld qword ptr ss:[ebp-0x40]
004013D7  |.  DC5D B0       fcomp qword ptr ss:[ebp-0x50]
004013DA  |.  DFE0          fstsw ax
004013DC  |.  9E            sahf
004013DD  |.  77 0B         ja Xzebrone.004013EA
004013DF  |.  DD45 B8       fld qword ptr ss:[ebp-0x48]
004013E2  |.  DC5D B0       fcomp qword ptr ss:[ebp-0x50]
004013E5  |.  DFE0          fstsw ax
004013E7  |.  9E            sahf
004013E8  |.  73 04         jnb Xzebrone.004013EE
004013EA  |>  31C0          xor eax,eax
004013EC  |.  EB 40         jmp Xzebrone.0040142E
004013EE  |>  DD45 F8       fld qword ptr ss:[ebp-0x8]
004013F1  |.  D9FE          fsin
004013F3  |.  DD5D A8       fstp qword ptr ss:[ebp-0x58]
004013F6  |.  DD45 F0       fld qword ptr ss:[ebp-0x10]
004013F9  |.  D9FE          fsin
004013FB  |.  DD5D A0       fstp qword ptr ss:[ebp-0x60]
004013FE  |.  DD45 A8       fld qword ptr ss:[ebp-0x58]
00401401  |.  DC4D A0       fmul qword ptr ss:[ebp-0x60]
00401404  |.  DF2D 30304000 fild qword ptr ds:[0x403030]
0040140A  |.  DEC9          fmulp st(1),st
0040140C  |.  83EC 08       sub esp,0x8
0040140F  |.  DD1C24        fstp qword ptr ss:[esp]
00401412  |.  E8 D1000000   call <jmp.&CRTDLL.floor>
00401417  |.  83C4 08       add esp,0x8
0040141A  |.  DD5D 98       fstp qword ptr ss:[ebp-0x68]
0040141D  |.  D9EE          fldz
0040141F  |.  DC5D 98       fcomp qword ptr ss:[ebp-0x68]
00401422  |.  DFE0          fstsw ax
00401424  |.  9E            sahf
00401425  |.  75 05         jnz Xzebrone.0040142C
00401427  |.  31C0          xor eax,eax
00401429  |.  40            inc eax
0040142A  |.  EB 02         jmp Xzebrone.0040142E
0040142C  |>  31C0          xor eax,eax
这是跟进call的代码
      
这个crack貌似是很垃圾的(下载网页上写的)
不会这么复杂吧
2012-1-31 17:49
0
游客
登录 | 注册 方可回帖
回帖 表情 雪币赚取及消费
高级回复
返回
//