160个破解练习之CrackMe 008

这个软件超简单,那我就简单的写一下过程:

直接OD载入,运行界面如下:

随便输入一个字符串提示如下:



那么我们直接在OD里面智能搜索字符串,定位到这个提示框调用的函数处;

00401CD0   > \55            push ebp
00401CD1   .  8BEC          mov ebp,esp
00401CD3   .  83EC 0C       sub esp,0xC
00401CD6   .  68 16104000   push <jmp.&MSVBVM50.__vbaExceptHandler>  ;  SE 处理程序安装
00401CDB   .  64:A1 0000000>mov eax,dword ptr fs:[0]
00401CE1   .  50            push eax                                 ;  Andréna.00401870
00401CE2   .  64:8925 00000>mov dword ptr fs:[0],esp
00401CE9   .  81EC BC000000 sub esp,0xBC
00401CEF   .  53            push ebx
00401CF0   .  56            push esi
00401CF1   .  57            push edi
00401CF2   .  8B7D 08       mov edi,dword ptr ss:[ebp+0x8]
00401CF5   .  8BC7          mov eax,edi
00401CF7   .  83E7 FE       and edi,-0x2
00401CFA   .  8965 F4       mov dword ptr ss:[ebp-0xC],esp
00401CFD   .  83E0 01       and eax,0x1
00401D00   .  8B1F          mov ebx,dword ptr ds:[edi]
00401D02   .  C745 F8 00104>mov dword ptr ss:[ebp-0x8],Andréna.00401>
00401D09   .  57            push edi
00401D0A   .  8945 FC       mov dword ptr ss:[ebp-0x4],eax           ;  Andréna.00401870
00401D0D   .  897D 08       mov dword ptr ss:[ebp+0x8],edi
00401D10   .  FF53 04       call dword ptr ds:[ebx+0x4]              ;  msvbvm50.740EC5C8
00401D13   .  33F6          xor esi,esi
00401D15   .  57            push edi
00401D16   .  8975 DC       mov dword ptr ss:[ebp-0x24],esi
00401D19   .  8975 D8       mov dword ptr ss:[ebp-0x28],esi
00401D1C   .  8975 D4       mov dword ptr ss:[ebp-0x2C],esi
00401D1F   .  8975 C4       mov dword ptr ss:[ebp-0x3C],esi
00401D22   .  8975 B4       mov dword ptr ss:[ebp-0x4C],esi
00401D25   .  8975 A4       mov dword ptr ss:[ebp-0x5C],esi
00401D28   .  8975 94       mov dword ptr ss:[ebp-0x6C],esi
00401D2B   .  8975 84       mov dword ptr ss:[ebp-0x7C],esi
00401D2E   .  89B5 74FFFFFF mov dword ptr ss:[ebp-0x8C],esi
00401D34   .  89B5 44FFFFFF mov dword ptr ss:[ebp-0xBC],esi
00401D3A   .  FF93 00030000 call dword ptr ds:[ebx+0x300]
00401D40   .  8D4D D4       lea ecx,dword ptr ss:[ebp-0x2C]
00401D43   .  50            push eax                                 ;  Andréna.00401870
00401D44   .  51            push ecx
00401D45   .  FF15 EC304000 call dword ptr ds:[<&MSVBVM50.__vbaObjSe>;  msvbvm50.__vbaObjSet
00401D4B   .  8BF8          mov edi,eax                              ;  Andréna.00401870
00401D4D   .  8D45 D8       lea eax,dword ptr ss:[ebp-0x28]
00401D50   .  50            push eax                                 ;  Andréna.00401870
00401D51   .  57            push edi
00401D52   .  8B17          mov edx,dword ptr ds:[edi]
00401D54   .  FF92 A0000000 call dword ptr ds:[edx+0xA0]
00401D5A   .  3BC6          cmp eax,esi
00401D5C   .  7D 12         jge short Andréna.00401D70
00401D5E   .  68 A0000000   push 0xA0
00401D63   .  68 401A4000   push Andréna.00401A40
00401D68   .  57            push edi
00401D69   .  50            push eax                                 ;  Andréna.00401870
00401D6A   .  FF15 E4304000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>;  msvbvm50.__vbaHresultCheckObj
