crackmes-01

http://crackmes.de/users/abzet/easycrackme/

Difficulty: 1 - Very easy, for newbies
Platform: Windows
Language: C/C++

打开exe,发现是密码突破问题。

输入test123，点Check。弹出 Invalid!

确定找关键位置的方法
1.通过字符串搜索 “Invalid!”
2.通过GetDlgTextItem

通过搜索找到了关键位置

004012EF   .  40            inc eax
004012F0   .  50            push eax                                 ; /Count = 2033A (131898.)
004012F1   .  8B45 F4       mov eax,dword ptr ss:[ebp-0xC]           ; |
004012F4   .  50            push eax                                 ; |Buffer = 0002033A
004012F5   .  68 91010000   push 0x191                               ; |ControlID = 191 (401.)
004012FA   .  8B45 08       mov eax,dword ptr ss:[ebp+0x8]           ; |
004012FD   .  50            push eax                                 ; |hWnd = 0002033A ('CrackMe',class='#32770')
004012FE   .  E8 4D030000   call <jmp.&USER32.GetDlgItemTextA>       ; \GetDlgItemTextA
00401303   .  C745 F0 00000>mov dword ptr ss:[ebp-0x10],0x0
0040130A   .  B8 22124000   mov eax,crakmeea.00401222                ;  10445678951
0040130F   .  8B10          mov edx,dword ptr ds:[eax]
00401311   .  8955 D0       mov dword ptr ss:[ebp-0x30],edx
00401314   .  8B50 04       mov edx,dword ptr ds:[eax+0x4]
00401317   .  8955 D4       mov dword ptr ss:[ebp-0x2C],edx
0040131A   .  8B40 08       mov eax,dword ptr ds:[eax+0x8]
0040131D   .  8945 D8       mov dword ptr ss:[ebp-0x28],eax
00401320   .  8D45 DC       lea eax,dword ptr ss:[ebp-0x24]
00401323   .  83C4 FC       add esp,-0x4
00401326   .  6A 08         push 0x8                                 ; /n = 0x8
00401328   .  6A 00         push 0x0                                 ; |c = 00
0040132A   .  50            push eax                                 ; |s = 0002033A
0040132B   .  E8 F0020000   call <jmp.&msvcrt.memset>                ; \memset
00401330   .  83C4 10       add esp,0x10
00401333   .  C745 CC 00000>mov dword ptr ss:[ebp-0x34],0x0
0040133A   .  8DB6 00000000 lea esi,dword ptr ds:[esi]
00401340   >  83C4 F4       add esp,-0xC
00401343   .  8D45 D0       lea eax,dword ptr ss:[ebp-0x30]          ;  取10445678951
00401346   .  50            push eax                                 ; /s = ""
00401347   .  E8 DC020000   call <jmp.&msvcrt.strlen>                ; \strlen
0040134C   .  83C4 10       add esp,0x10                             ;  10445678951 长度为 0xb
0040134F   .  89C0          mov eax,eax
00401351   .  8D50 FF       lea edx,dword ptr ds:[eax-0x1]           ;  edx=0xb-1=0xa
00401354   .  3955 F0       cmp dword ptr ss:[ebp-0x10],edx
00401357   .  72 07         jb short crakmeea.00401360
00401359   .  EB 35         jmp short crakmeea.00401390              ;  经过 循环  从这里跳出去
0040135B      90            nop
0040135C      8D7426 00     lea esi,dword ptr ds:[esi]
00401360   >  8B45 F4       mov eax,dword ptr ss:[ebp-0xC]           ;  test123
00401363   .  8B55 F0       mov edx,dword ptr ss:[ebp-0x10]
00401366   .  01D0          add eax,edx
00401368   .  0FBE10        movsx edx,byte ptr ds:[eax]              ;  取eax所指向的字母于edx中
0040136B   .  8D42 EC       lea eax,dword ptr ds:[edx-0x14]          ;  eax=edx-0x14
0040136E   .  8D55 D0       lea edx,dword ptr ss:[ebp-0x30]
00401371   .  8B4D F0       mov ecx,dword ptr ss:[ebp-0x10]
00401374   .  0FBE1411      movsx edx,byte ptr ds:[ecx+edx]          ;  取10445678951的第ecx+edx位置的字节
00401378   .  39D0          cmp eax,edx
0040137A   .  75 0D         jnz short crakmeea.00401389              ;  不相等的话就 i++ 进入下一循环
0040137C   .  8D45 D0       lea eax,dword ptr ss:[ebp-0x30]
0040137F   .  8B55 F0       mov edx,dword ptr ss:[ebp-0x10]
00401382   .  C60402 73     mov byte ptr ds:[edx+eax],0x73
00401386   .  FF45 CC       inc dword ptr ss:[ebp-0x34]
00401389   >  FF45 F0       inc dword ptr ss:[ebp-0x10]
