crackme
名称ex803
1.PEID查壳发现未加壳,使用Borland C++ 1999编写
2.运行程序,随便输入NAME,SERIAL. Name:alex Serial:123456
弹出错误提示框That's not correct
3.OD载入ex803
4.右击超级字符串查找 -> ASCII码查找 -> 找到That's not correct,双击进入
5.进入后向上找,在00401150处下断点(F2),F9运行程序,输入Name:alex Serial:123456
点CHECK后,0D产生中断
6.单步向下F8,算法分析。
00401150 /$ 55 PUSH EBP
00401151 |. 8BEC MOV EBP,ESP
00401153 |. 83C4 AC ADD ESP,-54
00401156 |. 53 PUSH EBX
00401157 |. 56 PUSH ESI
00401158 |. 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]
0040115B |. 6A 19 PUSH 19 ;
0040115D |. 6A 00 PUSH 0 ;
0040115F |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C] ;
00401162 |. 50 PUSH EAX ;
00401163 |. E8 CC110000 CALL ex803.00402334 ;
00401168 |. 83C4 0C ADD ESP,0C
0040116B |. 6A 19 PUSH 19 ;
0040116D |. 6A 00 PUSH 0 ;
0040116F |. 8D55 C8 LEA EDX,DWORD PTR SS:[EBP-38] ;
00401172 |. 52 PUSH EDX ;
00401173 |. E8 BC110000 CALL ex803.00402334 ;
00401178 |. 83C4 0C ADD ESP,0C
0040117B |. 6A 19 PUSH 19 ;
0040117D |. 6A 00 PUSH 0 ;
0040117F |. 8D4D AC LEA ECX,DWORD PTR SS:[EBP-54] ;
00401182 |. 51 PUSH ECX ;
00401183 |. E8 AC110000 CALL ex803.00402334 ;
00401188 |. 83C4 0C ADD ESP,0C
0040118B |. 6A 65 PUSH 65 ; ControlID = 65 (101.)
0040118D |. 56 PUSH ESI ; hwnd=001b0502
0040118E |. E8 5F900000 CALL <JMP.&USER32.GetDlgItem> ; GetDlgItem
00401193 |. 6A 19 PUSH 19 ; Count=19H(最大输入字符数25)
00401195 |. 8D55 E4 LEA EDX,DWORD PTR SS:[EBP-1C] ;
00401198 |. 52 PUSH EDX ; buffer=0012FAA8(存放注册名)
00401199 |. 50 PUSH EAX ; hWnd=001204FC
0040119A |. E8 59900000 CALL <JMP.&USER32.GetWindowTextA> ; EAX=注册名长度
0040119F |. 6A 66 PUSH 66 ; ControlID = 66 (102.)
004011A1 |. 56 PUSH ESI ; hWnd
004011A2 |. E8 4B900000 CALL <JMP.&USER32.GetDlgItem> ; GetDlgItem
004011A7 |. 6A 19 PUSH 19 ; Count=19H(最大输入字符数25)
004011A9 |. 8D4D C8 LEA ECX,DWORD PTR SS:[EBP-38] ;
004011AC |. 51 PUSH ECX ; Buffer=0012FA8C
004011AD |. 50 PUSH EAX ; hWnd
004011AE |. E8 45900000 CALL <JMP.&USER32.GetWindowTextA> ; EAX=注册码长度
004011B3 |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C] ; EAX=0012FAA8
004011B6 |. 50 PUSH EAX ; 保存注册名
004011B7 |. E8 A4120000 CALL ex803.00402460
004011BC |. 59 POP ECX ; ECX=0012FAA8
004011BD |. 8BC8 MOV ECX,EAX ; ECX=EAX=注册名长度
004011BF |. 83F9 04 CMP ECX,4
004011C2 |. 7D 14 JGE SHORT ex803.004011D8 ; 注册名长度大于等于4
004011C4 |. 6A 10 PUSH 10 ; Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
004011C6 |. 68 7CB14000 PUSH ex803.0040B17C ; ERROR
004011CB |. 68 4CB14000 PUSH ex803.0040B14C ; Your name must contain at least 4 characters!\r\n
004011D0 |. 56 PUSH ESI ; hOwner
004011D1 |. E8 28900000 CALL <JMP.&USER32.MessageBoxA> ; MessageBoxA
004011D6 |. EB 67 JMP SHORT ex803.0040123F
004011D8 |> 33D2 XOR EDX,EDX ; EDX清零
004011DA |. 33C0 XOR EAX,EAX ; EAX清零
004011DC |. 3BC8 CMP ECX,EAX
004011DE |. 7E 0D JLE SHORT ex803.004011ED
004011E0 |> 33DB /XOR EBX,EBX ; EBX清零
004011E2 |. 8A5C05 E4 |MOV BL,BYTE PTR SS:[EBP+EAX-1C] ; BL=注册名每一位ASCII码
004011E6 |. 03D3 |ADD EDX,EBX ; EDX=EDX+EBX(EDX用于累加注册名每一位ASCII码值)
004011E8 |. 40 |INC EAX ; EAX+1
004011E9 |. 3BC8 |CMP ECX,EAX ; 取到最后一个字符了吗?
