CrackMe等级自测(3)

今天早上看到这个CrackMe等级自测，直接来试试等级三好了(刚才看了看等级2的，比较弱智，那等级1可想而知了)

打开一下，发现没有注册按钮，拿资源工具把按钮调出来就行，只是隐藏了而已

如果觉得这样很不爽，是投机取巧的话，你也可以到DeDe里面找，找到编辑框变化事件的代码就行了，我试过了，也行的~

以下是注册按钮的代码

00430E10  /.  55                push    ebp
00430E11  |.  8BEC              mov     ebp, esp
00430E13  |.  6A 00             push    0
00430E15  |.  6A 00             push    0
00430E17  |.  53                push    ebx
00430E18  |.  8BD8              mov     ebx, eax
00430E1A  |.  33C0              xor     eax, eax
00430E1C  |.  55                push    ebp
00430E1D  |.  68 AF0F4300       push    00430FAF
00430E22  |.  64:FF30           push    dword ptr fs:[eax]
00430E25  |.  64:8920           mov     dword ptr fs:[eax], esp
00430E28  |.  8D55 FC           lea     edx, dword ptr [ebp-4]
00430E2B  |.  8B83 E4010000     mov     eax, dword ptr [ebx+1E4]
00430E31  |.  E8 EA85FEFF       call    <获取字符串>
00430E36  |.  8B45 FC           mov     eax, dword ptr [ebp-4]           ;  [952BD0]=username
00430E39  |.  E8 962AFDFF       call    <获取字符串大小>
00430E3E  |.  83F8 06           cmp     eax, 6
00430E41  |.  7D 16             jge     short 00430E59                   ;  用户名>=6个字符
00430E43  |.  68 30200000       push    2030                             ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_TASKMODAL
00430E48  |.  68 BC0F4300       push    00430FBC                         ; |Title = "No valid name!"
00430E4D  |.  68 CC0F4300       push    00430FCC                         ; |Text = "Your name must be at least 6 characters long"
00430E52  |.  6A 00             push    0                                ; |hOwner = NULL
00430E54  |.  E8 FB48FDFF       call    <jmp.&user32.MessageBoxA>        ; \MessageBoxA
00430E59  |>  8D55 FC           lea     edx, dword ptr [ebp-4]           ;  username
00430E5C  |.  8B83 E4010000     mov     eax, dword ptr [ebx+1E4]
00430E62  |.  E8 B985FEFF       call    <获取字符串>
00430E67  |.  8B45 FC           mov     eax, dword ptr [ebp-4]
00430E6A  |.  E8 652AFDFF       call    <获取字符串大小>
00430E6F  |.  83F8 06           cmp     eax, 6
00430E72  |.  7C 2A             jl      short 00430E9E
00430E74  |.  8D55 FC           lea     edx, dword ptr [ebp-4]
00430E77  |.  8B83 DC010000     mov     eax, dword ptr [ebx+1DC]
00430E7D  |.  E8 9E85FEFF       call    <获取字符串>                          ;  [956820]=password
00430E82  |.  837D FC 00        cmp     dword ptr [ebp-4], 0
00430E86  |.  75 16             jnz     short 00430E9E
00430E88  |.  68 30200000       push    2030                             ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_TASKMODAL
00430E8D  |.  68 FC0F4300       push    00430FFC                         ; |Title = "No valid code!"
00430E92  |.  68 0C104300       push    0043100C                         ; |Text = "You must enter a registration code"
00430E97  |.  6A 00             push    0                                ; |hOwner = NULL
00430E99  |.  E8 B648FDFF       call    <jmp.&user32.MessageBoxA>        ; \MessageBoxA
00430E9E  |>  8D55 FC           lea     edx, dword ptr [ebp-4]
00430EA1  |.  8B83 E4010000     mov     eax, dword ptr [ebx+1E4]
00430EA7  |.  E8 7485FEFF       call    <获取字符串>
00430EAC  |.  8B45 FC           mov     eax, dword ptr [ebp-4]
00430EAF  |.  E8 202AFDFF       call    <获取字符串大小>
00430EB4  |.  83F8 06           cmp     eax, 6
00430EB7  |.  0F8C D4000000     jl      00430F91
00430EBD  |.  8D55 FC           lea     edx, dword ptr [ebp-4]
00430EC0  |.  8B83 DC010000     mov     eax, dword ptr [ebx+1DC]
00430EC6  |.  E8 5585FEFF       call    <获取字符串>
00430ECB  |.  837D FC 00        cmp     dword ptr [ebp-4], 0
00430ECF  |.  0F84 BC000000     je      00430F91
00430ED5  |.  E8 A6010000       call    00431080                         ;  这个call产生注册码
00430EDA  |.  8D55 FC           lea     edx, dword ptr [ebp-4]
00430EDD  |.  8B83 DC010000     mov     eax, dword ptr [ebx+1DC]
00430EE3  |.  E8 3885FEFF       call    <获取字符串>
00430EE8  |.  8B45 FC           mov     eax, dword ptr [ebp-4]
00430EEB  |.  50                push    eax                              ;  password
00430EEC  |.  8D55 F8           lea     edx, dword ptr [ebp-8]
00430EEF  |.  A1 A4474300       mov     eax, dword ptr [4347A4]          ;  what the fuck
00430EF4  |.  E8 5757FDFF       call    00406650
00430EF9  |.  8B55 F8           mov     edx, dword ptr [ebp-8]
00430EFC  |.  58                pop     eax
00430EFD  |.  E8 E22AFDFF       call    004039E4
00430F02  |.  0F85 89000000     jnz     00430F91
00430F08  |.  68 40200000       push    2040                             ; /Style = MB_OK|MB_ICONASTERISK|MB_TASKMODAL
00430F0D  |.  68 30104300       push    00431030                         ; |Title = "You're now registered!"
00430F12  |.  68 48104300       push    00431048                         ; |Text = "Thank you for registering..."
00430F17  |.  6A 00             push    0                                ; |hOwner = NULL
00430F19  |.  E8 3648FDFF       call    <jmp.&user32.MessageBoxA>        ; \MessageBoxA

