160个练手CrackMe-021

最新推荐文章于 2019-04-07 17:09:55 发布

Mnnk

最新推荐文章于 2019-04-07 17:09:55 发布

阅读量365

点赞数

分类专栏： 160个练手CM 文章标签： CrackMe

本文链接：https://blog.csdn.net/M_N_N/article/details/78370984

版权

160个练手CM 专栏收录该内容

52 篇文章 0 订阅

订阅专栏

本文深入解析了使用Delphi编写的软件中的键盘事件处理和按钮点击事件处理过程。通过对Delphi程序代码的逆向工程，揭示了如何通过特定的输入序列触发软件内部的验证逻辑，并详细解释了验证过程中涉及的字符串比较等操作。

摘要由CSDN通过智能技术生成

1、无壳，Delphi

2、DarkDel定位事件，OD载入

EditKeyPass()

0042CE30   .  33D2          xor edx,edx                              ;  KeyPress
0042CE32   .  8A11          mov dl,byte ptr ds:[ecx]
0042CE34   .  83C2 F8       add edx,-0x8                             ;  Switch (cases 8..7A)
0042CE37   .  83FA 72       cmp edx,0x72
0042CE3A   .  0F87 80050000 ja Cabeca.0042D3C0
0042CE40   .  8A92 4DCE4200 mov dl,byte ptr ds:[edx+0x42CE4D]
0042CE46   .  FF2495 C0CE42>jmp dword ptr ds:[edx*4+0x42CEC0]
0042CE4D   .  35            db 35                                    ;  分支 0042CEC0 索引表

键盘按下事件，按下一个键Serial 1和Serial 2 分别加上case中对应的值。

Button1Click()

