[原创]VMProtect保护壳爆破步骤详解（入门级）-逆向工程-看雪安全社区

[原创]VMProtect保护壳爆破步骤详解（入门级）

发表于: 2024-5-31 16:09 30034

[原创]VMProtect保护壳爆破步骤详解（入门级）

ZyOrca

2024-5-31 16:09

30034

# 1. 原理
## 1.1 VMProtect Software 公司
VMProtect 软件公司成立于2000年，总部位于俄罗斯叶卡捷琳堡。该公司出品的软件保护软件 VMProtect（目前版本已更新到 3.x，以下简称VMP）可以说是软件破解领域的圣杯，多年来无数逆向分析人员前赴后继，一直试图揭开 VMP 的神秘面纱。
VMP 的特色功能包括虚拟化、混淆、反调试等。本文的测试内容主要针对的是VMP的虚拟化机制，即VMP 可以将受保护的代码放到内置的虚拟机中运行，以防止反编译和破解。
## 1.2 VMProtect 虚拟化原理
VMP 代码虚拟机是一款栈机，也就是说，VMP 的代码虚拟机与被保护程序的代码处于栈空间中。基于栈的虚拟机指令集主要是通过操作栈顶元素来完成。例如，Java 虚拟机（JVM）就是一个典型的基于栈的虚拟机。与之相对应的还有基于寄存器的虚拟机。指令操作数存储在虚拟寄存器中，指令集直接对寄存器进行操作。Lua 的虚拟机（称为 Lua 虚拟机，LVM）就是基于寄存器的。
而基于栈的 VMP 虚拟机因为要维护出栈入栈，所以执行同样的操作，需要的指令较多，间接使得执行效率较差。 VMP 会让程序变得臃肿、运行速度变慢，但被保护的程序代码膨胀后，也能给逆向分析人员造成很多困扰。

| **基本块名称** | **功能** |
| --- | --- |
| VStartVM | 从真实环境到虚拟环境的转换，开启新的虚拟空间给虚拟机使用，将除 esp 外的所有寄存器压入堆栈，esp 寄存器原来的值存放在 ebp 寄存器中 |
| VMDispatcher | 虚拟指令调度分流 |
| VHandler1..N | 不同功能的虚拟指令 |
| VCheckESP | 检查堆栈基本块,如果 esp (VMP 使用的堆栈)与 ebp (真实堆栈)即将被覆盖,则跟踪转到下一个基本块来开辟堆栈地址（sub esp, xxx），并将原来的 VMContext 中的内容复制到新的堆栈地址处，否则跳回 VMDispatcher |
| VRet | 这个指令存在于 VHandler 集合中。这个指令将堆栈中压入的寄存器值还原到物理寄存器中，然后退出整个虚拟机环境，并切换回真实的 CPU 环境。注意：这个指令的作用是退出虚拟环境，并不等于汇编语义上的 retn。 |

