[下载地址]： http://www.crackmes.de/users/noukeys/noukeys_keygenme1/
首先运行该程序没有出现注册窗口，而是先提醒要用数组当中随机产生的字符去注册，点OK出现注册窗口，然后输入用户名和假码得点确定得到提示MMMmm, no no no, try again!
有上面的提示，用OLLDBG调试：
1、将KEYGENME1程序发送至OLLDBG，在反汇编窗口点右键查找所有参考文本字符串（运行时得到提示的字符串）。
2、找到后（运行时得到提示的字符串）点右键中的反汇编窗口跟随即可。
3、在反汇编窗口中向上翻直到0045B314 /. 55 push ebp处下断点。
4、重新载入程序，F9运行，提示要某某字符去注册，点OK，程序注册窗口出现，输入用户名（必需8位且第三位一定要为x)与假码(十位）。以上输入的用户名与注册码的限制是初跟踪所得到的结果。
5、输入好上面的用户名与假码后点OK会断在下面处：
******上面省了不少汇编代码********************
0045B314 /. 55 push ebp
0045B315 |. 8BEC mov ebp, esp
0045B317 |. 33C9 xor ecx, ecx
0045B319 |. 51 push ecx
0045B31A |. 51 push ecx
0045B31B |. 51 push ecx
0045B31C |. 51 push ecx
0045B31D |. 51 push ecx
0045B31E |. 51 push ecx
0045B31F |. 51 push ecx
0045B320 |. 51 push ecx
0045B321 |. 53 push ebx
0045B322 |. 56 push esi
0045B323 |. 57 push edi
0045B324 |. 8BD8 mov ebx, eax
0045B326 |. 33C0 xor eax, eax
0045B328 |. 55 push ebp
0045B329 |. 68 4FB54500 push 0045B54F
0045B32E |. 64:FF30 push dword ptr fs:[eax]
0045B331 |. 64:8920 mov dword ptr fs:[eax], esp
0045B334 |. 33FF xor edi, edi
0045B336 |. FF05 30264600 inc dword ptr [462630]
0045B33C |. 833D 30264600>cmp dword ptr [462630], 3
0045B343 |. 0F8F DC010000 jg 0045B525
0045B349 |. 8D55 FC lea edx, dword ptr [ebp-4]
0045B34C |. 8B83 68030000 mov eax, dword ptr [ebx+368]
0045B352 |. E8 F115FEFF call 0043C948
0045B357 |. 8B45 FC mov eax, dword ptr [ebp-4]
0045B35A |. 8945 F8 mov dword ptr [ebp-8], eax
0045B35D |. 8B45 F8 mov eax, dword ptr [ebp-8]
0045B360 |. 85C0 test eax, eax
0045B362 |. 74 05 je short 0045B369
0045B364 |. 83E8 04 sub eax, 4
0045B367 |. 8B00 mov eax, dword ptr [eax]
0045B369 |> 83F8 08 cmp eax, 8
0045B36C |. 0F85 A7010000 jnz 0045B519
0045B372 |. 8D55 F4 lea edx, dword ptr [ebp-C]
0045B375 |. 8B83 68030000 mov eax, dword ptr [ebx+368]
0045B37B |. E8 C815FEFF call 0043C948
0045B380 |. 8B45 F4 mov eax, dword ptr [ebp-C]
0045B383 |. 8078 02 78 cmp byte ptr [eax+2], 78
0045B387 |. 0F85 80010000 jnz 0045B50D
0045B38D |. BE 01000000 mov esi, 1
0045B392 |> B8 2C264600 /mov eax, 0046262C
0045B397 |. E8 5C98FAFF |call 00404BF8 ; //此循环将随机生成的符号代替星（*）号-----共十个
0045B39C |. 0FB615 242646>|movzx edx, byte ptr [462624]
0045B3A3 |. 885430 FF |mov byte ptr [eax+esi-1], dl
0045B3A7 |. 46 |inc esi
0045B3A8 |. 83FE 0B |cmp esi, 0B
0045B3AB |.^ 75 E5 \jnz short 0045B392
0045B3AD |. 8D55 F0 lea edx, dword ptr [ebp-10]
0045B3B0 |. 8B83 68030000 mov eax, dword ptr [ebx+368]
0045B3B6 |. E8 8D15FEFF call 0043C948
0045B3BB |. 8B45 F0 mov eax, dword ptr [ebp-10] ; //将输入的用户名赋予EAX
0045B3BE |. 0FB640 07 movzx eax, byte ptr [eax+7] ; //取用户名最后一位赋予EAX
0045B3C2 |. 50 push eax ; //入栈
0045B3C3 |. B8 2C264600 mov eax, 0046262C
0045B3C8 |. E8 2B98FAFF call 00404BF8
0045B3CD |. 5A pop edx ; //出栈
0045B3CE |. 8850 01 mov byte ptr [eax+1], dl ; //结果值1:取用户名最后一位覆盖A7C9E8值的第二位(A7C9E8=上面用随机符号十位）
