此CM有壳有花,不过是明码比较,所以还是不难,带壳慢慢跟一会儿就能找到注册码.
OD载入并运行,输入假定注册码12345678回车,看到OD的LOG中有
Message = Thread 2. (ID 0000D9D4) terminated, exit code 5F4150 (6242640.)的信息
所以应该是开了线程来运算,重新载入,在CreateThread下断,输入12345678回车,OD断下,看堆栈:
0018FD84 [004463E2 acD ; /RETURN from kernel32.CreateThread to crackme.004463E2
0018FD88 /00000000 ; |pSecurity = NULL
0018FD8C |00000000 ; |StackSize = 0
0018FD90 |004044FF ?D@ ; |StartAddress = crackme.4044FF
0018FD94 |00000000 ; |Parameter = NULL
0018FD98 |00000000 ; |CreationFlags = 0
0018FD9C |0018FDB0 °y ; \pThreadId = 0018FDB0 -> 3
在004463E2下断,再运行,断到这儿:
004044FF /. 56 push esi
00404500 |. 57 push edi
00404501 |. 53 push ebx
00404502 |. E8 8DF3FFFF call 00403894
00404507 |. 5B pop ebx
00404508 |. 5F pop edi
00404509 |. 5E pop esi
0040450A \. C3 retn
跟进00403894,再一步步跟,来到这儿:
00403906 . 8B1D E8404800 mov ebx, [4840E8]
0040390C . 33C0 xor eax, eax
0040390E . 833B 00 cmp dword ptr [ebx], 0
00403911 . 7E 03 jle short 00403916
00403913 . 8B43 04 mov eax, [ebx+4] ; //取注册码应有的长度14
00403916 > 8945 F8 mov [ebp-8], eax
00403919 . F9 stc
0040391A . 72 01 jb short 0040391D
0040391C . B7 EB mov bh, 0EB
0040391E . 010F add [edi], ecx
00403920 . 68 04000080 push 80000004
00403925 . 6A 00 push 0
00403927 . EB 01 jmp short 0040392A
00403929 74 db 74 ; char 't'
0040392A /> A1 E0404800 mov eax, [4840E0] ; ASCII "12345678"
0040392F |. 85C0 test eax, eax
00403931 |. 75 05 jnz short 00403938
00403933 |. B8 D7734600 mov eax, offset 004673D7
00403938 |> 50 push eax
00403939 |. 68 01000000 push 1
0040393E |. BB D0454000 mov ebx, 004045D0 ; //计算输入的注册码SN长度
00403943 |. E8 690C0000 call 004045B1
00403948 |. 83C4 10 add esp, 10
0040394B |. 8945 F4 mov [ebp-0C], eax
0040394E \. EB 01 jmp short 00403951
00403950 0F db 0F
00403951 /> E8 00000000 call 00403956
00403956 |$ 830424 06 add dword ptr [arg.retaddr], 6
0040395A \. C3 retn
0040395B B7 db B7
0040395C F8 clc
0040395D 73 01 jae short 00403960
0040395F 84 db 84
00403960 8B45 F4 mov eax, [ebp-0C]
00403963 3945 F8 cmp [ebp-8], eax ; //比较SN长度,长度必须为14
00403966 0F85 39070000 jne 004040A5
0040396C . EB 01 jmp short 0040396F
清除之前的断点,在00403963下硬件运行断点,重新运行,输入1234567890abcd回车,又断到00403963
继续一步步跟,来到这儿:
004037F7 /. 8B5424 04 mov edx, [arg.1]
004037FB |. 8B4C24 08 mov ecx, [arg.2]
004037FF |. 85D2 test edx, edx
00403801 |. 75 0D jnz short 00403810
00403803 |. 33C0 xor eax, eax
00403805 |. 85C9 test ecx, ecx
00403807 |. 74 06 jz short 0040380F
00403809 |. 8039 00 cmp byte ptr [ecx], 0
0040380C |. 74 01 je short 0040380F
0040380E |. 48 dec eax
0040380F |> C3 retn
00403810 |> 85C9 test ecx, ecx
00403812 |. 75 09 jnz short 0040381D
00403814 |. 33C0 xor eax, eax
00403816 |. 803A 00 cmp byte ptr [edx], 0
00403819 |. 74 01 je short 0040381C
0040381B |. 40 inc eax
0040381C |> C3 retn
0040381D |> F7C2 03000000 test edx, 00000003
00403823 |. 75 37 jnz short 0040385C
00403825 |> 8B02 mov eax, [edx]
00403827 |. 3A01 cmp al, [ecx] ; //明码依次比较输入的SN[i]和一个常串KEY[i];在此下断,从[ecx]中可依次可得SN='codebywidesoft'
00403829 |. 75 2B jne short 00403856 //nop掉,比较永远成功,才会比较下一个
0040382B |. 0AC0 or al, al
0040382D |. 74 24 jz short 00403853
0040382F |. 3A61 01 cmp ah, [ecx+1]
00403832 |. 75 22 jne short 00403856
00403834 |. 0AE4 or ah, ah
00403836 |. 74 1B jz short 00403853
00403838 |. C1E8 10 shr eax, 10
0040383B |. 3A41 02 cmp al, [ecx+2]
0040383E |. 75 16 jne short 00403856
00403840 |. 0AC0 or al, al
00403842 |. 74 0F jz short 00403853
00403844 |. 3A61 03 cmp ah, [ecx+3]
00403847 |. 75 0D jne short 00403856
00403849 |. 83C1 04 add ecx, 4
0040384C |. 83C2 04 add edx, 4
0040384F |. 0AE4 or ah, ah
00403851 |.^ 75 D2 jnz short 00403825
00403853 |> 33C0 xor eax, eax
00403855 |. C3 retn
00403856 |> 1BC0 sbb eax, eax
00403858 |. D1E0 shl eax, 1
0040385A |. 40 inc eax
0040385B |. C3 retn
0040385C |> F7C2 01000000 test edx, 00000001
00403862 |. 74 14 jz short 00403878
00403864 |. 8A02 mov al, [edx]
00403866 |. 42 inc edx
00403867 |. 3A01 cmp al, [ecx]
00403869 |.^ 75 EB jne short 00403856
0040386B |. 41 inc ecx
0040386C |. 0AC0 or al, al
0040386E |.^ 74 E3 jz short 00403853
00403870 |. F7C2 02000000 test edx, 00000002
00403876 |.^ 74 AD jz short 00403825
00403878 |> 66:8B02 mov ax, [edx]
0040387B |. 83C2 02 add edx, 2
0040387E |. 3A01 cmp al, [ecx]
00403880 |.^ 75 D4 jne short 00403856
00403882 |. 0AC0 or al, al
00403884 |.^ 74 CD jz short 00403853
00403886 |. 3A61 01 cmp ah, [ecx+1]
00403889 |.^ 75 CB jne short 00403856
0040388B |. 0AE4 or ah, ah
0040388D |.^ 74 C4 jz short 00403853
0040388F |. 83C1 02 add ecx, 2
00403892 \.^ EB 91 jmp short 00403825
NOP掉00403829的跳转,在00403827下断并运行,依次可在[ecx]中看到真正的注册码:codebywidesoft
不开OD,直接运行程序,输入codebywidesoft回车,提示注册成功,破解完成.
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