注册码出来的函数：

00431080  /$  55                push    ebp
00431081  |.  8BEC              mov     ebp, esp
00431083  |.  6A 00             push    0
00431085  |.  6A 00             push    0
00431087  |.  53                push    ebx
00431088  |.  56                push    esi
00431089  |.  BB A4474300       mov     ebx, 004347A4
0043108E  |.  BE A8474300       mov     esi, 004347A8
00431093  |.  33C0              xor     eax, eax
00431095  |.  55                push    ebp
00431096  |.  68 01124300       push    00431201
0043109B  |.  64:FF30           push    dword ptr fs:[eax]
0043109E  |.  64:8920           mov     dword ptr fs:[eax], esp
004310A1  |.  33C0              xor     eax, eax
004310A3  |.  8903              mov     dword ptr [ebx], eax
004310A5  |.  8D55 FC           lea     edx, dword ptr [ebp-4]
004310A8  |.  A1 98474300       mov     eax, dword ptr [434798]
004310AD  |.  8B80 E4010000     mov     eax, dword ptr [eax+1E4]
004310B3  |.  E8 6883FEFF       call    <获取字符串>
004310B8  |.  B8 01000000       mov     eax, 1
004310BD  |>  8B55 FC           /mov     edx, dword ptr [ebp-4]
004310C0  |.  0FB65402 FF       |movzx   edx, byte ptr [edx+eax-1]
004310C5  |.  0113              |add     dword ptr [ebx], edx
004310C7  |.  40                |inc     eax
004310C8  |.  83F8 07           |cmp     eax, 7
004310CB  |.^ 75 F0             \jnz     short 004310BD                  ;  ASCII码加起来放到[4347A4]
004310CD  |.  8B45 FC           mov     eax, dword ptr [ebp-4]
004310D0  |.  E8 FF27FDFF       call    <获取字符串大小>
004310D5  |.  0103              add     dword ptr [ebx], eax             ;  再加username大小
004310D7  |.  6903 0EC11500     imul    eax, dword ptr [ebx], 15C10E     ;  再乘15C10E
004310DD  |.  8903              mov     dword ptr [ebx], eax
004310DF  |.  8B03              mov     eax, dword ptr [ebx]
004310E1  |.  B9 03000000       mov     ecx, 3
004310E6  |.  99                cdq
004310E7  |.  F7F9              idiv    ecx                              ;  再除以3
004310E9  |.  8903              mov     dword ptr [ebx], eax
004310EB  |.  8103 9A020000     add     dword ptr [ebx], 29A             ;  再加29A
004310F1  |.  8B03              mov     eax, dword ptr [ebx]
004310F3  |.  B9 88130000       mov     ecx, 1388
004310F8  |.  99                cdq
004310F9  |.  F7F9              idiv    ecx                              ;  再除以1388
004310FB  |.  8903              mov     dword ptr [ebx], eax
004310FD  |.  8B45 FC           mov     eax, dword ptr [ebp-4]
00431100  |.  E8 CF27FDFF       call    <获取字符串大小>
00431105  |.  F72B              imul    dword ptr [ebx]                  ;  再乘以userpass的大小
00431107  |.  8903              mov     dword ptr [ebx], eax
00431109  |.  8B45 FC           mov     eax, dword ptr [ebp-4]
0043110C  |.  0FB640 02         movzx   eax, byte ptr [eax+2]
00431110  |.  F72B              imul    dword ptr [ebx]                  ;  再乘以第三个字母
00431112  |.  8903              mov     dword ptr [ebx], eax
00431114  |.  8B45 FC           mov     eax, dword ptr [ebp-4]
00431117  |.  0FB640 04         movzx   eax, byte ptr [eax+4]
0043111B  |.  F72B              imul    dword ptr [ebx]                  ;  再乘以第四个字母
0043111D  |.  8903              mov     dword ptr [ebx], eax
