[原创]VMProtect保护壳爆破步骤详解（入门级）-逆向工程-看雪安全社区

# 1. 原理
## 1.1 VMProtect Software 公司
VMProtect 软件公司成立于2000年，总部位于俄罗斯叶卡捷琳堡。该公司出品的软件保护软件 VMProtect（目前版本已更新到 3.x，以下简称VMP）可以说是软件破解领域的圣杯，多年来无数逆向分析人员前赴后继，一直试图揭开 VMP 的神秘面纱。
VMP 的特色功能包括虚拟化、混淆、反调试等。本文的测试内容主要针对的是VMP的虚拟化机制，即VMP 可以将受保护的代码放到内置的虚拟机中运行，以防止反编译和破解。
## 1.2 VMProtect 虚拟化原理
VMP 代码虚拟机是一款栈机，也就是说，VMP 的代码虚拟机与被保护程序的代码处于栈空间中。基于栈的虚拟机指令集主要是通过操作栈顶元素来完成。例如，Java 虚拟机（JVM）就是一个典型的基于栈的虚拟机。与之相对应的还有基于寄存器的虚拟机。指令操作数存储在虚拟寄存器中，指令集直接对寄存器进行操作。Lua 的虚拟机（称为 Lua 虚拟机，LVM）就是基于寄存器的。
而基于栈的 VMP 虚拟机因为要维护出栈入栈，所以执行同样的操作，需要的指令较多，间接使得执行效率较差。 VMP 会让程序变得臃肿、运行速度变慢，但被保护的程序代码膨胀后，也能给逆向分析人员造成很多困扰。

| **基本块名称** | **功能** |
| --- | --- |
| VStartVM | 从真实环境到虚拟环境的转换，开启新的虚拟空间给虚拟机使用，将除 esp 外的所有寄存器压入堆栈，esp 寄存器原来的值存放在 ebp 寄存器中 |
| VMDispatcher | 虚拟指令调度分流 |
| VHandler1..N | 不同功能的虚拟指令 |
| VCheckESP | 检查堆栈基本块,如果 esp (VMP 使用的堆栈)与 ebp (真实堆栈)即将被覆盖,则跟踪转到下一个基本块来开辟堆栈地址（sub esp, xxx），并将原来的 VMContext 中的内容复制到新的堆栈地址处，否则跳回 VMDispatcher |
| VRet | 这个指令存在于 VHandler 集合中。这个指令将堆栈中压入的寄存器值还原到物理寄存器中，然后退出整个虚拟机环境，并切换回真实的 CPU 环境。注意：这个指令的作用是退出虚拟环境，并不等于汇编语义上的 retn。 |

