1）PEID，检查UPX 0.89.6 - 1.02 / 1.05 - 1.24 。
UPX的壳手脱起来很好脱，不在多说。手脱后检查Borland Delphi 4.0 - 5.0
2）试运行程序。任意输入注册信息后，有错误提示。
3）OD载入程序，用超级字符串查找，找到错误提示信息，
超级字串参考＋ , 条目 17
地址=00457E56
反汇编=MOV EDX,up123.00457FAC
文本字串=the serial you entered is in any case not valid !
双击来到00457E56处。向上找到注册信息计算开始的地方。下断。也可以用bp MessageBoxA
4）OD重新载入程序，任意输入注册信息后。程序中断。
00457BBE |. 55 PUSH EBP
00457BBF |. 68 8A7E4500 PUSH up123.00457E8A
00457BC4 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00457BC7 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
00457BCA |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
00457BCD |. 8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
00457BD3 |. E8 08C3FCFF CALL up123.00423EE0 ; 取注册名位数
00457BD8 |. 837D FC 00 CMP DWORD PTR SS:[EBP-4],0 ; 输入注册名了吗
00457BDC |. 75 18 JNZ SHORT up123.00457BF6
00457BDE |. 6A 00 PUSH 0
00457BE0 |. B9 987E4500 MOV ECX,up123.00457E98 ; enter your name !
00457BE5 |. BA AC7E4500 MOV EDX,up123.00457EAC ; you must enter your name !
00457BEA |. A1 98A54500 MOV EAX,DWORD PTR DS:[45A598]
00457BEF |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
00457BF1 |. E8 3A85FEFF CALL up123.00440130
00457BF6 |> 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4] ; EBP-4=注册名
00457BF9 |. 8B83 DC020000 MOV EAX,DWORD PTR DS:[EBX+2DC]
00457BFF |. E8 DCC2FCFF CALL up123.00423EE0 ; 取假码位数
00457C04 |. 837D FC 00 CMP DWORD PTR SS:[EBP-4],0 ; 输入注册码了吗
00457C08 |. 75 18 JNZ SHORT up123.00457C22
00457C0A |. 6A 00 PUSH 0
00457C0C |. B9 C87E4500 MOV ECX,up123.00457EC8 ; enter a serial !
00457C11 |. BA DC7E4500 MOV EDX,up123.00457EDC ; you must enter a serial !
00457C16 |. A1 98A54500 MOV EAX,DWORD PTR DS:[45A598]
00457C1B |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
00457C1D |. E8 0E85FEFF CALL up123.00440130
00457C22 |> 33C0 XOR EAX,EAX
00457C24 |. A3 40B84500 MOV DWORD PTR DS:[45B840],EAX
00457C29 |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4] ; EBP-4假码
00457C2C |. 8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
00457C32 |. E8 A9C2FCFF CALL up123.00423EE0 ; 取注册名位数
00457C37 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00457C3A |. E8 F9BFFAFF CALL up123.00403C38
00457C3F |. A3 44B84500 MOV DWORD PTR DS:[45B844],EAX
00457C44 |. A1 44B84500 MOV EAX,DWORD PTR DS:[45B844]
00457C49 |. E8 82FDFAFF CALL up123.004079D0
00457C4E |. 83F8 06 CMP EAX,6 ; 注册名位数与6相比
00457C51 |. 73 1D JNB SHORT up123.00457C70 小于六位就出现错误提示
00457C53 |. 6A 00 PUSH 0
00457C55 |. B9 F87E4500 MOV ECX,up123.00457EF8 ; name too short !
00457C5A |. BA 0C7F4500 MOV EDX,up123.00457F0C ; your name must be at least 6 chars long !
