1、无壳,VB编写
2、用VB Decompiler反编译
大致是:
for(int i=0; i<strlen(Text); i++){
buff[i] = Text[i] + 0x0A;
}
要拿到buff,再给他还原就是正确的key了。
3、OD载入
定位到Command1_Click() '401E20,下断。00402034 . 50 push eax ; /var18
00402035 . 51 push ecx ; |var28
00402036 . C785 5CFFFFFF>mov dword ptr ss:[ebp-0xA4],Andréna.0040>; |UNICODE "kXy^rO|*yXo*m\kMuOn*+"
00402040 . C785 54FFFFFF>mov dword ptr ss:[ebp-0xAC],0x8008 ; |
0040204A . FF15 40414000 call dword ptr ds:[<&MSVBVM50.__vbaVarTs>; \__vbaVarTstEq
__vbaVarTstEq是字符串比较函数,很明显,"kXy^rO|*yXo*m\kMuOn*+"
还原这段字串;
s = 'kXy^rO|*yXo*m\kMuOn*+'
for i in s:
print(chr(ord(i)-0x0A), end='')