（表格出自《加密与解密（第4版）》）
 VMP 虚拟化流程：
1.  VMP 将被保护的代码转换为虚拟机指令集（bytecode），并为每个虚拟指令对应一个处理程序（handler），每个 handler 实际上是一个小型的解释器。这些处理程序不是简单的地址，而是具体的处理逻辑代码。在代码转换过程中， VMP 还会对指令进行混淆和加密，以增加逆向工程的难度。
2.  VMP 还会对一些系统对象如文件、注册表等进行虚拟化，在虚拟机内部维护虚拟的系统资源，使得在虚拟机内部的系统交互不会影响到真实系统。 VMP 通常会结合多种反调试技术,例如代码自修改、反跟踪、反模拟执行等，增加调试难度。
3.  受保护程序运行时，会首先执行插入的 VStartVM 代码。 （VStartVM 通常是作为程序入口点被插入到受保护代码中的 ）VStartVM 负责将程序从真实环境转换到虚拟环境，并初始化虚拟机的上下文环境，将真实环境中的寄存器状态保存，并准备虚拟机所需的堆栈空间。此外，VStartVM 还会对一些关键的系统API进行hook，以截获系统调用并在虚拟环境中模拟执行。 VMP 允许在受保护代码块中插入特定的指令，用于主动切换回真实环境，例如调用未被 hook 的系统 API。
4. VMDispatcher 负责从虚拟指令流中读取虚拟指令（bytecode），然后通过解码确定对应的处理程序（handler）。解码后的虚拟指令并不是直接执行真实指令，而是调用相应的 handler 来模拟执行，这些 handler 处理的是虚拟机指令，而不是直接的原始指令。
5. VMP 使用两个堆栈：虚拟堆栈和真实堆栈。虚拟堆栈供虚拟机内部使用，而真实堆栈是线程原有的堆栈。为了避免两者冲突，VMP 会监控堆栈指针 esp。当虚拟指令需要修改真实寄存器时，真实寄存器的值会被临时保存在真实堆栈中，并将虚拟寄存器的值应用到真实寄存器上。如果 esp 与 ebp 即将发生冲突，VMP 会将当前虚拟机上下文保存到真实堆栈，然后开辟新的虚拟堆栈空间，确保虚拟机正常运行。对于多线程程序， VMP 会为每个线程维护独立的虚拟机上下文(VMContext),不同线程的虚拟机之间相互隔离。
6. 虚拟化指令执行完之后，虚拟机并不会立即退出虚拟环境。只有在整个受保护代码块执行完毕或者发生异常时，才会退出虚拟环境，恢复真实环境中的状态。退出虚拟环境时，虚拟机会恢复原始的寄存器状态，并确保所有的上下文环境都正确恢复。不过在退出之前，还需要将虚拟寄存器的值写回到真实寄存器，并解除之前所做的系统API hook。
# 2. 测试程序
## 2.1 测试环境
系统环境：Windows 7 专业版（32 位）
IDE：Dev-C++ 5.7.1
加壳程序：VMProtect 3.4
## 2.2 测试程序源代码
```
#include<bits/stdc++.h>
#include<windows.h>
using namespace std;

int main()
{
    printf("Please enter your pwd >> ");
    string s;
    cin>>s;
    if(s=="123456")
        printf("successful!\n");
    else
        printf("failed!\n");
    system("pause");
    return 0;
}
```
编译得到`CrackMe.exe`
## 2.3 测试目标
在输入错误密码的情况下，程序仍可打印“successful！”
（测试演示出自B站up主Rairn，文末有提供视频链接）
# 3.  VMP 编译测试程序
 用 OD 加载CrackMe.exe，找到一个关键且易识别的位置，用 VMP 加密；在 OD 反汇编窗口点击右键，选择`中文搜索引擎->智能搜索`，搜索源代码中的字符串，例如`successful`
!<a href="elink@267K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0f1J5y4U0j5^5x3o6q4Q4x3X3c8S2x3X3j5%4j5X3t1^5y4q4)9J5k6r3c8T1k6h3q4Q4x3X3b7@1k6o6g2X3i4K6u0V1j5U0W2V1y4#2)9J5k6o6u0V1j5h3b7K6x3o6R3&6k6o6k6X3y4g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3g2V1k6h3p5$3j5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5z5e0W2Q4x3U0k6A6k6q4)9K6c8s2g2X3k6X3p5$3z5r3x3H3y4q4)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7@1z5g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0l9J5y4g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5y4e0p5J5y4U0c8Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0g2X3x3$3k6X3z5e0y4T1i4K6u0V1x3U0j5@1k6W2)9J5k6o6b7K6k6o6g2Q4x3X3c8S2y4$3x3I4i4K6u0V1x3o6V1&6y4X3k6S2z5r3t1&6k6X3q4Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5y4U0R3K6i4K6u0W2x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6y4l9`.`.">image.png</a>
点进字符串`successful`对应的地址 `0x00401702`，分析一下反汇编代码，将加壳位置定为 `0x004016B0`，这看上去应该是一个函数的起始位置。将`004016B0    55              PUSH EBP`复制到剪切板，在记事本或其他类似工具记下来。
!<a href="elink@aedK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0f1@1x3o6j5H3x3e0S2Q4x3X3b7I4z5h3j5%4y4o6c8T1z5g2)9J5k6o6V1@1x3K6N6Q4x3X3b7@1j5U0y4U0i4K6u0V1j5X3b7I4z5g2)9J5k6o6R3I4x3K6q4W2j5e0p5#2k6r3p5&6y4q4)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5&6k6U0R3H3y4g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7@1x3o6k6Q4x3U0k6A6k6q4)9K6c8s2g2U0y4U0b7J5x3e0p5%4x3#2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6j5H3z5g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1^5x3W2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5x3U0R3&6x3o6u0Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6h3k6W2k6o6p5K6j5U0l9^5i4K6u0V1x3X3b7$3x3#2)9J5k6o6c8X3x3e0c8Q4x3X3c8S2y4X3f1%4i4K6u0V1k6e0b7$3z5o6c8U0x3$3k6S2z5h3q4Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5z5o6f1@1i4K6u0W2y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3y4R3`.`.">image.png</a>
打开 VMProtect 3.4，点击`需保护的进程->添加进程`，然后把地址`004016B0`复制进去，编译类型选择`超级（编译+虚拟）`
!<a href="elink@208K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0f1&6x3e0p5H3y4o6W2Q4x3X3b7I4k6U0u0W2x3e0l9J5z5g2)9J5k6o6m8X3y4o6W2Q4x3X3b7@1j5$3q4U0i4K6u0V1z5e0p5I4j5g2)9J5k6o6b7I4k6X3b7I4y4K6R3&6x3X3x3^5j5#2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3K6V1$3j5h3c8U0x3#2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7I4z5o6g2Q4x3U0k6A6k6q4)9K6c8s2f1@1y4h3j5%4k6r3c8W2z5q4)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6t1%4y4#2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1&6x3g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7^5z5e0b7#2y4q4)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2k6e0u0S2z5r3p5H3j5$3u0Q4x3X3c8X3z5o6x3@1i4K6u0V1y4o6V1%4x3#2)9J5k6r3p5K6j5e0k6Q4x3X3b7I4x3X3k6X3x3o6u0X3y4h3u0V1y4q4)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7^5y4U0m8Q4x3X3f1$3y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3">image.png</a>
!<a href="elink@793K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0j5I4x3o6V1$3x3o6q4Q4x3X3c8S2y4$3q4T1j5K6m8U0y4g2)9J5k6o6q4S2k6U0u0Q4x3X3b7@1z5o6j5J5i4K6u0V1j5U0S2U0j5W2)9J5k6o6x3J5y4U0y4V1x3o6j5#2x3e0R3$3x3g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3x3K6k6o6m8U0k6g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7I4y4e0S2Q4x3U0k6A6k6q4)9K6c8s2f1@1z5e0R3@1k6h3y4S2j5#2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6t1K6y4#2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0f1$3y4q4)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7#2x3K6R3$3y4g2)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2j5K6t1J5z5o6V1J5j5U0k6Q4x3X3c8S2y4h3k6S2i4K6u0V1y4o6f1^5z5g2)9J5k6r3q4T1y4$3c8Q4x3X3c8S2k6e0m8T1j5e0u0X3k6o6b7#2j5#2)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7I4x3o6b7J5i4K6u0W2y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3y4H3`.`.">image.png</a>
点击`选项`，除了`移除调试信息`选“是”，其余都选“否”，因为这次测试只针对虚拟机保护，暂不研究其他内容。
!<a href="elink@06eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0j5J5z5o6t1$3x3o6W2Q4x3X3c8V1y4X3x3J5x3o6W2S2z5q4)9J5k6r3k6U0j5$3q4Q4x3X3b7@1j5e0g2V1i4K6u0V1z5o6j5H3x3q4)9J5k6o6c8W2k6e0S2U0j5U0y4T1k6U0W2S2z5g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3f1J5k6o6k6T1x3q4)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7@1y4o6g2Q4x3U0k6A6k6q4)9K6c8s2f1&6j5h3t1&6x3U0q4U0y4W2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6j5$3z5q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0f1&6x3q4)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7I4x3o6f1#2x3U0N6Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0V1J5j5U0b7%4z5o6u0V1i4K6u0V1j5$3t1I4j5W2)9J5k6o6b7K6k6U0c8Q4x3X3c8S2j5U0M7$3i4K6u0V1k6X3g2V1y4K6M7%4j5$3q4T1k6o6W2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0l9$3x3l9`.`.">image.png</a>
然后点击`编译`，就可以得到加壳后的文件`CrackMe.vmp.exe`
!<a href="elink@fdfK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0j5@1y4K6t1#2y4e0q4Q4x3X3b7$3y4U0x3I4j5$3c8S2j5W2)9J5k6r3p5J5x3e0q4Q4x3X3b7@1x3$3k6X3i4K6u0V1j5X3u0T1j5#2)9J5k6r3p5#2j5K6p5$3y4X3t1^5y4o6l9&6j5#2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3b7K6k6o6k6U0j5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7@1y4o6W2Q4x3U0k6A6k6q4)9K6c8s2g2T1y4K6j5I4k6e0t1H3j5#2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6j5%4x3#2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0f1^5z5g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7I4x3e0b7$3y4o6W2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0q4W2x3U0m8W2j5$3y4W2i4K6u0V1y4o6S2S2k6W2)9J5k6o6b7&6z5o6y4Q4x3X3c8T1j5$3f1%4i4K6u0V1x3K6R3J5j5K6R3$3x3U0u0T1j5$3g2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0l9#2z5g2)9J5k6e0x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3`.">image.png</a>
用 LordPE 查看，` CrackMe.vmp.exe `多了一个区段`.vmp0`
!<a href="elink@856K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0j5%4y4o6t1#2y4K6u0Q4x3X3c8W2y4r3u0X3j5U0f1&6x3q4)9J5k6r3x3I4j5h3k6Q4x3X3b7@1y4K6y4T1i4K6u0V1j5e0q4U0k6g2)9J5k6o6M7$3k6o6q4V1j5U0x3&6k6o6R3^5z5g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3b7@1j5X3x3%4z5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7I4y4K6q4Q4x3U0k6A6k6q4)9K6c8s2f1%4k6r3p5$3x3K6S2S2x3q4)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6t1#2y4#2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5y4K6x3#2i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6x3K6x3o6j5%4i4K6t1$3M7%4c8S2N6s2g2K6i4K6y4p5k6r3!0F1k6g2)9J5y4Y4y4@1P5h3I4W2i4K6y4p5L8X3!0F1k6g2)9J5y4Y4c8S2M7$3E0u0k6q4)9K6c8s2g2X3y4K6f1^5j5h3u0X3k6q4)9J5k6o6p5@1j5h3y4Q4x3X3b7@1j5K6m8X3i4K6u0V1z5o6S2V1j5g2)9J5k6o6b7J5k6h3p5@1k6o6M7%4y4r3q4X3i4K6t1$3N6r3W2@1L8r3g2Q4x3@1c8Q4x3U0k6%4K9h3c8@1K9q4)9K6c8o6b7&6x3l9`.`.">image.png</a>
# 4. 调试和脚本编写
## 4.1 调试准备
用 OD 加载`CrackMe.vmp.exe`，做好以下几个准备。