004011EB |.^ 7F F3 \JG SHORT ex803.004011E0 ; 没有取完,goto 004011E0
004011ED |> 52 PUSH EDX ; Arg3=计算出的注册码
004011EE |. 68 82B14000 PUSH ex803.0040B182 ; %d
004011F3 |. 8D45 AC LEA EAX,DWORD PTR SS:[EBP-54] ;
004011F6 |. 50 PUSH EAX ; Arg1
004011F7 |. E8 C0280000 CALL ex803.00403ABC ; 转化为10进制数
004011FC |. 83C4 0C ADD ESP,0C
004011FF |. 8D55 AC LEA EDX,DWORD PTR SS:[EBP-54] ; EDX=转化后的十进制数(计算出的注册码)
00401202 |. 52 PUSH EDX ; 保存EDX
00401203 |. 8D4D C8 LEA ECX,DWORD PTR SS:[EBP-38] ; ECX=假注册码
00401206 |. 51 PUSH ECX ; 保存假注册码
00401207 |. E8 08120000 CALL ex803.00402414 ; 真假注册码比较F7跟进
0040120C |. 83C4 08 ADD ESP,8
0040120F |. 85C0 TEST EAX,EAX ; 标志位比较
00401211 |. 75 17 JNZ SHORT ex803.0040122A
00401213 |. 68 30000400 PUSH 40030 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL|40000
00401218 |. 68 CEB14000 PUSH ex803.0040B1CE ; |You Did It!
0040121D |. 68 85B14000 PUSH ex803.0040B185 ; |Congradulations, you have figured out Step1\nStep1 unlock code is: 17FF25
00401222 |. 56 PUSH ESI ; |hOwner
00401223 |. E8 D68F0000 CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
00401228 |. EB 15 JMP SHORT ex803.0040123F
0040122A |> 68 30000400 PUSH 40030 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL|40000
0040122F |. 68 EDB14000 PUSH ex803.0040B1ED ; |Wrong!