（表格出自《加密与解密（第4版）》）
 VMP 虚拟化流程：
1.  VMP 将被保护的代码转换为虚拟机指令集（bytecode），并为每个虚拟指令对应一个处理程序（handler），每个 handler 实际上是一个小型的解释器。这些处理程序不是简单的地址，而是具体的处理逻辑代码。在代码转换过程中， VMP 还会对指令进行混淆和加密，以增加逆向工程的难度。
2.  VMP 还会对一些系统对象如文件、注册表等进行虚拟化，在虚拟机内部维护虚拟的系统资源，使得在虚拟机内部的系统交互不会影响到真实系统。 VMP 通常会结合多种反调试技术,例如代码自修改、反跟踪、反模拟执行等，增加调试难度。
3.  受保护程序运行时，会首先执行插入的 VStartVM 代码。 （VStartVM 通常是作为程序入口点被插入到受保护代码中的 ）VStartVM 负责将程序从真实环境转换到虚拟环境，并初始化虚拟机的上下文环境，将真实环境中的寄存器状态保存，并准备虚拟机所需的堆栈空间。此外，VStartVM 还会对一些关键的系统API进行hook，以截获系统调用并在虚拟环境中模拟执行。 VMP 允许在受保护代码块中插入特定的指令，用于主动切换回真实环境，例如调用未被 hook 的系统 API。
4. VMDispatcher 负责从虚拟指令流中读取虚拟指令（bytecode），然后通过解码确定对应的处理程序（handler）。解码后的虚拟指令并不是直接执行真实指令，而是调用相应的 handler 来模拟执行，这些 handler 处理的是虚拟机指令，而不是直接的原始指令。
5. VMP 使用两个堆栈：虚拟堆栈和真实堆栈。虚拟堆栈供虚拟机内部使用，而真实堆栈是线程原有的堆栈。为了避免两者冲突，VMP 会监控堆栈指针 esp。当虚拟指令需要修改真实寄存器时，真实寄存器的值会被临时保存在真实堆栈中，并将虚拟寄存器的值应用到真实寄存器上。如果 esp 与 ebp 即将发生冲突，VMP 会将当前虚拟机上下文保存到真实堆栈，然后开辟新的虚拟堆栈空间，确保虚拟机正常运行。对于多线程程序， VMP 会为每个线程维护独立的虚拟机上下文(VMContext),不同线程的虚拟机之间相互隔离。
6. 虚拟化指令执行完之后，虚拟机并不会立即退出虚拟环境。只有在整个受保护代码块执行完毕或者发生异常时，才会退出虚拟环境，恢复真实环境中的状态。退出虚拟环境时，虚拟机会恢复原始的寄存器状态，并确保所有的上下文环境都正确恢复。不过在退出之前，还需要将虚拟寄存器的值写回到真实寄存器，并解除之前所做的系统API hook。
# 2. 测试程序
## 2.1 测试环境
系统环境：Windows 7 专业版（32 位）
IDE：Dev-C++ 5.7.1
加壳程序：VMProtect 3.4
## 2.2 测试程序源代码
```
#include<bits/stdc++.h>
#include<windows.h>
using namespace std;

int main()
{
    printf("Please enter your pwd >> ");
    string s;
    cin>>s;
    if(s=="123456")
        printf("successful!\n");
    else
        printf("failed!\n");
    system("pause");
    return 0;
}
```
编译得到`CrackMe.exe`
## 2.3 测试目标
在输入错误密码的情况下，程序仍可打印“successful！”
（测试演示出自B站up主Rairn，文末有提供视频链接）
# 3.  VMP 编译测试程序
 用 OD 加载CrackMe.exe，找到一个关键且易识别的位置，用 VMP 加密；在 OD 反汇编窗口点击右键，选择`中文搜索引擎->智能搜索`，搜索源代码中的字符串，例如`successful`
!<a href="elink@be4K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0f1J5y4U0j5^5x3o6q4Q4x3X3c8S2x3X3j5%4j5X3t1^5y4q4)9J5k6r3c8T1k6h3q4Q4x3X3b7@1k6o6g2X3i4K6u0V1j5U0W2V1y4#2)9J5k6o6u0V1j5h3b7K6x3o6R3&6k6o6k6X3y4g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3g2V1k6h3p5$3j5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5z5e0W2Q4x3U0k6A6k6q4)9K6c8s2g2X3k6X3p5$3z5r3x3H3y4q4)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7@1z5g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0l9J5y4g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5y4e0p5J5y4U0c8Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0g2X3x3$3k6X3z5e0y4T1i4K6u0V1x3U0j5@1k6W2)9J5k6o6b7K6k6o6g2Q4x3X3c8S2y4$3x3I4i4K6u0V1x3o6V1&6y4X3k6S2z5r3t1&6k6X3q4Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5y4U0R3K6i4K6u0W2x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6y4l9`.`.">image.png</a>
点进字符串`successful`对应的地址 `0x00401702`，分析一下反汇编代码，将加壳位置定为 `0x004016B0`，这看上去应该是一个函数的起始位置。将`004016B0    55              PUSH EBP`复制到剪切板，在记事本或其他类似工具记下来。
!<a href="elink@432K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0f1@1x3o6j5H3x3e0S2Q4x3X3b7I4z5h3j5%4y4o6c8T1z5g2)9J5k6o6V1@1x3K6N6Q4x3X3b7@1j5U0y4U0i4K6u0V1j5X3b7I4z5g2)9J5k6o6R3I4x3K6q4W2j5e0p5#2k6r3p5&6y4q4)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5&6k6U0R3H3y4g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7@1x3o6k6Q4x3U0k6A6k6q4)9K6c8s2g2U0y4U0b7J5x3e0p5%4x3#2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6j5H3z5g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1^5x3W2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5x3U0R3&6x3o6u0Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6h3k6W2k6o6p5K6j5U0l9^5i4K6u0V1x3X3b7$3x3#2)9J5k6o6c8X3x3e0c8Q4x3X3c8S2y4X3f1%4i4K6u0V1k6e0b7$3z5o6c8U0x3$3k6S2z5h3q4Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5z5o6f1@1i4K6u0W2y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3y4R3`.`.">image.png</a>
打开 VMProtect 3.4，点击`需保护的进程->添加进程`，然后把地址`004016B0`复制进去，编译类型选择`超级（编译+虚拟）`
!<a href="elink@fcbK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0f1&6x3e0p5H3y4o6W2Q4x3X3b7I4k6U0u0W2x3e0l9J5z5g2)9J5k6o6m8X3y4o6W2Q4x3X3b7@1j5$3q4U0i4K6u0V1z5e0p5I4j5g2)9J5k6o6b7I4k6X3b7I4y4K6R3&6x3X3x3^5j5#2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3K6V1$3j5h3c8U0x3#2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7I4z5o6g2Q4x3U0k6A6k6q4)9K6c8s2f1@1y4h3j5%4k6r3c8W2z5q4)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6t1%4y4#2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1&6x3g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7^5z5e0b7#2y4q4)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2k6e0u0S2z5r3p5H3j5$3u0Q4x3X3c8X3z5o6x3@1i4K6u0V1y4o6V1%4x3#2)9J5k6r3p5K6j5e0k6Q4x3X3b7I4x3X3k6X3x3o6u0X3y4h3u0V1y4q4)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7^5y4U0m8Q4x3X3f1$3y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3">image.png</a>
!<a href="elink@412K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0j5I4x3o6V1$3x3o6q4Q4x3X3c8S2y4$3q4T1j5K6m8U0y4g2)9J5k6o6q4S2k6U0u0Q4x3X3b7@1z5o6j5J5i4K6u0V1j5U0S2U0j5W2)9J5k6o6x3J5y4U0y4V1x3o6j5#2x3e0R3$3x3g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3x3K6k6o6m8U0k6g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7I4y4e0S2Q4x3U0k6A6k6q4)9K6c8s2f1@1z5e0R3@1k6h3y4S2j5#2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6t1K6y4#2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0f1$3y4q4)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7#2x3K6R3$3y4g2)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2j5K6t1J5z5o6V1J5j5U0k6Q4x3X3c8S2y4h3k6S2i4K6u0V1y4o6f1^5z5g2)9J5k6r3q4T1y4$3c8Q4x3X3c8S2k6e0m8T1j5e0u0X3k6o6b7#2j5#2)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7I4x3o6b7J5i4K6u0W2y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3y4H3`.`.">image.png</a>
点击`选项`，除了`移除调试信息`选“是”，其余都选“否”，因为这次测试只针对虚拟机保护，暂不研究其他内容。
!<a href="elink@402K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0j5J5z5o6t1$3x3o6W2Q4x3X3c8V1y4X3x3J5x3o6W2S2z5q4)9J5k6r3k6U0j5$3q4Q4x3X3b7@1j5e0g2V1i4K6u0V1z5o6j5H3x3q4)9J5k6o6c8W2k6e0S2U0j5U0y4T1k6U0W2S2z5g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3f1J5k6o6k6T1x3q4)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7@1y4o6g2Q4x3U0k6A6k6q4)9K6c8s2f1&6j5h3t1&6x3U0q4U0y4W2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6j5$3z5q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0f1&6x3q4)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7I4x3o6f1#2x3U0N6Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0V1J5j5U0b7%4z5o6u0V1i4K6u0V1j5$3t1I4j5W2)9J5k6o6b7K6k6U0c8Q4x3X3c8S2j5U0M7$3i4K6u0V1k6X3g2V1y4K6M7%4j5$3q4T1k6o6W2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0l9$3x3l9`.`.">image.png</a>
然后点击`编译`，就可以得到加壳后的文件`CrackMe.vmp.exe`
!<a href="elink@0bcK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0j5@1y4K6t1#2y4e0q4Q4x3X3b7$3y4U0x3I4j5$3c8S2j5W2)9J5k6r3p5J5x3e0q4Q4x3X3b7@1x3$3k6X3i4K6u0V1j5X3u0T1j5#2)9J5k6r3p5#2j5K6p5$3y4X3t1^5y4o6l9&6j5#2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3b7K6k6o6k6U0j5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7@1y4o6W2Q4x3U0k6A6k6q4)9K6c8s2g2T1y4K6j5I4k6e0t1H3j5#2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6j5%4x3#2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0f1^5z5g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7I4x3e0b7$3y4o6W2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0q4W2x3U0m8W2j5$3y4W2i4K6u0V1y4o6S2S2k6W2)9J5k6o6b7&6z5o6y4Q4x3X3c8T1j5$3f1%4i4K6u0V1x3K6R3J5j5K6R3$3x3U0u0T1j5$3g2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0l9#2z5g2)9J5k6e0x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3`.">image.png</a>
用 LordPE 查看，` CrackMe.vmp.exe `多了一个区段`.vmp0`
!<a href="elink@2dcK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0j5%4y4o6t1#2y4K6u0Q4x3X3c8W2y4r3u0X3j5U0f1&6x3q4)9J5k6r3x3I4j5h3k6Q4x3X3b7@1y4K6y4T1i4K6u0V1j5e0q4U0k6g2)9J5k6o6M7$3k6o6q4V1j5U0x3&6k6o6R3^5z5g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3b7@1j5X3x3%4z5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7I4y4K6q4Q4x3U0k6A6k6q4)9K6c8s2f1%4k6r3p5$3x3K6S2S2x3q4)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6t1#2y4#2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5y4K6x3#2i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6x3K6x3o6j5%4i4K6t1$3M7%4c8S2N6s2g2K6i4K6y4p5k6r3!0F1k6g2)9J5y4Y4y4@1P5h3I4W2i4K6y4p5L8X3!0F1k6g2)9J5y4Y4c8S2M7$3E0u0k6q4)9K6c8s2g2X3y4K6f1^5j5h3u0X3k6q4)9J5k6o6p5@1j5h3y4Q4x3X3b7@1j5K6m8X3i4K6u0V1z5o6S2V1j5g2)9J5k6o6b7J5k6h3p5@1k6o6M7%4y4r3q4X3i4K6t1$3N6r3W2@1L8r3g2Q4x3@1c8Q4x3U0k6%4K9h3c8@1K9q4)9K6c8o6b7&6x3l9`.`.">image.png</a>
# 4. 调试和脚本编写
## 4.1 调试准备
用 OD 加载`CrackMe.vmp.exe`，做好以下几个准备。

