【破解日期】 2006年5月9日
【破解作者】 冷血书生
【作者邮箱】 没有
【作者主页】 http://blog.csdn.net/xueleng/
【使用工具】 OD
【破解平台】 Win9x/NT/2000/XP
【软件名称】 langxang's CrackMe1
【下载地址】 本地
【软件简介】 没啥好介绍的
【软件大小】 48KB
【加壳方式】 无
【破解声明】 我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------------------------
【破解内容】
Microsoft Visual Basic 5.0 / 6.0编写,下断bp rtcMsgBox到达下面:
00404809 C785 20FFFFFF >mov dword ptr ss:[ebp-E0],CRACKME1.00403B88 ; UNICODE "c:\" /// 取C盘卷标
00404813 C785 18FFFFFF >mov dword ptr ss:[ebp-E8],8
0040481D FFD3 call ebx
0040481F 8D55 A8 lea edx,dword ptr ss:[ebp-58]
00404822 52 push edx
00404823 FF15 20114000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>] ; MSVBVM60.__vbaI4Var
00404829 8985 E0FEFFFF mov dword ptr ss:[ebp-120],eax
0040482F 8D45 D8 lea eax,dword ptr ss:[ebp-28]
00404832 50 push eax
00404833 FF15 20114000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>] ; MSVBVM60.__vbaI4Var
00404839 8B4D 94 mov ecx,dword ptr ss:[ebp-6C]
0040483C 6A 7F push 7F
0040483E 8D95 6CFFFFFF lea edx,dword ptr ss:[ebp-94]
00404844 51 push ecx
00404845 52 push edx
00404846 8985 E4FEFFFF mov dword ptr ss:[ebp-11C],eax
0040484C FF15 28114000 call dword ptr ds:[<&MSVBVM60.__vbaStrToAns>; MSVBVM60.__vbaStrToAnsi
00404852 50 push eax
00404853 8D45 E8 lea eax,dword ptr ss:[ebp-18]
00404856 8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]
0040485C 50 push eax
0040485D 8D95 E4FEFFFF lea edx,dword ptr ss:[ebp-11C]
00404863 51 push ecx
00404864 52 push edx
00404865 8D45 80 lea eax,dword ptr ss:[ebp-80]
00404868 6A 7F push 7F
0040486A 8D8D 74FFFFFF lea ecx,dword ptr ss:[ebp-8C]
00404870 50 push eax
00404871 51 push ecx
00404872 FF15 D0104000 call dword ptr ds:[<&MSVBVM60.__vbaStrVarVa>; MSVBVM60.__vbaStrVarVal
00404878 8D95 70FFFFFF lea edx,dword ptr ss:[ebp-90]
0040487E 50 push eax
0040487F 52 push edx
00404880 FF15 28114000 call dword ptr ds:[<&MSVBVM60.__vbaStrToAns>; MSVBVM60.__vbaStrToAnsi
00404886 50 push eax
00404887 8D45 98 lea eax,dword ptr ss:[ebp-68]
0040488A 8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-84]
00404890 50 push eax
00404891 51 push ecx
00404892 FF15 D0104000 call dword ptr ds:[<&MSVBVM60.__vbaStrVarVa>; MSVBVM60.__vbaStrVarVal
00404898 8D95 78FFFFFF lea edx,dword ptr ss:[ebp-88]
0040489E 50 push eax
0040489F 52 push edx
004048A0 FF15 28114000 call dword ptr ds:[<&MSVBVM60.__vbaStrToAns>; MSVBVM60.__vbaStrToAnsi
004048A6 50 push eax
004048A7 E8 28F3FFFF call CRACKME1.00403BD4
004048AC 8985 DCFEFFFF mov dword ptr ss:[ebp-124],eax
004048B2 FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaSetSyste>; MSVBVM60.__vbaSetSystemError
004048B8 8B85 E4FEFFFF mov eax,dword ptr ss:[ebp-11C]
004048BE 8D95 18FFFFFF lea edx,dword ptr ss:[ebp-E8]
004048C4 8D4D D8 lea ecx,dword ptr ss:[ebp-28]
004048C7 8985 20FFFFFF mov dword ptr ss:[ebp-E0],eax
004048CD C785 18FFFFFF >mov dword ptr ss:[ebp-E8],3
004048D7 FFD3 call ebx
