一.分析:
由此看出,需要解决的有两点,
1:
name
serial界面
输入相应的name和Serial,输入错误情况下提示:Sorry, The Serial is incorect !
2:
serial界面中
输入正确的serial,输入错误的情况下提示:Try Again!!
二.查壳
没有加壳,是用Delphi写的。
三.破解
既然是用
Delphi写的,直接拖到Idr中查看,
看到name serial界面中只有两个点击事件,还有之前看到的提示字符串,可以肯定重要判断逻辑就在这里
:
点开第一个点击事件,浏览代码:
Unit1.TNS.BitBtn1Click
0042F998 push ebp
0042F999 mov ebp,esp
0042F99B xor ecx,ecx
0042F99D push ecx
0042F99E push ecx
0042F99F push ecx
0042F9A0 push ecx
0042F9A1 push ecx
0042F9A2 push ecx
0042F9A3 push ebx
0042F9A4 push esi
0042F9A5 mov ebx,eax
0042F9A7 xor eax,eax
0042F9A9 push ebp
0042F9AA push 42FB67
0042F9AF push dword ptr fs:[eax]
0042F9B2 mov dword ptr fs:[eax],esp
0042F9B5 mov dword ptr ds:[431750],29;gvar_00431750:Integer
0042F9BF lea edx,[ebp-10]
0042F9C2 mov eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042F9C8 call TControl.GetText ;获取name
0042F9CD mov eax,dword ptr [ebp-10]
0042F9D0 call @LStrToPChar
0042F9D5 mov [0043176C],eax;gvar_0043176C:PChar
0042F9DA lea edx,[ebp-10]
0042F9DD mov eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042F9E3 call TControl.GetText
0042F9E8 mov eax,dword ptr [ebp-10]
0042F9EB movzx eax,byte ptr [eax] ;name[0]
0042F9EE mov esi,eax
0042F9F0 shl esi,3 ;name[0]*2^3
0042F9F3 sub esi,eax ;a=name[0]*2^3-name[0]
0042F9F5 lea edx,[ebp-14]
0042F9F8 mov eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042F9FE call TControl.GetText
0042FA03 mov eax,dword ptr [ebp-14]
0042FA06 movzx eax,byte ptr [eax+1] ;name[1]
0042FA0A shl eax,4 ;b=name[1]*2^4
0042FA0D add esi,eax ;a+b
0042FA0F mov dword ptr ds:[431754],esi;gvar_00431754
0042FA15 lea edx,[ebp-10]
0042FA18 mov eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042FA1E call TControl.GetText
0042FA23 mov eax,dword ptr [ebp-10]
0042FA26 movzx eax,byte ptr [eax+3] ;name[3]
0042FA2A imul esi,eax,0B ;c=name[3]*0xBh
0042FA2D lea edx,[ebp-14]
0042FA30 mov eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042FA36 call TControl.GetText
0042FA3B mov eax,dword ptr [ebp-14]
0042FA3E movzx eax,byte ptr [eax+2] ;name[2]
0042FA42 imul eax,eax,0E ;d=name[2]*0xEh
0042FA45 add esi,eax ;c+d
0042FA47 mov dword ptr ds:[431758],esi;gvar_00431758
0042FA4D mov eax,[0043176C];gvar_0043176C:PChar
0042FA52 call StrLen
0042FA57 cmp eax,4 ;判断字符串长度是否大于4
0042FA5A> jge 0042FA79 ;大于4是继续
0042FA5C push 0
0042FA5E mov ecx,42FB74;'Try Again!'
0042FA63 mov edx,42FB80;'Sorry , The serial is incorect !'
0042FA68 mov eax,[00430A48];^Application:TApplication
0042FA6D mov eax,dword ptr [eax]
0042FA6F call TApplication.MessageBox
0042FA74> jmp 0042FB37
0042FA79 lea edx,[ebp-10]
0042FA7C mov eax,dword ptr [ebx+1DC];TNS.Edit1:TEdit
0042FA82 call TControl.GetText
0042FA87 mov eax,dword ptr [ebp-10]
0042FA8A movzx eax,byte ptr [eax] ;name[0]
0042FA8D imul dword ptr ds:[431750];gvar_00431750:Integer ;name[0]*0x29h
0042FA93 mov [00431750],eax;gvar_00431750:Integer
0042FA98 mov eax,[00431750];gvar_00431750:Integer
0042FA9D add dword ptr ds:[431750],eax;gvar_00431750:Integer ;e=name[0]*0x29h+name[0]*0x29h
0042FAA3 lea eax,[ebp-4]
0042FAA6 mov edx,42FBAC;'CW'
0042FAAB call @LStrLAsg ;将‘CW’存储
0042FAB0 lea eax,[ebp-8]
0042FAB3 mov edx,42FBB8;'CRACKED'
0042FAB8 call @LStrLAsg ;将‘CRACKED’存储
0042FABD push dword ptr [ebp-4] ;‘CW’入栈
0042FAC0 push 42FBC8;'-' ;‘_’入栈
0042FAC5 lea edx,[ebp-18]
0042FAC8 mov eax,[00431750];gvar_00431750:Integer
0042FACD call IntToStr ;将e转化为字符型
0042FAD2 push dword ptr [ebp-18]
0042FAD5 push 42FBC8;'-' ;‘—’入栈
0042FADA push dword ptr [ebp-8] ;‘CRACKED’入栈
0042FADD lea eax,[ebp-0C]
0042FAE0 mov edx,5
0042FAE5 call @LStrCatN ;字符串链接,即serial
0042FAEA lea edx,[ebp-10]
0042FAED mov eax,dword ptr [ebx+1E0];TNS.Edit2:TEdit
0042FAF3 call TControl.GetText ;获取serial
0042FAF8 mov edx,dword ptr [ebp-10]
0042FAFB mov eax,dword ptr [ebp-0C]
0042FAFE call @LStrCmp ;输入的serial和正确进行比较
0042FB03> jne 0042FB1F ;弹出错误提示
0042FB05 push 0
0042FB07 mov ecx,42FBCC;'Congratz !!' ;弹出正确提示
0042FB0C mov edx,42FBD8;'Good job dude =)'
0042FB11 mov eax,[00430A48];^Application:TApplication
0042FB16 mov eax,dword ptr [eax]
0042FB18 call TApplication.MessageBox
0042FB1D> jmp 0042FB37
0042FB1F push 0
0042FB21 mov ecx,42FB74;'Try Again!'