- 在调试选项中设置，因为记录需要跟踪的信息
!<a href="elink@a12K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0M7#2z5e0j5J5x3K6m8Q4x3X3b7J5y4$3t1#2x3e0W2V1y4q4)9J5k6o6R3@1k6o6W2Q4x3X3b7@1y4r3b7I4i4K6u0V1z5r3k6X3y4g2)9J5k6o6N6X3k6X3b7#2j5X3x3K6x3r3q4X3z5q4)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5%4k6U0g2X3y4q4)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6y4U0q4Q4x3U0k6A6k6q4)9K6c8s2f1J5x3$3t1@1x3U0V1&6y4g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6f1@1x3g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5y4K6p5K6i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6p5I4x3o6M7K6y4W2)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2z5o6N6X3z5o6y4S2k6r3y4Q4x3X3b7I4z5o6q4U0i4K6u0V1y4o6W2S2y4g2)9J5k6r3p5J5x3h3k6Q4x3X3c8X3y4$3u0S2x3r3j5I4x3U0t1K6y4g2)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7@1y4K6g2Q4x3X3f1K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6">image.png</a>

- 打开 RUN 跟踪
  ![](upload/attach/202405/944427_5JG27SRJGBBH5US.webp)

- 点击菜单栏的`E`，将显示的 DLL 标记为系统 DLL，以免之后调试跟踪（ trace） 时被记录
!<a href="elink@130K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0M7@1y4o6R3$3y4o6S2Q4x3X3c8W2x3e0x3#2j5K6l9$3x3q4)9J5k6o6m8T1x3U0W2Q4x3X3b7@1z5e0y4S2i4K6u0V1z5h3p5%4x3W2)9J5k6r3p5^5y4o6R3H3k6o6g2T1y4e0p5%4y4g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3g2X3k6h3c8W2y4#2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7@1x3o6N6Q4x3U0k6A6k6q4)9K6c8s2f1@1x3K6c8V1k6h3b7$3x3#2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6j5I4x3q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5z5o6t1&6i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6p5H3y4o6p5^5y4g2)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2x3o6l9%4x3X3q4S2k6r3k6Q4x3X3b7^5y4o6R3%4i4K6u0V1y4o6f1J5x3g2)9J5k6r3t1I4j5h3c8Q4x3X3b7&6y4o6y4U0k6r3b7K6j5U0b7J5x3g2)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7#2y4e0u0Q4x3X3f1$3y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3">image.png</a>
## 4.2 调试过程
Ctrl + g 进入之前记下的地址`004016B0`，在此处 F2 下一个断点然后运行。可以看到，对比加壳前的情况，反汇编代码已经发生了很大变化。
!<a href="elink@868K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0M7&6y4e0j5$3y4K6W2Q4x3X3c8V1j5X3j5J5j5$3k6W2j5W2)9J5k6o6u0U0x3h3u0Q4x3X3b7@1k6X3y4V1i4K6u0V1j5e0j5&6k6q4)9J5k6o6p5$3y4$3u0S2k6U0m8V1y4U0g2W2k6W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5@1k6U0u0W2z5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6z5o6S2Q4x3U0k6A6k6q4)9K6c8s2f1%4y4h3p5H3x3K6j5$3z5g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6f1^5x3W2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0p5%4x3g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7I4z5o6V1H3y4K6m8Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6h3q4T1x3e0m8W2y4o6m8X3i4K6u0V1y4h3p5$3j5g2)9J5k6o6b7@1y4h3y4Q4x3X3b7^5y4e0V1^5i4K6u0V1z5r3u0T1y4e0q4W2k6h3x3$3x3K6c8Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5y4K6R3H3i4K6u0W2y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3y4R3`.`.">image.png</a>
Ctrl + F11 跟踪步过，程序也打印出了
> Please enter your pwd >>

