【破文标题】CrackMe_#1_by_JoJo 算法
【破文作者】XXNB
【作者邮箱】
【作者主页】http://free.ys168.com/?binbinbin7456
【破解工具】OD
【破解平台】xpsp2
【软件名称】CrackMe_#1_by_JoJo
【软件大小】
【原版下载】
【保护方式】
【软件简介】
【破解声明】向大侠们学习！！！只为学习！请尊重作者的劳动成功！
------------------------------------------------------------------------
【破解过程】
可以使用字符串参考，查找Unicode然后就轻松定位 了。
004028A0 > \55 push ebp
004028A1 . 8BEC mov ebp, esp
004028A3 . 83EC 0C sub esp, 0C
004028A6 . 68 76114000 push <jmp.&MSVBVM60.__vbaExceptHandle>; SE 处理程序安装
004028AB . 64:A1 0000000>mov eax, dword ptr fs:[0]
004028B1 . 50 push eax
004028B2 . 64:8925 00000>mov dword ptr fs:[0], esp
004028B9 . 81EC C0000000 sub esp, 0C0
004028BF . 53 push ebx
004028C0 . 56 push esi
004028C1 . 57 push edi
004028C2 . 8965 F4 mov dword ptr [ebp-C], esp
004028C5 . C745 F8 28114>mov dword ptr [ebp-8], 00401128
004028CC . 8B75 08 mov esi, dword ptr [ebp+8]
004028CF . 8BC6 mov eax, esi
004028D1 . 83E0 01 and eax, 1
004028D4 . 8945 FC mov dword ptr [ebp-4], eax
004028D7 . 83E6 FE and esi, FFFFFFFE
004028DA . 56 push esi
004028DB . 8975 08 mov dword ptr [ebp+8], esi
004028DE . 8B0E mov ecx, dword ptr [esi]
004028E0 . FF51 04 call dword ptr [ecx+4]
004028E3 . 8B16 mov edx, dword ptr [esi]
004028E5 . 33FF xor edi, edi
004028E7 . 56 push esi
004028E8 . 897D E8 mov dword ptr [ebp-18], edi
004028EB . 897D E4 mov dword ptr [ebp-1C], edi
004028EE . 897D D4 mov dword ptr [ebp-2C], edi
004028F1 . 897D C4 mov dword ptr [ebp-3C], edi
004028F4 . 897D B4 mov dword ptr [ebp-4C], edi
004028F7 . 897D A4 mov dword ptr [ebp-5C], edi
004028FA . 897D 94 mov dword ptr [ebp-6C], edi
004028FD . 897D 84 mov dword ptr [ebp-7C], edi
00402900 . 89BD 74FFFFFF mov dword ptr [ebp-8C], edi
00402906 . 89BD 64FFFFFF mov dword ptr [ebp-9C], edi
0040290C . 89BD 54FFFFFF mov dword ptr [ebp-AC], edi
00402912 . 89BD 44FFFFFF mov dword ptr [ebp-BC], edi
00402918 . FF92 04030000 call dword ptr [edx+304]
0040291E . 50 push eax
0040291F . 8D45 E4 lea eax, dword ptr [ebp-1C]
00402922 . 50 push eax
00402923 . FF15 40104000 call dword ptr [<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402929 . 8BD8 mov ebx, eax
0040292B . 8D55 E8 lea edx, dword ptr [ebp-18]
0040292E . 52 push edx
0040292F . 53 push ebx
00402930 . 8B0B mov ecx, dword ptr [ebx]
00402932 . FF91 A0000000 call dword ptr [ecx+A0]
00402938 . 3BC7 cmp eax, edi
0040293A . DBE2 fclex
0040293C . 7D 12 jge short 00402950
0040293E . 68 A0000000 push 0A0
00402943 . 68 10214000 push 00402110
00402948 . 53 push ebx
00402949 . 50 push eax
0040294A . FF15 30104000 call dword ptr [<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402950 > DD05 20114000 fld qword ptr [401120] ; 这里出现550。因为是固定注册码，所以是常量550
00402956 . 833D 00404000>cmp dword ptr [404000], 0
0040295D . 75 08 jnz short 00402967
0040295F . DC35 18114000 fdiv qword ptr [401118] ; 550除以2。实数相除
00402965 . EB 11 jmp short 00402978
00402967 > FF35 1C114000 push dword ptr [40111C]
0040296D . FF35 18114000 push dword ptr [401118]
00402973 . E8 1CE8FFFF call <jmp.&MSVBVM60._adj_fdiv_m64>
00402978 > 8B45 E8 mov eax, dword ptr [ebp-18] ; 我们输入的假码出现了
0040297B . 68 00001440 push 40140000
00402980 . 8945 9C mov dword ptr [ebp-64], eax
00402983 . 57 push edi
00402984 . BB 05000000 mov ebx, 5
00402989 . 68 00002040 push 40200000
0040298E . 57 push edi
0040298F . 897D E8 mov dword ptr [ebp-18], edi
00402992 . C745 94 08800>mov dword ptr [ebp-6C], 8008
00402999 . C785 7CFFFFFF>mov dword ptr [ebp-84], 0EA94 ; 60052 这个常数要注意哦。
004029A3 . C785 74FFFFFF>mov dword ptr [ebp-8C], 3
004029AD . 899D 64FFFFFF mov dword ptr [ebp-9C], ebx
004029B3 . DD9D 6CFFFFFF fstp qword ptr [ebp-94] ; 刚才上面550除以2的结果275
004029B9 . DFE0 fstsw ax
004029BB . A8 0D test al, 0D
004029BD . 0F85 15020000 jnz 00402BD8
004029C3 . FF15 B0104000 call dword ptr [<&MSVBVM60.__vbaPower>; MSVBVM60.__vbaPowerR8
004029C9 . DC0D 10114000 fmul qword ptr [401110] ; 32768乘以225＝7372800
004029CF . 68 00000840 push 40080000
004029D4 . 57 push edi
004029D5 . 68 004CCD40 push 40CD4C00
004029DA . 57 push edi
004029DB . DD9D 5CFFFFFF fstp qword ptr [ebp-A4] ; 乘的结果
004029E1 . DFE0 fstsw ax
004029E3 . A8 0D test al, 0D
004029E5 . 0F85 ED010000 jnz 00402BD8
004029EB . 899D 54FFFFFF mov dword ptr [ebp-AC], ebx
004029F1 . FF15 B0104000 call dword ptr [<&MSVBVM60.__vbaPower>; MSVBVM60.__vbaPowerR8
004029F7 . DD9D 4CFFFFFF fstp qword ptr [ebp-B4] ; 这个函数是“用来求一个数字的某次方”
004029FD . 8D45 94 lea eax, dword ptr [ebp-6C]
00402A00 . 83C6 34 add esi, 34
00402A03 . 50 push eax
00402A04 . 8D8D 74FFFFFF lea ecx, dword ptr [ebp-8C]
00402A0A . 56 push esi
00402A0B . 8D55 D4 lea edx, dword ptr [ebp-2C]
00402A0E . 51 push ecx
00402A0F . 52 push edx
00402A10 . 899D 44FFFFFF mov dword ptr [ebp-BC], ebx ; 下面是60052*-856302534
00402A16 . FF15 7C104000 call dword ptr [<&MSVBVM60.__vbaVarMu>; MSVBVM60.__vbaVarMul
00402A1C . 8B35 C4104000 mov esi, dword ptr [<&MSVBVM60.__vba>; MSVBVM60.__vbaVarAdd
00402A22 . 50 push eax ; 上面是一个乘
00402A23 . 8D85 64FFFFFF lea eax, dword ptr [ebp-9C] ; 然后把加的函数付给esi。以后call esi就是加了
00402A29 . 8D4D C4 lea ecx, dword ptr [ebp-3C] ; -51422679771768 这个是上面乘的结果
00402A2C . 50 push eax
00402A2D . 51 push ecx
00402A2E . FFD6 call esi ; <&MSVBVM60.__vbaVarAdd>
00402A30 . 50 push eax ; 加。跟进去的话可以知道加的是275（500÷2）
00402A31 . 8D95 54FFFFFF lea edx, dword ptr [ebp-AC] ; 我们也可以在寄存器窗口的ST7看结果
00402A37 . 8D45 B4 lea eax, dword ptr [ebp-4C]
00402A3A . 52 push edx
00402A3B . 50 push eax
00402A3C . FFD6 call esi ; 又加
00402A3E . 8D8D 44FFFFFF lea ecx, dword ptr [ebp-BC] ; 跟进去可以看到是加7372800
00402A44 . 50 push eax ; ST7看结果
00402A45 . 8D55 A4 lea edx, dword ptr [ebp-5C]
00402A48 . 51 push ecx
00402A49 . 52 push edx
00402A4A . FF15 00104000 call dword ptr [<&MSVBVM60.__vbaVarSu>; MSVBVM60.__vbaVarSub
00402A50 . 50 push eax ; 减。ST7看结果。这个结果就是固定的注册码了
00402A51 . FF15 60104000 call dword ptr [<&MSVBVM60.__vbaVarTs>; MSVBVM60.__vbaVarTstEq
00402A57 . 8D4D E4 lea ecx, dword ptr [ebp-1C] ; 上面比较。eax的值就是返回的结果
00402A5A . 8BD8 mov ebx, eax
00402A5C . FF15 F4104000 call dword ptr [<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj
00402A62 . 8B35 14104000 mov esi, dword ptr [<&MSVBVM60.__vba>; MSVBVM60.__vbaFreeVarList
00402A68 . 8D45 94 lea eax, dword ptr [ebp-6C]
00402A6B . 8D4D B4 lea ecx, dword ptr [ebp-4C]
00402A6E . 50 push eax
00402A6F . 8D55 C4 lea edx, dword ptr [ebp-3C]
00402A72 . 51 push ecx
00402A73 . 52 push edx
00402A74 . 6A 03 push 3
00402A76 . FFD6 call esi ; <&MSVBVM60.__vbaFreeVarList>
00402A78 . B9 04000280 mov ecx, 80020004
00402A7D . B8 0A000000 mov eax, 0A
00402A82 . 83C4 10 add esp, 10
00402A85 . 66:3BDF cmp bx, di ; 这里比较。
00402A88 . 894D AC mov dword ptr [ebp-54], ecx
00402A8B . 8945 A4 mov dword ptr [ebp-5C], eax
00402A8E . 894D BC mov dword ptr [ebp-44], ecx
00402A91 . 8945 B4 mov dword ptr [ebp-4C], eax
00402A94 . 74 6E je short 00402B04 ; 关键跳转
00402A96 . 8B1D CC104000 mov ebx, dword ptr [<&MSVBVM60.__vba>; MSVBVM60.__vbaVarDup
00402A9C . 8D95 64FFFFFF lea edx, dword ptr [ebp-9C]
00402AA2 . 8D4D C4 lea ecx, dword ptr [ebp-3C] ; 成功信息
00402AA5 . C785 6CFFFFFF>mov dword ptr [ebp-94], 00402174 ; Good!
00402AAF . C785 64FFFFFF>mov dword ptr [ebp-9C], 8
00402AB9 . FFD3 call ebx ; <&MSVBVM60.__vbaVarDup>
00402ABB . 8D95 74FFFFFF lea edx, dword ptr [ebp-8C]
00402AC1 . 8D4D D4 lea ecx, dword ptr [ebp-2C]
00402AC4 . C785 7CFFFFFF>mov dword ptr [ebp-84], 00402124 ; Good! - now write a Serial Retriever!
00402ACE . C785 74FFFFFF>mov dword ptr [ebp-8C], 8
00402AD8 . FFD3 call ebx
00402ADA . 8D45 A4 lea eax, dword ptr [ebp-5C]
00402ADD . 8D4D B4 lea ecx, dword ptr [ebp-4C]
00402AE0 . 50 push eax
00402AE1 . 8D55 C4 lea edx, dword ptr [ebp-3C]
00402AE4 . 51 push ecx
00402AE5 . 52 push edx
00402AE6 . 8D45 D4 lea eax, dword ptr [ebp-2C]
00402AE9 . 6A 40 push 40
00402AEB . 50 push eax
00402AEC . FF15 44104000 call dword ptr [<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox
00402AF2 . 8D4D A4 lea ecx, dword ptr [ebp-5C]
00402AF5 . 8D55 B4 lea edx, dword ptr [ebp-4C]
00402AF8 . 51 push ecx
00402AF9 . 8D45 C4 lea eax, dword ptr [ebp-3C]
00402AFC . 52 push edx
00402AFD . 8D4D D4 lea ecx, dword ptr [ebp-2C]
00402B00 . 50 push eax
00402B01 . 51 push ecx
00402B02 . EB 6C jmp short 00402B70
00402B04 > 8B1D CC104000 mov ebx, dword ptr [<&MSVBVM60.__vba>; MSVBVM60.__vbaVarDup
00402B0A . 8D95 64FFFFFF lea edx, dword ptr [ebp-9C] ; 失败信息
00402B10 . 8D4D C4 lea ecx, dword ptr [ebp-3C]
00402B13 . C785 6CFFFFFF>mov dword ptr [ebp-94], 004021AC ; Sorry
00402B1D . C785 64FFFFFF>mov dword ptr [ebp-9C], 8
00402B27 . FFD3 call ebx ; <&MSVBVM60.__vbaVarDup>
00402B29 . 8D95 74FFFFFF lea edx, dword ptr [ebp-8C]
00402B2F . 8D4D D4 lea ecx, dword ptr [ebp-2C]
00402B32 . C785 7CFFFFFF>mov dword ptr [ebp-84], 00402184 ; Sorry, try again!
00402B3C . C785 74FFFFFF>mov dword ptr [ebp-8C], 8
00402B46 . FFD3 call ebx
大家有空的也下载来分析下。就是一些实数加减乘除。
我这里的固定注册码是-54797672398693。如果直接下断MSVBVM60.__vbaVarTstEq这个函数的话，可以直接在寄存器窗口的ST7直接看到结果。
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
