160个crackme之008

继续crackme

经历过几个delphi的程序之后终于迎来了一个VB的程序，VB程序里面有很多神奇的库函数。

还是有大神总结了一下，这是一个很详细的介绍。

嗯，接下来还是进行逆向分析。

0X00  这是一个很简单的验证name的程序。

界面也很简单，随意输入发现弹窗。就是语言非常的神奇，总之是一种我没见过的语言。。

嗯，根据流程猜测一下大概就是输入key，然后对比验证。

0X01  接下来尝试爆破

对于这种典型的弹窗，我们一般都采用如下步骤：弹窗->暂停->alt+k查看栈情况->跟到messagebox->向上找到关键跳转->修改爆破

好的那么接下来拖到OD当中运行然后弹窗，alt+k查看

很明显最下面来自用户进程调用

跟进转到00401EA3，向上找到关键跳转

下断点运行到此处将标志位反转，即可实现爆破。此时弹出right字样的对话框

0X02  接下来分析算法

其实很简单，做一些标注

00401D6A   .  FF15 E4304000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>;  msvbvm50.__vbaHresultCheckObj
00401D70   >  8B4D D8       mov ecx,dword ptr ss:[ebp-0x28]
00401D73   .  51            push ecx                                 ;  ecx=name
00401D74   .  68 541A4000   push Andréna.00401A54                    ;  UNICODE "SynTaX 2oo1"
00401D79   .  FF15 08314000 call dword ptr ds:[<&MSVBVM50.__vbaStrCm>;  msvbvm50.__vbaStrCmp
00401D7F   .  8BF8          mov edi,eax
00401D81   .  8D4D D8       lea ecx,dword ptr ss:[ebp-0x28]
00401D84   .  F7DF          neg edi
00401D86   .  1BFF          sbb edi,edi
00401D88   .  47            inc edi
00401D89   .  F7DF          neg edi
00401D8B   .  FF15 5C314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>;  msvbvm50.__vbaFreeStr
00401D91   .  8D4D D4       lea ecx,dword ptr ss:[ebp-0x2C]
00401D94   .  FF15 60314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  msvbvm50.__vbaFreeObj
00401D9A   .  66:3BFE       cmp di,si
00401D9D   .  0F84 A0000000 je Andréna.00401E43
00401DA3   .  FF15 2C314000 call dword ptr ds:[<&MSVBVM50.#534>]     ;  msvbvm50.rtcBeep
00401DA9   .  8B3D 48314000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>;  msvbvm50.__vbaVarDup
00401DAF   .  B9 04000280   mov ecx,0x80020004
00401DB4   .  894D 9C       mov dword ptr ss:[ebp-0x64],ecx
00401DB7   .  B8 0A000000   mov eax,0xA
00401DBC   .  894D AC       mov dword ptr ss:[ebp-0x54],ecx
00401DBF   .  BB 08000000   mov ebx,0x8
00401DC4   .  8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C]
00401DCA   .  8D4D B4       lea ecx,dword ptr ss:[ebp-0x4C]
00401DCD   .  8945 94       mov dword ptr ss:[ebp-0x6C],eax
00401DD0   .  8945 A4       mov dword ptr ss:[ebp-0x5C],eax
00401DD3   .  C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],Andréna.0040>;  UNICODE "SuCCESFul !"
00401DDD   .  899D 74FFFFFF mov dword ptr ss:[ebp-0x8C],ebx          ;  Andréna.004022F0
00401DE3   .  FFD7          call edi                                 ;  <&MSVBVM50.__vbaVarDup>
00401DE5   .  8D55 84       lea edx,dword ptr ss:[ebp-0x7C]
00401DE8   .  8D4D C4       lea ecx,dword ptr ss:[ebp-0x3C]
00401DEB   .  C745 8C 701A4>mov dword ptr ss:[ebp-0x74],Andréna.0040>;  UNICODE "RiCHtiG ! ...nun weiter zu CrackMe 2 !"
00401DF2   .  895D 84       mov dword ptr ss:[ebp-0x7C],ebx          ;  Andréna.004022F0
00401DF5   .  FFD7          call edi
00401DF7   .  8D55 94       lea edx,dword ptr ss:[ebp-0x6C]
00401DFA   .  8D45 A4       lea eax,dword ptr ss:[ebp-0x5C]
00401DFD   .  52            push edx
00401DFE   .  8D4D B4       lea ecx,dword ptr ss:[ebp-0x4C]