0042D3C4  /.  55            push ebp                                 ;  Try_Click
0042D3C5  |.  8BEC          mov ebp,esp
0042D3C7  |.  33C9          xor ecx,ecx
0042D3C9  |.  51            push ecx
0042D3CA  |.  51            push ecx
0042D3CB  |.  51            push ecx
0042D3CC  |.  51            push ecx
0042D3CD  |.  53            push ebx
0042D3CE  |.  8BD8          mov ebx,eax
0042D3D0  |.  33C0          xor eax,eax
0042D3D2  |.  55            push ebp
0042D3D3  |.  68 ADD54200   push Cabeca.0042D5AD
0042D3D8  |.  64:FF30       push dword ptr fs:[eax]
0042D3DB  |.  64:8920       mov dword ptr fs:[eax],esp
0042D3DE  |.  833D 14F74200>cmp dword ptr ds:[0x42F714],0x0
0042D3E5  |.  74 45         je XCabeca.0042D42C
0042D3E7  |.  833D 18F74200>cmp dword ptr ds:[0x42F718],0x0
0042D3EE  |.  74 3C         je XCabeca.0042D42C
0042D3F0  |.  8D55 FC       lea edx,[local.1]
0042D3F3  |.  8B83 E0010000 mov eax,dword ptr ds:[ebx+0x1E0]
0042D3F9  |.  E8 E2C9FEFF   call Cabeca.00419DE0
0042D3FE  |.  837D FC 00    cmp [local.1],0x0
0042D402  |.  74 28         je XCabeca.0042D42C
0042D404  |.  8D55 F8       lea edx,[local.2]
0042D407  |.  8B83 E4010000 mov eax,dword ptr ds:[ebx+0x1E4]
0042D40D  |.  E8 CEC9FEFF   call Cabeca.00419DE0
0042D412  |.  837D F8 00    cmp [local.2],0x0
0042D416  |.  74 14         je XCabeca.0042D42C
0042D418  |.  8D55 F4       lea edx,[local.3]
0042D41B  |.  8B83 EC010000 mov eax,dword ptr ds:[ebx+0x1EC]
0042D421  |.  E8 BAC9FEFF   call Cabeca.00419DE0
0042D426  |.  837D F4 00    cmp [local.3],0x0
0042D42A  |.  75 44         jnz XCabeca.0042D470
0042D42C  |>  B8 C4D54200   mov eax,Cabeca.0042D5C4                  ;  ASCII "Fill all boxes first dumb!"
0042D431  |.  E8 56F6FFFF   call Cabeca.0042CA8C
0042D436  |.  33C0          xor eax,eax
0042D438  |.  A3 14F74200   mov dword ptr ds:[0x42F714],eax
0042D43D  |.  33C0          xor eax,eax
0042D43F  |.  A3 18F74200   mov dword ptr ds:[0x42F718],eax
0042D444  |.  33D2          xor edx,edx
0042D446  |.  8B83 E0010000 mov eax,dword ptr ds:[ebx+0x1E0]
0042D44C  |.  E8 BFC9FEFF   call Cabeca.00419E10
0042D451  |.  33D2          xor edx,edx
0042D453  |.  8B83 E4010000 mov eax,dword ptr ds:[ebx+0x1E4]
0042D459  |.  E8 B2C9FEFF   call Cabeca.00419E10
0042D45E  |.  33D2          xor edx,edx
0042D460  |.  8B83 EC010000 mov eax,dword ptr ds:[ebx+0x1EC]
0042D466  |.  E8 A5C9FEFF   call Cabeca.00419E10
0042D46B  |.  E9 1A010000   jmp Cabeca.0042D58A
0042D470  |>  833D 14F74200>cmp dword ptr ds:[0x42F714],0x0
0042D477  |.  74 6C         je XCabeca.0042D4E5
0042D479  |.  833D 18F74200>cmp dword ptr ds:[0x42F718],0x0
0042D480  |.  74 63         je XCabeca.0042D4E5
0042D482  |.  8D55 F0       lea edx,[local.4]
0042D485  |.  A1 14F74200   mov eax,dword ptr ds:[0x42F714]
0042D48A  |.  E8 C190FDFF   call Cabeca.00406550                     ;  Serial 1 = itoa([0x42F714])
0042D48F  |.  8B45 F0       mov eax,[local.4]
0042D492  |.  50            push eax
0042D493  |.  8D55 FC       lea edx,[local.1]
0042D496  |.  8B83 E4010000 mov eax,dword ptr ds:[ebx+0x1E4]
0042D49C  |.  E8 3FC9FEFF   call Cabeca.00419DE0
0042D4A1  |.  8B55 FC       mov edx,[local.1]                        ;  输入的Serial 1
0042D4A4  |.  58            pop eax                                  ;  正确的Serial 1
0042D4A5  |.  E8 2664FDFF   call Cabeca.004038D0                     ;  比较
0042D4AA  |.  75 39         jnz XCabeca.0042D4E5                     ;  爆破点
0042D4AC  |.  8D55 F0       lea edx,[local.4]
0042D4AF  |.  A1 18F74200   mov eax,dword ptr ds:[0x42F718]
0042D4B4  |.  E8 9790FDFF   call Cabeca.00406550                     ;  Serial 2 = itoa([0x42F718])
0042D4B9  |.  8B45 F0       mov eax,[local.4]
0042D4BC  |.  50            push eax
0042D4BD  |.  8D55 FC       lea edx,[local.1]
0042D4C0  |.  8B83 EC010000 mov eax,dword ptr ds:[ebx+0x1EC]
0042D4C6  |.  E8 15C9FEFF   call Cabeca.00419DE0
0042D4CB  |.  8B55 FC       mov edx,[local.1]
0042D4CE  |.  58            pop eax
0042D4CF  |.  E8 FC63FDFF   call Cabeca.004038D0
0042D4D4  |.  75 0F         jnz XCabeca.0042D4E5                     ;  爆破点
0042D4D6  |.  B8 E8D54200   mov eax,Cabeca.0042D5E8                  ;  ASCII "Hmmm.... Cracked... Congratulations idiot! :-)"
0042D4DB  |.  E8 ACF5FFFF   call Cabeca.0042CA8C
0042D4E0  |.  E9 A5000000   jmp Cabeca.0042D58A