!<a href="elink@483K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0R3I4x3K6p5@1x3K6c8Q4x3X3b7H3y4r3y4V1k6U0p5#2j5g2)9J5k6o6V1%4j5$3y4Q4x3X3b7@1j5h3p5H3i4K6u0V1z5e0b7&6y4W2)9J5k6o6b7&6y4U0u0X3k6r3p5&6x3e0R3%4x3g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3K6S2X3z5r3b7^5y4q4)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5x3U0W2Q4x3U0k6A6k6q4)9K6c8s2f1#2x3o6y4T1j5X3g2V1k6g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6x3@1x3#2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5z5e0R3H3i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6p5I4x3o6j5K6y4W2)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2k6o6t1$3y4e0W2U0y4K6u0Q4x3X3b7K6x3o6m8W2i4K6u0V1y4r3p5@1j5W2)9J5k6o6V1H3y4K6k6Q4x3X3b7^5k6e0p5K6y4o6u0W2j5e0m8V1k6W2)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7$3y4e0y4Q4x3X3f1K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3@1">image.png</a>
## 4.3 Trace 记录
在程序中随便输入一个密码，例如`55`，然后点开 OD 菜单栏中的`……`，点击右键选择 `记录到文件`，把调试跟踪的结果保存为 `trace.txt`，记得勾选“附加到已有文件”和“写入采集的数据”
!<a href="elink@3daK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0R3@1y4K6l9@1x3K6S2Q4x3X3c8V1k6X3u0U0z5h3p5#2x3W2)9J5k6r3g2W2j5e0u0Q4x3X3b7@1x3e0b7K6i4K6u0V1j5e0x3J5y4#2)9J5k6o6k6U0k6U0l9I4y4r3p5@1x3K6R3%4x3g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3t1K6j5U0u0T1x3g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6x3K6m8Q4x3U0k6A6k6q4)9K6c8s2f1@1j5h3u0V1z5e0y4T1x3q4)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7&6y4g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0j5%4x3g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5y4U0t1@1x3o6q4Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0x3I4j5$3u0U0x3o6m8W2i4K6u0V1x3U0l9^5y4g2)9J5k6o6c8X3y4o6c8Q4x3X3b7^5j5h3j5&6i4K6u0V1z5o6R3I4y4U0b7&6k6e0f1&6j5h3g2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0p5I4y4l9`.`.">image.png</a>
!<a href="elink@debK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0R3$3x3e0V1I4x3K6q4Q4x3X3c8U0x3K6g2V1j5X3f1H3x3g2)9J5k6o6m8X3z5h3q4Q4x3X3b7@1y4o6m8W2i4K6u0V1z5e0M7$3y4q4)9J5k6r3x3^5j5$3u0X3y4U0V1H3x3e0j5K6z5g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5K6k6U0u0X3x3q4)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5z5o6W2Q4x3U0k6A6k6q4)9K6c8s2g2T1j5X3p5H3y4X3b7$3z5g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7K6y4q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5y4U0f1^5i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6M7^5z5o6M7J5i4K6t1$3M7%4c8S2N6s2g2K6i4K6y4p5k6r3!0F1k6g2)9J5y4Y4y4@1P5h3I4W2i4K6y4p5L8X3!0F1k6g2)9J5y4Y4c8S2M7$3E0u0k6q4)9K6c8s2g2T1y4r3x3$3y4o6p5&6j5g2)9J5k6r3t1J5z5e0u0Q4x3X3b7@1k6r3t1H3i4K6u0V1z5o6u0U0x3q4)9J5k6o6N6V1y4X3x3I4z5e0p5H3y4K6y4S2i4K6t1$3N6r3W2@1L8r3g2Q4x3@1c8Q4x3U0k6%4K9h3c8@1K9q4)9K6c8o6b7K6z5q4)9J5k6e0j5$3y4U0j5$3y4U0j5$3y4U0j5$3y4U0M7`.">image.png</a>
查看`trace.txt`
!<a href="elink@099K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0R3%4x3o6p5$3z5o6W2Q4x3X3b7J5k6o6t1J5j5X3g2V1x3#2)9J5k6r3p5#2y4U0N6Q4x3X3b7@1z5e0m8T1i4K6u0V1j5e0t1$3y4g2)9J5k6o6S2T1k6e0y4V1y4e0g2S2y4o6p5^5j5g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5%4k6U0g2X3x3#2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7#2y4U0y4Q4x3U0k6A6k6q4)9K6c8s2f1H3x3U0V1&6y4$3u0W2k6W2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6R3@1y4g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1#2y4#2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5y4e0j5I4y4e0S2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0f1K6y4r3p5I4k6o6k6T1i4K6u0V1y4h3b7^5x3#2)9J5k6o6b7$3x3e0g2Q4x3X3b7&6y4K6g2S2i4K6u0V1y4X3j5%4y4U0t1&6x3r3p5#2y4U0S2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5z5o6x3^5">image.png</a>
在`trace.txt`搜索`00000040`，因为十六进制的`00000040`的二进制是`0100 0000`，可以被用来表示 ZF 标志位。在 x86 架构中，ZF 标志位的位置正好对应到 EFLAGS 寄存器的第 6 位（从第 0 位开始算起）。也就是说，当执行某些指令后，如果结果为零，则 ZF 标志位会被置 1。
VMP 会使用以下公式来计算 ZF 的值：
```
zf = and(0x40, eflags)
```
其中，0x40 就是 ZF 标志位的掩码值。当 eflags 寄存器的第 6 位为 1 时，and 运算的结果也会为 1，表示 ZF 标志位为 1。反之，当第 6 位为 0 时，and 运算的结果为 0，表示 ZF 标志位为 0。这样做可以非常高效地判断 ZF 标志位的状态，而不需要进行复杂的计算。
本次爆破测试是比较输入的密码是否是正确的密码，所以代码实现逻辑大概率依靠 CMP、JZ（若为 0 则跳转，ZF 需为 1）或者JE（若相等则跳转，ZF 需为 1）。
这类指令影响的符号位正是 ZF，所以需要搜寻`00000040`。
找到`00000040`后还需要在附近寻找类似以下特征的汇编指令
```
not a
not b
and a,b
//这三行代码通常不是连续出现，中间会有无用的代码隔开
//a, b皆为通用寄存器
```
寻找具备这种特征的汇编指令，是因为这是与非门（俗称万用门）的运算逻辑，表示为: Nand(a,b) = ~a & ~b，即将两个数分别取反后再进行与运算。汇编里面最基本的4种逻辑运算，都能用与非门表示。所以 VMP 3.x 版本中大量使用了Nand运算来表示其他的逻辑运算，真实地隐藏了原本的各种逻辑运算，有效地加大了逆向分析的难度。
```
Not(a) = ~a = ~a & ~a = Nand(a,a)
Or(a,b) = a | b = ~(~a & ~b) = Nand(Nand(a,b),Nand(a,b))
And(a,b) = a & b = ~~a & ~~b = Nand(Nand(a,a),Nand(b,b))
Xor(a,b) = (~a & b) | (a & ~b) = (0 | (a & ~b)) | (0 | (b & ~a)) = (a & (~a | ~b)) | (b & (~a | ~b)) = (~a | ~b) & (a | b) = ~(a & b) | ~(~a & ~b) = Nand(And(a,b),Nand(a,b)) =Nand(Nand(Nand(a,a),Nand(b,b)),Nand(a,b))
```
cmp指令本质上是减法，只不过结果不会写回操作数，Nand 门也能实现减法：
```
-a = ~a+1  => ~a = -a -1
~(~a+b) = ~(-a-1+b) = -(-a-1+b)-1 = a-b  => a-b = Not(Not(a)+b)
a-b最终可以由Not(Not(a)+b)来表示，而Not(a)又可以用Nand(a,a)来表示
```
简而言之，看到了`not a, not b, and a,b`这类特征的反汇编指令，就可以合理怀疑此处是 VMP 处理虚拟机指令的 handler 。VMP 会在 handler 入口处大量使用 nand 门运算来隐藏原本的各种逻辑运算。这些"Nand"指令往往会涉及对EFLAGS寄存器的读写操作。通过精细控制EFLAGS标志位的状态，VMP 可以实现对程序控制流的保护。
找到了疑似的指令，记下做 and 运算指令的地址`0049B79E`、以及两个寄存器的值`ECX=00000040`、`EAX=00000246`
```
and ecx, eax//运算结果为0x40
```
!<a href="elink@558K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0V1$3y4K6V1$3y4e0c8Q4x3X3b7#2y4U0R3K6x3$3j5J5x3q4)9J5k6r3c8S2x3U0g2Q4x3X3b7@1k6r3p5$3i4K6u0V1j5e0g2X3y4q4)9J5k6o6k6X3y4h3c8T1y4X3b7I4y4o6x3#2k6W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3f1I4k6e0m8V1k6g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5z5e0q4Q4x3U0k6A6k6q4)9K6c8s2f1J5z5o6t1$3x3e0q4V1x3g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7K6y4W2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0p5H3x3#2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7I4x3U0x3@1z5e0u0Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0q4U0x3e0y4X3z5o6t1$3i4K6u0V1x3U0f1K6k6g2)9J5k6o6b7%4z5r3k6Q4x3X3b7^5x3o6W2U0i4K6u0V1j5U0j5#2z5r3y4T1k6h3p5&6x3$3k6Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5y4K6x3#2i4K6u0W2x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6y4l9`.`.">image.png</a>
（FL 是 Flags标志位的缩写，FL=0 意味着在执行指令`and ecx, eax`后没有发生任何标志位的改变。因为`and ecx, eax`执行结果为0x40，也就是说原本的 ZF 标志位就是 1。在后面的操作中，我们只需要将修改 ecx ，就能将 ZF 的标志位改为 0， 就能改变程序原本的跳转逻辑。例如，在输入错误时，原本打印“failed”，就能跳转到 “successful！“）
## 4.4 脚本编写
```
bp 0049B79E           //设置断点，当程序执行到地址 0049B79E 时暂停执行。

start:                //标签，用于标识后续指令的起始位置。
run                   //继续执行程序，直到触发了设置的断点。
cmp ecx, 00000040
jnz start
cmp eax, 00000246
jnz start

end:
bc 0049B79E           //清除断点，使得程序不再在地址 0049B79E 处暂停执行。
ret                   //返回指令，结束当前脚本的执行。
```
保存为`script.txt`
# 5. 重新调试和破解
## 5.1 运行脚本
OD 重新加载`CrackMe.vmp.exe`，在反汇编窗口点击右键，选择`运行脚本->script.txt`
