-
-
[原创]一个CreaKMe的算法分析 入门级别，为了鼓励一下自己
-
发表于:
2005-12-31 13:10
9929
-
[原创]一个CreaKMe的算法分析 入门级别，为了鼓励一下自己
调试工具：ollyDBG10.0 UltraEdit9.0
CrackME下载地址： http://www.pghome.net/download/DueList2.exe
目的： 真的没什么目的，因为今天是2005年的最后一天，以前一直只是懂暴破，我想如果这样下去，我最终会什么也学不会，所以这次硬着头皮看完了这个CrackME的算法，虽然简单，但对于我自己来说，各方面都是个锻炼，特别是自己在汇编级的思考方面自我感觉真的进步不少。 在此先谢谢看雪学院！！
这个CrackMe是通过检查注册文件判断是否注册的。 我为什么知道：因为我用OD跟了一会才知道的。
ALT+F1下断 bp CreateFileW
按F9运行断在下面：
00401057 . A3 AF214000 MOV DWORD PTR DS[4021AF],EAX ;|
0040105C . 6A 00 PUSH 0 ; |/hTemplateFile = NULL
0040105E . 68 6F214000 PUSH DueList2.0040216F ; ||Attributes = READONLY|HIDDEN|SYSTEM|ARCHIVE|TEMPORARY|402048
00401063 . 6A 03 PUSH 3 ; ||Mode = OPEN_EXISTING
00401065 . 6A 00 PUSH 0 ; ||pSecurity = NULL
00401067 . 6A 03 PUSH 3 ; ||ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE
00401069 . 68 000000C0 PUSH C0000000 ; ||Access = GENERIC_READ|GENERIC_WRITE
0040106E . 68 79204000 PUSH DueList2.00402079 ; ||FileName = "due-cm2.dat" ;此处为读取注册码文件的文件名
00401073 . E8 0B020000 CALL <JMP.&KERNEL32.CreateFileA> ; |\CreateFileA
00401078 . 83F8 FF CMP EAX,-1 ; | ；比较是否有此注册文件，无就出错，终于程序；;
0040107B . 75 1D JNZ SHORTDueList2.0040109A ;|；不等于跟到0040109A处，对文件中注册码进行比较
0040107D . 6A 00 PUSH 0 ; |/Style = MB_OK|MB_APPLMODAL
0040107F . 68 01204000 PUSH DueList2.00402001 ; ||Title = "Duelist's Crackme #2"
00401084 . 68 17204000 PUSH DueList2.00402017 ; ||Text = "Your time-trial has ended... Please register and copy the keyfile sent to you to this directory!"
00401089 . 6A 00 PUSH 0 ; ||hOwner = NULL
0040108B . E8 D7020000 CALL JMP.&USER32.MessageBoxA>;|\MessageBoxA
00401090 . E8 24020000 CALL <JMP.&KERNEL32.ExitProcess>;\ExitProcess
00401095 . E9 28010000 JMP DueList2.004011C2
0040109A > 6A 00 PUSH 0 ; /pOverlapped = NULL ；开始读取文件中注册码
0040109C . 68 73214000 PUSH DueList2.00402173 ;|pBytesRead =DueList2.00402173
004010A1 . 6A 46 PUSH 46 ; |BytesToRead = 46 (70.)