00401D70   >  8B4D D8       mov ecx,dword ptr ss:[ebp-0x28]
00401D73   .  51            push ecx                                 ;  输入字符
00401D74   .  68 541A4000   push Andréna.00401A54                    ;  SynTaX 2oo1
00401D79   .  FF15 08314000 call dword ptr ds:[<&MSVBVM50.__vbaStrCm>;  关键,比较字符串
00401D7F   .  8BF8          mov edi,eax                              ;  关键
00401D81   .  8D4D D8       lea ecx,dword ptr ss:[ebp-0x28]
00401D84   .  F7DF          neg edi                                  ;  取反
00401D86   .  1BFF          sbb edi,edi
00401D88   .  47            inc edi
00401D89   .  F7DF          neg edi
00401D8B   .  FF15 5C314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>;  msvbvm50.__vbaFreeStr
00401D91   .  8D4D D4       lea ecx,dword ptr ss:[ebp-0x2C]
00401D94   .  FF15 60314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  msvbvm50.__vbaFreeObj
00401D9A   .  66:3BFE       cmp di,si                                ;  关键比较
00401D9D   .  0F84 A0000000 je Andréna.00401E43
00401DA3   .  FF15 2C314000 call dword ptr ds:[<&MSVBVM50.#534>]     ;  msvbvm50.rtcBeep
00401DA9   .  8B3D 48314000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>;  msvbvm50.__vbaVarDup
00401DAF   .  B9 04000280   mov ecx,0x80020004
00401DB4   .  894D 9C       mov dword ptr ss:[ebp-0x64],ecx
00401DB7   .  B8 0A000000   mov eax,0xA
00401DBC   .  894D AC       mov dword ptr ss:[ebp-0x54],ecx
00401DBF   .  BB 08000000   mov ebx,0x8
00401DC4   .  8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C]
00401DCA   .  8D4D B4       lea ecx,dword ptr ss:[ebp-0x4C]
00401DCD   .  8945 94       mov dword ptr ss:[ebp-0x6C],eax          ;  Andréna.00401870
00401DD0   .  8945 A4       mov dword ptr ss:[ebp-0x5C],eax          ;  Andréna.00401870
00401DD3   .  C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],Andréna.0040>;  SuCCESFul !
00401DDD   .  899D 74FFFFFF mov dword ptr ss:[ebp-0x8C],ebx
00401DE3   .  FFD7          call edi                                 ;  <&MSVBVM50.__vbaVarDup>
00401DE5   .  8D55 84       lea edx,dword ptr ss:[ebp-0x7C]
00401DE8   .  8D4D C4       lea ecx,dword ptr ss:[ebp-0x3C]
00401DEB   .  C745 8C 701A4>mov dword ptr ss:[ebp-0x74],Andréna.0040>;  RiCHtiG ! ...nun weiter zu CrackMe 2 !
00401DF2   .  895D 84       mov dword ptr ss:[ebp-0x7C],ebx
00401DF5   .  FFD7          call edi
00401DF7   .  8D55 94       lea edx,dword ptr ss:[ebp-0x6C]
00401DFA   .  8D45 A4       lea eax,dword ptr ss:[ebp-0x5C]
00401DFD   .  52            push edx
00401DFE   .  8D4D B4       lea ecx,dword ptr ss:[ebp-0x4C]
00401E01   .  50            push eax                                 ;  Andréna.00401870
00401E02   .  51            push ecx
00401E03   .  8D55 C4       lea edx,dword ptr ss:[ebp-0x3C]
00401E06   .  6A 30         push 0x30
00401E08   .  52            push edx
00401E09   .  FF15 F0304000 call dword ptr ds:[<&MSVBVM50.#595>]     ;  msvbvm50.rtcMsgBox
00401E0F   .  8D95 44FFFFFF lea edx,dword ptr ss:[ebp-0xBC]
00401E15   .  8D4D DC       lea ecx,dword ptr ss:[ebp-0x24]
00401E18   .  8985 4CFFFFFF mov dword ptr ss:[ebp-0xB4],eax          ;  Andréna.00401870
00401E1E   .  C785 44FFFFFF>mov dword ptr ss:[ebp-0xBC],0x3
