1、无壳
2、OD载入
根据提示框确定按钮事件。0x00401127
00401127 > /6A 00 push 0x0 ; /lParam = 0
00401129 . |6A 00 push 0x0 ; |wParam = 0
0040112B . |6A 0E push 0xE ; |Message = WM_GETTEXTLENGTH
0040112D . |6A 03 push 0x3 ; |ControlID = 3
0040112F . |FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd
00401132 . |E8 41020000 call <jmp.&USER32.SendDlgItemMessageA> ; \SendDlgItemMessageA
00401137 . |A3 AF214000 mov dword ptr ds:[0x4021AF],eax ; 获取Name长度
0040113C . |83F8 00 cmp eax,0x0
0040113F . |0F84 D5000000 je DueList_.0040121A
00401145 . |83F8 08 cmp eax,0x8
00401148 . |0F8F CC000000 jg DueList_.0040121A
0040114E . |8BF0 mov esi,eax
00401150 . |6A 00 push 0x0 ; /lParam = 0
00401152 . |6A 00 push 0x0 ; |wParam = 0
00401154 . |6A 0E push 0xE ; |Message = WM_GETTEXTLENGTH
00401156 . |6A 04 push 0x4 ; |ControlID = 4
00401158 . |FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd
0040115B . |E8 18020000 call <jmp.&USER32.SendDlgItemMessageA> ; \SendDlgItemMessageA
00401160 . |83F8 00 cmp eax,0x0 ; 获取Serial长度
00401163 . |0F84 B1000000 je DueList_.0040121A
00401169 . |3BF0 cmp esi,eax
0040116B . |0F85 A9000000 jnz DueList_.0040121A
00401171 . |68 60214000 push DueList_.00402160 ; /lParam = 402160
00401176 . |6A 08 push 0x8 ; |wParam = 8
00401178 . |6A 0D push 0xD ; |Message = WM_GETTEXT
0040117A . |6A 03 push 0x3 ; |ControlID = 3
0040117C . |FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd
0040117F . |E8 F4010000 call <jmp.&USER32.SendDlgItemMessageA> ; \SendDlgItemMessageA
00401184 . |68 79214000 push DueList_.00402179 ; /lParam = 402179
00401189 . |6A 10 push 0x10 ; |wParam = 10
0040118B . |6A 0D push 0xD ; |Message = WM_GETTEXT
0040118D . |6A 04 push 0x4 ; |ControlID = 4
0040118F . |FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd
00401192 . |E8 E1010000 call <jmp.&USER32.SendDlgItemMessageA> ; \SendDlgItemMessageA
00401197 . |B9 FFFFFFFF mov ecx,-0x1
0040119C > |41 inc ecx
0040119D . |0FBE81 602140>movsx eax,byte ptr ds:[ecx+0x402160]
004011A4 . |83F8 00 cmp eax,0x0 ; Switch (cases 0..7A)
004011A7 . |74 32 je XDueList_.004011DB
004011A9 . |BE FFFFFFFF mov esi,-0x1
004011AE . |83F8 41 cmp eax,0x41
004011B1 . |7C 67 jl XDueList_.0040121A
004011B3 . |83F8 7A cmp eax,0x7A
004011B6 . |77 62 ja XDueList_.0040121A ; 'A' ~ 'z'
004011B8 . |83F8 5A cmp eax,0x5A
004011BB . |7C 03 jl XDueList_.004011C0
004011BD . |83E8 20 sub eax,0x20 ; Cases 5A ('Z'),5B ('['),5C ('\'),5D (']'),5E ('^'),5F ('_'),60 ('`'),61 ('a'),62 ('b'),63 ('c'),64 ('d'),65 ('e'),66 ('f'),67 ('g'),68 ('h'),69 ('i'),6A ('j'),6B ('k'),6C ('l'),6D ('m')... of switch 004011A4
004011C0 > |46 inc esi ; Cases 41 ('A'),42 ('B'),43 ('C'),44 ('D'),45 ('E'),46 ('F'),47 ('G'),48 ('H'),49 ('I'),4A ('J'),4B ('K'),4C ('L'),4D ('M'),4E ('N'),4F ('O'),50 ('P'),51 ('Q'),52 ('R'),53 ('S'),54 ('T')... of switch 004011A4
004011C1 . |0FBE96 172040>movsx edx,byte ptr ds:[esi+0x402017]
004011C8 . |3BC2 cmp eax,edx
004011CA .^|75 F4 jnz XDueList_.004011C0
004011CC . |0FBE86 3C2040>movsx eax,byte ptr ds:[esi+0x40203C]
004011D3 . |8981 94214000 mov dword ptr ds:[ecx+0x402194],eax
004011D9 .^|EB C1 jmp XDueList_.0040119C
004011DB > |FF35 AF214000 push dword ptr ds:[0x4021AF] ; Case 0 of switch 004011A4
004011E1 . |68 94214000 push DueList_.00402194 ; ASCII "S4S"
004011E6 . |68 79214000 push DueList_.00402179 ; ASCII "S4S"
004011EB . |E8 54000000 call DueList_.00401244 ; strcmp()
004011F0 . |83F8 01 cmp eax,0x1
004011F3 .^|0F84 DEFEFFFF je DueList_.004010D7
004011F9 . |EB 1F jmp XDueList_.0040121A
004011FB > |837D 10 01 cmp dword ptr ss:[ebp+0x10],0x1 ; |
004011FF .^\0F84 22FFFFFF je DueList_.00401127 ; |Check按钮事件
00401205 . 837D 10 02 cmp dword ptr ss:[ebp+0x10],0x2 ; |
00401209 . 75 2F jnz XDueList_.0040123A ; |
0040120B > E8 B4000000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
00401210 . B8 01000000 mov eax,0x1
00401215 .^ E9 FFFEFFFF jmp DueList_.00401119
Name表地址,0x00402017
Serial表地址,0x0040203C
3、注册机
N = 'A1LSK2DJF4HGP3QWO5EIR6UTYZ8MXN7CBV9'
S = 'SU7CSJKF09NCSDO9SDF09SDRLVK7809S4NF'
D = {}
for i in range(len(N)):
D[N[i]] = S[i]
Name = input('Name:')
for i in Name:
print(D[i], end='')