首页
社区
课程
招聘
一个非常菜的CRACKME分析
发表于: 2008-8-16 21:34 13979

一个非常菜的CRACKME分析

2008-8-16 21:34
13979

crackme 
名称ex803

1.PEID查壳发现未加壳,使用Borland C++ 1999编写
2.运行程序,随便输入NAME,SERIAL. Name:alex Serial:123456
弹出错误提示框That's not correct
3.OD载入ex803
4.右击超级字符串查找 -> ASCII码查找 -> 找到That's not correct,双击进入
5.进入后向上找,在00401150处下断点(F2),F9运行程序,输入Name:alex Serial:123456
点CHECK后,0D产生中断
6.单步向下F8,算法分析。
00401150  /$  55            PUSH EBP
00401151  |.  8BEC          MOV EBP,ESP
00401153  |.  83C4 AC       ADD ESP,-54
00401156  |.  53            PUSH EBX
00401157  |.  56            PUSH ESI
00401158  |.  8B75 08       MOV ESI,DWORD PTR SS:[EBP+8]
0040115B  |.  6A 19         PUSH 19                                  ;
0040115D  |.  6A 00         PUSH 0                                   ; 
0040115F  |.  8D45 E4       LEA EAX,DWORD PTR SS:[EBP-1C]            ; 
00401162  |.  50            PUSH EAX                                 ;
00401163  |.  E8 CC110000   CALL ex803.00402334                      ; 
00401168  |.  83C4 0C       ADD ESP,0C
0040116B  |.  6A 19         PUSH 19                                  ; 
0040116D  |.  6A 00         PUSH 0                                   ; 
0040116F  |.  8D55 C8       LEA EDX,DWORD PTR SS:[EBP-38]            ;
00401172  |.  52            PUSH EDX                                 ;
00401173  |.  E8 BC110000   CALL ex803.00402334                      ; 
00401178  |.  83C4 0C       ADD ESP,0C
0040117B  |.  6A 19         PUSH 19                                  ; 
0040117D  |.  6A 00         PUSH 0                                   ;
0040117F  |.  8D4D AC       LEA ECX,DWORD PTR SS:[EBP-54]            ; 
00401182  |.  51            PUSH ECX                                 ; 
00401183  |.  E8 AC110000   CALL ex803.00402334                      ; 
00401188  |.  83C4 0C       ADD ESP,0C
0040118B  |.  6A 65         PUSH 65                                  ; ControlID = 65 (101.)
0040118D  |.  56            PUSH ESI                                 ; hwnd=001b0502
0040118E  |.  E8 5F900000   CALL <JMP.&USER32.GetDlgItem>            ; GetDlgItem
00401193  |.  6A 19         PUSH 19                                  ; Count=19H(最大输入字符数25)
00401195  |.  8D55 E4       LEA EDX,DWORD PTR SS:[EBP-1C]            ; 
00401198  |.  52            PUSH EDX                                 ; buffer=0012FAA8(存放注册名)
00401199  |.  50            PUSH EAX                                 ; hWnd=001204FC
0040119A  |.  E8 59900000   CALL <JMP.&USER32.GetWindowTextA>        ; EAX=注册名长度
0040119F  |.  6A 66         PUSH 66                                  ; ControlID = 66 (102.)
004011A1  |.  56            PUSH ESI                                 ; hWnd
004011A2  |.  E8 4B900000   CALL <JMP.&USER32.GetDlgItem>            ; GetDlgItem
004011A7  |.  6A 19         PUSH 19                                  ; Count=19H(最大输入字符数25)
004011A9  |.  8D4D C8       LEA ECX,DWORD PTR SS:[EBP-38]            ; 
004011AC  |.  51            PUSH ECX                                 ; Buffer=0012FA8C
004011AD  |.  50            PUSH EAX                                 ; hWnd
004011AE  |.  E8 45900000   CALL <JMP.&USER32.GetWindowTextA>        ; EAX=注册码长度
004011B3  |.  8D45 E4       LEA EAX,DWORD PTR SS:[EBP-1C]            ;  EAX=0012FAA8
004011B6  |.  50            PUSH EAX                                 ;  保存注册名
004011B7  |.  E8 A4120000   CALL ex803.00402460
004011BC  |.  59            POP ECX                                  ;  ECX=0012FAA8
004011BD  |.  8BC8          MOV ECX,EAX                              ;  ECX=EAX=注册名长度
004011BF  |.  83F9 04       CMP ECX,4