- 在调试选项中设置，因为记录需要跟踪的信息
!<a href="elink@5deK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0M7#2z5e0j5J5x3K6m8Q4x3X3b7J5y4$3t1#2x3e0W2V1y4q4)9J5k6o6R3@1k6o6W2Q4x3X3b7@1y4r3b7I4i4K6u0V1z5r3k6X3y4g2)9J5k6o6N6X3k6X3b7#2j5X3x3K6x3r3q4X3z5q4)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5%4k6U0g2X3y4q4)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6y4U0q4Q4x3U0k6A6k6q4)9K6c8s2f1J5x3$3t1@1x3U0V1&6y4g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6f1@1x3g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5y4K6p5K6i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6p5I4x3o6M7K6y4W2)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2z5o6N6X3z5o6y4S2k6r3y4Q4x3X3b7I4z5o6q4U0i4K6u0V1y4o6W2S2y4g2)9J5k6r3p5J5x3h3k6Q4x3X3c8X3y4$3u0S2x3r3j5I4x3U0t1K6y4g2)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7@1y4K6g2Q4x3X3f1K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6">image.png</a>

- 打开 RUN 跟踪
  ![](upload/attach/202405/944427_5JG27SRJGBBH5US.webp)

- 点击菜单栏的`E`，将显示的 DLL 标记为系统 DLL，以免之后调试跟踪（ trace） 时被记录
!<a href="elink@9feK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0M7@1y4o6R3$3y4o6S2Q4x3X3c8W2x3e0x3#2j5K6l9$3x3q4)9J5k6o6m8T1x3U0W2Q4x3X3b7@1z5e0y4S2i4K6u0V1z5h3p5%4x3W2)9J5k6r3p5^5y4o6R3H3k6o6g2T1y4e0p5%4y4g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3g2X3k6h3c8W2y4#2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7@1x3o6N6Q4x3U0k6A6k6q4)9K6c8s2f1@1x3K6c8V1k6h3b7$3x3#2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6j5I4x3q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5z5o6t1&6i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6p5H3y4o6p5^5y4g2)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2x3o6l9%4x3X3q4S2k6r3k6Q4x3X3b7^5y4o6R3%4i4K6u0V1y4o6f1J5x3g2)9J5k6r3t1I4j5h3c8Q4x3X3b7&6y4o6y4U0k6r3b7K6j5U0b7J5x3g2)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7#2y4e0u0Q4x3X3f1$3y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3">image.png</a>
## 4.2 调试过程
Ctrl + g 进入之前记下的地址`004016B0`，在此处 F2 下一个断点然后运行。可以看到，对比加壳前的情况，反汇编代码已经发生了很大变化。
!<a href="elink@70aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0M7&6y4e0j5$3y4K6W2Q4x3X3c8V1j5X3j5J5j5$3k6W2j5W2)9J5k6o6u0U0x3h3u0Q4x3X3b7@1k6X3y4V1i4K6u0V1j5e0j5&6k6q4)9J5k6o6p5$3y4$3u0S2k6U0m8V1y4U0g2W2k6W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5@1k6U0u0W2z5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6z5o6S2Q4x3U0k6A6k6q4)9K6c8s2f1%4y4h3p5H3x3K6j5$3z5g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6f1^5x3W2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0p5%4x3g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7I4z5o6V1H3y4K6m8Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6h3q4T1x3e0m8W2y4o6m8X3i4K6u0V1y4h3p5$3j5g2)9J5k6o6b7@1y4h3y4Q4x3X3b7^5y4e0V1^5i4K6u0V1z5r3u0T1y4e0q4W2k6h3x3$3x3K6c8Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5y4K6R3H3i4K6u0W2y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3y4R3`.`.">image.png</a>
Ctrl + F11 跟踪步过，程序也打印出了
> Please enter your pwd >>