00401234 |. 68 DAB14000 PUSH ex803.0040B1DA ; |That's not correct
00401239 |. 56 PUSH ESI ; |hOwner
0040123A |. E8 BF8F0000 CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
0040123F |> 5E POP ESI
00401240 |. 5B POP EBX
00401241 |. 8BE5 MOV ESP,EBP
00401243 |. 5D POP EBP
00401244 \. C3 RETN
在真假注册码比较处 F7跟进
00402414 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]
00402418 |. 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8]
0040241C |. 53 PUSH EBX
0040241D |. 33C0 XOR EAX,EAX ; EAX清零
0040241F 33DB XOR EBX,EBX ; EBX清零
00402421 8A01 MOV AL,BYTE PTR DS:[ECX] ; AL=注册码第一位ASCII码
00402423 8A1A MOV BL,BYTE PTR DS:[EDX] ; BL=计算出的注册码第一位
00402425 2BC3 SUB EAX,EBX ; EAX=EAX-EBX
00402427 75 34 |JNZ SHORT ex803.0040245D ; 真假注册码第一位不等,则OVER
00402429 84DB |TEST BL,BL
0040242B 74 30 |JE SHORT ex803.0040245D
0040242D 8A41 01 |MOV AL,BYTE PTR DS:[ECX+1]
00402430 8A5A 01 |MOV BL,BYTE PTR DS:[EDX+1]
00402433 2BC3 |SUB EAX,EBX
00402435 75 26 |JNZ SHORT ex803.0040245D ; 真假注册码第二位不等,则OVER
00402437 84DB |TEST BL,BL
00402439 74 22 |JE SHORT ex803.0040245D
0040243B 8A41 02 |MOV AL,BYTE PTR DS:[ECX+2]
0040243E 8A5A 02 |MOV BL,BYTE PTR DS:[EDX+2]
00402441 2BC3 |SUB EAX,EBX
00402443 75 18 |JNZ SHORT ex803.0040245D ; 真假注册码第三位不等,则OVER
00402445 84DB |TEST BL,BL
00402447 74 14 |JE SHORT ex803.0040245D
00402449 8A41 03 |MOV AL,BYTE PTR DS:[ECX+3]
0040244C 8A5A 03 |MOV BL,BYTE PTR DS:[EDX+3]
0040244F 2BC3 |SUB EAX,EBX
00402451 75 0A |JNZ SHORT ex803.0040245D ; 真假注册码第四位不等,则OVER
00402453 83C1 04 |ADD ECX,4
00402456 83C2 04 |ADD EDX,4
00402459 84DB |TEST BL,BL
0040245B ^ 75 C4 \JNZ SHORT ex803.00402421
0040245D |> 5B POP EBX
0040245E \. C3 RETN 算法分析
1.注册名长度至少4位。
2.累加注册名每一位ASCII码值
3.将累加结果转化成十进制数。
C语言注册机
#include <stdio.h>
#include <conio.h>
int KeyGen(char* strName)
{
int i, sum = 0;
for( i = 0; i < strlen(strName); i++)
{
sum += strName[i];
}
printf("%d",sum);
}
int main( int argc, char *argv[] )
{
char strName[20]="";
printf("input a user name which must long than 4 charactors,less than 19:");
scanf("%s",strName);
printf("\n\n");
KeyGen(strName);
getchar();
return 0;
} ************************************************************************************************************************
爆破法
00401202 |. 52 PUSH EDX ; 保存EDX
00401203 |. 8D4D C8 LEA ECX,DWORD PTR SS:[EBP-38] ; ECX=假注册码
00401206 |. 51 PUSH ECX ; 保存假注册码
00401207 |. E8 08120000 CALL ex803.00402414 ; 真假注册码比较
0040120C |. 83C4 08 ADD ESP,8
0040120F |. 85C0 TEST EAX,EAX ; 标志位比较
00401211 |. 75 17 JNZ SHORT ex803.0040122A
00401213 |. 68 30000400 PUSH 40030 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL|40000
00401218 |. 68 CEB14000 PUSH ex803.0040B1CE ; |You Did It!
0040121D |. 68 85B14000 PUSH ex803.0040B185 ; |Congradulations, you have figured out Step1\nStep1 unlock code is: 17FF25
00401222 |. 56 PUSH ESI ; |hOwner
00401223 |. E8 D68F0000 CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
00401228 |. EB 15 JMP SHORT ex803.0040123F
0040122A |> 68 30000400 PUSH 40030 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL|40000
0040122F |. 68 EDB14000 PUSH ex803.0040B1ED ; |Wrong!