004048D9 8B8D E0FEFFFF mov ecx,dword ptr ss:[ebp-120]
004048DF 8D95 08FFFFFF lea edx,dword ptr ss:[ebp-F8]
004048E5 898D 10FFFFFF mov dword ptr ss:[ebp-F0],ecx
004048EB 8D4D A8 lea ecx,dword ptr ss:[ebp-58]
004048EE C785 08FFFFFF >mov dword ptr ss:[ebp-F8],3
004048F8 FFD3 call ebx
004048FA 8B95 6CFFFFFF mov edx,dword ptr ss:[ebp-94]
00404900 8D45 94 lea eax,dword ptr ss:[ebp-6C]
00404903 52 push edx
00404904 50 push eax
00404905 FF15 B0104000 call dword ptr ds:[<&MSVBVM60.__vbaStrToUni>; MSVBVM60.__vbaStrToUnicode
0040490B 8B8D DCFEFFFF mov ecx,dword ptr ss:[ebp-124]
00404911 BB 03000000 mov ebx,3
00404916 898D 00FFFFFF mov dword ptr ss:[ebp-100],ecx
0040491C 8D95 F8FEFFFF lea edx,dword ptr ss:[ebp-108]
00404922 8D4D C8 lea ecx,dword ptr ss:[ebp-38]
00404925 899D F8FEFFFF mov dword ptr ss:[ebp-108],ebx
0040492B FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMove>>; MSVBVM60.__vbaVarMove
00404931 8D95 6CFFFFFF lea edx,dword ptr ss:[ebp-94]
00404937 8D85 70FFFFFF lea eax,dword ptr ss:[ebp-90]
0040493D 52 push edx
0040493E 8D8D 74FFFFFF lea ecx,dword ptr ss:[ebp-8C]
00404944 50 push eax
00404945 8D95 78FFFFFF lea edx,dword ptr ss:[ebp-88]
0040494B 51 push ecx
0040494C 8D85 7CFFFFFF lea eax,dword ptr ss:[ebp-84]
00404952 52 push edx
00404953 50 push eax
00404954 6A 05 push 5
00404956 FF15 0C114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrL>; MSVBVM60.__vbaFreeStrList
0040495C 83C4 18 add esp,18
0040495F B8 02000000 mov eax,2 /// 固定值2
00404964 8D4D D8 lea ecx,dword ptr ss:[ebp-28]
00404967 8985 20FFFFFF mov dword ptr ss:[ebp-E0],eax
0040496D 8985 18FFFFFF mov dword ptr ss:[ebp-E8],eax
00404973 8D95 18FFFFFF lea edx,dword ptr ss:[ebp-E8]
00404979 51 push ecx
0040497A 8D85 58FFFFFF lea eax,dword ptr ss:[ebp-A8]
00404980 52 push edx
00404981 50 push eax
00404982 C785 10FFFFFF >mov dword ptr ss:[ebp-F0],75BCD15 ; 固定值75BCD15(十进制为123456789)
0040498C 899D 08FFFFFF mov dword ptr ss:[ebp-F8],ebx
00404992 FF15 C0104000 call dword ptr ds:[<&MSVBVM60.__vbaVarDiv>] ; MSVBVM60.__vbaVarDiv /// C盘卷标/2
00404998 8D8D 08FFFFFF lea ecx,dword ptr ss:[ebp-F8]
0040499E 50 push eax
0040499F 8D95 48FFFFFF lea edx,dword ptr ss:[ebp-B8]
004049A5 51 push ecx
004049A6 52 push edx
004049A7 FF15 24114000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>] ; MSVBVM60.__vbaVarAdd /// 上面计算结果再加上123456789,结果为机器码
004049AD 50 push eax
004049AE FF15 20114000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>] ; MSVBVM60.__vbaI4Var
004049B4 8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-B8]
004049BA 8947 44 mov dword ptr ds:[edi+44],eax ; 算得的机器码
004049BD FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>>; MSVBVM60.__vbaFreeVar
004049C3 8B07 mov eax,dword ptr ds:[edi]
004049C5 57 push edi
004049C6 FF90 14030000 call dword ptr ds:[eax+314]
004049CC 8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
004049D2 50 push eax
004049D3 51 push ecx