!<a href="elink@143K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4U0l9J5z5o6b7@1x3e0N6Q4x3X3c8X3x3h3c8U0y4r3f1H3y4#2)9J5k6o6S2W2y4X3u0Q4x3X3b7@1j5U0c8U0i4K6u0V1j5X3t1@1j5#2)9J5k6o6j5#2k6e0p5H3k6e0k6W2j5$3q4V1j5W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3g2W2k6h3c8W2y4g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7#2y4U0y4Q4x3U0k6A6k6q4)9K6c8s2f1$3y4h3g2S2x3r3g2U0x3g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6R3@1y4g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5z5e0p5K6i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6t1%4x3U0t1^5x3W2)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2x3U0k6S2k6o6k6T1k6h3g2Q4x3X3c8T1y4K6m8T1i4K6u0V1y4o6W2W2z5g2)9J5k6r3t1^5z5o6c8Q4x3X3b7%4x3o6m8S2x3e0S2S2j5U0l9#2k6q4)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7$3x3o6S2Q4x3X3f1$3y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3">image.png</a>
此时程序会运行，并打印字符串`Please enter your pwd >>`，随便输入 66 按回车键，会弹出窗口显示“脚本运行完成”。
!<a href="elink@e35K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4U0l9#2y4o6V1&6y4U0y4Q4x3X3b7#2k6U0b7#2y4o6R3@1x3g2)9J5k6r3j5J5z5r3g2Q4x3X3b7@1y4e0t1J5i4K6u0V1z5r3k6X3x3#2)9J5k6r3q4U0j5e0R3#2z5o6x3^5x3U0p5H3j5W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3K6S2U0z5r3t1^5y4W2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7@1x3o6W2Q4x3U0k6A6k6q4)9K6c8s2f1#2k6o6x3I4x3U0f1H3j5W2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6j5I4y4q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0V1I4x3q4)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7K6z5e0f1#2x3U0W2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0t1K6z5e0R3@1j5K6f1%4i4K6u0V1k6r3b7#2j5#2)9J5k6o6c8W2j5e0W2Q4x3X3c8T1x3h3q4T1i4K6u0V1z5o6c8V1j5e0M7$3z5e0y4U0y4e0k6Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0t1%4x3#2)9J5k6e0x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3`.">image.png</a>
## 5.2 修改寄存器的值
点击“确定”后，发现 EIP 停留在了`0049B79E`，因为之前脚本就在这个地址下了断点。注意此时的寄存器窗口，各个寄存器的值
```
EAX 00000246
ECX 00000040
EDX 50655CD1
EBX 004D7A92 CrackMe_.004D7A92
ESP 0022FDE4
EBP 0049B777 CrackMe_.0049B777
ESI 0022FEC6
EDI 004F9B18 CrackMe_.004F9B18
EIP 0049B79E CrackMe_.0049B79E
```
!<a href="elink@e4eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4U0l9^5y4U0b7$3x3K6m8Q4x3X3b7$3x3$3y4S2z5r3f1&6y4#2)9J5k6r3y4T1z5r3q4Q4x3X3b7@1x3U0S2T1i4K6u0V1z5r3u0T1k6g2)9J5k6r3t1&6j5X3j5%4z5o6u0T1y4r3x3#2x3W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5@1k6U0u0W2j5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6x3K6N6Q4x3U0k6A6k6q4)9K6c8s2g2S2k6U0t1@1x3U0M7J5x3q4)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6f1H3y4W2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1$3x3#2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5x3K6x3@1z5o6S2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0W2W2x3U0y4V1y4U0u0U0i4K6u0V1k6r3q4X3k6q4)9J5k6o6c8V1z5o6u0Q4x3X3b7&6y4e0g2S2i4K6u0V1y4o6f1%4x3U0f1J5k6U0k6T1x3o6g2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5z5o6b7J5">image.png</a>
F7 走一下，寄存器的值没有发生任何变化
!<a href="elink@cdfK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4U0p5H3y4e0l9$3x3o6u0Q4x3X3b7J5k6U0q4V1j5$3q4X3z5g2)9J5k6r3f1%4y4e0W2Q4x3X3b7@1z5o6f1J5i4K6u0V1z5r3u0T1y4q4)9J5k6o6p5I4y4h3g2X3z5e0t1@1z5o6S2U0y4W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5K6k6U0q4W2z5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6y4U0y4Q4x3U0k6A6k6q4)9K6c8s2f1J5y4e0R3J5x3e0j5^5y4g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6f1@1y4q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1$3y4W2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5y4e0b7I4y4o6S2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0S2T1y4e0b7&6j5K6k6W2i4K6u0V1k6o6V1&6k6q4)9J5k6o6c8T1k6o6S2Q4x3X3c8S2y4$3t1%4i4K6u0V1j5$3f1K6k6e0R3@1x3e0k6U0j5e0k6Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5z5o6b7@1">image.png</a>
我们将 ECX 的值从`00000040`改为`00000000`
!<a href="elink@8e3K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4U0p5J5z5e0x3#2y4K6c8Q4x3X3c8T1y4o6t1&6z5o6R3%4j5#2)9J5k6r3t1$3z5o6S2Q4x3X3b7@1x3U0t1$3i4K6u0V1j5U0x3K6j5#2)9J5k6r3b7@1z5r3x3&6z5e0p5%4x3h3f1I4y4W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5@1k6U0y4W2j5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6x3U0g2Q4x3U0k6A6k6q4)9K6c8s2f1$3y4K6W2T1k6U0x3I4y4W2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7^5z5q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1%4x3g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5x3K6p5H3x3K6k6Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6h3c8W2j5h3f1^5x3$3b7$3i4K6u0V1y4K6W2X3k6q4)9J5k6o6c8T1y4K6S2Q4x3X3c8T1k6h3p5J5i4K6u0V1j5e0W2X3j5e0S2S2y4e0x3J5j5h3y4Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5z5o6b7%4i4K6u0W2x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6y4l9`.`.">image.png</a>
# 6. 破解成功
然后再点击运行，破解成功，注意此时的 ZF 标志位为 0；
```
eax = 0x246；
ecx = 0x0；
运算结果是0；
```
!<a href="elink@46bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3z5o6b7J5y4e0j5^5x3o6k6Q4x3X3b7J5y4r3t1H3z5r3p5H3x3q4)9J5k6r3x3J5j5h3q4Q4x3X3b7@1y4K6j5$3i4K6u0V1z5e0l9H3y4#2)9J5k6o6t1^5x3e0S2T1k6e0x3$3y4K6b7%4y4g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3u0U0j5X3q4T1x3g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6e0M7J5x3h3p5^5k6h3b7&6i4K6u0V1j5U0S2X3y4W2)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5y4o6N6Q4x3U0k6A6k6q4)9K6c8s2f1@1y4r3k6U0k6o6k6V1k6W2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6x3%4x3q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0f1%4y4q4)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7I4z5e0j5#2x3e0c8Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0c8S2j5U0b7%4x3U0x3$3i4K6u0V1z5h3p5J5x3q4)9J5k6o6b7K6z5r3u0Q4x3X3c8S2x3$3c8X3i4K6u0V1x3K6k6X3y4$3j5&6y4e0N6U0j5K6g2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0l9@1z5g2)9J5k6e0x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3`.">image.png</a>
对比看一下，在输入错误密码且没有修改 ecx 的情况下，ZF 标志位为1
!<a href="elink@612K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3z5o6b7I4x3e0x3^5y4U0c8Q4x3X3c8S2k6o6W2U0x3o6j5K6j5W2)9J5k6o6t1J5j5h3g2Q4x3X3b7@1j5$3g2T1i4K6u0V1j5X3t1J5j5g2)9J5k6o6c8T1x3o6l9J5k6X3x3%4y4o6y4W2j5W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3t1&6j5U0k6S2k6q4)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6e0M7J5x3h3p5^5k6h3b7&6i4K6u0V1j5U0S2X3y4W2)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5y4K6m8Q4x3U0k6A6k6q4)9K6c8s2g2W2y4K6u0X3x3U0V1&6y4g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7H3y4g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0j5I4x3W2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5x3e0M7H3x3e0W2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0m8S2x3X3k6S2z5o6j5&6i4K6u0V1j5X3u0U0j5g2)9J5k6o6b7%4k6U0g2Q4x3X3b7^5x3U0k6S2i4K6u0V1x3e0g2V1z5h3x3@1y4U0k6X3z5o6N6Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0l9%4y4q4)9J5k6e0j5$3y4U0j5$3y4U0j5$3y4U0j5$3y4U0M7`.">image.png</a>