0045B3D1 |. 8D55 EC lea edx, dword ptr [ebp-14]
0045B3D4 |. 8B83 68030000 mov eax, dword ptr [ebx+368]
0045B3DA |. E8 6915FEFF call 0043C948
0045B3DF |. 8B45 EC mov eax, dword ptr [ebp-14]
0045B3E2 |. 0FB640 01 movzx eax, byte ptr [eax+1] ; //取用户名第二位赋予EAX
0045B3E6 |. 50 push eax ; //入栈
0045B3E7 |. B8 2C264600 mov eax, 0046262C
0045B3EC |. E8 0798FAFF call 00404BF8
0045B3F1 |. 5A pop edx ; //出栈
0045B3F2 |. 8850 04 mov byte ptr [eax+4], dl ; //结果值2:取用户名第二位覆盖上面结果值1的第五位
0045B3F5 |. 8D55 E8 lea edx, dword ptr [ebp-18]
0045B3F8 |. 8B83 68030000 mov eax, dword ptr [ebx+368] ; //上面运算的结果赋予EAX
0045B3FE |. E8 4515FEFF call 0043C948
0045B403 |. 8B45 E8 mov eax, dword ptr [ebp-18]
0045B406 |. 0FB640 04 movzx eax, byte ptr [eax+4] ; //取用户名的第五位赋予EAX
0045B40A |. 50 push eax ; //入栈
0045B40B |. B8 2C264600 mov eax, 0046262C
0045B410 |. E8 E397FAFF call 00404BF8
0045B415 |. 5A pop edx ; //出栈
0045B416 |. 8850 06 mov byte ptr [eax+6], dl ; //结果值3:取用户名第五位覆盖上面结果值2的第7位
0045B419 |. 8D55 E4 lea edx, dword ptr [ebp-1C]
0045B41C |. 8B83 6C030000 mov eax, dword ptr [ebx+36C] ; //上面运算的结果赋予EAX
0045B422 |. E8 2115FEFF call 0043C948
0045B427 |. 8B45 E4 mov eax, dword ptr [ebp-1C] ; //将假注册码赋予EAX
0045B42A |. 8945 F8 mov dword ptr [ebp-8], eax
0045B42D |. 8B45 F8 mov eax, dword ptr [ebp-8]
0045B430 |. 85C0 test eax, eax
0045B432 |. 74 05 je short 0045B439
0045B434 |. 83E8 04 sub eax, 4
0045B437 |. 8B00 mov eax, dword ptr [eax] ; //最假注册码位数（10位）
0045B439 |> 83F8 0A cmp eax, 0A ; //比较十六进制A(十进制10）不等就跳，判断假码是否十位。
0045B43C |. 0F85 B8000000 jnz 0045B4FA
0045B442 |. B8 2C264600 mov eax, 0046262C
0045B447 |. E8 AC97FAFF call 00404BF8
0045B44C |. 8B15 20264600 mov edx, dword ptr [462620] ; //将A98E08赋予EDX
0045B452 |. 8B0D 28264600 mov ecx, dword ptr [462628] ; //将产生的随机数是数组当中的第几位的数值赋予ECX
0045B458 |. 0FB6540A FB movzx edx, byte ptr [edx+ecx-5] ; //[EDX+ECX-5]等于00A98E0A，此时将498E0A的值赋予EDX
0045B45D |. 8810 mov byte ptr [eax], dl ; //结果值4：取00A98E0A值的低位字节覆盖结果值3的第一位
0045B45F |. B8 2C264600 mov eax, 0046262C
0045B464 |. E8 8F97FAFF call 00404BF8
0045B469 |. 8B15 20264600 mov edx, dword ptr [462620] ; //将00A98E08赋予EDX
0045B46F |. 8B0D 28264600 mov ecx, dword ptr [462628] ; //将产生的随机数是数组当中的第几位的数值赋予ECX
0045B475 |. 0FB6540A 02 movzx edx, byte ptr [edx+ecx+2] ; //[EDX+ECX+2]等于00A98E11，将00A98E11的值赋予EDX
0045B47A |. 8850 03 mov byte ptr [eax+3], dl ; //结果值5：取00A98E11值的低位字节覆盖结果值4的第四位
0045B47D |. A1 28264600 mov eax, dword ptr [462628] ; //
0045B482 |. B9 09000000 mov ecx, 9
0045B487 |. 99 cdq
0045B488 |. F7F9 idiv ecx
0045B48A |. 8BF2 mov esi, edx
0045B48C |. B8 2C264600 mov eax, 0046262C
0045B491 |. E8 6297FAFF call 00404BF8
0045B496 |. 46 inc esi
0045B497 |. 8B15 20264600 mov edx, dword ptr [462620] ; //将00A98E08赋予EDX
0045B49D |. 8B0D 28264600 mov ecx, dword ptr [462628] ; //将产生的随机数是数组当中的第几位的数值赋予ECX
