160CrackMe之001Acid burn

一.分析：

由此看出，需要解决的有两点，

     1： name  serial界面 输入相应的name和Serial，输入错误情况下提示：Sorry, The Serial is incorect !     

     2： serial界面中 输入正确的serial，输入错误的情况下提示：Try Again!!

二.查壳

我们知道了题目的要求后就可以进行下一步了，放到PEID中查壳：

没有加壳，是用Delphi写的。

三.破解

既然是用 Delphi写的，直接拖到Idr中查看， 看到name serial界面中只有两个点击事件，还有之前看到的提示字符串，可以肯定重要判断逻辑就在这里 ：

 点开第一个点击事件，浏览代码：

Unit1.TNS.BitBtn1Click
0042F998        push        ebp
0042F999        mov         ebp,esp
0042F99B        xor         ecx,ecx
0042F99D        push        ecx
0042F99E        push        ecx
0042F99F        push        ecx
0042F9A0        push        ecx
0042F9A1        push        ecx
0042F9A2        push        ecx
0042F9A3        push        ebx
0042F9A4        push        esi
0042F9A5        mov         ebx,eax
0042F9A7        xor         eax,eax
0042F9A9        push        ebp
0042F9AA        push        42FB67
0042F9AF        push        dword ptr fs:[eax]
0042F9B2        mov         dword ptr fs:[eax],esp
0042F9B5        mov         dword ptr ds:[431750],29;gvar_00431750:Integer
0042F9BF        lea         edx,[ebp-10]
0042F9C2        mov         eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042F9C8        call        TControl.GetText                    ；获取name
0042F9CD        mov         eax,dword ptr [ebp-10]
0042F9D0        call        @LStrToPChar
0042F9D5        mov         [0043176C],eax;gvar_0043176C:PChar
0042F9DA        lea         edx,[ebp-10]
0042F9DD        mov         eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042F9E3        call        TControl.GetText
0042F9E8        mov         eax,dword ptr [ebp-10]
0042F9EB        movzx       eax,byte ptr [eax]                  ；name[0]
0042F9EE        mov         esi,eax
0042F9F0        shl         esi,3                               ；name[0]*2^3
0042F9F3        sub         esi,eax                             ；a=name[0]*2^3-name[0]
0042F9F5        lea         edx,[ebp-14]
0042F9F8        mov         eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042F9FE        call        TControl.GetText
0042FA03        mov         eax,dword ptr [ebp-14]
0042FA06        movzx       eax,byte ptr [eax+1]                ；name[1]
0042FA0A        shl         eax,4                               ；b=name[1]*2^4
0042FA0D        add         esi,eax                             ；a+b
0042FA0F        mov         dword ptr ds:[431754],esi;gvar_00431754
0042FA15        lea         edx,[ebp-10]
0042FA18        mov         eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042FA1E        call        TControl.GetText
0042FA23        mov         eax,dword ptr [ebp-10]
0042FA26        movzx       eax,byte ptr [eax+3]                ;name[3]
0042FA2A        imul        esi,eax,0B                          ;c=name[3]*0xBh
0042FA2D        lea         edx,[ebp-14]
0042FA30        mov         eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042FA36        call        TControl.GetText
0042FA3B        mov         eax,dword ptr [ebp-14]
0042FA3E        movzx       eax,byte ptr [eax+2]                ;name[2]
0042FA42        imul        eax,eax,0E                          ;d=name[2]*0xEh
0042FA45        add         esi,eax                             ;c+d
0042FA47        mov         dword ptr ds:[431758],esi;gvar_00431758  
0042FA4D        mov         eax,[0043176C];gvar_0043176C:PChar  
0042FA52        call        StrLen
0042FA57        cmp         eax,4                               ;判断字符串长度是否大于4
0042FA5A>       jge         0042FA79                            ;大于4是继续
0042FA5C        push        0
0042FA5E        mov         ecx,42FB74;'Try Again!'             
0042FA63        mov         edx,42FB80;'Sorry , The serial is incorect !'
0042FA68        mov         eax,[00430A48];^Application:TApplication
0042FA6D        mov         eax,dword ptr [eax]
0042FA6F        call        TApplication.MessageBox
0042FA74>       jmp         0042FB37
0042FA79        lea         edx,[ebp-10]                    
0042FA7C        mov         eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042FA82        call        TControl.GetText
0042FA87        mov         eax,dword ptr [ebp-10]
0042FA8A        movzx       eax,byte ptr [eax]                            ；name[0]
0042FA8D        imul        dword ptr ds:[431750];gvar_00431750:Integer   ；name[0]*0x29h
0042FA93        mov         [00431750],eax;gvar_00431750:Integer
0042FA98        mov         eax,[00431750];gvar_00431750:Integer
0042FA9D        add         dword ptr ds:[431750],eax;gvar_00431750:Integer  ；e=name[0]*0x29h+name[0]*0x29h
0042FAA3        lea         eax,[ebp-4]
0042FAA6        mov         edx,42FBAC;'CW'
0042FAAB        call        @LStrLAsg                                     ；将‘CW’存储
0042FAB0        lea         eax,[ebp-8]
0042FAB3        mov         edx,42FBB8;'CRACKED'
0042FAB8        call        @LStrLAsg                                     ；将‘CRACKED’存储
0042FABD        push        dword ptr [ebp-4]                             ；‘CW’入栈                   
0042FAC0        push        42FBC8;'-'                                    ；‘_’入栈
0042FAC5        lea         edx,[ebp-18]
0042FAC8        mov         eax,[00431750];gvar_00431750:Integer  
0042FACD        call        IntToStr                                      ；将e转化为字符型
0042FAD2        push        dword ptr [ebp-18]
0042FAD5        push        42FBC8;'-'                                    ；‘—’入栈
0042FADA        push        dword ptr [ebp-8]                             ；‘CRACKED’入栈
0042FADD        lea         eax,[ebp-0C] 
0042FAE0        mov         edx,5
0042FAE5        call        @LStrCatN                                     ；字符串链接，即serial
0042FAEA        lea         edx,[ebp-10]
0042FAED        mov         eax,dword ptr [ebx+1E0];TNS.Edit2:TEdit
0042FAF3        call        TControl.GetText                              ;获取serial
0042FAF8        mov         edx,dword ptr [ebp-10] 
0042FAFB        mov         eax,dword ptr [ebp-0C]
0042FAFE        call        @LStrCmp                                      ;输入的serial和正确进行比较
0042FB03>       jne         0042FB1F                                      ；弹出错误提示
0042FB05        push        0
0042FB07        mov         ecx,42FBCC;'Congratz !!'                      ；弹出正确提示
0042FB0C        mov         edx,42FBD8;'Good job dude =)'
0042FB11        mov         eax,[00430A48];^Application:TApplication
0042FB16        mov         eax,dword ptr [eax]
0042FB18        call        TApplication.MessageBox
0042FB1D>       jmp         0042FB37
0042FB1F        push        0
0042FB21        mov         ecx,42FB74;'Try Again!'
0042FB26        mov         edx,42FB80;'Sorry , The serial is incorect !'
0042FB2B        mov         eax,[00430A48];^Application:TApplication