004049D4 FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
004049DA 8B57 44 mov edx,dword ptr ds:[edi+44]
004049DD 8B18 mov ebx,dword ptr ds:[eax]
004049DF 52 push edx
004049E0 8985 D8FEFFFF mov dword ptr ss:[ebp-128],eax
004049E6 FF15 0C104000 call dword ptr ds:[<&MSVBVM60.__vbaStrI4>] ; MSVBVM60.__vbaStrI4
004049EC 8BD0 mov edx,eax
004049EE 8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-84]
004049F4 FF15 40114000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>>; MSVBVM60.__vbaStrMove
004049FA 899D C4FEFFFF mov dword ptr ss:[ebp-13C],ebx
00404A00 8B9D D8FEFFFF mov ebx,dword ptr ss:[ebp-128]
00404A06 50 push eax
00404A07 8B85 C4FEFFFF mov eax,dword ptr ss:[ebp-13C]
00404A0D 53 push ebx
00404A0E FF90 A4000000 call dword ptr ds:[eax+A4]
00404A14 3BC6 cmp eax,esi
00404A16 DBE2 fclex
00404A18 7D 12 jge short CRACKME1.00404A2C
00404A1A 68 A4000000 push 0A4
00404A1F 68 FC3B4000 push CRACKME1.00403BFC
00404A24 53 push ebx
00404A25 50 push eax
00404A26 FF15 34104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultC>; MSVBVM60.__vbaHresultCheckObj
00404A2C 8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-84]
00404A32 FF15 54114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>; MSVBVM60.__vbaFreeStr
00404A38 8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
00404A3E FF15 58114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>>; MSVBVM60.__vbaFreeObj
00404A44 68 182D4000 push CRACKME1.00402D18
00404A49 FF15 98104000 call dword ptr ds:[<&MSVBVM60.__vbaNew>] ; MSVBVM60.__vbaNew
00404A4F 8D4D B8 lea ecx,dword ptr ss:[ebp-48]
00404A52 50 push eax
00404A53 51 push ecx
00404A54 FF15 04114000 call dword ptr ds:[<&MSVBVM60.__vbaVarSetOb>; MSVBVM60.__vbaVarSetObj
00404A5A 8B17 mov edx,dword ptr ds:[edi]
00404A5C 57 push edi
00404A5D FF92 14030000 call dword ptr ds:[edx+314]
00404A63 50 push eax
00404A64 8D85 68FFFFFF lea eax,dword ptr ss:[ebp-98]
00404A6A 50 push eax
00404A6B FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00404A71 8BD8 mov ebx,eax
00404A73 8D95 7CFFFFFF lea edx,dword ptr ss:[ebp-84]
00404A79 52 push edx
00404A7A 53 push ebx
00404A7B 8B0B mov ecx,dword ptr ds:[ebx]
00404A7D FF91 A0000000 call dword ptr ds:[ecx+A0]
00404A83 3BC6 cmp eax,esi
00404A85 DBE2 fclex
00404A87 7D 12 jge short CRACKME1.00404A9B
00404A89 68 A0000000 push 0A0
00404A8E 68 FC3B4000 push CRACKME1.00403BFC
00404A93 53 push ebx
00404A94 50 push eax
00404A95 FF15 34104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultC>; MSVBVM60.__vbaHresultCheckObj
00404A9B 8B85 7CFFFFFF mov eax,dword ptr ss:[ebp-84]
00404AA1 50 push eax
00404AA2 FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaI4Str>] ; MSVBVM60.__vbaI4Str
00404AA8 8985 C0FEFFFF mov dword ptr ss:[ebp-140],eax
00404AAE DB85 C0FEFFFF fild dword ptr ss:[ebp-140]
00404AB4 DD9D B8FEFFFF fstp qword ptr ss:[ebp-148]
00404ABA DD85 B8FEFFFF fld qword ptr ss:[ebp-148]