004011C2  |.  7D 14         JGE SHORT ex803.004011D8                 ;  注册名长度大于等于4
004011C4  |.  6A 10         PUSH 10                                  ; Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
004011C6  |.  68 7CB14000   PUSH ex803.0040B17C                      ; ERROR
004011CB  |.  68 4CB14000   PUSH ex803.0040B14C                      ; Your name must contain at least 4 characters!\r\n
004011D0  |.  56            PUSH ESI                                 ; hOwner
004011D1  |.  E8 28900000   CALL <JMP.&USER32.MessageBoxA>           ; MessageBoxA
004011D6  |.  EB 67         JMP SHORT ex803.0040123F
004011D8  |>  33D2          XOR EDX,EDX                              ;  EDX清零
004011DA  |.  33C0          XOR EAX,EAX                              ;  EAX清零
004011DC  |.  3BC8          CMP ECX,EAX
004011DE  |.  7E 0D         JLE SHORT ex803.004011ED
004011E0  |>  33DB          /XOR EBX,EBX                             ;  EBX清零
004011E2  |.  8A5C05 E4     |MOV BL,BYTE PTR SS:[EBP+EAX-1C]         ;  BL=注册名每一位ASCII码
004011E6  |.  03D3          |ADD EDX,EBX                             ;  EDX=EDX+EBX(EDX用于累加注册名每一位ASCII码值)
004011E8  |.  40            |INC EAX                                 ;  EAX+1
004011E9  |.  3BC8          |CMP ECX,EAX                             ;  取到最后一个字符了吗?
004011EB  |.^ 7F F3         \JG SHORT ex803.004011E0                 ;  没有取完,goto 004011E0
004011ED  |>  52            PUSH EDX                                 ; Arg3=计算出的注册码
004011EE  |.  68 82B14000   PUSH ex803.0040B182                      ; %d
004011F3  |.  8D45 AC       LEA EAX,DWORD PTR SS:[EBP-54]            ; 
004011F6  |.  50            PUSH EAX                                 ; Arg1
004011F7  |.  E8 C0280000   CALL ex803.00403ABC                      ; 转化为10进制数
004011FC  |.  83C4 0C       ADD ESP,0C
004011FF  |.  8D55 AC       LEA EDX,DWORD PTR SS:[EBP-54]            ;  EDX=转化后的十进制数(计算出的注册码)
00401202  |.  52            PUSH EDX                                 ;  保存EDX
00401203  |.  8D4D C8       LEA ECX,DWORD PTR SS:[EBP-38]            ;  ECX=假注册码
00401206  |.  51            PUSH ECX                                 ;  保存假注册码
00401207  |.  E8 08120000   CALL ex803.00402414                      ;  真假注册码比较F7跟进
0040120C  |.  83C4 08       ADD ESP,8
0040120F  |.  85C0          TEST EAX,EAX                             ;  标志位比较
00401211  |.  75 17         JNZ SHORT ex803.0040122A
00401213  |.  68 30000400   PUSH 40030                               ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL|40000
00401218  |.  68 CEB14000   PUSH ex803.0040B1CE                      ; |You Did It!
0040121D  |.  68 85B14000   PUSH ex803.0040B185                      ; |Congradulations, you have figured out Step1\nStep1 unlock code is: 17FF25
00401222  |.  56            PUSH ESI                                 ; |hOwner
00401223  |.  E8 D68F0000   CALL <JMP.&USER32.MessageBoxA>           ; \MessageBoxA
00401228  |.  EB 15         JMP SHORT ex803.0040123F
0040122A  |>  68 30000400   PUSH 40030                               ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL|40000
0040122F  |.  68 EDB14000   PUSH ex803.0040B1ED                      ; |Wrong!
00401234  |.  68 DAB14000   PUSH ex803.0040B1DA                      ; |That's not correct
00401239  |.  56            PUSH ESI                                 ; |hOwner
0040123A  |.  E8 BF8F0000   CALL <JMP.&USER32.MessageBoxA>           ; \MessageBoxA
0040123F  |>  5E            POP ESI
00401240  |.  5B            POP EBX
00401241  |.  8BE5          MOV ESP,EBP
00401243  |.  5D            POP EBP
00401244  \.  C3            RETN