00401E28   .  FF15 D0304000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>;  msvbvm50.__vbaVarMove
00401E2E   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00401E31   .  8D4D A4       lea ecx,dword ptr ss:[ebp-0x5C]
00401E34   .  50            push eax                                 ;  Andréna.00401870
00401E35   .  8D55 B4       lea edx,dword ptr ss:[ebp-0x4C]
00401E38   .  51            push ecx
00401E39   .  8D45 C4       lea eax,dword ptr ss:[ebp-0x3C]
00401E3C   .  52            push edx
00401E3D   .  50            push eax                                 ;  Andréna.00401870
00401E3E   .  E9 95000000   jmp Andréna.00401ED8
00401E43   >  8B3D 48314000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>;  msvbvm50.__vbaVarDup
00401E49   .  B9 04000280   mov ecx,0x80020004
00401E4E   .  894D 9C       mov dword ptr ss:[ebp-0x64],ecx
00401E51   .  B8 0A000000   mov eax,0xA
00401E56   .  894D AC       mov dword ptr ss:[ebp-0x54],ecx
00401E59   .  BB 08000000   mov ebx,0x8
00401E5E   .  8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C]
00401E64   .  8D4D B4       lea ecx,dword ptr ss:[ebp-0x4C]
00401E67   .  8945 94       mov dword ptr ss:[ebp-0x6C],eax          ;  Andréna.00401870
00401E6A   .  8945 A4       mov dword ptr ss:[ebp-0x5C],eax          ;  Andréna.00401870
00401E6D   .  C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],Andréna.0040>;  leider NeiN !
00401E77   .  899D 74FFFFFF mov dword ptr ss:[ebp-0x8C],ebx
00401E7D   .  FFD7          call edi                                 ;  <&MSVBVM50.__vbaVarDup>
00401E7F   .  8D55 84       lea edx,dword ptr ss:[ebp-0x7C]
00401E82   .  8D4D C4       lea ecx,dword ptr ss:[ebp-0x3C]
00401E85   .  C745 8C E01A4>mov dword ptr ss:[ebp-0x74],Andréna.0040>;  Leider Falsch !  Schau noch mal genau nach ...
00401E8C   .  895D 84       mov dword ptr ss:[ebp-0x7C],ebx
00401E8F   .  FFD7          call edi
00401E91   .  8D4D 94       lea ecx,dword ptr ss:[ebp-0x6C]
00401E94   .  8D55 A4       lea edx,dword ptr ss:[ebp-0x5C]
00401E97   .  51            push ecx
00401E98   .  8D45 B4       lea eax,dword ptr ss:[ebp-0x4C]
00401E9B   .  52            push edx
00401E9C   .  50            push eax                                 ;  Andréna.00401870
00401E9D   .  8D4D C4       lea ecx,dword ptr ss:[ebp-0x3C]
00401EA0   .  6A 10         push 0x10
00401EA2   .  51            push ecx
00401EA3   .  FF15 F0304000 call dword ptr ds:[<&MSVBVM50.#595>]     ;  信息框
00401EA9   .  8D95 44FFFFFF lea edx,dword ptr ss:[ebp-0xBC]
00401EAF   .  8D4D DC       lea ecx,dword ptr ss:[ebp-0x24]
00401EB2   .  8985 4CFFFFFF mov dword ptr ss:[ebp-0xB4],eax          ;  Andréna.00401870
00401EB8   .  C785 44FFFFFF>mov dword ptr ss:[ebp-0xBC],0x3
00401EC2   .  FF15 D0304000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>;  msvbvm50.__vbaVarMove
00401EC8   .  8D55 94       lea edx,dword ptr ss:[ebp-0x6C]
00401ECB   .  8D45 A4       lea eax,dword ptr ss:[ebp-0x5C]
00401ECE   .  52            push edx
00401ECF   .  8D4D B4       lea ecx,dword ptr ss:[ebp-0x4C]
00401ED2   .  50            push eax                                 ;  Andréna.00401870
00401ED3   .  8D55 C4       lea edx,dword ptr ss:[ebp-0x3C]
00401ED6   .  51            push ecx
00401ED7   .  52            push edx
00401ED8   >  6A 04         push 0x4
00401EDA   .  FF15 D8304000 call dword ptr ds:[<&MSVBVM50.__vbaFreeV>;  msvbvm50.__vbaFreeVarList
00401EE0   .  83C4 14       add esp,0x14
00401EE3   .  8975 FC       mov dword ptr ss:[ebp-0x4],esi
00401EE6   .  68 251F4000   push Andréna.00401F25
00401EEB   .  EB 2E         jmp short Andréna.00401F1B
00401EED   .  8D4D D8       lea ecx,dword ptr ss:[ebp-0x28]
00401EF0   .  FF15 5C314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>;  msvbvm50.__vbaFreeStr
00401EF6   .  8D4D D4       lea ecx,dword ptr ss:[ebp-0x2C]
00401EF9   .  FF15 60314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  msvbvm50.__vbaFreeObj
00401EFF   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00401F02   .  8D4D A4       lea ecx,dword ptr ss:[ebp-0x5C]
00401F05   .  50            push eax                                 ;  Andréna.00401870
00401F06   .  8D55 B4       lea edx,dword ptr ss:[ebp-0x4C]
00401F09   .  51            push ecx
00401F0A   .  8D45 C4       lea eax,dword ptr ss:[ebp-0x3C]
00401F0D   .  52            push edx
00401F0E   .  50            push eax                                 ;  Andréna.00401870
00401F0F   .  6A 04         push 0x4
00401F11   .  FF15 D8304000 call dword ptr ds:[<&MSVBVM50.__vbaFreeV>;  msvbvm50.__vbaFreeVarList
00401F17   .  83C4 14       add esp,0x14
00401F1A   .  C3            retn
00401F1B   >  8D4D DC       lea ecx,dword ptr ss:[ebp-0x24]
00401F1E   .- FF25 D4304000 jmp dword ptr ds:[<&MSVBVM50.__vbaFreeVa>;  msvbvm50.__vbaFreeVar
00401F24   .  C3            retn
00401F25   .  8B45 08       mov eax,dword ptr ss:[ebp+0x8]
00401F28   .  50            push eax                                 ;  Andréna.00401870
00401F29   .  8B08          mov ecx,dword ptr ds:[eax]
00401F2B   .  FF51 08       call dword ptr ds:[ecx+0x8]
00401F2E   .  8B4D EC       mov ecx,dword ptr ss:[ebp-0x14]          ;  Andréna.00401000
00401F31   .  8B45 FC       mov eax,dword ptr ss:[ebp-0x4]
00401F34   .  5F            pop edi                                  ;  0018F324
00401F35   .  5E            pop esi                                  ;  0018F324
00401F36   .  64:890D 00000>mov dword ptr fs:[0],ecx
00401F3D   .  5B            pop ebx                                  ;  0018F324
00401F3E   .  8BE5          mov esp,ebp
00401F40   .  5D            pop ebp                                  ;  0018F324
00401F41   .  C2 0400       retn 0x4


这是整个函数的代码,主要的代码就在这里:


00401D73   .  51            push ecx                                 ;  输入字符
00401D74   .  68 541A4000   push Andréna.00401A54                    ;  SynTaX 2oo1
00401D79   .  FF15 08314000 call dword ptr ds:[<&MSVBVM50.__vbaStrCm>;  关键,比较字符串
00401D7F   .  8BF8          mov edi,eax                              ;  关键
00401D81   .  8D4D D8       lea ecx,dword ptr ss:[ebp-0x28]
00401D84   .  F7DF          neg edi                                  ;  取反

这里将输入的字符串直接与SynTax 2oo1进行了对比,如果相同,后面就跳到了正确的地方执行,即注册码就是SynTax 2oo1



评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值