!<a href="elink@636K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0R3I4x3K6p5@1x3K6c8Q4x3X3b7H3y4r3y4V1k6U0p5#2j5g2)9J5k6o6V1%4j5$3y4Q4x3X3b7@1j5h3p5H3i4K6u0V1z5e0b7&6y4W2)9J5k6o6b7&6y4U0u0X3k6r3p5&6x3e0R3%4x3g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3K6S2X3z5r3b7^5y4q4)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5x3U0W2Q4x3U0k6A6k6q4)9K6c8s2f1#2x3o6y4T1j5X3g2V1k6g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6x3@1x3#2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5z5e0R3H3i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6p5I4x3o6j5K6y4W2)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2k6o6t1$3y4e0W2U0y4K6u0Q4x3X3b7K6x3o6m8W2i4K6u0V1y4r3p5@1j5W2)9J5k6o6V1H3y4K6k6Q4x3X3b7^5k6e0p5K6y4o6u0W2j5e0m8V1k6W2)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7$3y4e0y4Q4x3X3f1K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3@1">image.png</a>
## 4.3 Trace 记录
在程序中随便输入一个密码，例如`55`，然后点开 OD 菜单栏中的`……`，点击右键选择 `记录到文件`，把调试跟踪的结果保存为 `trace.txt`，记得勾选“附加到已有文件”和“写入采集的数据”
!<a href="elink@44eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0R3@1y4K6l9@1x3K6S2Q4x3X3c8V1k6X3u0U0z5h3p5#2x3W2)9J5k6r3g2W2j5e0u0Q4x3X3b7@1x3e0b7K6i4K6u0V1j5e0x3J5y4#2)9J5k6o6k6U0k6U0l9I4y4r3p5@1x3K6R3%4x3g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3t1K6j5U0u0T1x3g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6x3K6m8Q4x3U0k6A6k6q4)9K6c8s2f1@1j5h3u0V1z5e0y4T1x3q4)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7&6y4g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0j5%4x3g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5y4U0t1@1x3o6q4Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0x3I4j5$3u0U0x3o6m8W2i4K6u0V1x3U0l9^5y4g2)9J5k6o6c8X3y4o6c8Q4x3X3b7^5j5h3j5&6i4K6u0V1z5o6R3I4y4U0b7&6k6e0f1&6j5h3g2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0p5I4y4l9`.`.">image.png</a>
!<a href="elink@3d8K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0R3$3x3e0V1I4x3K6q4Q4x3X3c8U0x3K6g2V1j5X3f1H3x3g2)9J5k6o6m8X3z5h3q4Q4x3X3b7@1y4o6m8W2i4K6u0V1z5e0M7$3y4q4)9J5k6r3x3^5j5$3u0X3y4U0V1H3x3e0j5K6z5g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5K6k6U0u0X3x3q4)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5z5o6W2Q4x3U0k6A6k6q4)9K6c8s2g2T1j5X3p5H3y4X3b7$3z5g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7K6y4q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5y4U0f1^5i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6M7^5z5o6M7J5i4K6t1$3M7%4c8S2N6s2g2K6i4K6y4p5k6r3!0F1k6g2)9J5y4Y4y4@1P5h3I4W2i4K6y4p5L8X3!0F1k6g2)9J5y4Y4c8S2M7$3E0u0k6q4)9K6c8s2g2T1y4r3x3$3y4o6p5&6j5g2)9J5k6r3t1J5z5e0u0Q4x3X3b7@1k6r3t1H3i4K6u0V1z5o6u0U0x3q4)9J5k6o6N6V1y4X3x3I4z5e0p5H3y4K6y4S2i4K6t1$3N6r3W2@1L8r3g2Q4x3@1c8Q4x3U0k6%4K9h3c8@1K9q4)9K6c8o6b7K6z5q4)9J5k6e0j5$3y4U0j5$3y4U0j5$3y4U0j5$3y4U0M7`.">image.png</a>
查看`trace.txt`
!<a href="elink@0a3K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0R3%4x3o6p5$3z5o6W2Q4x3X3b7J5k6o6t1J5j5X3g2V1x3#2)9J5k6r3p5#2y4U0N6Q4x3X3b7@1z5e0m8T1i4K6u0V1j5e0t1$3y4g2)9J5k6o6S2T1k6e0y4V1y4e0g2S2y4o6p5^5j5g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5%4k6U0g2X3x3#2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7#2y4U0y4Q4x3U0k6A6k6q4)9K6c8s2f1H3x3U0V1&6y4$3u0W2k6W2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6R3@1y4g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1#2y4#2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5y4e0j5I4y4e0S2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0f1K6y4r3p5I4k6o6k6T1i4K6u0V1y4h3b7^5x3#2)9J5k6o6b7$3x3e0g2Q4x3X3b7&6y4K6g2S2i4K6u0V1y4X3j5%4y4U0t1&6x3r3p5#2y4U0S2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5z5o6x3^5">image.png</a>
在`trace.txt`搜索`00000040`，因为十六进制的`00000040`的二进制是`0100 0000`，可以被用来表示 ZF 标志位。在 x86 架构中，ZF 标志位的位置正好对应到 EFLAGS 寄存器的第 6 位（从第 0 位开始算起）。也就是说，当执行某些指令后，如果结果为零，则 ZF 标志位会被置 1。
VMP 会使用以下公式来计算 ZF 的值：
```
zf = and(0x40, eflags)
```
其中，0x40 就是 ZF 标志位的掩码值。当 eflags 寄存器的第 6 位为 1 时，and 运算的结果也会为 1，表示 ZF 标志位为 1。反之，当第 6 位为 0 时，and 运算的结果为 0，表示 ZF 标志位为 0。这样做可以非常高效地判断 ZF 标志位的状态，而不需要进行复杂的计算。
本次爆破测试是比较输入的密码是否是正确的密码，所以代码实现逻辑大概率依靠 CMP、JZ（若为 0 则跳转，ZF 需为 1）或者JE（若相等则跳转，ZF 需为 1）。
这类指令影响的符号位正是 ZF，所以需要搜寻`00000040`。
找到`00000040`后还需要在附近寻找类似以下特征的汇编指令
```
not a
not b
and a,b
//这三行代码通常不是连续出现，中间会有无用的代码隔开
//a, b皆为通用寄存器
```
寻找具备这种特征的汇编指令，是因为这是与非门（俗称万用门）的运算逻辑，表示为: Nand(a,b) = ~a & ~b，即将两个数分别取反后再进行与运算。汇编里面最基本的4种逻辑运算，都能用与非门表示。所以 VMP 3.x 版本中大量使用了Nand运算来表示其他的逻辑运算，真实地隐藏了原本的各种逻辑运算，有效地加大了逆向分析的难度。
```
Not(a) = ~a = ~a & ~a = Nand(a,a)
Or(a,b) = a | b = ~(~a & ~b) = Nand(Nand(a,b),Nand(a,b))
And(a,b) = a & b = ~~a & ~~b = Nand(Nand(a,a),Nand(b,b))
Xor(a,b) = (~a & b) | (a & ~b) = (0 | (a & ~b)) | (0 | (b & ~a)) = (a & (~a | ~b)) | (b & (~a | ~b)) = (~a | ~b) & (a | b) = ~(a & b) | ~(~a & ~b) = Nand(And(a,b),Nand(a,b)) =Nand(Nand(Nand(a,a),Nand(b,b)),Nand(a,b))
```
cmp指令本质上是减法，只不过结果不会写回操作数，Nand 门也能实现减法：