00457C5F |. A1 98A54500 MOV EAX,DWORD PTR DS:[45A598]
00457C64 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
00457C66 |. E8 C584FEFF CALL up123.00440130
00457C6B |. E9 59010000 JMP up123.00457DC9
00457C70 |> 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
00457C73 |. 8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
00457C79 |. E8 62C2FCFF CALL up123.00423EE0
00457C7E |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00457C81 |. BA 01000000 MOV EDX,1 EDX=1
00457C86 |. 4A DEC EDX
00457C87 |. 3B50 FC CMP EDX,DWORD PTR DS:[EAX-4]
00457C8A |. 72 05 JB SHORT up123.00457C91
00457C8C |. E8 F3AEFAFF CALL up123.00402B84
00457C91 |> 42 INC EDX
00457C92 |. 0FB64410 FF MOVZX EAX,BYTE PTR DS:[EAX+EDX-1] ; 取注册名第一位的ASCII值
00457C97 |. 6BF0 02 IMUL ESI,EAX,2 ; ESI=EAX*2
00457C9A |. 71 05 JNO SHORT up123.00457CA1
00457C9C |. E8 EBAEFAFF CALL up123.00402B8C
00457CA1 |> 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
00457CA4 |. 8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
00457CAA |. E8 31C2FCFF CALL up123.00423EE0
00457CAF |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00457CB2 |. BA 02000000 MOV EDX,2 EDX=2
00457CB7 |. 4A DEC EDX
00457CB8 |. 3B50 FC CMP EDX,DWORD PTR DS:[EAX-4]
00457CBB |. 72 05 JB SHORT up123.00457CC2
00457CBD |. E8 C2AEFAFF CALL up123.00402B84
00457CC2 |> 42 INC EDX
00457CC3 |. 0FB64410 FF MOVZX EAX,BYTE PTR DS:[EAX+EDX-1] ; 取注册名第二位的ASCII值
00457CC8 |. 6BC0 02 IMUL EAX,EAX,2 ; EAX=EAX*2
00457CCB |. 71 05 JNO SHORT up123.00457CD2
00457CCD |. E8 BAAEFAFF CALL up123.00402B8C
00457CD2 |> 03F0 ADD ESI,EAX ; ESI=注册名前二位ASCII值经过一定计算后相加
00457CD4 |. 71 05 JNO SHORT up123.00457CDB
00457CD6 |. E8 B1AEFAFF CALL up123.00402B8C
00457CDB |> 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
00457CDE |. 8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
00457CE4 |. E8 F7C1FCFF CALL up123.00423EE0
00457CE9 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
00457CEC |. BA 03000000 MOV EDX,3 EDX=3
00457CF1 |. 4A DEC EDX
00457CF2 |. 3B50 FC CMP EDX,DWORD PTR DS:[EAX-4]
00457CF5 |. 72 05 JB SHORT up123.00457CFC
00457CF7 |. E8 88AEFAFF CALL up123.00402B84
00457CFC |> 42 INC EDX
00457CFD |. 0FB64410 FF MOVZX EAX,BYTE PTR DS:[EAX+EDX-1] ; 取注册名第三位的ASCII值
00457D02 |. 6BC0 02 IMUL EAX,EAX,2 ; EAX=EAX*2
00457D05 |. 71 05 JNO SHORT up123.00457D0C
00457D07 |. E8 80AEFAFF CALL up123.00402B8C
00457D0C |> 03F0 ADD ESI,EAX ; ESI=注册名前三位ASCII值经过一定计算后相加
00457D0E |. 71 05 JNO SHORT up123.00457D15
00457D10 |. E8 77AEFAFF CALL up123.00402B8C
00457D15 |> 8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10]
00457D18 |. 8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
00457D1E |. E8 BDC1FCFF CALL up123.00423EE0
00457D23 |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
00457D26 |. BA 04000000 MOV EDX,4 EDX=4
00457D2B |. 4A DEC EDX
00457D2C |. 3B50 FC CMP EDX,DWORD PTR DS:[EAX-4]
00457D2F |. 72 05 JB SHORT up123.00457D36
00457D31 |. E8 4EAEFAFF CALL up123.00402B84
00457D36 |> 42 INC EDX
00457D37 |. 0FB64410 FF MOVZX EAX,BYTE PTR DS:[EAX+EDX-1] ; 取注册名第四位的ASCII值
00457D3C |. 6BC0 02 IMUL EAX,EAX,2 ; EAX=EAX*2
00457D3F |. 71 05 JNO SHORT up123.00457D46
00457D41 |. E8 46AEFAFF CALL up123.00402B8C
00457D46 |> 03F0 ADD ESI,EAX ; ESI=注册名前四位ASCII值经过一定计算后相加
00457D48 |. 71 05 JNO SHORT up123.00457D4F
00457D4A |. E8 3DAEFAFF CALL up123.00402B8C
00457D4F |> 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
00457D52 |. 8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
00457D58 |. E8 83C1FCFF CALL up123.00423EE0
00457D5D |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00457D60 |. BA 05000000 MOV EDX,5 EDX=5
00457D65 |. 4A DEC EDX
00457D66 |. 3B50 FC CMP EDX,DWORD PTR DS:[EAX-4]
00457D69 |. 72 05 JB SHORT up123.00457D70
00457D6B |. E8 14AEFAFF CALL up123.00402B84
00457D70 |> 42 INC EDX
00457D71 |. 0FB64410 FF MOVZX EAX,BYTE PTR DS:[EAX+EDX-1] ; 取注册名第五位的ASCII值
