MessageBox(“Make me think your HD is a CD-Rom.”)->GetDriveType(“C:\”)->MessageBox(“Nah… This is not a CD-ROM Drive!”) or MessageBox(“OK,I really think that your HD is a CD-ROM!:p”)
在消息窗口按确定后,程序会调用GetDriveType()API,获取C盘驱动器的类型,大部分返回的是HDD类型,我们要做的就是操作它,使之被识别为CD-ROM类型,再在消息窗口中输出“OK,I really think that your HD is a CD-ROM!:p”。
分析
00401024 |. 3BC6 CMP EAX,ESI
00401026 |. 74 15 JE SHORT abexcm1-.0040103D
运行abex’ crackme运行点击确定按钮程序弹出Error按钮就终止运行了,下面直接调试分析它。用Olldbg调试EP代码非常短,与我们前面分析的HelloWorld有非常大的不同,这是因为abex’ crackme程序是使用汇编语言编写出来的可执行文件。函数调用顺序.MessageBox(“Make me think your HD is a CD-Rom.”)->GetDriveType(“C:\”)->MessageBox(“Nah… This is n