```
-a = ~a+1  => ~a = -a -1
~(~a+b) = ~(-a-1+b) = -(-a-1+b)-1 = a-b  => a-b = Not(Not(a)+b)
a-b最终可以由Not(Not(a)+b)来表示，而Not(a)又可以用Nand(a,a)来表示
```
简而言之，看到了`not a, not b, and a,b`这类特征的反汇编指令，就可以合理怀疑此处是 VMP 处理虚拟机指令的 handler 。VMP 会在 handler 入口处大量使用 nand 门运算来隐藏原本的各种逻辑运算。这些"Nand"指令往往会涉及对EFLAGS寄存器的读写操作。通过精细控制EFLAGS标志位的状态，VMP 可以实现对程序控制流的保护。
找到了疑似的指令，记下做 and 运算指令的地址`0049B79E`、以及两个寄存器的值`ECX=00000040`、`EAX=00000246`
```
and ecx, eax//运算结果为0x40
```
!<a href="elink@470K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4e0V1$3y4K6V1$3y4e0c8Q4x3X3b7#2y4U0R3K6x3$3j5J5x3q4)9J5k6r3c8S2x3U0g2Q4x3X3b7@1k6r3p5$3i4K6u0V1j5e0g2X3y4q4)9J5k6o6k6X3y4h3c8T1y4X3b7I4y4o6x3#2k6W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3f1I4k6e0m8V1k6g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5z5e0q4Q4x3U0k6A6k6q4)9K6c8s2f1J5z5o6t1$3x3e0q4V1x3g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7K6y4W2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0p5H3x3#2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7I4x3U0x3@1z5e0u0Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0q4U0x3e0y4X3z5o6t1$3i4K6u0V1x3U0f1K6k6g2)9J5k6o6b7%4z5r3k6Q4x3X3b7^5x3o6W2U0i4K6u0V1j5U0j5#2z5r3y4T1k6h3p5&6x3$3k6Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5y4K6x3#2i4K6u0W2x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6y4l9`.`.">image.png</a>
（FL 是 Flags标志位的缩写，FL=0 意味着在执行指令`and ecx, eax`后没有发生任何标志位的改变。因为`and ecx, eax`执行结果为0x40，也就是说原本的 ZF 标志位就是 1。在后面的操作中，我们只需要将修改 ecx ，就能将 ZF 的标志位改为 0， 就能改变程序原本的跳转逻辑。例如，在输入错误时，原本打印“failed”，就能跳转到 “successful！“）
## 4.4 脚本编写
```
bp 0049B79E           //设置断点，当程序执行到地址 0049B79E 时暂停执行。

start:                //标签，用于标识后续指令的起始位置。
run                   //继续执行程序，直到触发了设置的断点。
cmp ecx, 00000040
jnz start
cmp eax, 00000246
jnz start

end:
bc 0049B79E           //清除断点，使得程序不再在地址 0049B79E 处暂停执行。
ret                   //返回指令，结束当前脚本的执行。
```
保存为`script.txt`
# 5. 重新调试和破解
## 5.1 运行脚本
OD 重新加载`CrackMe.vmp.exe`，在反汇编窗口点击右键，选择`运行脚本->script.txt`
!<a href="elink@9e8K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4U0l9J5z5o6b7@1x3e0N6Q4x3X3c8X3x3h3c8U0y4r3f1H3y4#2)9J5k6o6S2W2y4X3u0Q4x3X3b7@1j5U0c8U0i4K6u0V1j5X3t1@1j5#2)9J5k6o6j5#2k6e0p5H3k6e0k6W2j5$3q4V1j5W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3g2W2k6h3c8W2y4g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7#2y4U0y4Q4x3U0k6A6k6q4)9K6c8s2f1$3y4h3g2S2x3r3g2U0x3g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6R3@1y4g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5z5e0p5K6i4K6t1$3L8%4u0A6k6$3W2F1j5h3I4f1P5i4m8W2i4K6y4p5j5X3W2F1j5i4u0&6i4K6t1$3M7X3q4@1K9h3!0Q4x3@1b7I4i4K6u0W2y4g2)9J5y4Y4u0G2N6r3q4@1K9h3!0F1i4K6y4p5x3q4)9J5y4Y4y4Z5L8%4N6f1K9i4c8D9k6g2)9K6c8r3k6S2L8s2y4W2i4K6t1$3M7$3W2*7k6g2)9K6c8o6t1%4x3U0t1^5x3W2)9J5y4Y4y4@1j5i4c8#2M7#2)9K6c8r3c8G2L8X3g2Q4x3U0k6K6N6s2W2D9k6g2)9K6c8r3&6G2L8X3g2Q4x3U0k6@1j5i4y4C8d9h3c8Q4x3@1c8#2x3U0k6S2k6o6k6T1k6h3g2Q4x3X3c8T1y4K6m8T1i4K6u0V1y4o6W2W2z5g2)9J5k6r3t1^5z5o6c8Q4x3X3b7%4x3o6m8S2x3e0S2S2j5U0l9#2k6q4)9J5y4Y4c8A6N6r3I4W2i4K6y4p5i4K6t1$3N6$3W2V1N6r3S2Q4x3@1b7$3x3o6S2Q4x3X3f1$3y4U0j5$3y4U0j5$3y4U0j5$3y4U0j5$3">image.png</a>
此时程序会运行，并打印字符串`Please enter your pwd >>`，随便输入 66 按回车键，会弹出窗口显示“脚本运行完成”。
!<a href="elink@09eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4U0l9#2y4o6V1&6y4U0y4Q4x3X3b7#2k6U0b7#2y4o6R3@1x3g2)9J5k6r3j5J5z5r3g2Q4x3X3b7@1y4e0t1J5i4K6u0V1z5r3k6X3x3#2)9J5k6r3q4U0j5e0R3#2z5o6x3^5x3U0p5H3j5W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3K6S2U0z5r3t1^5y4W2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7@1x3o6W2Q4x3U0k6A6k6q4)9K6c8s2f1#2k6o6x3I4x3U0f1H3j5W2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6j5I4y4q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0V1I4x3q4)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7K6z5e0f1#2x3U0W2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0t1K6z5e0R3@1j5K6f1%4i4K6u0V1k6r3b7#2j5#2)9J5k6o6c8W2j5e0W2Q4x3X3c8T1x3h3q4T1i4K6u0V1z5o6c8V1j5e0M7$3z5e0y4U0y4e0k6Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0t1%4x3#2)9J5k6e0x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3`.">image.png</a>
## 5.2 修改寄存器的值
点击“确定”后，发现 EIP 停留在了`0049B79E`，因为之前脚本就在这个地址下了断点。注意此时的寄存器窗口，各个寄存器的值
```
EAX 00000246
ECX 00000040
EDX 50655CD1
EBX 004D7A92 CrackMe_.004D7A92
ESP 0022FDE4
EBP 0049B777 CrackMe_.0049B777
ESI 0022FEC6
EDI 004F9B18 CrackMe_.004F9B18
EIP 0049B79E CrackMe_.0049B79E
```
!<a href="elink@ad4K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4U0l9^5y4U0b7$3x3K6m8Q4x3X3b7$3x3$3y4S2z5r3f1&6y4#2)9J5k6r3y4T1z5r3q4Q4x3X3b7@1x3U0S2T1i4K6u0V1z5r3u0T1k6g2)9J5k6r3t1&6j5X3j5%4z5o6u0T1y4r3x3#2x3W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5@1k6U0u0W2j5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6x3K6N6Q4x3U0k6A6k6q4)9K6c8s2g2S2k6U0t1@1x3U0M7J5x3q4)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6f1H3y4W2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1$3x3#2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5x3K6x3@1z5o6S2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0W2W2x3U0y4V1y4U0u0U0i4K6u0V1k6r3q4X3k6q4)9J5k6o6c8V1z5o6u0Q4x3X3b7&6y4e0g2S2i4K6u0V1y4o6f1%4x3U0f1J5k6U0k6T1x3o6g2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5z5o6b7J5">image.png</a>
