能力值:
(RANK:10 )
|
-
-
2 楼
用OD很容易搞定嘛
直接下断MessageBoxA
或者直接调试运行程序,弹出对话框后暂停,查看堆栈信息,也很容易找到调用的地方
NOP掉,搞定
我搞定的在附件里面,CrackMe一般除NAG不会很难
刚刚看了一下这个CrackMe的about,发现我这方法还不符合要求
见此句
The exercise is to do this without changing more than 2 bytes
不能改变超过两个字节......
|
能力值:
( LV9,RANK:170 )
|
-
-
3 楼
修改点:
0043EFC4 C3 retn
过程:
Bp MessageBoxA
断下后返回这里
0043EFE3 . 33D2 xor edx, edx
查看代码
0043EFC4 53 push ebx
0043EFC5 . 8BD8 mov ebx, eax
0043EFC7 . 6A 00 push 0 ; /Style = MB_OK|MB_APPLMODAL
0043EFC9 . 68 F4EF4300 push 0043EFF4 ; |Title = "Register today !!!"
0043EFCE . 68 08F04300 push 0043F008 ; |Text = "This is an unregistered Sharewareversion of CrackMe#3 (c) tC... If you want to get rid of that Nag Screen you had to buy the full version for only 500$."
0043EFD3 . A1 040C4400 mov eax, dword ptr [440C04] ; |
0043EFD8 . 8B00 mov eax, dword ptr [eax] ; |
0043EFDA . 8B40 24 mov eax, dword ptr [eax+24] ; |
0043EFDD . 50 push eax ; |hOwner
0043EFDE . E8 7572FCFF call <jmp.&user32.MessageBoxA> ; \MessageBoxA
0043EFE3 . 33D2 xor edx, edx
0043EFE5 . 8B83 C8020000 mov eax, dword ptr [ebx+2C8]
0043EFEB . E8 A82EFEFF call 00421E98
0043EFF0 . 5B pop ebx
0043EFF1 . C3 retn
|
能力值:
( LV2,RANK:10 )
|
-
-
4 楼
路过~
LS的应该都给的正解
不看了
|
能力值:
( LV2,RANK:10 )
|
-
-
5 楼
0043EFC7 . 6A 00 push 0 ; /Style = MB_OK|MB_APPLMODAL
0043EFC9 . 68 F4EF4300 push 0043EFF4 ; |Title = "Register today !!!"
0043EFCE . 68 08F04300 push 0043F008 ; |Text = "This is an unregistered Sharewareversion of CrackMe#3 (c) tC... If you want to get rid of that Nag Screen you had to buy the full version for only 500$."
0043EFD3 . A1 040C4400 mov eax, dword ptr [440C04] ; |
0043EFD8 . 8B00 mov eax, dword ptr [eax] ; |
0043EFDA . 8B40 24 mov eax, dword ptr [eax+24] ; |
0043EFDD . 50 push eax ; |hOwner
0043EFDE . E8 7572FCFF call <jmp.&user32.MessageBoxA> ; \MessageBoxA
0043EFE3 . 33D2 xor edx, edx
0043EFE5 . 8B83 C8020000 mov eax, dword ptr [ebx+2C8]
这个断下了,但是程序要求不要超过两个字节的,这么多我NOP 掉不算的.而且这个程序是自解压的.是否还有CRC校验?跟的我头都大了..我要加油!!!
|
能力值:
(RANK:10 )
|
-
-
6 楼
3楼已经给出正解了啊,提前返回就行了
|
能力值:
( LV2,RANK:10 )
|
-
-
7 楼
00439725 . 66:83B8 66020000 00 cmp word ptr [eax+266], 0
004370A1 . 66:83B8 B6020000 00 cmp word ptr [eax+2B6], 0
把上面两行的0改成43也可以,这样应该是改变2个字节就可以了
|
能力值:
( LV2,RANK:10 )
|
-
-
8 楼
|
能力值:
( LV2,RANK:10 )
|
-
-
9 楼
学习了....
|
|
|