在真假注册码比较处 F7跟进
00402414  /$  8B4C24 04     MOV ECX,DWORD PTR SS:[ESP+4]
00402418  |.  8B5424 08     MOV EDX,DWORD PTR SS:[ESP+8]
0040241C  |.  53            PUSH EBX
0040241D  |.  33C0          XOR EAX,EAX                              ;  EAX清零
0040241F      33DB          XOR EBX,EBX                              ;  EBX清零
00402421      8A01          MOV AL,BYTE PTR DS:[ECX]                 ;  AL=注册码第一位ASCII码
00402423      8A1A          MOV BL,BYTE PTR DS:[EDX]                 ;  BL=计算出的注册码第一位
00402425      2BC3          SUB EAX,EBX                              ;  EAX=EAX-EBX
00402427      75 34         |JNZ SHORT ex803.0040245D                ;  真假注册码第一位不等,则OVER
00402429      84DB          |TEST BL,BL
0040242B      74 30         |JE SHORT ex803.0040245D
0040242D      8A41 01       |MOV AL,BYTE PTR DS:[ECX+1]
00402430      8A5A 01       |MOV BL,BYTE PTR DS:[EDX+1]
00402433      2BC3          |SUB EAX,EBX
00402435      75 26         |JNZ SHORT ex803.0040245D                ;  真假注册码第二位不等,则OVER
00402437      84DB          |TEST BL,BL
00402439      74 22         |JE SHORT ex803.0040245D
0040243B      8A41 02       |MOV AL,BYTE PTR DS:[ECX+2]
0040243E      8A5A 02       |MOV BL,BYTE PTR DS:[EDX+2]
00402441      2BC3          |SUB EAX,EBX
00402443      75 18         |JNZ SHORT ex803.0040245D                ;  真假注册码第三位不等,则OVER
00402445      84DB          |TEST BL,BL
00402447      74 14         |JE SHORT ex803.0040245D
00402449      8A41 03       |MOV AL,BYTE PTR DS:[ECX+3]
0040244C      8A5A 03       |MOV BL,BYTE PTR DS:[EDX+3]
0040244F      2BC3          |SUB EAX,EBX
00402451      75 0A         |JNZ SHORT ex803.0040245D                ;  真假注册码第四位不等,则OVER
00402453      83C1 04       |ADD ECX,4
00402456      83C2 04       |ADD EDX,4
00402459      84DB          |TEST BL,BL
0040245B    ^ 75 C4         \JNZ SHORT ex803.00402421
0040245D  |>  5B            POP EBX
0040245E  \.  C3            RETN

算法分析
1.注册名长度至少4位。
2.累加注册名每一位ASCII码值
3.将累加结果转化成十进制数。

C语言注册机
#include <stdio.h>
#include <conio.h>
int KeyGen(char* strName)
{
  int i, sum = 0;
  for( i = 0; i < strlen(strName); i++)
  {
    sum += strName[i];
  }
  printf("%d",sum);
}
int main( int argc, char *argv[] )
{
  char strName[20]="";
  printf("input a user name which must long than 4 charactors,less than 19:");
  scanf("%s",strName);
  printf("\n\n");
  KeyGen(strName);
  
  getchar();  
  return 0;
}

************************************************************************************************************************
爆破法

