160 - 36 cupofcoffe.2

环境
Winows xp sp3

工具
1.exeinfo PE
2.ollydbg

查壳
OD载入后看出是VB程序

测试
输入：12345678

继续OD搜字符串：

00521688   .  68 60054500   push cupofcof.00450560                   ;  UNICODE ".........."
0052168D   .  FF15 F8405200 call dword ptr ds:[<&MSVBVM50.__vbaStrCm>;  MSVBVM50.__vbaStrCmp
00521693   .  8BF0          mov esi,eax
00521695   .  8D4D E8       lea ecx,dword ptr ss:[ebp-0x18]
00521698   .  F7DE          neg esi
0052169A   .  1BF6          sbb esi,esi
0052169C   .  F7DE          neg esi
0052169E   .  F7DE          neg esi
005216A0   .  FF15 4C415200 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>;  MSVBVM50.__vbaFreeStr
005216A6   .  8D4D E4       lea ecx,dword ptr ss:[ebp-0x1C]
005216A9   .  FF15 50415200 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  MSVBVM50.__vbaFreeObj
005216AF   .  66:3BF7       cmp si,di
005216B2   .  74 6E         je Xcupofcof.00521722
005216B4   .  B9 04000280   mov ecx,0x80020004
005216B9   .  B8 0A000000   mov eax,0xA
005216BE   .  894D AC       mov dword ptr ss:[ebp-0x54],ecx
005216C1   .  894D BC       mov dword ptr ss:[ebp-0x44],ecx
005216C4   .  894D CC       mov dword ptr ss:[ebp-0x34],ecx
005216C7   .  8D55 94       lea edx,dword ptr ss:[ebp-0x6C]
005216CA   .  8D4D D4       lea ecx,dword ptr ss:[ebp-0x2C]
005216CD   .  8945 A4       mov dword ptr ss:[ebp-0x5C],eax
005216D0   .  8945 B4       mov dword ptr ss:[ebp-0x4C],eax
005216D3   .  8945 C4       mov dword ptr ss:[ebp-0x3C],eax
005216D6   .  C745 9C 7C054>mov dword ptr ss:[ebp-0x64],cupofcof.004>;  UNICODE "Incorrect password"
005216DD   .  C745 94 08000>mov dword ptr ss:[ebp-0x6C],0x8
005216E4   .  FF15 38415200 call dword ptr ds:[<&MSVBVM50.__vbaVarDu>;  MSVBVM50.__vbaVarDup
005216EA   .  8D55 A4       lea edx,dword ptr ss:[ebp-0x5C]
005216ED   .  8D45 B4       lea eax,dword ptr ss:[ebp-0x4C]
005216F0   .  52            push edx
005216F1   .  8D4D C4       lea ecx,dword ptr ss:[ebp-0x3C]
005216F4   .  50            push eax
005216F5   .  51            push ecx
005216F6   .  8D55 D4       lea edx,dword ptr ss:[ebp-0x2C]
005216F9   .  6A 10         push 0x10
005216FB   .  52            push edx
005216FC   .  FF15 E0405200 call dword ptr ds:[<&MSVBVM50.#595>]     ;  MSVBVM50.rtcMsgBox

[00521688]处明文比较，依旧是10个“.”。

还是这张图。。。