新160个crackme -086-crackme_0007

运行分析

• 需要破解Name和Serial

---

PE分析

• ASM程序，32位，无壳

---

静态分析&动态调试

• ida找到关键字符串

---

• ida动态调试进行分析，逻辑是获取Serial和Name，经过13个判断函数，若全部满足要求，则返回成功，需要对13个函数逐一分析

---

• func1：Serial[0] = ‘H’
• func2：Serial[1] = ‘T’
• func3：Serial[2] = ‘-’
• func4：Serial[2] = ‘7’

---

• func5：Serial[4] + Serial[6] = Serial[9] + Serial[10]
• func6：Serial[5] = (Name每个字符ascii值的和)/len(Name)
• func7：Serial[7] + Serial[8] = Name[1] + Name[-2]
• func8：(Serial[9]+Serial[10]) % 2== 0

---

• func9：len(Name) % 3 = 0
• func10：(Serial[12]+Serial[5]) % 2== 1
• func12：len(Name) + Serial[12] + Serial[13] + Serial[14] = 266
• func13：Serial[15] = Name[-2]

---

算法分析

Name = 'concealbear1'

Serial = [0] * 16
n = 0
for i in range(len(Name)):
    n = (n + ord(Name[i]))

Serial[0] = 'H'
Serial[1] = 'T'
Serial[2] = '-'
Serial[3] = '7'
Serial[4] = 'a'
Serial[5] = chr(n // len(Name))
Serial[6] = 'a'
Serial[7] = Name[1]
Serial[8] = Name[-2]
Serial[9] = 'a'
Serial[10] = 'a'
Serial[11] = 'a'
Serial[12] = chr(ord(Serial[5]) + 1)
Serial[13] = chr((266 - len(Name) - ord(Serial[12])) // 2)
Serial[14] = chr(266 - len(Name) - ord(Serial[12]) - ord(Serial[13]))
Serial[15] = Name[-2]

print(Name + '的Serial为：\n' + ''"".join(Serial))

• 验证成功