160个CrackMe 0x02 Afkayas_1

0x02 Afkayas_1

本来是写好了的但是这部分忘记保存导致丢失因此就简要写一下吧：

首先根据字符串找到判断位置：

单步运行可以找到对应abcd的serial:AKA-390221

下面分析一下算法：

004023F7   | 68 A0000000       | push A0                                      |
004023FC   | 68 5C1B4000       | push afkayas.1.401B5C                        |
00402401   | 53                | push ebx                                     |
00402402   | 50                | push eax                                     |
00402403   | FF15 04414000     | call dword ptr ds:[<&__vbaHresultCheckObj>]  |
00402409   | 8B95 50FFFFFF     | mov edx,dword ptr ss:[ebp-B0]                |
0040240F   | 8B45 E4           | mov eax,dword ptr ss:[ebp-1C]                | [ebp-1C]:L"abcd"
00402412   | 50                | push eax                                     |
00402413   | 8B1A              | mov ebx,dword ptr ds:[edx]                   |
00402415   | FF15 E4404000     | call dword ptr ds:[<&__vbaLenBstr>]          |
0040241B   | 8BF8              | mov edi,eax                                  |
0040241D   | 8B4D E8           | mov ecx,dword ptr ss:[ebp-18]                | [ebp-18]:L"abcd"
00402420   | 69FF FB7C0100     | imul edi,edi,17CFB                           |
00402426   | 51                | push ecx                                     |
00402427   | 0F80 91020000     | jo afkayas.1.4026BE                          |
0040242D   | FF15 F8404000     | call dword ptr ds:[<&rtcRightVar>]           |
00402433   | 0FBFD0            | movsx edx,ax                                 |
00402436   | 03FA              | add edi,edx                                  |
00402438   | 0F80 80020000     | jo afkayas.1.4026BE                          |
0040243E   | 57                | push edi                                     |
0040243F   | FF15 E0404000     | call dword ptr ds:[<&__vbaStrI4>]            |

总结一下就是

serial = hex2dec(strlen(name)*0x17CFB + name[0])