这个就是book1里面的那个chap601.exe
OD载入在错误提示来到:
................
0040D975 . 8D45 AC lea eax, dword ptr [ebp-54]
0040D978 . 50 push eax
0040D979 . FF15 F4F04000 call dword ptr [<&MSVBVM50.__vbaStrVa>; MSVBVM50.__vbaStrVarMove //取用户名到eax
0040D97F . 8B1D 8CF14000 mov ebx, dword ptr [<&MSVBVM50.__vba>; MSVBVM50.__vbaStrMove
0040D985 . 8BD0 mov edx, eax
0040D987 . 8D4D D8 lea ecx, dword ptr [ebp-28]
0040D98A . FFD3 call ebx ; <&MSVBVM50.__vbaStrMove> //用户名移到[ebp-28]
0040D98C . 8D4D AC lea ecx, dword ptr [ebp-54]
0040D98F . 8D55 BC lea edx, dword ptr [ebp-44] //用户名
0040D992 . 51 push ecx
0040D993 . 52 push edx
0040D994 . 6A 02 push 2
0040D996 . FF15 FCF04000 call dword ptr [<&MSVBVM50.__vbaFreeV>; MSVBVM50.__vbaFreeVarList
0040D99C . 8B45 D8 mov eax, dword ptr [ebp-28] //用户名
0040D99F . 83C4 0C add esp, 0C
0040D9A2 . 50 push eax ; /String
0040D9A3 . FF15 F8F04000 call dword ptr [<&MSVBVM50.__vbaLenBs>; \__vbaLenBstr ,得到文本长度
0040D9A9 . 8BC8 mov ecx, eax
0040D9AB . FF15 44F14000 call dword ptr [<&MSVBVM50.__vbaI2I4>>; MSVBVM50.__vbaI2I4
0040D9B1 . 8985 48FFFFFF mov dword ptr [ebp-B8], eax //文本长度
0040D9B7 . BE 01000000 mov esi, 1
0040D9BC > 66:3BB5 48FFF>cmp si, word ptr [ebp-B8] //循环N次,直到N>长度
//下面一段算法,看了头晕.
0040D9C3 . 0F8F 3A010000 jg 0040DB03
0040D9C9 . 8D4D D8 lea ecx, dword ptr [ebp-28]
0040D9CC . 8D55 BC lea edx, dword ptr [ebp-44]
0040D9CF . 0FBFC6 movsx eax, si
0040D9D2 . 894D 84 mov dword ptr [ebp-7C], ecx
0040D9D5 . 52 push edx ; /Length8
0040D9D6 . 8D8D 7CFFFFFF lea ecx, dword ptr [ebp-84] ; |
0040D9DC . 50 push eax ; |Start
0040D9DD . 8D55 AC lea edx, dword ptr [ebp-54] ; |
0040D9E0 . 51 push ecx ; |dString8
0040D9E1 . 52 push edx ; |RetBUFFER
0040D9E2 . C745 C4 01000>mov dword ptr [ebp-3C], 1 ; |
0040D9E9 . C745 BC 02000>mov dword ptr [ebp-44], 2 ; |
0040D9F0 . C785 7CFFFFFF>mov dword ptr [ebp-84], 4008 ; |
0040D9FA . FF15 30F14000 call dword ptr [<&MSVBVM50.#632>] ; \rtcMidCharVar
0040DA00 . 8D45 AC lea eax, dword ptr [ebp-54]
0040DA03 . 50 push eax
0040DA04 . FF15 F4F04000 call dword ptr [<&MSVBVM50.__vbaStrVa>; MSVBVM50.__vbaStrVarMove
0040DA0A . 8BD0 mov edx, eax
0040DA0C . 8D4D E8 lea ecx, dword ptr [ebp-18]
0040DA0F . FFD3 call ebx
0040DA11 . 8D4D AC lea ecx, dword ptr [ebp-54]
0040DA14 . 8D55 BC lea edx, dword ptr [ebp-44]
0040DA17 . 51 push ecx
0040DA18 . 52 push edx
0040DA19 . 6A 02 push 2
0040DA1B . FF15 FCF04000 call dword ptr [<&MSVBVM50.__vbaFreeV>; MSVBVM50.__vbaFreeVarList
0040DA21 . 8B45 E8 mov eax, dword ptr [ebp-18]
0040DA24 . 83C4 0C add esp, 0C
0040DA27 . 50 push eax ; /String
0040DA28 . FF15 08F14000 call dword ptr [<&MSVBVM50.#516>] ; \rtcAnsiValueBstr
0040DA2E . 66:2D 4000 sub ax, 40
0040DA32 . 0F80 A1020000 jo 0040DCD9
0040DA38 . 66:69C0 8200 imul ax, ax, 82
0040DA3D . 0F80 96020000 jo 0040DCD9
0040DA43 . 66:03C7 add ax, di
0040DA46 . 0F80 8D020000 jo 0040DCD9
0040DA4C . 66:05 5000 add ax, 50
0040DA50 . 0F80 83020000 jo 0040DCD9
0040DA56 . 66:05 5000 add ax, 50
0040DA5A . 0F80 79020000 jo 0040DCD9
0040DA60 . 66:05 5000 add ax, 50
0040DA64 . 0F80 6F020000 jo 0040DCD9
0040DA6A . 66:05 5000 add ax, 50
0040DA6E . 0F80 65020000 jo 0040DCD9
0040DA74 . 66:05 5000 add ax, 50
0040DA78 . 0F80 5B020000 jo 0040DCD9
0040DA7E . 66:05 5000 add ax, 50
0040DA82 . 0F80 51020000 jo 0040DCD9
0040DA88 . 66:05 5000 add ax, 50
