160 - 35 cupofcoffe.1

环境
Windows xp sp3

工具
1.exeinfo PE
2.ollydbg

查壳
OD载入后可以看出是VB程序

测试
输入：12345678

显示的内容发生了改变，也不影响查找字符串。

004FEC14   > \8B4D E8       mov ecx,dword ptr ss:[ebp-0x18]
004FEC17   .  51            push ecx
004FEC18   .  68 E41B4000   push cupofcof.00401BE4                   ;  UNICODE ".........."
004FEC1D   .  FF15 F8105000 call dword ptr ds:[<&MSVBVM50.__vbaStrCm>;  MSVBVM50.__vbaStrCmp
004FEC23   .  8BF0          mov esi,eax
004FEC25   .  8D4D E8       lea ecx,dword ptr ss:[ebp-0x18]
004FEC28   .  F7DE          neg esi
004FEC2A   .  1BF6          sbb esi,esi
004FEC2C   .  F7DE          neg esi
004FEC2E   .  F7DE          neg esi
004FEC30   .  FF15 4C115000 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>;  MSVBVM50.__vbaFreeStr
004FEC36   .  8D4D E4       lea ecx,dword ptr ss:[ebp-0x1C]
004FEC39   .  FF15 50115000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  MSVBVM50.__vbaFreeObj
004FEC3F   .  66:3BF7       cmp si,di
004FEC42   .  74 6E         je Xcupofcof.004FECB2
004FEC44   .  B9 04000280   mov ecx,0x80020004
004FEC49   .  B8 0A000000   mov eax,0xA
004FEC4E   .  894D AC       mov dword ptr ss:[ebp-0x54],ecx
004FEC51   .  894D BC       mov dword ptr ss:[ebp-0x44],ecx
004FEC54   .  894D CC       mov dword ptr ss:[ebp-0x34],ecx
004FEC57   .  8D55 94       lea edx,dword ptr ss:[ebp-0x6C]
004FEC5A   .  8D4D D4       lea ecx,dword ptr ss:[ebp-0x2C]
004FEC5D   .  8945 A4       mov dword ptr ss:[ebp-0x5C],eax
004FEC60   .  8945 B4       mov dword ptr ss:[ebp-0x4C],eax
004FEC63   .  8945 C4       mov dword ptr ss:[ebp-0x3C],eax
004FEC66   .  C745 9C 001C4>mov dword ptr ss:[ebp-0x64],cupofcof.004>;  UNICODE "Incorrect password"
004FEC6D   .  C745 94 08000>mov dword ptr ss:[ebp-0x6C],0x8
004FEC74   .  FF15 38115000 call dword ptr ds:[<&MSVBVM50.__vbaVarDu>;  MSVBVM50.__vbaVarDup
004FEC7A   .  8D55 A4       lea edx,dword ptr ss:[ebp-0x5C]
004FEC7D   .  8D45 B4       lea eax,dword ptr ss:[ebp-0x4C]
004FEC80   .  52            push edx
004FEC81   .  8D4D C4       lea ecx,dword ptr ss:[ebp-0x3C]
004FEC84   .  50            push eax
004FEC85   .  51            push ecx
004FEC86   .  8D55 D4       lea edx,dword ptr ss:[ebp-0x2C]
004FEC89   .  6A 10         push 0x10
004FEC8B   .  52            push edx
004FEC8C   .  FF15 E0105000 call dword ptr ds:[<&MSVBVM50.#595>]     ;  MSVBVM50.rtcMsgBox

[004FEC18]里可以看出明文比较，10个“.”

有点可怕