参考链接：
https://bbs.kanxue.com/thread-224732.htm
<mark class="encrypted">35fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3N6r3S2W2M7$3g2$3k6h3&6@1K9s2y4G2L8W2)9J5c8Y4m8Q4x3V1j5I4y4o6t1%4y4o6j5#2x3#2)9J5k6h3S2@1L8h3H3`.</mark>
<mark class="encrypted">343K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2T1K9h3I4A6j5X3W2D9K9g2)9J5k6h3y4G2L8g2)9J5c8Y4k6A6k6r3g2G2i4K6u0r3b7W2j5I4N6V1D9@1P5e0q4c8y4@1D9%4i4K6u0r3i4K6y4r3M7%4m8E0i4K6g2X3K9h3c8Q4y4h3k6X3M7X3!0E0i4K6y4p5x3K6x3K6i4K6u0W2x3K6x3%4i4K6u0W2M7$3g2S2M7X3y4Z5i4K6u0V1j5$3q4J5k6q4)9J5k6h3q4D9L8q4)9J5k6h3y4D9K9h3y4C8i4K6t1$3N6X3c8Q4y4h3k6K6L8%4g2J5j5$3g2Q4x3@1c8W2y4h3t1$3y4h3y4X3x3$3u0W2j5e0R3%4x3$3t1H3j5$3k6W2z5o6y4U0y4X3j5K6k6o6x3H3j5e0M7I4x3l9`.`.</mark>
《加密与解密（第4版）》