0040DA8C . 0F80 47020000 jo 0040DCD9
0040DA92 . 66:05 5000 add ax, 50
0040DA96 . 0F80 3D020000 jo 0040DCD9
0040DA9C . 66:05 5000 add ax, 50
0040DAA0 . 0F80 33020000 jo 0040DCD9
0040DAA6 . 66:05 5000 add ax, 50
0040DAAA . 0F80 29020000 jo 0040DCD9
0040DAB0 . 66:05 5000 add ax, 50
0040DAB4 . 0F80 1F020000 jo 0040DCD9
0040DABA . 66:05 5000 add ax, 50
0040DABE . 0F80 15020000 jo 0040DCD9
0040DAC4 . 66:05 5000 add ax, 50
0040DAC8 . 0F80 0B020000 jo 0040DCD9
0040DACE . 66:05 5000 add ax, 50
0040DAD2 . 0F80 01020000 jo 0040DCD9
0040DAD8 . 66:05 5000 add ax, 50
0040DADC . 0F80 F7010000 jo 0040DCD9
0040DAE2 . 66:05 5000 add ax, 50
0040DAE6 . 0F80 ED010000 jo 0040DCD9
0040DAEC . 8BF8 mov edi, eax
0040DAEE . B8 01000000 mov eax, 1
0040DAF3 . 66:03C6 add ax, si
0040DAF6 . 0F80 DD010000 jo 0040DCD9
0040DAFC . 8BF0 mov esi, eax //出来eax=EA6
0040DAFE .^ E9 B9FEFFFF jmp 0040D9BC
0040DB03 > 8B45 08 mov eax, dword ptr [ebp+8]
0040DB06 . 50 push eax
0040DB07 . 8B08 mov ecx, dword ptr [eax]
0040DB09 . FF91 FC020000 call dword ptr [ecx+2FC]
0040DB0F . 8D55 CC lea edx, dword ptr [ebp-34]
0040DB12 . 50 push eax
0040DB13 . 52 push edx
0040DB14 . FF15 20F14000 call dword ptr [<&MSVBVM50.__vbaObjSe>; MSVBVM50.__vbaObjSet
0040DB1A . 8BF0 mov esi, eax
0040DB1C . 8D4D D4 lea ecx, dword ptr [ebp-2C]
0040DB1F . 51 push ecx
0040DB20 . 56 push esi
0040DB21 . 8B06 mov eax, dword ptr [esi]
0040DB23 . FF90 A0000000 call dword ptr [eax+A0]
0040DB29 . 85C0 test eax, eax
0040DB2B . 7D 12 jge short 0040DB3F
0040DB2D . 68 A0000000 push 0A0
0040DB32 . 68 10D44000 push 0040D410
0040DB37 . 56 push esi
0040DB38 . 50 push eax
0040DB39 . FF15 14F14000 call dword ptr [<&MSVBVM50.__vbaHresu>; MSVBVM50.__vbaHresultCheckObj
0040DB3F > 8B55 D4 mov edx, dword ptr [ebp-2C] //取序列号
0040DB42 . 52 push edx
0040DB43 . 57 push edi
0040DB44 . FF15 E8F04000 call dword ptr [<&MSVBVM50.__vbaStrI2>; MSVBVM50.__vbaStrI2
0040DB4A . 8BD0 mov edx, eax
0040DB4C . 8D4D D0 lea ecx, dword ptr [ebp-30]
0040DB4F . FFD3 call ebx
0040DB51 . 50 push eax //可在此处看到正确的注册码
0040DB52 . FF15 40F14000 call dword ptr [<&MSVBVM50.__vbaStrCm>; MSVBVM50.__vbaStrCmp
0040DB58 . 8BF0 mov esi, eax
0040DB5A . 8D45 D0 lea eax, dword ptr [ebp-30]
0040DB5D . F7DE neg esi
0040DB5F . 1BF6 sbb esi, esi
0040DB61 . 8D4D D4 lea ecx, dword ptr [ebp-2C]
0040DB64 . 50 push eax
0040DB65 . 46 inc esi
0040DB66 . 51 push ecx
0040DB67 . 6A 02 push 2
0040DB69 . F7DE neg esi
0040DB6B . FF15 78F14000 call dword ptr [<&MSVBVM50.__vbaFreeS>; MSVBVM50.__vbaFreeStrList
0040DB71 . 83C4 0C add esp, 0C
0040DB74 . 8D4D CC lea ecx, dword ptr [ebp-34]
0040DB77 . FF15 9CF14000 call dword ptr [<&MSVBVM50.__vbaFreeO>; MSVBVM50.__vbaFreeObj
0040DB7D . B9 04000280 mov ecx, 80020004
0040DB82 . B8 0A000000 mov eax, 0A
0040DB87 . 66:85F6 test si, si
0040DB8A . 894D 94 mov dword ptr [ebp-6C], ecx
0040DB8D . 8945 8C mov dword ptr [ebp-74], eax
0040DB90 . 894D A4 mov dword ptr [ebp-5C], ecx
0040DB93 . 8945 9C mov dword ptr [ebp-64], eax
0040DB96 . 894D B4 mov dword ptr [ebp-4C], ecx
0040DB99 . 8945 AC mov dword ptr [ebp-54], eax
0040DB9C . 74 5E je short 0040DBFC
0040DB9E . 8B35 10F14000 mov esi, dword ptr [<&MSVBVM50.__vba>; MSVBVM50.__vbaStrCat
0040DBA4 . 68 24D44000 push 0040D424 ; UNICODE "Nice Going!!! you Cracked the CrackMe!"