0040138C   .^ EB B2         jmp short crakmeea.00401340
0040138E      89F6          mov esi,esi                              ;  crakmeea.00401240
00401390   >  B8 2E124000   mov eax,crakmeea.0040122E                ;  Correct!
00401395   .  8B10          mov edx,dword ptr ds:[eax]
00401397   .  8955 B0       mov dword ptr ss:[ebp-0x50],edx
0040139A   .  8B50 04       mov edx,dword ptr ds:[eax+0x4]
0040139D   .  8955 B4       mov dword ptr ss:[ebp-0x4C],edx
004013A0   .  8A40 08       mov al,byte ptr ds:[eax+0x8]
004013A3   .  8845 B8       mov byte ptr ss:[ebp-0x48],al
004013A6   .  8D45 B9       lea eax,dword ptr ss:[ebp-0x47]
004013A9   .  83C4 FC       add esp,-0x4
004013AC   .  6A 01         push 0x1                                 ; /n = 0x1
004013AE   .  6A 00         push 0x0                                 ; |c = 00
004013B0   .  50            push eax                                 ; |s = 0002033A
004013B1   .  E8 6A020000   call <jmp.&msvcrt.memset>                ; \memset
004013B6   .  83C4 10       add esp,0x10
004013B9   .  B8 37124000   mov eax,crakmeea.00401237                ;  Invalid!
004013BE   .  8B10          mov edx,dword ptr ds:[eax]
004013C0   .  8955 A0       mov dword ptr ss:[ebp-0x60],edx
004013C3   .  8B50 04       mov edx,dword ptr ds:[eax+0x4]
004013C6   .  8955 A4       mov dword ptr ss:[ebp-0x5C],edx
004013C9   .  8A40 08       mov al,byte ptr ds:[eax+0x8]
004013CC   .  8845 A8       mov byte ptr ss:[ebp-0x58],al
004013CF   .  8D45 A9       lea eax,dword ptr ss:[ebp-0x57]
004013D2   .  83C4 FC       add esp,-0x4
004013D5   .  6A 01         push 0x1                                 ; /n = 0x1
004013D7   .  6A 00         push 0x0                                 ; |c = 00
004013D9   .  50            push eax                                 ; |s = 0002033A
004013DA   .  E8 41020000   call <jmp.&msvcrt.memset>                ; \memset
004013DF   .  83C4 10       add esp,0x10
004013E2   .  8B45 F0       mov eax,dword ptr ss:[ebp-0x10]          ;  eax是 长度
004013E5   .  3B45 CC       cmp eax,dword ptr ss:[ebp-0x34]          ;  循环中每有一次相等就 会+1
004013E8   .  75 16         jnz short crakmeea.00401400              ;  这里不跳转就为成功
004013EA   .  6A 00         push 0x0                                 ; /Style = MB_OK|MB_APPLMODAL
004013EC   .  8D45 B0       lea eax,dword ptr ss:[ebp-0x50]          ; |
004013EF   .  50            push eax                                 ; |Title = ""
004013F0   .  8D45 B0       lea eax,dword ptr ss:[ebp-0x50]          ; |
004013F3   .  50            push eax                                 ; |Text = ""
004013F4   .  6A 00         push 0x0                                 ; |hOwner = NULL
004013F6   .  E8 5D020000   call <jmp.&USER32.MessageBoxA>           ; \MessageBoxA
004013FB   .  EB 14         jmp short crakmeea.00401411
004013FD      8D76 00       lea esi,dword ptr ds:[esi]
00401400   >  6A 00         push 0x0                                 ; /Style = MB_OK|MB_APPLMODAL
00401402   .  8D45 A0       lea eax,dword ptr ss:[ebp-0x60]          ; |
00401405   .  50            push eax                                 ; |Title = ""
00401406   .  8D45 A0       lea eax,dword ptr ss:[ebp-0x60]          ; |
00401409   .  50            push eax                                 ; |Text = ""
0040140A   .  6A 00         push 0x0                                 ; |hOwner = NULL
0040140C   .  E8 47020000   call <jmp.&USER32.MessageBoxA>           ; \MessageBoxA
00401411   >  EB 00         jmp short crakmeea.00401413
00401413   >  EB 1B         jmp short crakmeea.00401430

程序中的cipher是 就是10445678951 长度是11 在每次的循环中 将 每个字符加0x14和我们输入的字符串比较，如果都相等，则最后比较通过，否则认为密码不正确。所以

>>>
>>> s="10445678951"
>>> res=""
>>> for i in s:
...     res+=chr(ord(i)+0x14)
...
>>> print res
EDHHIJKLMIE

EDHHIJKLMIE就是密码