00401202  |.  52            PUSH EDX                                 ;  保存EDX
00401203  |.  8D4D C8       LEA ECX,DWORD PTR SS:[EBP-38]            ;  ECX=假注册码
00401206  |.  51            PUSH ECX                                 ;  保存假注册码
00401207  |.  E8 08120000   CALL ex803.00402414                      ;  真假注册码比较
0040120C  |.  83C4 08       ADD ESP,8
0040120F  |.  85C0          TEST EAX,EAX                             ;  标志位比较
00401211  |.  75 17         JNZ SHORT ex803.0040122A
00401213  |.  68 30000400   PUSH 40030                               ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL|40000
00401218  |.  68 CEB14000   PUSH ex803.0040B1CE                      ; |You Did It!
0040121D  |.  68 85B14000   PUSH ex803.0040B185                      ; |Congradulations, you have figured out Step1\nStep1 unlock code is: 17FF25
00401222  |.  56            PUSH ESI                                 ; |hOwner
00401223  |.  E8 D68F0000   CALL <JMP.&USER32.MessageBoxA>           ; \MessageBoxA
00401228  |.  EB 15         JMP SHORT ex803.0040123F
0040122A  |>  68 30000400   PUSH 40030                               ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL|40000
0040122F  |.  68 EDB14000   PUSH ex803.0040B1ED                      ; |Wrong!
00401234  |.  68 DAB14000   PUSH ex803.0040B1DA                      ; |That's not correct
00401239  |.  56            PUSH ESI                                 ; |hOwner
0040123A  |.  E8 BF8F0000   CALL <JMP.&USER32.MessageBoxA>           ; \MessageBoxA
0040123F  |>  5E            POP ESI
00401240  |.  5B            POP EBX
00401241  |.  8BE5          MOV ESP,EBP
00401243  |.  5D            POP EBP
00401244  \.  C3            RETN

将00401211  |.  75 17         JNZ SHORT ex803.0040122A处
 JNZ SHORT ex803.0040122A 改成  JZ SHORT ex803.0040122A
 保存。OK

**************************************************************************************************************************
标志位法

在真假注册码比较处 F7跟进后
原代码
00402414  /$  8B4C24 04     MOV ECX,DWORD PTR SS:[ESP+4]
00402418  |.  8B5424 08     MOV EDX,DWORD PTR SS:[ESP+8]
0040241C  |.  53            PUSH EBX
0040241D  |.  33C0          XOR EAX,EAX                             
0040241F      33DB          XOR EBX,EBX                             
00402421      8A01          MOV AL,BYTE PTR DS:[ECX]                
00402423      8A1A          MOV BL,BYTE PTR DS:[EDX]                
00402425      2BC3          SUB EAX,EBX                             
00402427      75 34         |JNZ SHORT ex803.0040245D              
00402429      84DB          |TEST BL,BL
0040242B      74 30         |JE SHORT ex803.0040245D
0040242D      8A41 01       |MOV AL,BYTE PTR DS:[ECX+1]
00402430      8A5A 01       |MOV BL,BYTE PTR DS:[EDX+1]
00402433      2BC3          |SUB EAX,EBX
00402435      75 26         |JNZ SHORT ex803.0040245D               
00402437      84DB          |TEST BL,BL
00402439      74 22         |JE SHORT ex803.0040245D
0040243B      8A41 02       |MOV AL,BYTE PTR DS:[ECX+2]
0040243E      8A5A 02       |MOV BL,BYTE PTR DS:[EDX+2]
00402441      2BC3          |SUB EAX,EBX
00402443      75 18         |JNZ SHORT ex803.0040245D               
00402445      84DB          |TEST BL,BL
00402447      74 14         |JE SHORT ex803.0040245D
00402449      8A41 03       |MOV AL,BYTE PTR DS:[ECX+3]
0040244C      8A5A 03       |MOV BL,BYTE PTR DS:[EDX+3]
0040244F      2BC3          |SUB EAX,EBX
00402451      75 0A         |JNZ SHORT ex803.0040245D               
00402453      83C1 04       |ADD ECX,4
00402456      83C2 04       |ADD EDX,4
00402459      84DB          |TEST BL,BL
0040245B    ^ 75 C4         \JNZ SHORT ex803.00402421
0040245D  |>  5B            POP EBX
0040245E  \.  C3            RETN