0045B4A3 |. 0FB6540A 03 movzx edx, byte ptr [edx+ecx+3] ; //[EDX+ECX+3]等于00A98E12，将00A98E12的值赋予EDX
0045B4A8 |. 885430 FF mov byte ptr [eax+esi-1], dl ; //结果值6:取00A98E12值的低位字节覆盖结果值5的第八位
0045B4AC |. BE 01000000 mov esi, 1 ; //将1赋予ESI
0045B4B1 |> 8D55 E0 /lea edx, dword ptr [ebp-20] ; /循环：将假注册码每位与结果值6的每位比较，必需相等，不等失败。----->结果值6就是运算的正确注册码
0045B4B4 |. 8B83 6C030000 |mov eax, dword ptr [ebx+36C] ; |
0045B4BA |. E8 8914FEFF |call 0043C948 ; |
0045B4BF |. 8B45 E0 |mov eax, dword ptr [ebp-20] ; |将假码赋予EAX
0045B4C2 |. 0FB64430 FF |movzx eax, byte ptr [eax+esi-1] ; |第一次循环：取假码第一位赋予EAX,以后按寄存器的值变化依次运算
0045B4C7 |. 8B15 2C264600 |mov edx, dword ptr [46262C] ; |第一次循环：将结果值6赋予EDX
0045B4CD |. 3A4432 FF |cmp al, byte ptr [edx+esi-1] ; |第一次：将假码第一位与结果值6的第一位比较，必需相等。以后按寄存器的值变化依次运算
0045B4D1 |. 74 05 |je short 0045B4D8 ; |相等就跳
0045B4D3 |. BF 01000000 |mov edi, 1 ; |
0045B4D8 |> 46 |inc esi ; |加1
0045B4D9 |. 83FE 0B |cmp esi, 0B ; |与十六进制0B（十进制11）比较，大于就跳出循环往下运行
0045B4DC |.^ 75 D3 \jnz short 0045B4B1 ; \
0045B4DE |. 85FF test edi, edi ; //判断上面循环运算的EDI值是否为1，为1就失败
0045B4E0 |. 75 0C jnz short 0045B4EE
0045B4E2 |. B8 68B54500 mov eax, 0045B568 ; ASCII "Thanks you for solve. Now write a tuto and code a keygen."
0045B4E7 |. E8 E439FDFF call 0042EED0
0045B4EC |. EB 3E jmp short 0045B52C
0045B4EE |> B8 ACB54500 mov eax, 0045B5AC ; ASCII ":****( MMmmmmm, try... try.... try...."
0045B4F3 |. E8 D839FDFF call 0042EED0
0045B4F8 |. EB 32 jmp short 0045B52C
0045B4FA |> B8 DCB54500 mov eax, 0045B5DC ; ASCII "I close now because you are near to solve."
0045B4FF |. E8 CC39FDFF call 0042EED0
0045B504 |. 8BC3 mov eax, ebx
0045B506 |. E8 71A1FFFF call 0045567C
0045B50B |. EB 1F jmp short 0045B52C
0045B50D |> B8 10B64500 mov eax, 0045B610 ; ASCII ":( Sorry. You don`t know the answer "
0045B512 |. E8 B939FDFF call 0042EED0
0045B517 |. EB 13 jmp short 0045B52C
0045B519 |> B8 40B64500 mov eax, 0045B640 ; ASCII "MMMmm, no no no, try again! "
0045B51E |. E8 AD39FDFF call 0042EED0
0045B523 |. EB 07 jmp short 0045B52C
0045B525 |> 8BC3 mov eax, ebx
0045B527 |. E8 50A1FFFF call 0045567C
0045B52C |> 33C0 xor eax, eax
0045B52E |. 5A pop edx
0045B52F |. 59 pop ecx
0045B530 |. 59 pop ecx
0045B531 |. 64:8910 mov dword ptr fs:[eax], edx
0045B534 |. 68 56B54500 push 0045B556
0045B539 |> 8D45 E0 lea eax, dword ptr [ebp-20]
0045B53C |. BA 06000000 mov edx, 6
0045B541 |. E8 BA91FAFF call 00404700
0045B546 |. 8D45 FC lea eax, dword ptr [ebp-4]
0045B549 |. E8 8E91FAFF call 004046DC
0045B54E \. C3 retn
0045B54F .^ E9 F08AFAFF jmp 00404044
0045B554 .^ EB E3 jmp short 0045B539
0045B556 . 5F pop edi
0045B557 . 5E pop esi
0045B558 . 5B pop ebx
0045B559 . 8BE5 mov esp, ebp
0045B55B . 5D pop ebp
0045B55C . C3 retn
*******下面省了汇编代码***************************
总结：不难，非常适合新手。
tomenzi
2007年8月14日
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