0043111F  |.  813B FFE0F505     cmp     dword ptr [ebx], 5F5E0FF
00431125  |.  7E 08             jle     short 0043112F                   ;  <5F5E0FF则跳
00431127  |.  813B 00CA9A3B     cmp     dword ptr [ebx], 3B9ACA00
0043112D  |.  7C 31             jl      short 00431160                   ;  <3B9ACA00则跳
0043112F  |>  8B45 FC           /mov     eax, dword ptr [ebp-4]          ;  这里的循环同上面都是对同一个值(不知道怎么称呼，不妨叫MagicNumber吧)操作，写注册机的时候再详细看吧
00431132  |.  E8 9D27FDFF       |call    <获取字符串大小>
00431137  |.  0103              |add     dword ptr [ebx], eax
00431139  |.  8B45 FC           |mov     eax, dword ptr [ebp-4]
0043113C  |.  0FB600            |movzx   eax, byte ptr [eax]
0043113F  |.  F72B              |imul    dword ptr [ebx]
00431141  |.  8903              |mov     dword ptr [ebx], eax
00431143  |.  833B 00           |cmp     dword ptr [ebx], 0
00431146  |.  7D 08             |jge     short 00431150
00431148  |.  8B03              |mov     eax, dword ptr [ebx]
0043114A  |.  8BD0              |mov     edx, eax
0043114C  |.  F7D8              |neg     eax
0043114E  |.  8903              |mov     dword ptr [ebx], eax
00431150  |>  813B FFE0F505     |cmp     dword ptr [ebx], 5F5E0FF
00431156  |.^ 7E D7             |jle     short 0043112F
00431158  |.  813B 00CA9A3B     |cmp     dword ptr [ebx], 3B9ACA00
0043115E  |.^ 7D CF             \jge     short 0043112F
00431160  |>  8B03              mov     eax, dword ptr [ebx]
00431162  |.  8906              mov     dword ptr [esi], eax
00431164  |>  8B45 FC           /mov     eax, dword ptr [ebp-4]
00431167  |.  E8 6827FDFF       |call    <获取字符串大小>
0043116C  |.  50                |push    eax
0043116D  |.  8B06              |mov     eax, dword ptr [esi]
0043116F  |.  5A                |pop     edx
00431170  |.  8BCA              |mov     ecx, edx
00431172  |.  99                |cdq
00431173  |.  F7F9              |idiv    ecx                             ;  MagicNumber/username大小
00431175  |.  8906              |mov     dword ptr [esi], eax
00431177  |.  813E 10270000     |cmp     dword ptr [esi], 2710
0043117D  |.  7D 06             |jge     short 00431185                  ;  大于等于2710则跳
0043117F  |.  8B06              |mov     eax, dword ptr [esi]
00431181  |.  F7E8              |imul    eax
00431183  |.  8906              |mov     dword ptr [esi], eax
00431185  |>  813E 0F270000     |cmp     dword ptr [esi], 270F
0043118B  |.^ 7E D7             |jle     short 00431164                  ;  在此范围[2710,270F]内则往回跳
0043118D  |.  813E A0860100     |cmp     dword ptr [esi], 186A0
00431193  |.^ 7D CF             \jge     short 00431164                  ;  要除到小于这个数才能出循环
00431195  |.  8D55 F8           lea     edx, dword ptr [ebp-8]           ;  dword buffer
00431198  |.  8B03              mov     eax, dword ptr [ebx]             ;  Magic Number
0043119A  |.  E8 B154FDFF       call    00406650                         ;  往buffer里面塞一个地址，指向Magic Number的十进制形式
0043119F  |.  8B55 F8           mov     edx, dword ptr [ebp-8]           ;  然后输入这个为密码就显示成功了，就是说后面的call都是比较了
004311A2  |.  A1 98474300       mov     eax, dword ptr [434798]          ;  完

经验：

挺简单的CrackMe，但是有一个问题就是库函数会把人给逼疯~~ 但是单纯去拿个插件来识别，甚至是自己写个插件去识别都只是方便一时而已，要根本地提升逆向能力就要去把一些VC,Delphi里的库函数自己逆向一下！