0042FB26 mov edx,42FB80;'Sorry , The serial is incorect !'
0042FB2B mov eax,[00430A48];^Application:TApplication
这段的算法是:
def serial_code(string):
if len(string)<4:
print 'Please input the length of name greater than 4 .'
else:
code=ord(string[0])*41*2
print 'serial:CW-%d-CRACKED'%(code)
name=raw_input("Please input name:")
serial_code(name)
计算个serial:
验证一下:
弹出正确的对话框,可以进行下一步,查看Serial界面:
同样点进判断点击事件内查看代码:
Unit3.Tserial.button1Click
0042F470 push ebp
0042F471 mov ebp,esp
0042F473 xor ecx,ecx
0042F475 push ecx
0042F476 push ecx
0042F477 push ecx
0042F478 push ecx
0042F479 push ebx
0042F47A mov ebx,eax
0042F47C xor eax,eax
0042F47E push ebp
0042F47F push 42F52C
0042F484 push dword ptr fs:[eax]
0042F487 mov dword ptr fs:[eax],esp
0042F48A lea eax,[ebp-4]
0042F48D mov edx,42F540;'Hello'
0042F492 call @LStrLAsg ;存储'Hello'
0042F497 lea eax,[ebp-8]
0042F49A mov edx,42F550;'Dude!' ;存储'Dude!'
0042F49F call @LStrLAsg
0042F4A4 push dword ptr [ebp-4] ;'Hello'入栈
0042F4A7 push 42F560;' ' ;' '入栈
0042F4AC push dword ptr [ebp-8] ;'Dude!'入栈
0042F4AF lea eax,[ebp-0C]
0042F4B2 mov edx,3
0042F4B7 call @LStrCatN ;拼接字符串:Hello Dude!
0042F4BC lea edx,[ebp-10]
0042F4BF mov eax,dword ptr [ebx+1E0];Tserial.Edit1:TEdit
0042F4C5 call TControl.GetText ;获取Sreial
0042F4CA mov eax,dword ptr [ebp-10]
0042F4CD mov edx,dword ptr [ebp-0C]
0042F4D0 call @LStrCmp ;输入的Serial与Hello Dude!进行比较
0042F4D5> jne 0042F4F1 ;输入错误,弹出错误提示
0042F4D7 push 0
0042F4D9 mov ecx,42F564;'Congratz!'
0042F4DE mov edx,42F570;'God Job dude !! =)'
0042F4E3 mov eax,[00430A48];^Application:TApplication
0042F4E8 mov eax,dword ptr [eax]
0042F4EA call TApplication.MessageBox
0042F4EF> jmp 0042F509
0042F4F1 push 0
0042F4F3 mov ecx,42F584;'Failed!'
0042F4F8 mov edx,42F58C;'Try Again!!'
0042F4FD mov eax,[00430A48];^Application:TApplication
0042F502 mov eax,dword ptr [eax]
0042F504 call TApplication.MessageBox
这个界面的判断就很简单了,Serial是固定的“
Hello Dude!
”:
这两个界面就算完成破解了,这时发现刚开始弹出的对话框也是要Kill的:
进入主界面查看代码:
Unit2.Tindex.FormCreate
0042F784 push 0
0042F786 mov ecx,42F7A0;'hello you have to kill me!'
0042F78B mov edx,42F7BC;'Welcome to this Newbies Crackme made by ACiD BuRN [CracKerWoRlD]'
0042F790 mov eax,[00430A48];^Application:TApplication
0042F795 mov eax,dword ptr [eax]
0042F797 call TApplication.MessageBox
0042F79C ret
进入0042F797处的MessageBox找到直接调用对话框的地方:
将0042A1A2到0042A1A9的代码用NO填充即可。到现在这个CrackMe已经全部完成了。