新160个crackme - 038-Eternal Bliss.3

运行分析

• 需要输入注册码

---

PE分析

• VB程序，32位，无壳

---

静态分析&动态调试

• 使用VB Decompiler静态分析，找到关键函数入口点402AC4

---

• ida跳转至402AC4，按F5反汇编，发现有407行代码，配合VB Decompiler得到的代码耐心分析
  
• 首先在137行得到var_44 = 101
  
• 动调至212行，发现v19 = 0x2DC

---

Private Sub Command1_Click() '402AC4
  Dim var_138 As Variant
  loc_00402B19: On Error GoTo loc_00403491
  loc_00402B93: Serial_1 = Serial
  loc_00402B9B: serial_2 = Serial_1
  loc_00402C27: For i = 1 To Len(Serial_1) Step 1           'serial每个字符ascii码乘2的值相加,最终值重命名为serial_sum
  loc_00402C2C:   var_184 = i
  loc_00402C42:   GoTo loc_00402D83
  loc_00402C77:   serial_1 = Serial
  loc_00402C7F:   serial_2 = serial_1
  loc_00402D21:   serial_i = Asc(CStr(Mid(serial_1, CLng(i), 1)))    
  loc_00402D2C:   serial_sum = serial_sum + serial_i
  loc_00402D34:   serial_sum = serial_sum + serial_i        '错误代码，删除
  loc_00402D78: Next i
  loc_00402D7D: var_184 = Next i
  loc_00402D83: ' Referenced from: 00402C42
  loc_00402D8A: If var_184 Then GoTo loc_00402C47
  loc_00402D93: var_20 = var_20 + var_44                  '通过动调得到var_44 = 0x65
  loc_00402D9C: var_20+var_44 = var_20+var_44 + var_50
  loc_00402DA5: var_20+var_44+var_50 = var_20+var_44+var_50 + var_44
  loc_00402DAE: var_20+var_44+var_50+var_44 = var_20+var_44+var_50+var_44 + var_34
  loc_00402DB7: var_20+var_44+var_50+var_44+var_34 = var_20+var_44+var_50+var_44+var_34 + var_3C
  loc_00402DD2: If serial_sum = var_20+var_44+var_50+var_44+var_34+var_3C+var_44 Then       '条件1：serial_sum要等于固定值，通过动调得到固定值为0x2dc
  loc_00402E08:   serial_1 = Serial
  loc_00402E10:   serial_2 = serial_1
  loc_00402E79:   serial_3 = Serial
  loc_00402E81:   serial_4 = serial_3
  loc_00402EEA:   serial_5 = Serial
  loc_00402EF2:   serial_6 = serial_5
  loc_00403090:   var_150 = (((Asc(CStr(Mid(serial_1, 2, 1))) - var_44) + 1 And (Asc(CStr(Mid(serial_3, 4, 1))) - var_44) + 1) And (Asc(CStr(Mid(serial_5, 7, 1))) - var_44) + 1)       '条件2：serial第2、4、7的ascii码值=var_44=0x65,即字母'e'
  loc_00403115:   If var_150 Then
  loc_0040313E:     var_48 = var_48 * var_20 * var_44
  loc_00403147:     If var_48 = var_4C Then               '动调得到var_48和var_4C为固定值，一定相等       
  loc_00403165:       var_138 = Form1.Text1
  loc_0040317E:       var_138.Text = "You have cracked it!!"
  loc_00403186:       serial_2 = var_138
  loc_004031DF:       var_138 = Form1.Text1
  loc_004031F5:       var_138.Enabled = False
  loc_004031FD:       serial_2 = var_138
  loc_00403256:       var_138 = Form1.Command1
  loc_0040326C:       var_138.Visible = False
  loc_00403274:       serial_2 = var_138
  loc_004032CD:       var_138 = Form1.Command3
  loc_004032E3:       var_138.Visible = True
  loc_004032EB:       serial_2 = var_138
  loc_00403344:       var_138 = Form1.Command3
  loc_0040335A:       var_138.Enabled = True
  loc_00403362:       serial_2 = var_138
  loc_004033BB:       var_138 = Form1.Command3
  loc_004033D4:       var_138.Caption = "&Again!"
  loc_004033D9:       serial_2 = var_138
  loc_0040342F:       var_138 = Form1.Command2
  loc_00403443:       var_138.SetFocus
  loc_0040344B:       serial_2 = var_138.SetFocus
  loc_00403491:     Else
  loc_00403491:     End If
  loc_00403491:   End If
  loc_004034A9:   var_138 = Form1.Text1
  loc_004034C2:   var_138.Text = "Wrong! Try Again!!"
  loc_004034CA:   serial_2 = var_138
  loc_00403523:   var_138 = Form1.Text1
  loc_00403539:   var_138.Enabled = False
  loc_00403541:   serial_2 = var_138
  loc_0040359A:   var_138 = Form1.Command1
  loc_004035B0:   var_138.Visible = False
  loc_004035B8:   serial_2 = var_138
  loc_00403611:   var_138 = Form1.Command3
  loc_00403627:   var_138.Visible = True
  loc_0040362F:   serial_2 = var_138
  loc_00403688:   var_138 = Form1.Command3
  loc_0040369E:   var_138.Enabled = True
  loc_004036A6:   serial_2 = var_138
  loc_004036FF:   var_138 = Form1.Command3
  loc_00403713:   var_138.SetFocus
  loc_0040371B:   serial_2 = var_138.SetFocus
  loc_0040375C: End If
  loc_0040375C: Exit Sub
  loc_00403766: GoTo loc_004037ED
  loc_004037EC: Exit Sub
  loc_004037ED: ' Referenced from: 00403766
End Sub

• 对VB Decompiler得到的代码进行分析，满足正确Serial需满足以下条件：
• 1、将serial每个字符ascii码的值相加，最终值为serial_sum = v19 = 0x2dc
• 2、serial第2、4、7的ascii码值 = var_44=0x65，即字母’e’

算法分析

for serial_0 in range(33,127):
    for serial_2 in range(33,127):
        for serial_4 in range(33, 127):
            for serial_5 in range(33, 127):
                serial = chr(serial_0) + 'e' + chr(serial_2) + 'e' + chr(serial_4) + chr(serial_5) + 'e'
                serial_sum = 0
                for i in range(len(serial)):
                    serial_sum += ord(serial[i])
                if serial_sum == 0x2dc:
                    print('正确Serial为：' + serial)

• 仅考虑serial为7位的情况
• 仅考虑可见字符，即ascii码为33~127

---

• 跑了几分钟，得到76076个结果

---

• 随便找几个测试，验证成功