1、无壳,TASM / MASM
2、OD载入
搜索字符串。定位到成功信息
00401294 |. E8 BA010000 call Chafe_1.00401453 ; Case 113 (WM_TIMER) of switch 0040123F
00401299 |. 0FBE05 663140>movsx eax,byte ptr ds:[0x403166]
004012A0 |. 3A05 67314000 cmp al,byte ptr ds:[0x403167]
004012A6 |. 75 06 jnz XChafe_1.004012AE
004012A8 |. 33C0 xor eax,eax
004012AA |. C9 leave
004012AB |. C2 1000 retn 0x10
004012AE |> A2 67314000 mov byte ptr ds:[0x403167],al
004012B3 |. 83F8 10 cmp eax,0x10
004012B6 |. 74 16 je XChafe_1.004012CE
004012B8 |. 68 65304000 push Chafe_1.00403065 ; /Your serial is not valid.
004012BD |. FF35 7C314000 push dword ptr ds:[0x40317C] ; |hWnd = 00050BC6 ('Your serial is not valid.',class='Edit',parent=000509F4)
004012C3 |. E8 66020000 call <jmp.&USER32.SetWindowTextA> ; \SetWindowTextA
004012C8 |. 33C0 xor eax,eax
004012CA |. C9 leave
004012CB |. C2 1000 retn 0x10
004012CE |> 68 7F304000 push Chafe_1.0040307F ; /YES! You found your serial!!
004012D3 |. FF35 7C314000 push dword ptr ds:[0x40317C] ; |hWnd = 00050BC6 ('Your serial is not valid.',class='Edit',parent=000509F4)
004012D9 |. E8 50020000 call <jmp.&USER32.SetWindowTextA> ; \SetWindowTextA
004012DE |. 33C0 xor eax,eax
004012E0 |. C9 leave
004012E1 |. C2 1000 retn 0x10
最直接的条件是 Eax==0x10,Eax的值来自[0x403166],查找参考
四条+4操作,初步判断是每条执行一次,满足[0x403166]=0x10,每条单独下断,发现第一、三条无条件执行,第二条是一个循环过程,每16次执行一次+4。
从第四条开始分析。
0040149C . A1 88314000 mov eax,dword ptr ds:[0x403188]
004014A1 . 05 78241109 add eax,0x9112478
004014A6 . 85C0 test eax,eax
004014A8 . 75 09 jnz XChafe_1.004014B3
004014AA . 8005 66314000>add byte ptr ds:[0x403166],0x4 ; [0x403188]+0x9112478 == 0 执行
004014B1 . EB 07 jmp XChafe_1.004014BA
004014B3 > C605 66314000>mov byte ptr ds:[0x403166],0x0
004014BA > 8B25 A0314000 mov esp,dword ptr ds:[0x4031A0]
004014C0 . C9 leave
004014C1 . C3 retn
要满足条件 [0x403188]+0x9112478 == 0,[0x403188]的值经过查找参考发现是来自于00401483 GetDlgItemInt(); 即获取Serial编辑框文本并转换成int型。
第二条是对[0x403188]的处理。
00401361 . 8D3D 8C314000 lea edi,dword ptr ds:[0x40318C] ; name首地址
00401367 . 0FBE05 683140>movsx eax,byte ptr ds:[0x403168]
0040136E . 03F8 add edi,eax ; name首地址 + i
00401370 . FE05 68314000 inc byte ptr ds:[0x403168]
00401376 . A1 88314000 mov eax,dword ptr ds:[0x403188]
0040137B . 8B25 A0314000 mov esp,dword ptr ds:[0x4031A0]
00401381 . 40 inc eax
00401382 . FF05 88314000 inc dword ptr ds:[0x403188] ; + 1
00401388 . 3307 xor eax,dword ptr ds:[edi]
0040138A . A3 88314000 mov dword ptr ds:[0x403188],eax
0040138F . 803D 68314000>cmp byte ptr ds:[0x403168],0x10 ; i < 16
00401396 . 75 07 jnz XChafe_1.0040139F
00401398 . 8005 66314000>add byte ptr ds:[0x403166],0x4 ; [0x403168] == 0x10 执行
0040139F > C9 leave
004013A0 . C3 retn
注册流程:
[0x403188] = int("输入的Serial");
for(i=0; i<16; i++){
[0x403188] ^= *(int *)(name + i);
[0x403188]++;
}
if([0x403188]+0x9112478 == 0)
"Yes! You found your serial!!"
else
"Your serial is not valid."
4、注册机
int main(){
int i;
char name[20] = {0};
unsigned int n = -152118392;
printf("Name:");
scanf("%s", name);
for(i=15; i>=0; i--){
// printf("%X ^ %X = ", *(int *)(name+i), n);
n = n ^ *(int *)(name+i);
// printf("%X\n", n);
n--;
}
printf("Serial:%u", n);
return 0;
}