004010A3 . 68 1A214000 PUSH DueList2.0040211A ;|Buffer = DueList2.0040211A
004010A8 . 50 PUSH EAX ; |hFile
004010A9 . E8 2F020000 CALL <JMP.&KERNEL32.ReadFile> ; \ReadFile
004010AE . 85C0 TEST EAX,EAX
004010B0 . 75 02 JNZ SHORT DueList2.004010B4
004010B2 . EB 43 JMP SHORT DueList2.004010F7
004010B4 > 33DB XOR EBX,EBX
004010B6 . 33F6 XOR ESI,ESI
004010B8 . 833D 73214000 >CMP DWORD PTR DS:[402173],12 ; 字段长度不可小于12位,小于12位就跳出终止程序
004010BF . 7C 36 JL SHORT DueList2.004010F7
004010C1 > 8A83 1A214000 MOV AL,BYTE PTR DS:[EBX+40211A]
004010C7 . 3C 00 CMP AL,0
004010C9 . 74 08 JE SHORT DueList2.004010D3 ; 等于时转移
004010CB . 3C 01 CMP AL,1
004010CD . 75 01 JNZ SHORT DueList2.004010D0 ; 不等时转移
004010CF . 46 INC ESI
004010D0 > 43 INC EBX
004010D1 .^EB EE JMP SHORT DueList2.004010C1
004010D3 > 83FE 02 CMP ESI,2 ; 小于时转移
004010D6 . 7C 1F JL SHORT DueList2.004010F7
004010D8 . 33F6 XOR ESI,ESI
004010DA . 33DB XOR EBX,EBX
004010DC > 8A83 1A214000 MOV AL,BYTE PTR DS:[EBX+40211A]
004010E2 . 3C 00 CMP AL,0
004010E4 . 74 09 JE SHORT DueList2.004010EF ; 等于时转移
004010E6 . 3C 01 CMP AL,1
004010E8 . 74 05 JE SHORT DueList2.004010EF
004010EA . 03F0 ADD ESI,EAX
004010EC . 43 INC EBX
004010ED .^EB ED JMP SHORT DueList2.004010DC
004010EF > 81FE D5010000 CMP ESI,1D5 ; 比较注册码中大于0的前的数据十六制值相加必段等于1D4; 不等出错跳出终止程序运行
004010F5 . 74 1D JE SHORT DueList2.00401114 ;成功跳到：00401114处，继续对注册码进行比较
004010F7 > 6A 00 PUSH 0 ; |/Style = MB_OK|MB_APPLMODAL
004010F9 . 68 01204000 PUSH DueList2.00402001 ; ||Title = "Duelist's Crackme #2"
004010FE . 68 86204000 PUSH DueList2.00402086 ; ||Text = "Your current keyfile is invalid... Please obtain a valid one from the software author!"
00401103 . 6A 00 PUSH 0 ; ||hOwner = NULL
00401105 . E8 5D020000 CALL <JMP.&USER32.MessageBoxA> ; |\MessageBoxA
0040110A . E8 AA010000 CALL <JMP.&KERNEL32.ExitProcess> ; \ExitProcess
0040110F . E9 AE000000 JMP DueList2.004011C2
00401114 > 33F6 XOR ESI,ESI ; 此处为由cmp esi ,1D5处跳转过来；
00401116 > 43 INC EBX
00401117 . 8A83 1A214000 MOV AL,BYTE PTR DS:[EBX+40211A]
0040111D . 3C 00 CMP AL,0
0040111F . 74 18 JE SHORT DueList2.00401139
00401121 . 3C 01 CMP AL,1
00401123 . 74 14 JE SHORT DueList2.00401139
00401125 . 83FE 0F CMP ESI,0F
00401128 . 73 0F JNB SHORT DueList2.00401139 ; 大于或等于时转移
0040112A . 3286 1A214000 XOR AL,BYTE PTR DS:[ESI+40211A]
00401130 . 8986 60214000 MOV DWORD PTR DS:[ESI+402160],EAX
00401136 . 46 INC ESI
00401137 .^EB DD JMP SHORT DueList2.00401116
00401139 > 43 INC EBX
0040113A . 33F6 XOR ESI,ESI
0040113C > 8A83 1A214000 MOV AL,BYTE PTR DS:[EBX+40211A]
00401142 . 3C 00 CMP AL,0
00401144 . 74 09 JE SHORT DueList2.0040114F ;
00401146 . 3C 01 CMP AL,1
00401148 .^74 F2 JE SHORT DueList2.0040113C ; 等于时转移
0040114A . 03F0 ADD ESI,EAX
0040114C . 43 INC EBX
0040114D .^EB ED JMP SHORT DueList2.0040113C
0040114F > 81FE B2010000 CMP ESI,1B2 ; 注册码中0后面的字符的十六进制的值相加与1b2比较，必须相等 ;
00401155 .^75 A0 JNZ SHORT DueList2.004010F7；不相等跳到004010F7处出错；
00401157 . 6A 00 PUSH 0 ; /lParam = NULL
00401159 . 68 C9114000 PUSH DueList2.004011C9;|DlgProc= DueList2.004011C9
0040115E . 6A 00 PUSH 0 ; |hOwner = NULL
00401160 . 6A 05 PUSH 5 ; |pTemplate = 5
00401162 . FF35 77214000 PUSH DWORD PTR DS:[402177] ; |hInst = 00400000
00401168 . E8 42020000 CALL <JMP.&USER32.DialogBoxParamA> ; \DialogBoxParamA ;跳到此处成功・！
总体说起来这个CrackMe很简单，只是我的汇编功能不够好或者说这么多年写程序的思想一时改变不过来，用了我五个多小时，中间被别个问问题打断N次之后终于成功；
最后没忘记写出自己的注册号：
在这个crackME相同的目录下建立一个due-cm2.dat文件，
注册码为: ~~~U1234567$
[招生]科锐逆向工程师培训(2025年3月11日实地，远程教学同时开班, 第52期)！