这段的算法是：

def serial_code(string):
    if len(string)<4:
        print 'Please input the length of name greater than 4 .'
    else:
        code=ord(string[0])*41*2
        print 'serial:CW-%d-CRACKED'%(code)
name=raw_input("Please input name:")
serial_code(name)

计算个serial：

 验证一下：

弹出正确的对话框，可以进行下一步，查看Serial界面：

同样点进判断点击事件内查看代码：

Unit3.Tserial.button1Click
0042F470        push        ebp
0042F471        mov         ebp,esp
0042F473        xor         ecx,ecx
0042F475        push        ecx
0042F476        push        ecx
0042F477        push        ecx
0042F478        push        ecx
0042F479        push        ebx
0042F47A        mov         ebx,eax
0042F47C        xor         eax,eax
0042F47E        push        ebp
0042F47F        push        42F52C
0042F484        push        dword ptr fs:[eax]
0042F487        mov         dword ptr fs:[eax],esp
0042F48A        lea         eax,[ebp-4]
0042F48D        mov         edx,42F540;'Hello'                              
0042F492        call        @LStrLAsg                                         ；存储'Hello'
0042F497        lea         eax,[ebp-8]
0042F49A        mov         edx,42F550;'Dude!'                                ；存储'Dude!'
0042F49F        call        @LStrLAsg
0042F4A4        push        dword ptr [ebp-4]                                 ;'Hello'入栈
0042F4A7        push        42F560;' '                                        ；' '入栈
0042F4AC        push        dword ptr [ebp-8]                                 ;'Dude!'入栈
0042F4AF        lea         eax,[ebp-0C]
0042F4B2        mov         edx,3
0042F4B7        call        @LStrCatN                                         ；拼接字符串：Hello Dude!
0042F4BC        lea         edx,[ebp-10]
0042F4BF        mov         eax,dword ptr [ebx+1E0];Tserial.Edit1:TEdit
0042F4C5        call        TControl.GetText                                  ;获取Sreial
0042F4CA        mov         eax,dword ptr [ebp-10]
0042F4CD        mov         edx,dword ptr [ebp-0C]
0042F4D0        call        @LStrCmp                                          ;输入的Serial与Hello Dude!进行比较
0042F4D5>       jne         0042F4F1                                          ;输入错误，弹出错误提示
0042F4D7        push        0
0042F4D9        mov         ecx,42F564;'Congratz!'
0042F4DE        mov         edx,42F570;'God Job dude !! =)'
0042F4E3        mov         eax,[00430A48];^Application:TApplication
0042F4E8        mov         eax,dword ptr [eax]
0042F4EA        call        TApplication.MessageBox
0042F4EF>       jmp         0042F509
0042F4F1        push        0
0042F4F3        mov         ecx,42F584;'Failed!'
0042F4F8        mov         edx,42F58C;'Try Again!!'
0042F4FD        mov         eax,[00430A48];^Application:TApplication
0042F502        mov         eax,dword ptr [eax]
0042F504        call        TApplication.MessageBox

这个界面的判断就很简单了，Serial是固定的“ Hello Dude! ”：

这两个界面就算完成破解了，这时发现刚开始弹出的对话框也是要Kill的：

 进入主界面查看代码：

Unit2.Tindex.FormCreate
0042F784        push        0
0042F786        mov         ecx,42F7A0;'hello you have to kill me!'
0042F78B        mov         edx,42F7BC;'Welcome to this Newbies Crackme made by ACiD BuRN [CracKerWoRlD]'
0042F790        mov         eax,[00430A48];^Application:TApplication
0042F795        mov         eax,dword ptr [eax]
0042F797        call        TApplication.MessageBox
0042F79C        ret

进入0042F797处的MessageBox找到直接调用对话框的地方：

将0042A1A2到0042A1A9的代码用NO填充即可。到现在这个CrackMe已经全部完成了。