00401234 |. 68 DAB14000 PUSH ex803.0040B1DA ; |That's not correct
00401239 |. 56 PUSH ESI ; |hOwner
0040123A |. E8 BF8F0000 CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
0040123F |> 5E POP ESI
00401240 |. 5B POP EBX
00401241 |. 8BE5 MOV ESP,EBP
00401243 |. 5D POP EBP
00401244 \. C3 RETN
将00401211 |. 75 17 JNZ SHORT ex803.0040122A处
JNZ SHORT ex803.0040122A 改成 JZ SHORT ex803.0040122A
保存。OK **************************************************************************************************************************
标志位法
在真假注册码比较处 F7跟进后
原代码
00402414 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]
00402418 |. 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8]
0040241C |. 53 PUSH EBX
0040241D |. 33C0 XOR EAX,EAX
0040241F 33DB XOR EBX,EBX
00402421 8A01 MOV AL,BYTE PTR DS:[ECX]
00402423 8A1A MOV BL,BYTE PTR DS:[EDX]
00402425 2BC3 SUB EAX,EBX
00402427 75 34 |JNZ SHORT ex803.0040245D
00402429 84DB |TEST BL,BL
0040242B 74 30 |JE SHORT ex803.0040245D
0040242D 8A41 01 |MOV AL,BYTE PTR DS:[ECX+1]
00402430 8A5A 01 |MOV BL,BYTE PTR DS:[EDX+1]
00402433 2BC3 |SUB EAX,EBX
00402435 75 26 |JNZ SHORT ex803.0040245D
00402437 84DB |TEST BL,BL
00402439 74 22 |JE SHORT ex803.0040245D
0040243B 8A41 02 |MOV AL,BYTE PTR DS:[ECX+2]
0040243E 8A5A 02 |MOV BL,BYTE PTR DS:[EDX+2]
00402441 2BC3 |SUB EAX,EBX
00402443 75 18 |JNZ SHORT ex803.0040245D
00402445 84DB |TEST BL,BL
00402447 74 14 |JE SHORT ex803.0040245D
00402449 8A41 03 |MOV AL,BYTE PTR DS:[ECX+3]
0040244C 8A5A 03 |MOV BL,BYTE PTR DS:[EDX+3]
0040244F 2BC3 |SUB EAX,EBX
00402451 75 0A |JNZ SHORT ex803.0040245D
00402453 83C1 04 |ADD ECX,4
00402456 83C2 04 |ADD EDX,4
00402459 84DB |TEST BL,BL
0040245B ^ 75 C4 \JNZ SHORT ex803.00402421
0040245D |> 5B POP EBX
0040245E \. C3 RETN 修改后的代码
00402414 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]
00402418 |. 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8]
0040241C |. 53 PUSH EBX
0040241D |. 33C0 XOR EAX,EAX
0040241F 33DB XOR EBX,EBX
00402421 B8 00000000 MOV EAX,0
00402426 90 NOP
00402427 90 |NOP
00402428 90 NOP
00402429 90 |NOP
0040242A 90 NOP
0040242B 90 |NOP
0040242C 90 NOP
0040242D 90 |NOP
0040242E 90 NOP
0040242F 90 NOP
00402430 90 |NOP
00402431 90 NOP
00402432 90 NOP
00402433 90 |NOP
00402434 90 NOP
00402435 90 |NOP
00402436 90 NOP
00402437 90 |NOP
00402438 90 NOP
00402439 90 |NOP
0040243A 90 NOP
0040243B 90 |NOP
0040243C 90 NOP
0040243D 90 NOP
0040243E 90 |NOP
0040243F 90 NOP
00402440 90 NOP
00402441 90 |NOP
00402442 90 NOP
00402443 90 |NOP
00402444 90 NOP
00402445 90 |NOP
00402446 90 NOP
00402447 90 |NOP
00402448 90 NOP
00402449 90 |NOP
0040244A 90 NOP
0040244B 90 NOP
0040244C 90 |NOP
0040244D 90 NOP
0040244E 90 NOP
0040244F 90 |NOP
00402450 90 NOP
00402451 90 |NOP
00402452 90 NOP
00402453 90 |NOP
00402454 90 NOP
00402455 90 NOP
00402456 90 |NOP
00402457 90 NOP
00402458 90 NOP
00402459 90 |NOP
0040245A 90 NOP
0040245B 90 \NOP
0040245C 90 NOP
0040245D |> 5B POP EBX
0040245E \. C3 RETN 1.选中00402421到0040245B 右击 -> 二进制 -> 使用NOP填充
2.然后在第一个NOP处 右击 -> 汇编 -> 改成 MOV EAX,0
3.保存. OK
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!
上传的附件: