这个软件超简单,那我就简单的写一下过程:
直接OD载入,运行界面如下:
随便输入一个字符串提示如下:
那么我们直接在OD里面智能搜索字符串,定位到这个提示框调用的函数处;
00401CD0 > \55 push ebp
00401CD1 . 8BEC mov ebp,esp
00401CD3 . 83EC 0C sub esp,0xC
00401CD6 . 68 16104000 push <jmp.&MSVBVM50.__vbaExceptHandler> ; SE 处理程序安装
00401CDB . 64:A1 0000000>mov eax,dword ptr fs:[0]
00401CE1 . 50 push eax ; Andréna.00401870
00401CE2 . 64:8925 00000>mov dword ptr fs:[0],esp
00401CE9 . 81EC BC000000 sub esp,0xBC
00401CEF . 53 push ebx
00401CF0 . 56 push esi
00401CF1 . 57 push edi
00401CF2 . 8B7D 08 mov edi,dword ptr ss:[ebp+0x8]
00401CF5 . 8BC7 mov eax,edi
00401CF7 . 83E7 FE and edi,-0x2
00401CFA . 8965 F4 mov dword ptr ss:[ebp-0xC],esp
00401CFD . 83E0 01 and eax,0x1
00401D00 . 8B1F mov ebx,dword ptr ds:[edi]
00401D02 . C745 F8 00104>mov dword ptr ss:[ebp-0x8],Andréna.00401>
00401D09 . 57 push edi
00401D0A . 8945 FC mov dword ptr ss:[ebp-0x4],eax ; Andréna.00401870
00401D0D . 897D 08 mov dword ptr ss:[ebp+0x8],edi
00401D10 . FF53 04 call dword ptr ds:[ebx+0x4] ; msvbvm50.740EC5C8
00401D13 . 33F6 xor esi,esi
00401D15 . 57 push edi
00401D16 . 8975 DC mov dword ptr ss:[ebp-0x24],esi
00401D19 . 8975 D8 mov dword ptr ss:[ebp-0x28],esi
00401D1C . 8975 D4 mov dword ptr ss:[ebp-0x2C],esi
00401D1F . 8975 C4 mov dword ptr ss:[ebp-0x3C],esi
00401D22 . 8975 B4 mov dword ptr ss:[ebp-0x4C],esi
00401D25 . 8975 A4 mov dword ptr ss:[ebp-0x5C],esi
00401D28 . 8975 94 mov dword ptr ss:[ebp-0x6C],esi
00401D2B . 8975 84 mov dword ptr ss:[ebp-0x7C],esi
00401D2E . 89B5 74FFFFFF mov dword ptr ss:[ebp-0x8C],esi
00401D34 . 89B5 44FFFFFF mov dword ptr ss:[ebp-0xBC],esi
00401D3A . FF93 00030000 call dword ptr ds:[ebx+0x300]
00401D40 . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C]
00401D43 . 50 push eax ; Andréna.00401870
00401D44 . 51 push ecx
00401D45 . FF15 EC304000 call dword ptr ds:[<&MSVBVM50.__vbaObjSe>; msvbvm50.__vbaObjSet
00401D4B . 8BF8 mov edi,eax ; Andréna.00401870
00401D4D . 8D45 D8 lea eax,dword ptr ss:[ebp-0x28]
00401D50 . 50 push eax ; Andréna.00401870
00401D51 . 57 push edi
00401D52 . 8B17 mov edx,dword ptr ds:[edi]
00401D54 . FF92 A0000000 call dword ptr ds:[edx+0xA0]
00401D5A . 3BC6 cmp eax,esi
00401D5C . 7D 12 jge short Andréna.00401D70
00401D5E . 68 A0000000 push 0xA0
00401D63 . 68 401A4000 push Andréna.00401A40
00401D68 . 57 push edi
00401D69 . 50 push eax ; Andréna.00401870
00401D6A . FF15 E4304000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj
00401D70 > 8B4D D8 mov ecx,dword ptr ss:[ebp-0x28]
00401D73 . 51 push ecx ; 输入字符
00401D74 . 68 541A4000 push Andréna.00401A54 ; SynTaX 2oo1
00401D79 . FF15 08314000 call dword ptr ds:[<&MSVBVM50.__vbaStrCm>; 关键,比较字符串
00401D7F . 8BF8 mov edi,eax ; 关键
00401D81 . 8D4D D8 lea ecx,dword ptr ss:[ebp-0x28]
00401D84 . F7DF neg edi ; 取反
00401D86 . 1BFF sbb edi,edi
00401D88 . 47 inc edi
00401D89 . F7DF neg edi
00401D8B . FF15 5C314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>; msvbvm50.__vbaFreeStr
00401D91 . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C]
00401D94 . FF15 60314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>; msvbvm50.__vbaFreeObj
00401D9A . 66:3BFE cmp di,si ; 关键比较
00401D9D . 0F84 A0000000 je Andréna.00401E43
00401DA3 . FF15 2C314000 call dword ptr ds:[<&MSVBVM50.#534>] ; msvbvm50.rtcBeep
00401DA9 . 8B3D 48314000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>; msvbvm50.__vbaVarDup
00401DAF . B9 04000280 mov ecx,0x80020004
00401DB4 . 894D 9C mov dword ptr ss:[ebp-0x64],ecx
00401DB7 . B8 0A000000 mov eax,0xA
00401DBC . 894D AC mov dword ptr ss:[ebp-0x54],ecx
00401DBF . BB 08000000 mov ebx,0x8
00401DC4 . 8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C]
00401DCA . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C]
00401DCD . 8945 94 mov dword ptr ss:[ebp-0x6C],eax ; Andréna.00401870
00401DD0 . 8945 A4 mov dword ptr ss:[ebp-0x5C],eax ; Andréna.00401870
00401DD3 . C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],Andréna.0040>; SuCCESFul !
00401DDD . 899D 74FFFFFF mov dword ptr ss:[ebp-0x8C],ebx
00401DE3 . FFD7 call edi ; <&MSVBVM50.__vbaVarDup>
00401DE5 . 8D55 84 lea edx,dword ptr ss:[ebp-0x7C]
00401DE8 . 8D4D C4 lea ecx,dword ptr ss:[ebp-0x3C]
00401DEB . C745 8C 701A4>mov dword ptr ss:[ebp-0x74],Andréna.0040>; RiCHtiG ! ...nun weiter zu CrackMe 2 !
00401DF2 . 895D 84 mov dword ptr ss:[ebp-0x7C],ebx
00401DF5 . FFD7 call edi
00401DF7 . 8D55 94 lea edx,dword ptr ss:[ebp-0x6C]
00401DFA . 8D45 A4 lea eax,dword ptr ss:[ebp-0x5C]
00401DFD . 52 push edx
00401DFE . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C]
00401E01 . 50 push eax ; Andréna.00401870
00401E02 . 51 push ecx
00401E03 . 8D55 C4 lea edx,dword ptr ss:[ebp-0x3C]
00401E06 . 6A 30 push 0x30
00401E08 . 52 push edx
00401E09 . FF15 F0304000 call dword ptr ds:[<&MSVBVM50.#595>] ; msvbvm50.rtcMsgBox
00401E0F . 8D95 44FFFFFF lea edx,dword ptr ss:[ebp-0xBC]
00401E15 . 8D4D DC lea ecx,dword ptr ss:[ebp-0x24]
00401E18 . 8985 4CFFFFFF mov dword ptr ss:[ebp-0xB4],eax ; Andréna.00401870
00401E1E . C785 44FFFFFF>mov dword ptr ss:[ebp-0xBC],0x3
00401E28 . FF15 D0304000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>; msvbvm50.__vbaVarMove
00401E2E . 8D45 94 lea eax,dword ptr ss:[ebp-0x6C]
00401E31 . 8D4D A4 lea ecx,dword ptr ss:[ebp-0x5C]
00401E34 . 50 push eax ; Andréna.00401870
00401E35 . 8D55 B4 lea edx,dword ptr ss:[ebp-0x4C]
00401E38 . 51 push ecx
00401E39 . 8D45 C4 lea eax,dword ptr ss:[ebp-0x3C]
00401E3C . 52 push edx
00401E3D . 50 push eax ; Andréna.00401870
00401E3E . E9 95000000 jmp Andréna.00401ED8
00401E43 > 8B3D 48314000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>; msvbvm50.__vbaVarDup
00401E49 . B9 04000280 mov ecx,0x80020004
00401E4E . 894D 9C mov dword ptr ss:[ebp-0x64],ecx
00401E51 . B8 0A000000 mov eax,0xA
00401E56 . 894D AC mov dword ptr ss:[ebp-0x54],ecx
00401E59 . BB 08000000 mov ebx,0x8
00401E5E . 8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C]
00401E64 . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C]
00401E67 . 8945 94 mov dword ptr ss:[ebp-0x6C],eax ; Andréna.00401870
00401E6A . 8945 A4 mov dword ptr ss:[ebp-0x5C],eax ; Andréna.00401870
00401E6D . C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],Andréna.0040>; leider NeiN !
00401E77 . 899D 74FFFFFF mov dword ptr ss:[ebp-0x8C],ebx
00401E7D . FFD7 call edi ; <&MSVBVM50.__vbaVarDup>
00401E7F . 8D55 84 lea edx,dword ptr ss:[ebp-0x7C]
00401E82 . 8D4D C4 lea ecx,dword ptr ss:[ebp-0x3C]
00401E85 . C745 8C E01A4>mov dword ptr ss:[ebp-0x74],Andréna.0040>; Leider Falsch ! Schau noch mal genau nach ...
00401E8C . 895D 84 mov dword ptr ss:[ebp-0x7C],ebx
00401E8F . FFD7 call edi
00401E91 . 8D4D 94 lea ecx,dword ptr ss:[ebp-0x6C]
00401E94 . 8D55 A4 lea edx,dword ptr ss:[ebp-0x5C]
00401E97 . 51 push ecx
00401E98 . 8D45 B4 lea eax,dword ptr ss:[ebp-0x4C]
00401E9B . 52 push edx
00401E9C . 50 push eax ; Andréna.00401870
00401E9D . 8D4D C4 lea ecx,dword ptr ss:[ebp-0x3C]
00401EA0 . 6A 10 push 0x10
00401EA2 . 51 push ecx
00401EA3 . FF15 F0304000 call dword ptr ds:[<&MSVBVM50.#595>] ; 信息框
00401EA9 . 8D95 44FFFFFF lea edx,dword ptr ss:[ebp-0xBC]
00401EAF . 8D4D DC lea ecx,dword ptr ss:[ebp-0x24]
00401EB2 . 8985 4CFFFFFF mov dword ptr ss:[ebp-0xB4],eax ; Andréna.00401870
00401EB8 . C785 44FFFFFF>mov dword ptr ss:[ebp-0xBC],0x3
00401EC2 . FF15 D0304000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>; msvbvm50.__vbaVarMove
00401EC8 . 8D55 94 lea edx,dword ptr ss:[ebp-0x6C]
00401ECB . 8D45 A4 lea eax,dword ptr ss:[ebp-0x5C]
00401ECE . 52 push edx
00401ECF . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C]
00401ED2 . 50 push eax ; Andréna.00401870
00401ED3 . 8D55 C4 lea edx,dword ptr ss:[ebp-0x3C]
00401ED6 . 51 push ecx
00401ED7 . 52 push edx
00401ED8 > 6A 04 push 0x4
00401EDA . FF15 D8304000 call dword ptr ds:[<&MSVBVM50.__vbaFreeV>; msvbvm50.__vbaFreeVarList
00401EE0 . 83C4 14 add esp,0x14
00401EE3 . 8975 FC mov dword ptr ss:[ebp-0x4],esi
00401EE6 . 68 251F4000 push Andréna.00401F25
00401EEB . EB 2E jmp short Andréna.00401F1B
00401EED . 8D4D D8 lea ecx,dword ptr ss:[ebp-0x28]
00401EF0 . FF15 5C314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>; msvbvm50.__vbaFreeStr
00401EF6 . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C]
00401EF9 . FF15 60314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>; msvbvm50.__vbaFreeObj
00401EFF . 8D45 94 lea eax,dword ptr ss:[ebp-0x6C]
00401F02 . 8D4D A4 lea ecx,dword ptr ss:[ebp-0x5C]
00401F05 . 50 push eax ; Andréna.00401870
00401F06 . 8D55 B4 lea edx,dword ptr ss:[ebp-0x4C]
00401F09 . 51 push ecx
00401F0A . 8D45 C4 lea eax,dword ptr ss:[ebp-0x3C]
00401F0D . 52 push edx
00401F0E . 50 push eax ; Andréna.00401870
00401F0F . 6A 04 push 0x4
00401F11 . FF15 D8304000 call dword ptr ds:[<&MSVBVM50.__vbaFreeV>; msvbvm50.__vbaFreeVarList
00401F17 . 83C4 14 add esp,0x14
00401F1A . C3 retn
00401F1B > 8D4D DC lea ecx,dword ptr ss:[ebp-0x24]
00401F1E .- FF25 D4304000 jmp dword ptr ds:[<&MSVBVM50.__vbaFreeVa>; msvbvm50.__vbaFreeVar
00401F24 . C3 retn
00401F25 . 8B45 08 mov eax,dword ptr ss:[ebp+0x8]
00401F28 . 50 push eax ; Andréna.00401870
00401F29 . 8B08 mov ecx,dword ptr ds:[eax]
00401F2B . FF51 08 call dword ptr ds:[ecx+0x8]
00401F2E . 8B4D EC mov ecx,dword ptr ss:[ebp-0x14] ; Andréna.00401000
00401F31 . 8B45 FC mov eax,dword ptr ss:[ebp-0x4]
00401F34 . 5F pop edi ; 0018F324
00401F35 . 5E pop esi ; 0018F324
00401F36 . 64:890D 00000>mov dword ptr fs:[0],ecx
00401F3D . 5B pop ebx ; 0018F324
00401F3E . 8BE5 mov esp,ebp
00401F40 . 5D pop ebp ; 0018F324
00401F41 . C2 0400 retn 0x4
这是整个函数的代码,主要的代码就在这里:
00401D73 . 51 push ecx ; 输入字符
00401D74 . 68 541A4000 push Andréna.00401A54 ; SynTaX 2oo1
00401D79 . FF15 08314000 call dword ptr ds:[<&MSVBVM50.__vbaStrCm>; 关键,比较字符串
00401D7F . 8BF8 mov edi,eax ; 关键
00401D81 . 8D4D D8 lea ecx,dword ptr ss:[ebp-0x28]
00401D84 . F7DF neg edi ; 取反
这里将输入的字符串直接与SynTax 2oo1进行了对比,如果相同,后面就跳到了正确的地方执行,即注册码就是SynTax 2oo1