CrackMe160-0x04

---

title: CrackMe160_0x04
date: 2021-05-10 19:55:41
tags:

CrackMe160

轮流做题

---

18 Brad Soblesky.1.exe

查壳

打开运行试试：

所以发现有弹窗，而且没壳，那我们就可以试着去看看关键的地方。

然后在里面的时候意外发现了这个：

然后试了一下，好像是的。。。

注册码就是里面进行比较的一个字符串。

<BrD-SoB>

这个在函数里面蹦出来的。

函数如下：

00401512  /.  55            push ebp
00401513  |.  8BEC          mov ebp,esp
00401515  |.  83EC 20       sub esp,0x20
00401518  |.  894D E0       mov [local.8],ecx
0040151B  |.  66:A1 5C31400>mov ax,word ptr ds:[0x40315C]
00401521  |.  66:8945 F4    mov word ptr ss:[ebp-0xC],ax
00401525  |.  33C9          xor ecx,ecx
00401527  |.  894D F6       mov dword ptr ss:[ebp-0xA],ecx
0040152A  |.  894D FA       mov dword ptr ss:[ebp-0x6],ecx
0040152D  |.  8B15 20304000 mov edx,dword ptr ds:[0x403020]
00401533  |.  8955 E4       mov [local.7],edx
00401536  |.  A1 24304000   mov eax,dword ptr ds:[0x403024]
0040153B  |.  8945 E8       mov [local.6],eax
0040153E  |.  66:8B0D 28304>mov cx,word ptr ds:[0x403028]
00401545  |.  66:894D EC    mov word ptr ss:[ebp-0x14],cx
00401549  |.  6A 0A         push 0xA
0040154B  |.  8D55 F4       lea edx,[local.3]
0040154E  |.  52            push edx
0040154F  |.  68 E8030000   push 0x3E8
00401554  |.  8B4D E0       mov ecx,[local.8]
00401557  |.  E8 A8050000   call <jmp.&MFC42.#CWnd::GetDlgItemTextA_>
0040155C  |.  8D45 F4       lea eax,[local.3]
0040155F  |.  50            push eax                                 ; /String = 00000005 ???
00401560  |.  FF15 04204000 call dword ptr ds:[<&KERNEL32.lstrlenA>] ; \lstrlenA
00401566  |.  8945 F0       mov [local.4],eax
00401569  |.  837D F0 01    cmp [local.4],0x1
0040156D  |.  73 16         jnb short Brad_Sob.00401585
0040156F  |.  6A 40         push 0x40
00401571  |.  68 2C304000   push Brad_Sob.0040302C                   ;  ASCII "CrackMe"
00401576  |.  68 34304000   push Brad_Sob.00403034                   ;  ASCII "Enter Registration Number"
0040157B  |.  8B4D E0       mov ecx,[local.8]
0040157E  |.  E8 7B050000   call <jmp.&MFC42.#CWnd::MessageBoxA_4224>
00401583  |.  EB 3C         jmp short Brad_Sob.004015C1
00401585  |>  8D4D E4       lea ecx,[local.7]
00401588  |.  51            push ecx                                 ; /String2 = "<BrD-SoB>"
00401589  |.  8D55 F4       lea edx,[local.3]                        ; |
0040158C  |.  52            push edx                                 ; |String1 = "1212"
0040158D  |.  FF15 00204000 call dword ptr ds:[<&KERNEL32.lstrcmpA>] ; \lstrcmpA
00401593  |.  85C0          test eax,eax
00401595      75 16         jnz short Brad_Sob.004015AD
00401597  |.  6A 40         push 0x40
00401599  |.  68 50304000   push Brad_Sob.00403050                   ;  ASCII "CrackMe"
0040159E  |.  68 58304000   push Brad_Sob.00403058                   ;  ASCII "Correct way to go!!"
004015A3  |.  8B4D E0       mov ecx,[local.8]
004015A6  |.  E8 53050000   call <jmp.&MFC42.#CWnd::MessageBoxA_4224>
004015AB  |.  EB 14         jmp short Brad_Sob.004015C1
004015AD  |>  6A 40         push 0x40
004015AF  |.  68 6C304000   push Brad_Sob.0040306C                   ;  ASCII "CrackMe"
004015B4  |.  68 74304000   push Brad_Sob.00403074                   ;  ASCII "Incorrect try again!!"
004015B9  |.  8B4D E0       mov ecx,[local.8]
004015BC  |.  E8 3D050000   call <jmp.&MFC42.#CWnd::MessageBoxA_4224>
004015C1  |>  8BE5          mov esp,ebp
004015C3  |.  5D            pop ebp                                  ;  0019FE34
004015C4  \.  C3            retn

这个就有点没想到了。hhh

---

19 Brad Soblesky.2

查壳

没有发现壳的踪迹，运行试试。