00401E01   .  50            push eax
00401E02   .  51            push ecx
00401E03   .  8D55 C4       lea edx,dword ptr ss:[ebp-0x3C]
00401E06   .  6A 30         push 0x30
00401E08   .  52            push edx
00401E09   .  FF15 F0304000 call dword ptr ds:[<&MSVBVM50.#595>]     ;  msvbvm50.rtcMsgBox
00401E0F   .  8D95 44FFFFFF lea edx,dword ptr ss:[ebp-0xBC]
00401E15   .  8D4D DC       lea ecx,dword ptr ss:[ebp-0x24]
00401E18   .  8985 4CFFFFFF mov dword ptr ss:[ebp-0xB4],eax
00401E1E   .  C785 44FFFFFF>mov dword ptr ss:[ebp-0xBC],0x3
00401E28   .  FF15 D0304000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>;  msvbvm50.__vbaVarMove
00401E2E   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00401E31   .  8D4D A4       lea ecx,dword ptr ss:[ebp-0x5C]
00401E34   .  50            push eax
00401E35   .  8D55 B4       lea edx,dword ptr ss:[ebp-0x4C]
00401E38   .  51            push ecx
00401E39   .  8D45 C4       lea eax,dword ptr ss:[ebp-0x3C]
00401E3C   .  52            push edx
00401E3D   .  50            push eax
00401E3E   .  E9 95000000   jmp Andréna.00401ED8
00401E43   >  8B3D 48314000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>;  msvbvm50.__vbaVarDup
00401E49   .  B9 04000280   mov ecx,0x80020004
00401E4E   .  894D 9C       mov dword ptr ss:[ebp-0x64],ecx
00401E51   .  B8 0A000000   mov eax,0xA
00401E56   .  894D AC       mov dword ptr ss:[ebp-0x54],ecx
00401E59   .  BB 08000000   mov ebx,0x8
00401E5E   .  8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C]
00401E64   .  8D4D B4       lea ecx,dword ptr ss:[ebp-0x4C]
00401E67   .  8945 94       mov dword ptr ss:[ebp-0x6C],eax
00401E6A   .  8945 A4       mov dword ptr ss:[ebp-0x5C],eax
00401E6D   .  C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],Andréna.0040>;  UNICODE "leider NeiN !"
00401E77   .  899D 74FFFFFF mov dword ptr ss:[ebp-0x8C],ebx          ;  Andréna.004022F0
00401E7D   .  FFD7          call edi                                 ;  <&MSVBVM50.__vbaVarDup>
00401E7F   .  8D55 84       lea edx,dword ptr ss:[ebp-0x7C]
00401E82   .  8D4D C4       lea ecx,dword ptr ss:[ebp-0x3C]
00401E85   .  C745 8C E01A4>mov dword ptr ss:[ebp-0x74],Andréna.0040>;  UNICODE "Leider Falsch !  Schau noch mal genau nach ..."
00401E8C   .  895D 84       mov dword ptr ss:[ebp-0x7C],ebx          ;  Andréna.004022F0
00401E8F   .  FFD7          call edi
00401E91   .  8D4D 94       lea ecx,dword ptr ss:[ebp-0x6C]
00401E94   .  8D55 A4       lea edx,dword ptr ss:[ebp-0x5C]
00401E97   .  51            push ecx
00401E98   .  8D45 B4       lea eax,dword ptr ss:[ebp-0x4C]
00401E9B   .  52            push edx
00401E9C   .  50            push eax
00401E9D   .  8D4D C4       lea ecx,dword ptr ss:[ebp-0x3C]
00401EA0   .  6A 10         push 0x10
00401EA2   .  51            push ecx
00401EA3   .  FF15 F0304000 call dword ptr ds:[<&MSVBVM50.#595>]     ;  msvbvm50.rtcMsgBox

00401D6A   .  FF15 E4304000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>;  msvbvm50.__vbaHresultCheckObj       

和我们想象的一样，将name取出与key进行对比。

那么找到key=SynTaX 2oo1

成功。