VMProtect 软件公司成立于2000年，总部位于俄罗斯叶卡捷琳堡。该公司出品的软件保护软件 VMProtect（目前版本已更新到 3.x，以下简称VMP）可以说是软件破解领域的圣杯，多年来无数逆向分析人员前赴后继，一直试图揭开 VMP 的神秘面纱。
VMP 的特色功能包括虚拟化、混淆、反调试等。本文的测试内容主要针对的是VMP的虚拟化机制，即VMP 可以将受保护的代码放到内置的虚拟机中运行，以防止反编译和破解。

VMP 代码虚拟机是一款栈机，也就是说，VMP 的代码虚拟机与被保护程序的代码处于栈空间中。基于栈的虚拟机指令集主要是通过操作栈顶元素来完成。例如，Java 虚拟机（JVM）就是一个典型的基于栈的虚拟机。与之相对应的还有基于寄存器的虚拟机。指令操作数存储在虚拟寄存器中，指令集直接对寄存器进行操作。Lua 的虚拟机（称为 Lua 虚拟机，LVM）就是基于寄存器的。
而基于栈的 VMP 虚拟机因为要维护出栈入栈，所以执行同样的操作，需要的指令较多，间接使得执行效率较差。 VMP 会让程序变得臃肿、运行速度变慢，但被保护的程序代码膨胀后，也能给逆向分析人员造成很多困扰。

（表格出自《加密与解密（第4版）》）
VMP 虚拟化流程：

系统环境：Windows 7 专业版（32 位）
IDE：Dev-C++ 5.7.1
加壳程序：VMProtect 3.4

编译得到CrackMe.exe

在输入错误密码的情况下，程序仍可打印“successful！”
（测试演示出自B站up主Rairn，文末有提供视频链接）

用 OD 加载CrackMe.exe，找到一个关键且易识别的位置，用 VMP 加密；在 OD 反汇编窗口点击右键，选择中文搜索引擎->智能搜索，搜索源代码中的字符串，例如successful

点进字符串successful对应的地址 0x00401702，分析一下反汇编代码，将加壳位置定为 0x004016B0，这看上去应该是一个函数的起始位置。将004016B0 55 PUSH EBP复制到剪切板，在记事本或其他类似工具记下来。

打开 VMProtect 3.4，点击需保护的进程->添加进程，然后把地址004016B0复制进去，编译类型选择超级（编译+虚拟）

点击选项，除了移除调试信息选“是”，其余都选“否”，因为这次测试只针对虚拟机保护，暂不研究其他内容。

然后点击编译，就可以得到加壳后的文件CrackMe.vmp.exe

用 LordPE 查看，CrackMe.vmp.exe多了一个区段.vmp0

用 OD 加载CrackMe.vmp.exe，做好以下几个准备。

在调试选项中设置，因为记录需要跟踪的信息

打开 RUN 跟踪

点击菜单栏的E，将显示的 DLL 标记为系统 DLL，以免之后调试跟踪（ trace）时被记录

Ctrl + g 进入之前记下的地址004016B0，在此处 F2 下一个断点然后运行。可以看到，对比加壳前的情况，反汇编代码已经发生了很大变化。

Ctrl + F11 跟踪步过，程序也打印出了

Please enter your pwd >>

在程序中随便输入一个密码，例如55，然后点开 OD 菜单栏中的……，点击右键选择 记录到文件，把调试跟踪的结果保存为 trace.txt，记得勾选“附加到已有文件”和“写入采集的数据”

查看trace.txt

在trace.txt搜索00000040，因为十六进制的00000040的二进制是0100 0000，可以被用来表示 ZF 标志位。在 x86 架构中，ZF 标志位的位置正好对应到 EFLAGS 寄存器的第 6 位（从第 0 位开始算起）。也就是说，当执行某些指令后，如果结果为零，则 ZF 标志位会被置 1。
VMP 会使用以下公式来计算 ZF 的值：

其中，0x40 就是 ZF 标志位的掩码值。当 eflags 寄存器的第 6 位为 1 时，and 运算的结果也会为 1，表示 ZF 标志位为 1。反之，当第 6 位为 0 时，and 运算的结果为 0，表示 ZF 标志位为 0。这样做可以非常高效地判断 ZF 标志位的状态，而不需要进行复杂的计算。
本次爆破测试是比较输入的密码是否是正确的密码，所以代码实现逻辑大概率依靠 CMP、JZ（若为 0 则跳转，ZF 需为 1）或者JE（若相等则跳转，ZF 需为 1）。
这类指令影响的符号位正是 ZF，所以需要搜寻00000040。
找到00000040后还需要在附近寻找类似以下特征的汇编指令

寻找具备这种特征的汇编指令，是因为这是与非门（俗称万用门）的运算逻辑，表示为: Nand(a,b) = ~a & ~b，即将两个数分别取反后再进行与运算。汇编里面最基本的4种逻辑运算，都能用与非门表示。所以 VMP 3.x 版本中大量使用了Nand运算来表示其他的逻辑运算，真实地隐藏了原本的各种逻辑运算，有效地加大了逆向分析的难度。

cmp指令本质上是减法，只不过结果不会写回操作数，Nand 门也能实现减法：

简而言之，看到了not a, not b, and a,b这类特征的反汇编指令，就可以合理怀疑此处是 VMP 处理虚拟机指令的 handler 。VMP 会在 handler 入口处大量使用 nand 门运算来隐藏原本的各种逻辑运算。这些"Nand"指令往往会涉及对EFLAGS寄存器的读写操作。通过精细控制EFLAGS标志位的状态，VMP 可以实现对程序控制流的保护。
找到了疑似的指令，记下做 and 运算指令的地址0049B79E、以及两个寄存器的值ECX=00000040、EAX=00000246

（FL 是 Flags标志位的缩写，FL=0 意味着在执行指令and ecx, eax后没有发生任何标志位的改变。因为and ecx, eax执行结果为0x40，也就是说原本的 ZF 标志位就是 1。在后面的操作中，我们只需要将修改 ecx ，就能将 ZF 的标志位改为 0，就能改变程序原本的跳转逻辑。例如，在输入错误时，原本打印“failed”，就能跳转到 “successful！“）

保存为script.txt

OD 重新加载CrackMe.vmp.exe，在反汇编窗口点击右键，选择运行脚本->script.txt

此时程序会运行，并打印字符串Please enter your pwd >>，随便输入 66 按回车键，会弹出窗口显示“脚本运行完成”。

点击“确定”后，发现 EIP 停留在了0049B79E，因为之前脚本就在这个地址下了断点。注意此时的寄存器窗口，各个寄存器的值

F7 走一下，寄存器的值没有发生任何变化

我们将 ECX 的值从00000040改为00000000

然后再点击运行，破解成功，注意此时的 ZF 标志位为 0；

对比看一下，在输入错误密码且没有修改 ecx 的情况下，ZF 标志位为1

参考链接：
https://bbs.kanxue.com/thread-224732.htm
701K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3N6r3S2W2M7$3g2$3k6h3&6@1K9s2y4G2L8W2)9J5c8Y4m8Q4x3V1j5I4y4o6t1%4y4o6j5#2x3#2)9J5k6h3S2@1L8h3H3`.
0a3K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2T1K9h3I4A6j5X3W2D9K9g2)9J5k6h3y4G2L8g2)9J5c8Y4k6A6k6r3g2G2i4K6u0r3b7W2j5I4N6V1D9@1P5e0q4c8y4@1D9%4i4K6u0r3i4K6y4r3M7%4m8E0i4K6g2X3K9h3c8Q4y4h3k6X3M7X3!0E0i4K6y4p5x3K6x3K6i4K6u0W2x3K6x3%4i4K6u0W2M7$3g2S2M7X3y4Z5i4K6u0V1j5$3q4J5k6q4)9J5k6h3q4D9L8q4)9J5k6h3y4D9K9h3y4C8i4K6t1$3j5h3#2H3i4K6y4n7N6X3c8Q4y4h3k6K6L8%4g2J5j5$3g2Q4x3@1c8W2y4h3t1$3y4h3y4X3x3$3u0W2j5e0R3%4x3$3t1H3j5$3k6W2z5o6y4U0y4X3j5K6k6o6x3H3j5e0M7I4x3l9`.`.
《加密与解密（第4版）》

基本块名称	功能
VStartVM	从真实环境到虚拟环境的转换，开启新的虚拟空间给虚拟机使用，将除 esp 外的所有寄存器压入堆栈，esp 寄存器原来的值存放在 ebp 寄存器中
VMDispatcher	虚拟指令调度分流
VHandler1..N	不同功能的虚拟指令
VCheckESP	检查堆栈基本块,如果 esp (VMP 使用的堆栈)与 ebp (真实堆栈)即将被覆盖,则跟踪转到下一个基本块来开辟堆栈地址（sub esp, xxx），并将原来的 VMContext 中的内容复制到新的堆栈地址处，否则跳回 VMDispatcher
VRet	这个指令存在于 VHandler 集合中。这个指令将堆栈中压入的寄存器值还原到物理寄存器中，然后退出整个虚拟机环境，并切换回真实的 CPU 环境。注意：这个指令的作用是退出虚拟环境，并不等于汇编语义上的 retn。

#include<bits/stdc++.h>
#include<windows.h>
using namespace std;
 
int main()
{
    printf("Please enter your pwd >> ");
    string s;
    cin>>s;
    if(s=="123456")
        printf("successful!\n");
    else
        printf("failed!\n");
    system("pause");
    return 0;
}

#include<bits/stdc++.h>

#include<windows.h>

using namespace std;

int main()

{

printf("Please enter your pwd >> ");

string s;

cin>>s;

if(s=="123456")

printf("successful!\n");

else

printf("failed!\n");

system("pause");

return 0;

}

zf = and(0x40, eflags)

not a
not b
and a,b
//这三行代码通常不是连续出现，中间会有无用的代码隔开
//a, b皆为通用寄存器

not a

not b

and a,b

//这三行代码通常不是连续出现，中间会有无用的代码隔开

//a, b皆为通用寄存器

Not(a) = ~a = ~a & ~a = Nand(a,a)
Or(a,b) = a | b = ~(~a & ~b) = Nand(Nand(a,b),Nand(a,b))
And(a,b) = a & b = ~~a & ~~b = Nand(Nand(a,a),Nand(b,b))
Xor(a,b) = (~a & b) | (a & ~b) = (0 | (a & ~b)) | (0 | (b & ~a)) = (a & (~a | ~b)) | (b & (~a | ~b)) = (~a | ~b) & (a | b) = ~(a & b) | ~(~a & ~b) = Nand(And(a,b),Nand(a,b)) =Nand(Nand(Nand(a,a),Nand(b,b)),Nand(a,b))

Not(a) = ~a = ~a & ~a = Nand(a,a)

Or(a,b) = a | b = ~(~a & ~b) = Nand(Nand(a,b),Nand(a,b))

And(a,b) = a & b = ~~a & ~~b = Nand(Nand(a,a),Nand(b,b))

登录后可查看完整内容

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

最后于 2024-5-31 16:17 被ZyOrca编辑，原因：

#其他内容 #软件保护 #调试逆向

上传的附件：

CrackMe.exe （1.30MB，66次下载）

wyfe 雪币： 2575 活跃值： (577) 能力值： ( LV6，RANK：85 ) 在线值：发帖 66 回帖 465 粉丝 0 关注私信	wyfe 2 楼解决问题的思路值得学习 2024-5-31 18:25 0
小菜鸟一雪币： 3012 活跃值： (6322) 能力值： ( LV5，RANK：69 ) 在线值：发帖 6 回帖 908 粉丝 4 关注私信	小菜鸟一 3 楼能保存修改的文件并成功运行就更厉害了 2024-5-31 18:59 0
MonKeyDu 雪币： 2422 活跃值： (370) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 17 粉丝 1 关注私信	MonKeyDu 4 楼值得学习，希望多出这种零基础的教程！！ 2024-6-3 07:08 0
vaguem 雪币： 0 活跃值： (847) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 48 粉丝 1 关注私信	vaguem 5 楼这个特征太明显了，已经用泄露的源码把这段魔改了 2024-6-5 19:11 0
yuanyouran 雪币： 98 活跃值： (3366) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 201 粉丝 1 关注私信	yuanyouran 6 楼值得学习，过程思路清晰可见，感谢~~ 2024-6-24 10:24 0
木志本柯雪币： 6597 活跃值： (8704) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 448 粉丝 9 关注私信	木志本柯 7 楼 vmp也是一顿被吹上神探，基本上只要是虚拟化的加壳软件，有哪个是能被轻易分析的像tmd什么的，加了壳后都一样丢回收站。 2024-6-24 13:45 1
星雨雪币： 311 活跃值： (685) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 16 粉丝 0 关注私信	星雨 8 楼知其然知其所以然非常感谢我终于看懂vmp了 2026-8-5 17:20 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复