160个练手CrackMe-049

1、无壳

2、OD载入

根据提示框确定按钮事件。0x00401127

00401127   > /6A 00         push 0x0                                 ; /lParam = 0
00401129   . |6A 00         push 0x0                                 ; |wParam = 0
0040112B   . |6A 0E         push 0xE                                 ; |Message = WM_GETTEXTLENGTH
0040112D   . |6A 03         push 0x3                                 ; |ControlID = 3
0040112F   . |FF75 08       push dword ptr ss:[ebp+0x8]              ; |hWnd
00401132   . |E8 41020000   call <jmp.&USER32.SendDlgItemMessageA>   ; \SendDlgItemMessageA
00401137   . |A3 AF214000   mov dword ptr ds:[0x4021AF],eax          ;  获取Name长度
0040113C   . |83F8 00       cmp eax,0x0
0040113F   . |0F84 D5000000 je DueList_.0040121A
00401145   . |83F8 08       cmp eax,0x8
00401148   . |0F8F CC000000 jg DueList_.0040121A
0040114E   . |8BF0          mov esi,eax
00401150   . |6A 00         push 0x0                                 ; /lParam = 0
00401152   . |6A 00         push 0x0                                 ; |wParam = 0
00401154   . |6A 0E         push 0xE                                 ; |Message = WM_GETTEXTLENGTH
00401156   . |6A 04         push 0x4                                 ; |ControlID = 4
00401158   . |FF75 08       push dword ptr ss:[ebp+0x8]              ; |hWnd
0040115B   . |E8 18020000   call <jmp.&USER32.SendDlgItemMessageA>   ; \SendDlgItemMessageA
00401160   . |83F8 00       cmp eax,0x0                              ;  获取Serial长度
00401163   . |0F84 B1000000 je DueList_.0040121A
00401169   . |3BF0          cmp esi,eax
0040116B   . |0F85 A9000000 jnz DueList_.0040121A
00401171   . |68 60214000   push DueList_.00402160                   ; /lParam = 402160
00401176   . |6A 08         push 0x8                                 ; |wParam = 8
00401178   . |6A 0D         push 0xD                                 ; |Message = WM_GETTEXT
0040117A   . |6A 03         push 0x3                                 ; |ControlID = 3
0040117C   . |FF75 08       push dword ptr ss:[ebp+0x8]              ; |hWnd
0040117F   . |E8 F4010000   call <jmp.&USER32.SendDlgItemMessageA>   ; \SendDlgItemMessageA
00401184   . |68 79214000   push DueList_.00402179                   ; /lParam = 402179
00401189   . |6A 10         push 0x10                                ; |wParam = 10
0040118B   . |6A 0D         push 0xD                                 ; |Message = WM_GETTEXT
0040118D   . |6A 04         push 0x4                                 ; |ControlID = 4
0040118F   . |FF75 08       push dword ptr ss:[ebp+0x8]              ; |hWnd
00401192   . |E8 E1010000   call <jmp.&USER32.SendDlgItemMessageA>   ; \SendDlgItemMessageA
00401197   . |B9 FFFFFFFF   mov ecx,-0x1
0040119C   > |41            inc ecx
0040119D   . |0FBE81 602140>movsx eax,byte ptr ds:[ecx+0x402160]
004011A4   . |83F8 00       cmp eax,0x0                              ;  Switch (cases 0..7A)
004011A7   . |74 32         je XDueList_.004011DB
004011A9   . |BE FFFFFFFF   mov esi,-0x1
004011AE   . |83F8 41       cmp eax,0x41
004011B1   . |7C 67         jl XDueList_.0040121A
004011B3   . |83F8 7A       cmp eax,0x7A
004011B6   . |77 62         ja XDueList_.0040121A                    ;  'A' ~ 'z'
004011B8   . |83F8 5A       cmp eax,0x5A
004011BB   . |7C 03         jl XDueList_.004011C0
004011BD   . |83E8 20       sub eax,0x20                             ;  Cases 5A ('Z'),5B ('['),5C ('\'),5D (']'),5E ('^'),5F ('_'),60 ('`'),61 ('a'),62 ('b'),63 ('c'),64 ('d'),65 ('e'),66 ('f'),67 ('g'),68 ('h'),69 ('i'),6A ('j'),6B ('k'),6C ('l'),6D ('m')... of switch 004011A4
004011C0   > |46            inc esi                                  ;  Cases 41 ('A'),42 ('B'),43 ('C'),44 ('D'),45 ('E'),46 ('F'),47 ('G'),48 ('H'),49 ('I'),4A ('J'),4B ('K'),4C ('L'),4D ('M'),4E ('N'),4F ('O'),50 ('P'),51 ('Q'),52 ('R'),53 ('S'),54 ('T')... of switch 004011A4
004011C1   . |0FBE96 172040>movsx edx,byte ptr ds:[esi+0x402017]
004011C8   . |3BC2          cmp eax,edx
004011CA   .^|75 F4         jnz XDueList_.004011C0
004011CC   . |0FBE86 3C2040>movsx eax,byte ptr ds:[esi+0x40203C]
004011D3   . |8981 94214000 mov dword ptr ds:[ecx+0x402194],eax
004011D9   .^|EB C1         jmp XDueList_.0040119C
004011DB   > |FF35 AF214000 push dword ptr ds:[0x4021AF]             ;  Case 0 of switch 004011A4
004011E1   . |68 94214000   push DueList_.00402194                   ;  ASCII "S4S"
004011E6   . |68 79214000   push DueList_.00402179                   ;  ASCII "S4S"
004011EB   . |E8 54000000   call DueList_.00401244                   ;  strcmp()
004011F0   . |83F8 01       cmp eax,0x1
004011F3   .^|0F84 DEFEFFFF je DueList_.004010D7
004011F9   . |EB 1F         jmp XDueList_.0040121A
004011FB   > |837D 10 01    cmp dword ptr ss:[ebp+0x10],0x1          ; |
004011FF   .^\0F84 22FFFFFF je DueList_.00401127                     ; |Check按钮事件
00401205   .  837D 10 02    cmp dword ptr ss:[ebp+0x10],0x2          ; |
00401209   .  75 2F         jnz XDueList_.0040123A                   ; |
0040120B   >  E8 B4000000   call <jmp.&KERNEL32.ExitProcess>         ; \ExitProcess
00401210   .  B8 01000000   mov eax,0x1
00401215   .^ E9 FFFEFFFF   jmp DueList_.00401119

Name表地址，0x00402017

Serial表地址，0x0040203C

3、注册机

N = 'A1LSK2DJF4HGP3QWO5EIR6UTYZ8MXN7CBV9'
S = 'SU7CSJKF09NCSDO9SDF09SDRLVK7809S4NF'

D = {}
for i in range(len(N)):
    D[N[i]] = S[i]

Name = input('Name:')
for i in Name:
    print(D[i], end='')