【破文标题】CRACKME算法分析
【破文作者】逍遥风[OCN][PYG]
【作者邮箱】tc-xb@163.com
【破解工具】OD PEID
【破解平台】WINXP
------------------------------------------------------------------------
1）PEID检查，Borland Delphi 3.0 无壳
2）根据错误提示，用OD的字符串查找，很容易来到如下代码处 在这里下断
00427B44 /. 55 PUSH EBP
00427B45 |. 8BEC MOV EBP,ESP
00427B47 |. 6A 00 PUSH 0
00427B49 |. 6A 00 PUSH 0
00427B4B |. 53 PUSH EBX
00427B4C |. 8BD8 MOV EBX,EAX
00427B4E |. 33C0 XOR EAX,EAX
00427B50 |. 55 PUSH EBP
00427B51 |. 68 FA7B4200 PUSH echap515.00427BFA
00427B56 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00427B59 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
00427B5C |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
00427B5F |. 8B83 DC010000 MOV EAX,DWORD PTR DS:[EBX+1DC]
00427B65 |. E8 26E2FEFF CALL echap515.00415D90 ; 取注册名
00427B6A |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; EBP-4=注册名
00427B6D |. E8 3EBCFDFF CALL echap515.004037B0 ; 取注册名位数
00427B72 |. 48 DEC EAX ; 注册名位数减1
00427B73 |. 7C 30 JL SHORT echap515.00427BA5
00427B75 |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
00427B78 |. 8B83 EC010000 MOV EAX,DWORD PTR DS:[EBX+1EC]
00427B7E |. E8 0DE2FEFF CALL echap515.00415D90 ; 取假码位数
00427B83 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; EBP-4=假码
00427B86 |. 50 PUSH EAX
00427B87 |. 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
00427B8A |. 8B83 DC010000 MOV EAX,DWORD PTR DS:[EBX+1DC]
00427B90 |. E8 FBE1FEFF CALL echap515.00415D90 ; 取注册名位数
00427B95 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; EBP-8=注册名
00427B98 |. 5A POP EDX
00427B99 |. E8 82FEFFFF CALL echap515.00427A20 ; 算法CALL。。。
00427B9E |. 3D 4E61BC00 CMP EAX,0BC614E
00427BA3 |. 7D 1E JGE SHORT echap515.00427BC3
00427BA5 |> 6A 00 PUSH 0
00427BA7 |. 68 087C4200 PUSH echap515.00427C08 ; error
00427BAC |. 68 107C4200 PUSH echap515.00427C10 ; wrong serial number !
00427BB1 |. A1 44974200 MOV EAX,DWORD PTR DS:[429744]
00427BB6 |. E8 411EFFFF CALL echap515.004199FC
00427BBB |. 50 PUSH EAX ; |hOwner
00427BBC |. E8 4FD9FDFF CALL ; \MessageBoxA
00427BC1 |. EB 1C JMP SHORT echap515.00427BDF
00427BC3 |> 6A 00 PUSH 0
00427BC5 |. 68 287C4200 PUSH echap515.00427C28 ; success
00427BCA |. 68 307C4200 PUSH echap515.00427C30 ; congratulation ! you've did it.\nmail us : ekhmail@egroups.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
进入算法CALL。。。
00427A20 /$ 55 PUSH EBP
00427A21 |. 8BEC MOV EBP,ESP
00427A23 |. 83C4 F0 ADD ESP,-10
00427A26 |. 53 PUSH EBX
00427A27 |. 56 PUSH ESI
00427A28 |. 33C9 XOR ECX,ECX
00427A2A |. 894D F0 MOV DWORD PTR SS:[EBP-10],ECX
00427A2D |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX
00427A30 |. 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX
00427A33 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
00427A36 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00427A39 |. E8 26BFFDFF CALL echap515.00403964
00427A3E |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00427A41 |. E8 1EBFFDFF CALL echap515.00403964
00427A46 |. 33C0 XOR EAX,EAX
00427A48 |. 55 PUSH EBP
00427A49 |. 68 2A7B4200 PUSH echap515.00427B2A
00427A4E |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00427A51 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
00427A54 |. 33DB XOR EBX,EBX
00427A56 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; 注册名给EAX
00427A59 |. E8 52BDFDFF CALL echap515.004037B0 ; 取注册名位数
00427A5E |. 8BF0 MOV ESI,EAX ; EAX的值给ESI
00427A60 |. 85F6 TEST ESI,ESI
00427A62 |. 7E 3C JLE SHORT echap515.00427AA0
00427A64 |. B8 01000000 MOV EAX,1 ; 令EAX=1
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