F7 走一下，寄存器的值没有发生任何变化
!<a href="elink@20fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4U0p5H3y4e0l9$3x3o6u0Q4x3X3b7J5k6U0q4V1j5$3q4X3z5g2)9J5k6r3f1%4y4e0W2Q4x3X3b7@1z5o6f1J5i4K6u0V1z5r3u0T1y4q4)9J5k6o6p5I4y4h3g2X3z5e0t1@1z5o6S2U0y4W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5K6k6U0q4W2z5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6y4U0y4Q4x3U0k6A6k6q4)9K6c8s2f1J5y4e0R3J5x3e0j5^5y4g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6f1@1y4q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1$3y4W2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5y4e0b7I4y4o6S2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0S2T1y4e0b7&6j5K6k6W2i4K6u0V1k6o6V1&6k6q4)9J5k6o6c8T1k6o6S2Q4x3X3c8S2y4$3t1%4i4K6u0V1j5$3f1K6k6e0R3@1x3e0k6U0j5e0k6Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5z5o6b7@1">image.png</a>
我们将 ECX 的值从`00000040`改为`00000000`
!<a href="elink@954K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3y4U0p5J5z5e0x3#2y4K6c8Q4x3X3c8T1y4o6t1&6z5o6R3%4j5#2)9J5k6r3t1$3z5o6S2Q4x3X3b7@1x3U0t1$3i4K6u0V1j5U0x3K6j5#2)9J5k6r3b7@1z5r3x3&6z5e0p5%4x3h3f1I4y4W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3j5@1k6U0y4W2j5g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6h3j5H3y4$3u0S2y4K6q4W2i4K6u0V1y4o6p5J5x3q4)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7K6x3U0g2Q4x3U0k6A6k6q4)9K6c8s2f1$3y4K6W2T1k6U0x3I4y4W2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7^5z5q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0t1%4x3g2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5x3K6p5H3x3K6k6Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6h3c8W2j5h3f1^5x3$3b7$3i4K6u0V1y4K6W2X3k6q4)9J5k6o6c8T1y4K6S2Q4x3X3c8T1k6h3p5J5i4K6u0V1j5e0W2X3j5e0S2S2y4e0x3J5j5h3y4Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5z5o6b7%4i4K6u0W2x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6y4l9`.`.">image.png</a>
# 6. 破解成功
然后再点击运行，破解成功，注意此时的 ZF 标志位为 0；
```
eax = 0x246；
ecx = 0x0；
运算结果是0；
```
!<a href="elink@5c5K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3z5o6b7J5y4e0j5^5x3o6k6Q4x3X3b7J5y4r3t1H3z5r3p5H3x3q4)9J5k6r3x3J5j5h3q4Q4x3X3b7@1y4K6j5$3i4K6u0V1z5e0l9H3y4#2)9J5k6o6t1^5x3e0S2T1k6e0x3$3y4K6b7%4y4g2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3u0U0j5X3q4T1x3g2)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6e0M7J5x3h3p5^5k6h3b7&6i4K6u0V1j5U0S2X3y4W2)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5y4o6N6Q4x3U0k6A6k6q4)9K6c8s2f1@1y4r3k6U0k6o6k6V1k6W2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6x3%4x3q4)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0f1%4y4q4)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7I4z5e0j5#2x3e0c8Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0c8S2j5U0b7%4x3U0x3$3i4K6u0V1z5h3p5J5x3q4)9J5k6o6b7K6z5r3u0Q4x3X3c8S2x3$3c8X3i4K6u0V1x3K6k6X3y4$3j5&6y4e0N6U0j5K6g2Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0l9@1z5g2)9J5k6e0x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3K6x3`.">image.png</a>
对比看一下，在输入错误密码且没有修改 ecx 的情况下，ZF 标志位为1
!<a href="elink@63cK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0k6r3&6Q4x3X3g2F1L8r3q4J5K9#2)9J5k6h3y4G2L8g2)9J5c8Y4W2#2M7i4g2W2i4K6u0r3x3q4)9J5c8U0t1H3x3U0c8Q4x3V1k6H3L8X3N6Q4x3V1j5@1x3o6b7J5z5o6x3&6z5g2)9J5c8U0p5%4x3e0M7H3z5o6b7I4x3e0x3^5y4U0c8Q4x3X3c8S2k6o6W2U0x3o6j5K6j5W2)9J5k6o6t1J5j5h3g2Q4x3X3b7@1j5$3g2T1i4K6u0V1j5X3t1J5j5g2)9J5k6o6c8T1x3o6l9J5k6X3x3%4y4o6y4W2j5W2)9J5k6i4m8F1k6#2)9J5x3$3q4$3k6i4u0S2k6$3g2t1N6h3g2Q4x3@1c8Q4x3U0f1J5x3$3t1&6j5U0k6S2k6q4)9J5y4X3y4D9K9h3g2F1N6p5W2V1i4K6y4p5N6e0M7J5x3h3p5^5k6h3b7&6i4K6u0V1j5U0S2X3y4W2)9J5k6o6c8Q4x3U0k6X3M7X3!0E0i4K6y4p5M7r3q4K6N6r3g2Q4x3U0k6Z5k6h3W2Y4K9s2c8Q4x3@1b7J5y4K6m8Q4x3U0k6A6k6q4)9K6c8s2g2W2y4K6u0X3x3U0V1&6y4g2)9J5y4X3!0J5K9h3N6A6L8V1S2W2K9h3N6Z5N6q4)9K6c8o6b7H3y4g2)9J5y4X3!0J5K9h3N6A6L8W2N6A6k6s2c8Z5i4K6y4p5x3e0j5I4x3W2)9J5y4X3!0J5K9h3N6A6L8X3q4D9g2s2W2H3k6g2)9K6c8r3u0A6L8X3q4J5P5g2)9J5y4Y4u0S2N6r3W2G2i4K6y4p5x3g2)9J5k6e0g2Q4x3U0k6J5L8%4c8S2N6r3W2G2L8W2)9K6c8o6m8Q4x3U0k6K6K9r3!0%4g2r3W2@1L8r3g2Q4x3@1c8X3j5h3I4K6k6g2)9J5y4Y4y4A6P5X3g2Q4x3@1b7J5x3e0M7H3x3e0W2Q4x3U0k6K6N6r3q4@1N6i4y4Q4x3@1c8V1L8$3&6W2i4K6t1$3M7%4c8&6L8r3g2Q4x3@1c8F1L8$3&6W2i4K6t1$3N6r3q4K6K9@1W2V1i4K6y4p5N6e0m8S2x3X3k6S2z5o6j5&6i4K6u0V1j5X3u0U0j5g2)9J5k6o6b7%4k6U0g2Q4x3X3b7^5x3U0k6S2i4K6u0V1x3e0g2V1z5h3x3@1y4U0k6X3z5o6N6Q4x3U0k6@1K9i4c8D9k6g2)9K6c8q4)9J5y4Y4N6A6k6s2c8Z5i4K6y4p5x3e0l9%4y4q4)9J5k6e0j5$3y4U0j5$3y4U0j5$3y4U0j5$3y4U0M7`.">image.png</a>

