【破解日期】 2006年8月2日
【破解作者】 冷血书生
【作者邮箱】 colddoctor@126.com
【作者主页】 http://www.126sohu.com
【使用工具】 OD
【破解平台】 Win9x/NT/2000/XP
【软件名称】 wxh9833's CrackMe
【下载地址】 本地
【软件大小】 32KB
【加壳方式】 无
【破解声明】 我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------------------------
【破解内容】
下断bp __vbaStrComp,中断取消并返回
00402FD7 call crackme_.00403470 ; 将用户名用MD5进行四轮运算
00402FDC mov dword ptr ss:[ebp-6C],eax ; 结果传送到[ebp-6C]
00402FDF lea eax,dword ptr ss:[ebp-74]
00402FE2 lea ecx,dword ptr ss:[ebp-84]
00402FE8 push eax
00402FE9 push ecx
00402FEA mov dword ptr ss:[ebp-74],8
00402FF1 call dword ptr ds:[<&MSVBVM60.#518>] ; MSVBVM60.rtcLowerCaseVar
00402FF7 lea edx,dword ptr ss:[ebp-84]
00402FFD lea ebx,dword ptr ds:[esi+34]
00403000 push edx
00403001 call dword ptr ds:[<&MSVBVM60.__vbaStrVarMove>; MSVBVM60.__vbaStrVarMove
00403007 mov edx,eax
00403009 lea ecx,dword ptr ss:[ebp-60]
0040300C call edi
0040300E mov edx,eax
00403010 mov ecx,ebx
00403012 call dword ptr ds:[<&MSVBVM60.__vbaStrCopy>] ; MSVBVM60.__vbaStrCopy
00403018 lea eax,dword ptr ss:[ebp-60]
0040301B lea ecx,dword ptr ss:[ebp-5C]
0040301E push eax
0040301F mov edi,2
00403024 push ecx
00403025 push edi
00403026 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrLis>; MSVBVM60.__vbaFreeStrList
0040302C add esp,0C
0040302F lea ecx,dword ptr ss:[ebp-64]
00403032 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00403038 lea edx,dword ptr ss:[ebp-84]
0040303E lea eax,dword ptr ss:[ebp-74]
00403041 push edx
00403042 push eax
00403043 push edi
00403044 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarLis>; MSVBVM60.__vbaFreeVarList
0040304A mov ecx,dword ptr ds:[ebx]
0040304C add esp,0C
0040304F push ecx
00403050 call dword ptr ds:[<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00403056 mov ebx,dword ptr ds:[<&MSVBVM60.__vbaVarMove>; MSVBVM60.__vbaVarMove
0040305C lea edx,dword ptr ss:[ebp-A4]
00403062 lea ecx,dword ptr ss:[ebp-54]
00403065 mov dword ptr ss:[ebp-9C],eax
0040306B mov dword ptr ss:[ebp-A4],3
00403075 call ebx
00403077 mov eax,1
0040307C lea edx,dword ptr ss:[ebp-A4]
00403082 mov dword ptr ss:[ebp-9C],eax
00403088 mov dword ptr ss:[ebp-AC],eax
0040308E lea eax,dword ptr ss:[ebp-54]
00403091 push edx
00403092 lea ecx,dword ptr ss:[ebp-B4]
00403098 push eax
00403099 lea edx,dword ptr ss:[ebp-F0]
0040309F push ecx
004030A0 lea eax,dword ptr ss:[ebp-E0]
004030A6 push edx
004030A7 lea ecx,dword ptr ss:[ebp-24]
004030AA push eax
004030AB push ecx
004030AC mov dword ptr ss:[ebp-A4],edi
004030B2 mov dword ptr ss:[ebp-B4],edi
004030B8 call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>; MSVBVM60.__vbaVarForInit
004030BE test eax,eax
004030C0 je crackme_.00403196
004030C6 mov edx,dword ptr ds:[esi+38]
004030C9 lea edi,dword ptr ds:[esi+38]
004030CC lea eax,dword ptr ds:[esi+34]
004030CF mov dword ptr ss:[ebp-BC],edx
004030D5 mov dword ptr ss:[ebp-9C],eax
004030DB lea eax,dword ptr ss:[ebp-74]
004030DE push eax
004030DF lea ecx,dword ptr ss:[ebp-A4]
004030E5 push 14
004030E7 lea edx,dword ptr ss:[ebp-84]
004030ED push ecx
004030EE push edx
004030EF mov dword ptr ss:[ebp-C4],8
004030F9 mov dword ptr ss:[ebp-6C],4
00403100 mov dword ptr ss:[ebp-74],2
00403107 mov dword ptr ss:[ebp-A4],4008
00403111 call dword ptr ds:[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
00403117 lea eax,dword ptr ss:[ebp-C4]
0040311D lea ecx,dword ptr ss:[ebp-84]
00403123 push eax
00403124 lea edx,dword ptr ss:[ebp-94]
0040312A push ecx
0040312B push edx
0040312C call dword ptr ds:[<&MSVBVM60.__vbaVarCat>] ; MSVBVM60.__vbaVarCat
00403132 push eax
00403133 call dword ptr ds:[<&MSVBVM60.__vbaStrVarMove>; MSVBVM60.__vbaStrVarMove
00403139 mov edx,eax ; 取第三轮运算结果后面四位
0040313B lea ecx,dword ptr ss:[ebp-58]
0040313E call dword ptr ds:[<&MSVBVM60.__vbaStrMove>] ; MSVBVM60.__vbaStrMove
00403144 mov edx,eax
00403146 mov ecx,edi
00403148 call dword ptr ds:[<&MSVBVM60.__vbaStrCopy>] ; MSVBVM60.__vbaStrCopy
0040314E lea ecx,dword ptr ss:[ebp-58]
00403151 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
00403157 lea eax,dword ptr ss:[ebp-94]
0040315D lea ecx,dword ptr ss:[ebp-84]
00403163 push eax
00403164 lea edx,dword ptr ss:[ebp-74]
00403167 push ecx
00403168 push edx
00403169 push 3
0040316B call dword ptr ds:[<&MSVBVM60.__vbaFreeVarLis>; MSVBVM60.__vbaFreeVarList
00403171 add esp,10
00403174 lea eax,dword ptr ss:[ebp-F0]
0040317A lea ecx,dword ptr ss:[ebp-E0]
00403180 lea edx,dword ptr ss:[ebp-24]
00403183 push eax
00403184 push ecx
00403185 push edx
00403186 call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>; MSVBVM60.__vbaVarForNext
0040318C mov edi,2
00403191 jmp crackme_.004030BE ; 循环复制N次,具体不记得,用N代替,这里不是关键
00403196 mov eax,1
0040319B lea ecx,dword ptr ss:[ebp-B4]
004031A1 mov dword ptr ss:[ebp-9C],eax
004031A7 mov dword ptr ss:[ebp-BC],eax
004031AD lea eax,dword ptr ss:[ebp-A4]
004031B3 lea edx,dword ptr ss:[ebp-C4]
004031B9 push eax
004031BA push ecx
004031BB lea eax,dword ptr ss:[ebp-110]
004031C1 push edx
004031C2 lea ecx,dword ptr ss:[ebp-100]
004031C8 push eax
004031C9 lea edx,dword ptr ss:[ebp-24]
004031CC push ecx
004031CD push edx
004031CE mov dword ptr ss:[ebp-A4],edi
004031D4 mov dword ptr ss:[ebp-AC],4
004031DE mov dword ptr ss:[ebp-B4],edi
004031E4 mov dword ptr ss:[ebp-C4],edi
004031EA call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>; MSVBVM60.__vbaVarForInit
004031F0 test eax,eax
004031F2 je crackme_.004032E8
004031F8 lea ecx,dword ptr ss:[ebp-74]
004031FB lea edx,dword ptr ss:[ebp-24]
004031FE lea eax,dword ptr ds:[esi+38]
00403201 push ecx
00403202 push edx
00403203 mov dword ptr ss:[ebp-6C],1
0040320A mov dword ptr ss:[ebp-74],edi
0040320D mov dword ptr ss:[ebp-9C],eax
00403213 mov dword ptr ss:[ebp-A4],4008
0040321D call dword ptr ds:[<&MSVBVM60.__vbaI4Var>] ; MSVBVM60.__vbaI4Var
00403223 push eax
00403224 lea eax,dword ptr ss:[ebp-A4]
0040322A lea ecx,dword ptr ss:[ebp-84]
00403230 push eax
00403231 push ecx
00403232 call dword ptr ds:[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
00403238 lea edx,dword ptr ss:[ebp-84]
0040323E lea eax,dword ptr ss:[ebp-58]
00403241 push edx
00403242 push eax
00403243 call dword ptr ds:[<&MSVBVM60.__vbaStrVarVal>>; MSVBVM60.__vbaStrVarVal
00403249 push eax
0040324A call dword ptr ds:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00403250 lea edx,dword ptr ss:[ebp-C4]
00403256 lea ecx,dword ptr ss:[ebp-44]
00403259 mov word ptr ss:[ebp-BC],ax ; ax转移到[ebp-BC]
00403260 mov dword ptr ss:[ebp-C4],edi
00403266 call ebx
00403268 lea ecx,dword ptr ss:[ebp-58]
0040326B call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
00403271 lea ecx,dword ptr ss:[ebp-84]
00403277 lea edx,dword ptr ss:[ebp-74]
0040327A push ecx
0040327B push edx
0040327C push edi
0040327D call dword ptr ds:[<&MSVBVM60.__vbaFreeVarLis>; MSVBVM60.__vbaFreeVarList
00403283 add esp,0C
00403286 lea eax,dword ptr ss:[ebp-44]
00403289 lea ecx,dword ptr ss:[ebp-A4]
0040328F lea edx,dword ptr ss:[ebp-74]
00403292 push eax
00403293 push ecx
00403294 push edx
00403295 mov dword ptr ss:[ebp-9C],3
0040329F mov dword ptr ss:[ebp-A4],edi
004032A5 call dword ptr ds:[<&MSVBVM60.__vbaVarMul>] ; MSVBVM60.__vbaVarMul /// 上面的值*3
004032AB mov edx,eax
004032AD lea ecx,dword ptr ss:[ebp-44]
004032B0 call ebx
004032B2 lea eax,dword ptr ss:[ebp-34]
004032B5 lea ecx,dword ptr ss:[ebp-44]
004032B8 push eax
004032B9 lea edx,dword ptr ss:[ebp-74]
004032BC push ecx
004032BD push edx
004032BE call dword ptr ds:[<&MSVBVM60.__vbaVarCat>] ; MSVBVM60.__vbaVarCat
004032C4 mov edx,eax
004032C6 lea ecx,dword ptr ss:[ebp-34]
004032C9 call ebx
004032CB lea eax,dword ptr ss:[ebp-110]
004032D1 lea ecx,dword ptr ss:[ebp-100]
004032D7 push eax
004032D8 lea edx,dword ptr ss:[ebp-24]
004032DB push ecx
004032DC push edx
004032DD call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>; MSVBVM60.__vbaVarForNext
004032E3 jmp crackme_.004031F0 ; 循环四次
004032E8 mov eax,dword ptr ds:[esi]
004032EA push esi
004032EB call dword ptr ds:[eax+300]
004032F1 mov ebx,dword ptr ds:[<&MSVBVM60.__vbaObjSet>>; MSVBVM60.__vbaObjSet
004032F7 lea ecx,dword ptr ss:[ebp-64]
004032FA push eax
004032FB push ecx
004032FC call ebx
004032FE mov edi,eax
00403300 lea eax,dword ptr ss:[ebp-58]
00403303 push eax
00403304 push edi
00403305 mov edx,dword ptr ds:[edi]
00403307 call dword ptr ds:[edx+A0]
0040330D test eax,eax
0040330F fclex
00403311 jge short crackme_.00403325
00403313 push 0A0
00403318 push crackme_.0040299C
0040331D push edi
0040331E push eax
0040331F call dword ptr ds:[<&MSVBVM60.__vbaHresultChe>; MSVBVM60.__vbaHresultCheckObj
00403325 mov eax,dword ptr ss:[ebp-58] ; 假码
00403328 lea ecx,dword ptr ss:[ebp-74]
0040332B lea edx,dword ptr ss:[ebp-34]
0040332E push ecx
0040332F push edx
00403330 mov dword ptr ss:[ebp-58],0
00403337 mov dword ptr ss:[ebp-6C],eax ; 出现真码
0040333A mov dword ptr ss:[ebp-74],8008
00403341 call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>] ; MSVBVM60.__vbaVarTstEq
00403347 lea ecx,dword ptr ss:[ebp-64]
0040334A mov edi,eax
0040334C call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00403352 lea ecx,dword ptr ss:[ebp-74]
////////////////////////////////////////////////////////////////////////////////////////////
算法总结:
1) 将用户名用MD5进行四轮运算,取第三轮运算结果的后面四位(大写转小写) = A
2) A的每一位*3 =B
3) 将B的每一次计算结果转化为十进制并连接起来 = 注册码
如:
name : leng
code : 144168303297
--------------------------------------------------------------------------------
【版权声明】 本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