00457D76 |. 6BC0 02 IMUL EAX,EAX,2 ; EAX=EAX*2
00457D79 |. 71 05 JNO SHORT up123.00457D80
00457D7B |. E8 0CAEFAFF CALL up123.00402B8C
00457D80 |> 03F0 ADD ESI,EAX ; ESI=注册名前五位ASCII值经过一定计算后相加
00457D82 |. 71 05 JNO SHORT up123.00457D89
00457D84 |. E8 03AEFAFF CALL up123.00402B8C
00457D89 |> 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
00457D8C |. 8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
00457D92 |. E8 49C1FCFF CALL up123.00423EE0
00457D97 |. 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18]
00457D9A |. BA 06000000 MOV EDX,6 EDX=6
00457D9F |. 4A DEC EDX
00457DA0 |. 3B50 FC CMP EDX,DWORD PTR DS:[EAX-4]
00457DA3 |. 72 05 JB SHORT up123.00457DAA
00457DA5 |. E8 DAADFAFF CALL up123.00402B84
00457DAA |> 42 INC EDX
00457DAB |. 0FB64410 FF MOVZX EAX,BYTE PTR DS:[EAX+EDX-1] ; 取注册名第六位的ASCII值
00457DB0 |. 6BC0 02 IMUL EAX,EAX,2 ; EAX=EAX*2
00457DB3 |. 71 05 JNO SHORT up123.00457DBA
00457DB5 |. E8 D2ADFAFF CALL up123.00402B8C
00457DBA |> 03F0 ADD ESI,EAX ; ESI=注册名前六位ASCII值经过一定计算后相加
00457DBC |. 71 05 JNO SHORT up123.00457DC3
00457DBE |. E8 C9ADFAFF CALL up123.00402B8C
00457DC3 |> 8935 40B84500 MOV DWORD PTR DS:[45B840],ESI
00457DC9 |> A1 44B84500 MOV EAX,DWORD PTR DS:[45B844]
00457DCE |. E8 FDFBFAFF CALL up123.004079D0 ; 取注册名位数
00457DD3 |. 6BC0 02 IMUL EAX,EAX,2 ; 注册名位数*2
00457DD6 |. 73 05 JNB SHORT up123.00457DDD
00457DD8 |. E8 AFADFAFF CALL up123.00402B8C
00457DDD |> 33D2 XOR EDX,EDX
00457DDF |. 52 PUSH EDX
00457DE0 |. 50 PUSH EAX
00457DE1 |. A1 40B84500 MOV EAX,DWORD PTR DS:[45B840]
00457DE6 |. 99 CDQ
00457DE7 |. 030424 ADD EAX,DWORD PTR SS:[ESP] ; 两步的运算结果相加
00457DEA |. 135424 04 ADC EDX,DWORD PTR SS:[ESP+4]
00457DEE |. 71 05 JNO SHORT up123.00457DF5
00457DF0 |. E8 97ADFAFF CALL up123.00402B8C
00457DF5 |> 83C4 08 ADD ESP,8
00457DF8 |. 50 PUSH EAX
00457DF9 |. C1F8 1F SAR EAX,1F
00457DFC |. 3BC2 CMP EAX,EDX
00457DFE |. 58 POP EAX
00457DFF |. 74 05 JE SHORT up123.00457E06
00457E01 |. E8 7EADFAFF CALL up123.00402B84
00457E06 |> A3 40B84500 MOV DWORD PTR DS:[45B840],EAX
00457E0B |. 8D55 E4 LEA EDX,DWORD PTR SS:[EBP-1C]
00457E0E |. A1 40B84500 MOV EAX,DWORD PTR DS:[45B840]
00457E13 |. E8 2CF9FAFF CALL up123.00407744 ; 结果转换成十进制
00457E18 |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
00457E1B |. 50 PUSH EAX
00457E1C |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
00457E1F |. 8B83 DC020000 MOV EAX,DWORD PTR DS:[EBX+2DC]
00457E25 |. E8 B6C0FCFF CALL up123.00423EE0
00457E2A |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00457E2D |. 58 POP EAX
00457E2E |. E8 51BDFAFF CALL up123.00403B84
00457E33 |. 75 1A JNZ SHORT up123.00457E4F
00457E35 |. 6A 00 PUSH 0
00457E37 |. B9 387F4500 MOV ECX,up123.00457F38 ; congratz !
00457E3C |. BA 447F4500 MOV EDX,up123.00457F44 ; you cracked the cff crackme #4 ! please send your solution to [email]acidbytes@gmx.net[/email] !
00457E41 |. A1 98A54500 MOV EAX,DWORD PTR DS:[45A598]
00457E46 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
00457E48 |. E8 E382FEFF CALL up123.00440130
00457E4D |. EB 18 JMP SHORT up123.00457E67
00457E4F |> 6A 00 PUSH 0
00457E51 |. B9 987F4500 MOV ECX,up123.00457F98 ; serial not valid
00457E56 |. BA AC7F4500 MOV EDX,up123.00457FAC ; the serial you entered is in any case not valid !
00457E5B |. A1 98A54500 MOV EAX,DWORD PTR DS:[45A598]
00457E60 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
00457E62 |. E8 C982FEFF CALL up123.00440130
------------------------------------------------------------------------BY 逍遥风
算法总结：
1）注册名必须大于等于6位。
2）取注册名前6位的ASCII值乘以定值2，并把每一位所得的积相加。设结果为A
3）注册名位数乘以定值2。设结果为B
4）A加B的结果转换成相应的十进制数即得注册码。
例：注册名 tcxbtc
1）t:74*2=E8 c:63*2=C6 x:78*2=F0 b:62*2=C4 t:74*2=E8 c:63*2=C6
E8+C6+F0+C4+E8+C6=510
2）6*2=C
3）510+C=51C 转换成十进制等于1308
所以 注册名tcxbtc
注册码1308
[培训]二进制漏洞攻防（第3期）；满10人开班；模糊测试与工具使用二次开发；网络协议漏洞挖掘；Linux内核漏洞挖掘与利用；AOSP漏洞挖掘与利用；代码审计。