参考链接：
https://bbs.kanxue.com/thread-224732.htm
<mark class="encrypted">b2bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3N6r3S2W2M7$3g2$3k6h3&6@1K9s2y4G2L8W2)9J5c8Y4m8Q4x3V1j5I4y4o6t1%4y4o6j5#2x3#2)9J5k6h3S2@1L8h3H3`.</mark>
<mark class="encrypted">e4bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2T1K9h3I4A6j5X3W2D9K9g2)9J5k6h3y4G2L8g2)9J5c8Y4k6A6k6r3g2G2i4K6u0r3b7W2j5I4N6V1D9@1P5e0q4c8y4@1D9%4i4K6u0r3i4K6y4r3M7%4m8E0i4K6g2X3K9h3c8Q4y4h3k6X3M7X3!0E0i4K6y4p5x3K6x3K6i4K6u0W2x3K6x3%4i4K6u0W2M7$3g2S2M7X3y4Z5i4K6u0V1j5$3q4J5k6q4)9J5k6h3q4D9L8q4)9J5k6h3y4D9K9h3y4C8i4K6t1$3N6X3c8Q4y4h3k6K6L8%4g2J5j5$3g2Q4x3@1c8W2y4h3t1$3y4h3y4X3x3$3u0W2j5e0R3%4x3$3t1H3j5$3k6W2z5o6y4U0y4X3j5K6k6o6x3H3j5e0M7I4x3l9`.`.</mark>
《加密与解密（第4版）》

登录后可查看完整内容

传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！！

最后于 2024-5-31 16:17 被ZyOrca编辑，原因：

#其他内容 #软件保护 #调试逆向

上传的附件：

CrackMe.exe （1.30MB，62次下载）

收藏・54

点赞・13

打赏

最新回复 (7)
wyfe 雪币： 2575 活跃值： (577) 能力值： ( LV6，RANK：85 ) 在线值：发帖 66 回帖 465 粉丝 0 关注私信	wyfe 2 楼解决问题的思路值得学习 2024-5-31 18:25 0
小菜鸟一雪币： 2950 活跃值： (6247) 能力值： ( LV5，RANK：69 ) 在线值：发帖 6 回帖 908 粉丝 4 关注私信	小菜鸟一 3 楼能保存修改的文件并成功运行就更厉害了 2024-5-31 18:59 0
MonKeyDu 雪币： 2422 活跃值： (360) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 17 粉丝 1 关注私信	MonKeyDu 4 楼值得学习，希望多出这种零基础的教程！！ 2024-6-3 07:08 0
vaguem 雪币： 0 活跃值： (782) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 45 粉丝 1 关注私信	vaguem 5 楼这个特征太明显了，已经用泄露的源码把这段魔改了 2024-6-5 19:11 0
yuanyouran 雪币： 305 活跃值： (3075) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 184 粉丝 0 关注私信	yuanyouran 6 楼值得学习，过程思路清晰可见，感谢~~ 2024-6-24 10:24 0
木志本柯雪币： 6564 活跃值： (8619) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 446 粉丝 8 关注私信	木志本柯 7 楼 vmp也是一顿被吹上神探，基本上只要是虚拟化的加壳软件，有哪个是能被轻易分析的像tmd什么的，加了壳后都一样丢回收站。 2024-6-24 13:45 1
星雨雪币： 302 活跃值： (649) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 15 粉丝 0 关注私信	星雨 8 楼知其然知其所以然非常感谢我终于看懂vmp了 2026-8-5 17:20 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

ZyOrca

发帖

回帖

220

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (7)
wyfe 雪币： 2575 活跃值： (577) 能力值： ( LV6，RANK：85 ) 在线值：发帖 66 回帖 465 粉丝 0 关注私信	wyfe 2 楼解决问题的思路值得学习 2024-5-31 18:25 0
小菜鸟一雪币： 2950 活跃值： (6247) 能力值： ( LV5，RANK：69 ) 在线值：发帖 6 回帖 908 粉丝 4 关注私信	小菜鸟一 3 楼能保存修改的文件并成功运行就更厉害了 2024-5-31 18:59 0
MonKeyDu 雪币： 2422 活跃值： (360) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 17 粉丝 1 关注私信	MonKeyDu 4 楼值得学习，希望多出这种零基础的教程！！ 2024-6-3 07:08 0
vaguem 雪币： 0 活跃值： (782) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 45 粉丝 1 关注私信	vaguem 5 楼这个特征太明显了，已经用泄露的源码把这段魔改了 2024-6-5 19:11 0
yuanyouran 雪币： 305 活跃值： (3075) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 184 粉丝 0 关注私信	yuanyouran 6 楼值得学习，过程思路清晰可见，感谢~~ 2024-6-24 10:24 0
木志本柯雪币： 6564 活跃值： (8619) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 446 粉丝 8 关注私信	木志本柯 7 楼 vmp也是一顿被吹上神探，基本上只要是虚拟化的加壳软件，有哪个是能被轻易分析的像tmd什么的，加了壳后都一样丢回收站。 2024-6-24 13:45 1
星雨雪币： 302 活跃值： (649) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 15 粉丝 0 关注私信	星雨 8 楼知其然知其所以然非常感谢我终于看懂vmp了 2026-8-5 17:20 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复