修改后的代码
00402414  /$  8B4C24 04     MOV ECX,DWORD PTR SS:[ESP+4]
00402418  |.  8B5424 08     MOV EDX,DWORD PTR SS:[ESP+8]
0040241C  |.  53            PUSH EBX
0040241D  |.  33C0          XOR EAX,EAX                             
0040241F      33DB          XOR EBX,EBX                           
00402421      B8 00000000   MOV EAX,0                               
00402426      90            NOP
00402427      90            |NOP                                 
00402428      90            NOP
00402429      90            |NOP
0040242A      90            NOP
0040242B      90            |NOP
0040242C      90            NOP
0040242D      90            |NOP
0040242E      90            NOP
0040242F      90            NOP
00402430      90            |NOP
00402431      90            NOP
00402432      90            NOP
00402433      90            |NOP
00402434      90            NOP
00402435      90            |NOP                                 
00402436      90            NOP
00402437      90            |NOP
00402438      90            NOP
00402439      90            |NOP
0040243A      90            NOP
0040243B      90            |NOP
0040243C      90            NOP
0040243D      90            NOP
0040243E      90            |NOP
0040243F      90            NOP
00402440      90            NOP
00402441      90            |NOP
00402442      90            NOP
00402443      90            |NOP                                   
00402444      90            NOP
00402445      90            |NOP
00402446      90            NOP
00402447      90            |NOP
00402448      90            NOP
00402449      90            |NOP
0040244A      90            NOP
0040244B      90            NOP
0040244C      90            |NOP
0040244D      90            NOP
0040244E      90            NOP
0040244F      90            |NOP
00402450      90            NOP
00402451      90            |NOP                                   
00402452      90            NOP
00402453      90            |NOP
00402454      90            NOP
00402455      90            NOP
00402456      90            |NOP
00402457      90            NOP
00402458      90            NOP
00402459      90            |NOP
0040245A      90            NOP
0040245B      90            \NOP
0040245C      90            NOP
0040245D  |>  5B            POP EBX
0040245E  \.  C3            RETN

1.选中00402421到0040245B 右击 -> 二进制 -> 使用NOP填充
2.然后在第一个NOP处 右击 -> 汇编 -> 改成 MOV EAX,0
3.保存. OK


[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

上传的附件:
收藏
免费 7
支持
分享
最新回复 (45)
雪    币: 350
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
下来跟楼主学习.
2008-8-16 21:44
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
进来学习一下
2008-8-16 21:47
0
雪    币: 846
活跃值: (221)
能力值: (RANK:570 )
在线值:
发帖
回帖
粉丝
4
很认真,很详细,很全面
置顶几天看看人气怎么样
2008-8-17 01:03
0
雪    币: 252
活跃值: (14)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
我来加点人气,呵呵,真是详细啊...幸亏我们论坛字数限制宽...
纯支持!
2008-8-17 14:20
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
呵呵看到了..!!不错.>!
2008-8-17 18:36
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
7
看看`~学习学习`~~
2008-8-17 20:44
0
雪    币: 347
活跃值: (25)
能力值: ( LV9,RANK:420 )
在线值:
发帖
回帖
粉丝
8
很好,很详细,学习了
2008-8-17 21:09
0
雪    币: 211
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
9
说的很详细啊,呵呵,谢谢楼主
2008-8-18 00:19
0
雪    币: 203
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
10
很长时间没来了!看到LZ的教程感觉受益非浅!
2008-8-18 10:23
0
雪    币: 223
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
11
我也来加点人气~谢谢分享~
2008-8-18 10:46
0
雪    币: 260
活跃值: (47)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
12
不错,学习下!
2008-8-18 13:14
0
雪    币: 251
活跃值: (25)
能力值: ( LV9,RANK:290 )
在线值:
发帖
回帖
粉丝
13
楼主很厉害
2008-8-18 15:20
0
雪    币: 212
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
14
学校,支持楼主,分析辛苦了
2008-8-18 18:39
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
15
支持啊!下来学习学习啊!
2008-8-18 21:39
0
雪    币: 740
活跃值: (952)
能力值: ( LV9,RANK:160 )
在线值:
发帖
回帖
粉丝
16
支持,呵呵..
2008-8-19 11:18
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
gwh
17
很需要这么详细注释的教程,支持了
2008-8-19 15:17
0
雪    币: 201
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
18
刚来的,也来顶一下
2008-8-19 21:08
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
19
附件里的是原版文件还是CRACK后的?
2008-8-20 05:43
0
雪    币: 209
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
20
支持啊!下来学习学习啊!
2008-8-20 11:27
0
雪    币: 155
活跃值: (20)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
21
CRACK后的
2008-8-20 16:36
0
雪    币: 408
活跃值: (14)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
22
很适合初学者~~
2008-8-20 21:50
0
雪    币: 210
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
23
hao hao xue xi
!!! xiexie lou zhu!!
2008-8-21 13:58
0
雪    币: 707
活跃值: (375)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
24
不错啊!下来学习学习
2008-8-22 08:42
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
25
来看一下下~~
2008-8-22 20:52
0
游客
登录 | 注册 方可回帖
返回
//