20211026gfsj_re_gametime

游戏，当然是用来爆破的啦！

载入OD，跑几下熟悉一下流程，了解哪个函数是重要的。

00201686  |.  E8 27FCFFFF   call gametime.002012B2                   ;  倒数
0020168B  |.  B9 C8000000   mov ecx,0xC8
00201690  |.  E8 40FCFFFF   call gametime.002012D5
00201695  |.  8D45 E4       lea eax,[local.7]
00201698  |.  BA F4010000   mov edx,0x1F4
0020169D  |.  50            push eax
0020169E  |.  8D45 EC       lea eax,[local.5]
002016A1  |.  50            push eax
002016A2  |.  51            push ecx
002016A3  |.  6A 0A         push 0xA
002016A5  |.  6A 20         push 0x20
002016A7  |.  59            pop ecx
002016A8  |.  E8 88FDFFFF   call gametime.00201435

确定00201435函数是关键函数，步入看看。

002014A3  |.  E8 2DFEFFFF   call gametime.002012D5                   ;  显示get ready to play
002014A8  |.  8B7D 08       mov edi,[arg.1]
002014AB  |.  85FF          test edi,edi
002014AD  |.  7E 1B         jle short gametime.002014CA
002014AF  |>  68 6C7A2100   /push gametime.00217A6C                  ;  UNICODE "."
002014B4  |.  E8 BA050000   |call gametime.00201A73
002014B9  |.  59            |pop ecx                                 ;  gametime.002016AD
002014BA  |.  68 C8000000   |push 0xC8                               ; /Timeout = 200. ms
002014BF  |.  FF15 20212100 |call dword ptr ds:[<&KERNEL32.Sleep>]   ; \Sleep
002014C5  |.  83EF 01       |sub edi,0x1
002014C8  |.^ 75 E5         \jnz short gametime.002014AF
;循环几个点
002014CA  |>  BA A0860100   mov edx,0x186A0
002014CF  |.  8BCE          mov ecx,esi                              ;  gametime.00217B50
002014D1  |.  E8 8AFDFFFF   call gametime.00201260;在s,m,x中随机选取，按下键盘
002014D6  |.  5F            pop edi                                  ;  gametime.002016AD
002014D7  |.  5E            pop esi                                  ;  gametime.002016AD
002014D8  |.  5B            pop ebx                                  ;  gametime.002016AD
002014D9  |.  84C0          test al,al
002014DB  |.  75 26         jnz short gametime.00201503;比较al的值，al=1表示通过
002014DD  |.  FF75 10       push [arg.3]
002014E0  |.  FF75 14       push [arg.4]
002014E3  |.  68 707A2100   push gametime.00217A70                   ;  ASCII "key is %s (%s)\r"
002014E8  |.  E8 86050000   call gametime.00201A73
002014ED  |.  E8 31FFFFFF   call gametime.00201423
002014F2  |.  68 807A2100   push gametime.00217A80                   ;  ASCII "\rUDDER FAILURE! http://imgur.com/4Ajx21P \n"
002014F7  |.  E8 77050000   call gametime.00201A73
002014FC  |.  83C4 10       add esp,0x10
002014FF  |.  32C0          xor al,al
00201501  |.  5D            pop ebp                                  ;  gametime.002016AD
00201502  |.  C3            retn
00201503  |>  B0 01         mov al,0x1
00201505  |.  5D            pop ebp                                  ;  gametime.002016AD
00201506  \.  C3            retn

每一次有随机数的出现，都会用到这个函数，所以修改一下al的值，让它永远返回1，一步到位。

002014D9  |.  84C0          test al,al		=>		mov al,1

key is  (no5c30416d6cf52638460377995c6a8cf5)