00404AC0 833D 00904000 >cmp dword ptr ds:[409000],0
00404AC7 75 08 jnz short CRACKME1.00404AD1
00404AC9 DC35 70114000 fdiv qword ptr ds:[401170] ; 机器码/4
00404ACF EB 11 jmp short CRACKME1.00404AE2
00404AD1 FF35 74114000 push dword ptr ds:[401174]
00404AD7 FF35 70114000 push dword ptr ds:[401170]
00404ADD E8 F2C7FFFF call <jmp.&MSVBVM60._adj_fdiv_m64>
00404AE2 DC0D 68114000 fmul qword ptr ds:[401168] ; 上面结果*3
00404AE8 DC05 60114000 fadd qword ptr ds:[401160] ; 上面结果+987654321 00404AEE DFE0 fstsw ax
00404AF0 A8 0D test al,0D
00404AF2 0F85 1D030000 jnz CRACKME1.00404E15
00404AF8 FF15 54104000 call dword ptr ds:[<&MSVBVM60.__vbaFPFix>] ; MSVBVM60.__vbaFPFix
00404AFE 8B95 1CFFFFFF mov edx,dword ptr ss:[ebp-E4]
00404B04 83EC 10 sub esp,10
00404B07 DD9D 20FFFFFF fstp qword ptr ss:[ebp-E0] ; 获得上面的结算结果
00404B0D 8BCC mov ecx,esp
00404B0F B8 05000000 mov eax,5
00404B14 8985 18FFFFFF mov dword ptr ss:[ebp-E8],eax
00404B1A 6A 01 push 1
00404B1C 8901 mov dword ptr ds:[ecx],eax
00404B1E 8B85 20FFFFFF mov eax,dword ptr ss:[ebp-E0]
00404B24 68 B83D4000 push CRACKME1.00403DB8 ; UNICODE "Md5_String_Calc" /// MD5类模块
00404B29 8D5F 34 lea ebx,dword ptr ds:[edi+34]
00404B2C 8951 04 mov dword ptr ds:[ecx+4],edx
00404B2F 8B95 24FFFFFF mov edx,dword ptr ss:[ebp-DC]
00404B35 8941 08 mov dword ptr ds:[ecx+8],eax
00404B38 8D45 B8 lea eax,dword ptr ss:[ebp-48]
00404B3B 50 push eax
00404B3C 8951 0C mov dword ptr ds:[ecx+C],edx
00404B3F 8D8D 58FFFFFF lea ecx,dword ptr ss:[ebp-A8]
00404B45 51 push ecx
00404B46 FF15 38114000 call dword ptr ds:[<&MSVBVM60.__vbaVarLateM>; MSVBVM60.__vbaVarLateMemCallLd
00404B4C 83C4 20 add esp,20
00404B4F 8BD0 mov edx,eax
00404B51 8BCB mov ecx,ebx
00404B53 FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMove>>; MSVBVM60.__vbaVarMove
00404B59 8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-84]
00404B5F FF15 54114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>; MSVBVM60.__vbaFreeStr
00404B65 8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
00404B6B FF15 58114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>>; MSVBVM60.__vbaFreeObj
00404B71 8D8D 58FFFFFF lea ecx,dword ptr ss:[ebp-A8]
00404B77 FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>>; MSVBVM60.__vbaFreeVar
00404B7D 8D95 58FFFFFF lea edx,dword ptr ss:[ebp-A8]
00404B83 8D85 48FFFFFF lea eax,dword ptr ss:[ebp-B8]
00404B89 52 push edx
00404B8A 6A 06 push 6
00404B8C 53 push ebx
00404B8D 50 push eax
00404B8E C785 60FFFFFF >mov dword ptr ss:[ebp-A0],8
00404B98 C785 58FFFFFF >mov dword ptr ss:[ebp-A8],2
00404BA2 FF15 60104000 call dword ptr ds:[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
00404BA8 8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-B8]
00404BAE 51 push ecx
00404BAF FF15 18104000 call dword ptr ds:[<&MSVBVM60.__vbaStrVarMo>; MSVBVM60.__vbaStrVarMove
00404BB5 8BD0 mov edx,eax
00404BB7 8D4D 90 lea ecx,dword ptr ss:[ebp-70]
00404BBA FF15 40114000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>>; MSVBVM60.__vbaStrMove
00404BC0 8B1D 1C104000 mov ebx,dword ptr ds:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00404BC6 8D95 48FFFFFF lea edx,dword ptr ss:[ebp-B8]
00404BCC 8D85 58FFFFFF lea eax,dword ptr ss:[ebp-A8]
00404BD2 52 push edx
00404BD3 50 push eax
00404BD4 6A 02 push 2
00404BD6 FFD3 call ebx
00404BD8 8B0F mov ecx,dword ptr ds:[edi]
00404BDA 83C4 0C add esp,0C
00404BDD 57 push edi
00404BDE FF91 10030000 call dword ptr ds:[ecx+310]
00404BE4 8D95 68FFFFFF lea edx,dword ptr ss:[ebp-98]
00404BEA 50 push eax
00404BEB 52 push edx
00404BEC FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00404BF2 8BF8 mov edi,eax
00404BF4 8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-84]
00404BFA 51 push ecx
00404BFB 57 push edi
00404BFC 8B07 mov eax,dword ptr ds:[edi]
00404BFE FF90 A0000000 call dword ptr ds:[eax+A0]
00404C04 3BC6 cmp eax,esi
00404C06 DBE2 fclex
00404C08 7D 12 jge short CRACKME1.00404C1C
00404C0A 68 A0000000 push 0A0
00404C0F 68 FC3B4000 push CRACKME1.00403BFC
00404C14 57 push edi
00404C15 50 push eax
00404C16 FF15 34104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultC>; MSVBVM60.__vbaHresultCheckObj
00404C1C 8B95 7CFFFFFF mov edx,dword ptr ss:[ebp-84]
00404C22 8B45 90 mov eax,dword ptr ss:[ebp-70]
00404C25 52 push edx
00404C26 50 push eax
00404C27 FF15 78104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCmp>] ; MSVBVM60.__vbaStrCmp
00404C2D 8BF8 mov edi,eax
00404C2F 8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-84]
00404C35 F7DF neg edi
00404C37 1BFF sbb edi,edi
00404C39 47 inc edi
00404C3A F7DF neg edi
00404C3C FF15 54114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>>; MSVBVM60.__vbaFreeStr
00404C42 8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
00404C48 FF15 58114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>>; MSVBVM60.__vbaFreeObj
00404C4E B9 04000280 mov ecx,80020004
00404C53 B8 0A000000 mov eax,0A
00404C58 66:3BFE cmp di,si
00404C5B 898D 30FFFFFF mov dword ptr ss:[ebp-D0],ecx
00404C61 8985 28FFFFFF mov dword ptr ss:[ebp-D8],eax
00404C67 898D 40FFFFFF mov dword ptr ss:[ebp-C0],ecx
00404C6D 8985 38FFFFFF mov dword ptr ss:[ebp-C8],eax
00404C73 898D 50FFFFFF mov dword ptr ss:[ebp-B0],ecx
00404C79 8985 48FFFFFF mov dword ptr ss:[ebp-B8],eax
00404C7F 74 67 je short CRACKME1.00404CE8 /// 爆破点
///////////////////////////////////////////////////////////////////////////////////////
算法总结:
C盘卷标/2 +123456789= 机器码
**************************************************************************************
MD5(机器码/4 *3 +987654321) = A
取A的取6--13位即为注册码
--------------------------------------------------------------------------------
【破解总结】
没啥好总结的,纯属娱乐~~
--------------------------------------------------------------------------------
【版权声明】 本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
