【文章标题】:菜鸟的第二个注册机
【文章作者】:SHAKA919
【破解日期】:2007_02_07
【下载地址】:附件
【使用工具】:OD , PEiD
【作者声明】:只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
这是一个非常适合新手的CM,而且是我破出来的第二个CM(高手不要笑我阿,每个人都曾经是新手的, 呵呵!)废话少说,开搞吧.
PEiD查壳,发现是MASM32 / TASM32写的.难怪程序才4K这么小.
运行这个程序,随便输入name 和 code.没有反应?看来是输入正确才有反应的 呵呵.OD载入把.用超级字符串查找,"yeah, you did it!"这句话好象是正确的提示.双击转到代码.我们在0400110E设断点.
004010FC /$ 55 PUSH EBP
004010FD |. 8BEC MOV EBP,ESP
004010FF |. 6A 14 PUSH 14 ; /Count = 14 (20.)
00401101 |. 68 80304000 PUSH AD_CM#2.00403080 ; |Buffer = AD_CM#2.00403080
00401106 |. 68 B80B0000 PUSH 0BB8 ; |ControlID = BB8 (3000.)
0040110B |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
0040110E |. E8 77000000 CALL <JMP.&USER32.GetDlgItemTextA> ; \取得name这里断下~~~~
00401113 |. 8BF0 MOV ESI,EAX ; esi = len(name)
00401115 |. 8D01 LEA EAX,DWORD PTR DS:[ECX]
00401117 |. 83FE 05 CMP ESI,5 ; len(name) >= 5
0040111A |. 7D 18 JGE SHORT AD_CM#2.00401134
0040111C |. 6A 40 PUSH 40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0040111E |. 68 12304000 PUSH AD_CM#2.00403012 ; |arturdents crackme#2
00401123 |. 68 44304000 PUSH AD_CM#2.00403044 ; |your name must be at least five characters long!
00401128 |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hOwner
0040112B |. E8 60000000 CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
00401130 |. 33C0 XOR EAX,EAX
00401132 |. EB 40 JMP SHORT AD_CM#2.00401174
00401134 |> 6A 14 PUSH 14 ; /Count = 14 (20.)
00401136 |. 68 80324000 PUSH AD_CM#2.00403280 ; |Buffer = AD_CM#2.00403280
0040113B |. 68 B90B0000 PUSH 0BB9 ; |ControlID = BB9 (3001.)
00401140 |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
00401143 |. E8 42000000 CALL <JMP.&USER32.GetDlgItemTextA> ; 取得code
00401148 |. B8 80304000 MOV EAX,AD_CM#2.00403080
0040114D |. BB 80324000 MOV EBX,AD_CM#2.00403280
00401152 |. 8BCE MOV ECX,ESI
00401154 |> 8A10 MOV DL,BYTE PTR DS:[EAX] // name里面每一个字符送DL
00401156 |. 2AD1 |SUB DL,CL // DL = DL - CL
00401158 |. 3813 |CMP BYTE PTR DS:[EBX],DL ; 关键比较处,不相等就挂
0040115A |. 75 18 |JNZ SHORT AD_CM#2.00401174 ; 挂了
0040115C |. 40 |INC EAX // 指向name下一个字符
0040115D |. 43 |INC EBX // 指向code下一个字符
0040115E |.^ E2 F4 \LOOPD SHORT AD_CM#2.00401154 // 循环回去,ecx ++
00401160 |. 6A 40 PUSH 40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
00401162 |. 68 12304000 PUSH AD_CM#2.00403012 ; |arturdents crackme#2
00401167 |. 68 27304000 PUSH AD_CM#2.00403027 ; |yeah, you did it!
0040116C |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hOwner
0040116F |. E8 1C000000 CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA 成功的提示框
00401174 |> C9 LEAVE // 挂了来到这里
00401175 \. C2 0400 RETN 4
总结一下:
每个字符转换为ASCII码记为ASCII(Name[i]),ASCII(Name[i]) - len(Name) - i // i从0开始计算.code不能比name短,但是在前面的len(name)位满足上面的规则的情况下,后面可以有任意多位字符.
算法非常简单,但是让我找到了自信,这个CM早就破出来了,我只是想把自己的喜悦和大家分享,希望有一天我不再是新手!:D
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
