160个练手CrackMe-023

1、无壳，TASM / MASM

2、OD载入

搜索字符串。定位到成功信息

00401294  |.  E8 BA010000   call Chafe_1.00401453                    ;  Case 113 (WM_TIMER) of switch 0040123F
00401299  |.  0FBE05 663140>movsx eax,byte ptr ds:[0x403166]
004012A0  |.  3A05 67314000 cmp al,byte ptr ds:[0x403167]
004012A6  |.  75 06         jnz XChafe_1.004012AE
004012A8  |.  33C0          xor eax,eax
004012AA  |.  C9            leave
004012AB  |.  C2 1000       retn 0x10
004012AE  |>  A2 67314000   mov byte ptr ds:[0x403167],al
004012B3  |.  83F8 10       cmp eax,0x10
004012B6  |.  74 16         je XChafe_1.004012CE
004012B8  |.  68 65304000   push Chafe_1.00403065                    ; /Your serial is not valid.
004012BD  |.  FF35 7C314000 push dword ptr ds:[0x40317C]             ; |hWnd = 00050BC6 ('Your serial is not valid.',class='Edit',parent=000509F4)
004012C3  |.  E8 66020000   call <jmp.&USER32.SetWindowTextA>        ; \SetWindowTextA
004012C8  |.  33C0          xor eax,eax
004012CA  |.  C9            leave
004012CB  |.  C2 1000       retn 0x10
004012CE  |>  68 7F304000   push Chafe_1.0040307F                    ; /YES! You found your serial!!
004012D3  |.  FF35 7C314000 push dword ptr ds:[0x40317C]             ; |hWnd = 00050BC6 ('Your serial is not valid.',class='Edit',parent=000509F4)
004012D9  |.  E8 50020000   call <jmp.&USER32.SetWindowTextA>        ; \SetWindowTextA
004012DE  |.  33C0          xor eax,eax
004012E0  |.  C9            leave
004012E1  |.  C2 1000       retn 0x10

最直接的条件是 Eax==0x10，Eax的值来自[0x403166]，查找参考

四条+4操作，初步判断是每条执行一次，满足[0x403166]=0x10，每条单独下断，发现第一、三条无条件执行，第二条是一个循环过程，每16次执行一次+4。
从第四条开始分析。

0040149C   .  A1 88314000   mov eax,dword ptr ds:[0x403188]
004014A1   .  05 78241109   add eax,0x9112478
004014A6   .  85C0          test eax,eax
004014A8   .  75 09         jnz XChafe_1.004014B3
004014AA   .  8005 66314000>add byte ptr ds:[0x403166],0x4           ;  [0x403188]+0x9112478 == 0 执行
004014B1   .  EB 07         jmp XChafe_1.004014BA
004014B3   >  C605 66314000>mov byte ptr ds:[0x403166],0x0
004014BA   >  8B25 A0314000 mov esp,dword ptr ds:[0x4031A0]
004014C0   .  C9            leave
004014C1   .  C3            retn

要满足条件 [0x403188]+0x9112478 == 0，[0x403188]的值经过查找参考发现是来自于00401483 GetDlgItemInt(); 即获取Serial编辑框文本并转换成int型。

第二条是对[0x403188]的处理。

00401361   .  8D3D 8C314000 lea edi,dword ptr ds:[0x40318C]          ;  name首地址
00401367   .  0FBE05 683140>movsx eax,byte ptr ds:[0x403168]
0040136E   .  03F8          add edi,eax                              ;  name首地址 + i
00401370   .  FE05 68314000 inc byte ptr ds:[0x403168]
00401376   .  A1 88314000   mov eax,dword ptr ds:[0x403188]
0040137B   .  8B25 A0314000 mov esp,dword ptr ds:[0x4031A0]
00401381   .  40            inc eax
00401382   .  FF05 88314000 inc dword ptr ds:[0x403188]              ;  + 1
00401388   .  3307          xor eax,dword ptr ds:[edi]
0040138A   .  A3 88314000   mov dword ptr ds:[0x403188],eax
0040138F   .  803D 68314000>cmp byte ptr ds:[0x403168],0x10          ;  i < 16
00401396   .  75 07         jnz XChafe_1.0040139F
00401398   .  8005 66314000>add byte ptr ds:[0x403166],0x4           ;  [0x403168] == 0x10 执行
0040139F   >  C9            leave
004013A0   .  C3            retn

注册流程：

    [0x403188] = int("输入的Serial");
    for(i=0; i<16; i++）{
        [0x403188] ^= *(int *)(name + i);
        [0x403188]++;
    }
    if([0x403188]+0x9112478 == 0)
        "Yes! You found your serial!!"
    else
        "Your serial is not valid."

4、注册机

int main(){
    int i;
    char name[20] = {0}; 
    unsigned int n = -152118392;

    printf("Name:"); 
    scanf("%s", name);
    for(i=15; i>=0; i--){
//      printf("%X ^ %X = ", *(int *)(name+i), n);
        n = n ^ *(int *)(name+i);
//      printf("%X\n", n);
        n--;
    }
    printf("Serial:%u", n);
    return 0;
}