0040DBA9 . 68 6CD34000 push 0040D36C ; /String = CR,""
0040DBAE . FFD6 call esi ; \__vbaStrCat
0040DBB0 . 8BD0 mov edx, eax
0040DBB2 . 8D4D D4 lea ecx, dword ptr [ebp-2C]
0040DBB5 . FFD3 call ebx
0040DBB7 . 50 push eax
0040DBB8 . 68 84D44000 push 0040D484 ; UNICODE "Contact HackerG or DEATH to get your Present..."
0040DBBD . FFD6 call esi
0040DBBF . 8945 C4 mov dword ptr [ebp-3C], eax
0040DBC2 . 8D55 8C lea edx, dword ptr [ebp-74]
0040DBC5 . 8D45 9C lea eax, dword ptr [ebp-64]
0040DBC8 . 52 push edx
0040DBC9 . 8D4D AC lea ecx, dword ptr [ebp-54]
0040DBCC . 50 push eax
0040DBCD . 51 push ecx
0040DBCE . 8D55 BC lea edx, dword ptr [ebp-44]
0040DBD1 . 6A 00 push 0
0040DBD3 . 52 push edx
0040DBD4 . C745 BC 08000>mov dword ptr [ebp-44], 8
0040DBDB . FF15 1CF14000 call dword ptr [<&MSVBVM50.#595>] ; MSVBVM50.rtcMsgBox
0040DBE1 . 8D4D D4 lea ecx, dword ptr [ebp-2C]
0040DBE4 . FF15 A0F14000 call dword ptr [<&MSVBVM50.__vbaFreeS>; MSVBVM50.__vbaFreeStr
0040DBEA . 8D45 8C lea eax, dword ptr [ebp-74]
0040DBED . 8D4D 9C lea ecx, dword ptr [ebp-64]
0040DBF0 . 50 push eax
0040DBF1 . 8D55 AC lea edx, dword ptr [ebp-54]
0040DBF4 . 51 push ecx
0040DBF5 . 8D45 BC lea eax, dword ptr [ebp-44]
0040DBF8 . 52 push edx
0040DBF9 . 50 push eax
0040DBFA . EB 5C jmp short 0040DC58
0040DBFC > 8B35 10F14000 mov esi, dword ptr [<&MSVBVM50.__vba>; MSVBVM50.__vbaStrCat
0040DC02 . 68 E8D44000 push 0040D4E8 ; UNICODE "You Lamer!!! Cant Crack This?!"
0040DC07 . 68 6CD34000 push 0040D36C ; /String = CR,""
0040DC0C . FFD6 call esi ; \__vbaStrCat
0040DC0E . 8BD0 mov edx, eax
0040DC10 . 8D4D D4 lea ecx, dword ptr [ebp-2C]
0040DC13 . FFD3 call ebx
0040DC15 . 50 push eax
0040DC16 . 68 2CD54000 push 0040D52C ; UNICODE "Try Again..."
0040DC1B . FFD6 call esi
0040DC1D . 8D4D 8C lea ecx, dword ptr [ebp-74]
0040DC20 . 8945 C4 mov dword ptr [ebp-3C], eax
0040DC23 . 8D55 9C lea edx, dword ptr [ebp-64]
0040DC26 . 51 push ecx
0040DC27 . 8D45 AC lea eax, dword ptr [ebp-54]
0040DC2A . 52 push edx
结果:
0040DB51可在此处看到正确的注册码
虽然可以知道注册码,可是算法不懂,哪位高人有空能帮看下,注释下?
小菜这里先谢了.
附件:
chap601.rar
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
