【文章标题】: 新手入门级算法分析
【文章作者】: xxxxxx
【作者邮箱】: 暂无
【作者主页】: 无
【软件名称】: CrackMe
【软件大小】: 216KB
【下载地址】: 自己搜索下载
【加壳方式】: 无
【保护方式】: 无
【编写语言】: DELPHI
【使用工具】: IDA,OD
【操作平台】: XPSP2
【软件介绍】: 非常简单的CrackMe
【作者声明】: 新手的第一个注册机,第一次算法分析
--------------------------------------------------------------------------------
【详细过程】
第一次使用 IDA ~~不太会用 直接 COPY 出来的代码好像没 OD COPY 出来的容易看懂~~
直接使用 IDA 的字符串查找~~~发现目标 "No no no! :( Try again
直接来到了这里
CODE:0042D57D ; ---------------------------------------------------------------------------
CODE:0042D57D
CODE:0042D57D loc_42D57D: ; CODE XREF: sub_42D4A8+C7j
CODE:0042D57D mov eax, offset s_NoNoNoTryAgai ; "No no no! :( Try again!"
CODE:0042D582 call sub_42D0F8
CODE:0042D582
按一下空格,转为 流程图,非常明了,直接来到下面的位置
CODE:0042D4A9 mov ebp, esp
CODE:0042D4AB xor ecx, ecx
CODE:0042D4AD push ecx
CODE:0042D4AE push ecx
CODE:0042D4AF push ecx
CODE:0042D4B0 push ecx
CODE:0042D4B1 push ebx
CODE:0042D4B2 push esi
CODE:0042D4B3 push edi
CODE:0042D4B4 mov esi, eax
CODE:0042D4B6 xor eax, eax
CODE:0042D4B8 push ebp
CODE:0042D4B9 push offset s_S1zI_Lx ; "?Z?xFF脎_^[?]密xFF\xFF\xFF\xFF\x1B"
CODE:0042D4BE push dword ptr fs:[eax]
CODE:0042D4C1 mov fs:[eax], esp
CODE:0042D4C4 lea edx, [ebp+var_8]
CODE:0042D4C7 mov eax, [esi+1DCh]
CODE:0042D4CD call sub_419E60 ; 取出用户名
CODE:0042D4CD
CODE:0042D4D2 cmp [ebp+var_8], 0 ; 用户名的长度是不是为0
CODE:0042D4D6 jz short loc_42D4EC 是0就死
CODE:0042D4D6
CODE:0042D4D8 lea edx, [ebp+var_C]
CODE:0042D4DB mov eax, [esi+1E0h]
CODE:0042D4E1 call sub_419E60 ; 取出密码的
CODE:0042D4E1
CODE:0042D4E6 cmp [ebp+var_C], 0 ; 比较长度是不是大于0
CODE:0042D4EA jnz short loc_42D4FB ; 不是0就去注册算法
CODE:0042D4EA
CODE:0042D4EC
CODE:0042D4EC loc_42D4EC: ; CODE XREF: sub_42D4A8+2Ej
CODE:0042D4EC mov eax, offset s_OneOfTheField ; "One of the fields is empty!"
CODE:0042D4F1 call sub_42D0F8
CODE:0042D4F1
CODE:0042D4F6 jmp loc_42D587
CODE:0042D4F6
CODE:0042D4FB ; ---------------------------------------------------------------------------
CODE:0042D4FB
CODE:0042D4FB loc_42D4FB: ; CODE XREF: sub_42D4A8+42j
CODE:0042D4FB mov ebx, 1
CODE:0042D500 lea edx, [ebp+var_8]
CODE:0042D503 mov eax, [esi+1DCh] ; 用户名的长度放入EAX
CODE:0042D509 call sub_419E60
CODE:0042D509
CODE:0042D50E mov eax, [ebp+var_8]
CODE:0042D511 call sub_4037C0
CODE:0042D511
CODE:0042D516 mov edi, eax
CODE:0042D518 lea eax, [ebp+var_4]
CODE:0042D51B call sub_403544
CODE:0042D51B
CODE:0042D520 cmp edi, ebx
CODE:0042D522 jl short loc_42D556
CODE:0042D522
CODE:0042D524
CODE:0042D524 loc_42D524: ; CODE XREF: sub_42D4A8+ACj
CODE:0042D524 lea edx, [ebp+var_8]
CODE:0042D527 mov eax, [esi+1DCh]
CODE:0042D52D call sub_419E60
CODE:0042D52D
CODE:0042D532 mov eax, [ebp+var_8] ; 用户名放入EAX
CODE:0042D535 xor edx, edx ; EDX清0
CODE:0042D537 mov dl, [eax+ebx-1] ; 依次取出用户名的ASCII码放入 dl 设为 A
CODE:0042D53B add edx, 5 ; A:=A+5
CODE:0042D53E lea eax, [ebp+var_10]
CODE:0042D541 call sub_4036E8
CODE:0042D541
CODE:0042D546 mov edx, [ebp+var_10]
CODE:0042D549 lea eax, [ebp+var_4]
CODE:0042D54C call sub_4037C8 ; A就是注册码了
CODE:0042D54C
CODE:0042D551 inc ebx ; 位置加1
CODE:0042D552 cmp edi, ebx ; 取完了所有吗?
CODE:0042D554 jge short loc_42D524
CODE:0042D554
CODE:0042D556
CODE:0042D556 loc_42D556: ; CODE XREF: sub_42D4A8+7Aj
CODE:0042D556 lea edx, [ebp+var_8]
CODE:0042D559 mov eax, [esi+1E0h]
CODE:0042D55F call sub_419E60
CODE:0042D55F
CODE:0042D564 mov eax, [ebp+var_8]
CODE:0042D567 mov edx, [ebp+var_4]
CODE:0042D56A call sub_4038D0
CODE:0042D56A
CODE:0042D56F jnz short loc_42D57D
CODE:0042D56F
CODE:0042D571 mov eax, offset s_CongratzCrack ; "Congratz cracker! hehehe"
CODE:0042D576 call sub_42D0F8
CODE:0042D576
CODE:0042D57B jmp short loc_42D587
CODE:0042D57B
CODE:0042D57D ; ---------------------------------------------------------------------------
CODE:0042D57D
CODE:0042D57D loc_42D57D: ; CODE XREF: sub_42D4A8+C7j
CODE:0042D57D mov eax, offset s_NoNoNoTryAgai ; "No no no! :( Try again!"
CODE:0042D582 call sub_42D0F8
--------------------------------------------------------------------------------
【经验总结】
第一次使用 IDA 来分析东西~~也是第一次搞出算法~~
注册算法
依次取出用户名的 ASCII值 加5后换成字符 就是注册码了~~超级容易~~
function GetKey(uid:string):string;
var
Temp:PChar;
b:Byte;
i:Integer;
begin
for i:=0 to Length(uid)-1 do
begin
temp:=PChar(uid);
b:=Ord(temp[i]) ;
b:=b+5;
Result:= Result+char(b);
end;
end;
--------------------------------------------------------------------------------
【版权声明】: 本文原创于看雪技术论坛, 转载请注明作者并保持文章的完整, 谢谢!
2007年02月01日 23:06:13
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
上传的附件：
