吾爱破解160个crackme之014

来源：互联网发布：linux 嵌入式播放器编辑：程序博客网时间：2024/05/01 02:11

题目是vb的，没有加壳，比较传统简单的题目。
输入123456789，打开vbcompiler，找到函数断点下断即可，
因为较简单，就不细说，关键代码如下：

004036E5   .  83F8 09       cmp eax,0x9004036E8   .  0f95c1        setne cl004036EB   .  F7D9          neg ecx004036ED   .  8BF1          mov esi,ecx

规定九个字符

0040377C   > /66:8B8D 14FFF>mov cx,word ptr ss:[ebp-0xEC]                        ;  判断点00403783   . |66:394D E8    cmp word ptr ss:[ebp-0x18],cx00403787   . |0F8F 17030000 jg bjanes_1.00403AA4

九个字符必须正确，判断九次

004039AB   .  8D8D 30FFFFFF lea ecx,dword ptr ss:[ebp-0xD0]004039B1   .  8D55 80       lea edx,dword ptr ss:[ebp-0x80]004039B4   .  51            push ecx                                             ; /var18 = NULL004039B5      52            push edx004039B6   .  FF15 A0104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstNe>]        ; \__vbaVarTstNe004039BC   .  8BF8          mov edi,eax004039BE   .  8D45 D8       lea eax,dword ptr ss:[ebp-0x28]004039C1   .  8D4D DC       lea ecx,dword ptr ss:[ebp-0x24]004039C4   .  50            push eax004039C5   .  8D55 E0       lea edx,dword ptr ss:[ebp-0x20]004039C8   .  51            push ecx004039C9   .  8D45 E4       lea eax,dword ptr ss:[ebp-0x1C]004039CC   .  52            push edx004039CD   .  50            push eax004039CE   .  6A 04         push 0x4004039D0   .  FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>]     ;  msvbvm60.__vbaFreeStrList004039D6   .  83C4 14       add esp,0x14004039D9   .  8D4D D4       lea ecx,dword ptr ss:[ebp-0x2C]004039DC   .  FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>]         ;  msvbvm60.__vbaFreeObj004039E2   .  8D4D 80       lea ecx,dword ptr ss:[ebp-0x80]004039E5   .  8D55 90       lea edx,dword ptr ss:[ebp-0x70]004039E8   .  51            push ecx004039E9   .  8D45 A0       lea eax,dword ptr ss:[ebp-0x60]004039EC   .  52            push edx004039ED   .  8D4D B0       lea ecx,dword ptr ss:[ebp-0x50]004039F0   .  50            push eax004039F1   .  8D55 C0       lea edx,dword ptr ss:[ebp-0x40]004039F4   .  51            push ecx004039F5   .  52            push edx004039F6   .  6A 05         push 0x5004039F8   .  FF15 0C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>]     ;  msvbvm60.__vbaFreeVarList004039FE   .  83C4 18       add esp,0x1800403A01   .  66:85FF       test di,di00403A04   .  75 1C         jnz short bjanes_1.00403A2200403A06   .  8B7D 08       mov edi,dword ptr ss:[ebp+0x8]00403A09   .  B8 01000000   mov eax,0x100403A0E   .  66:0345 E8    add ax,word ptr ss:[ebp-0x18]

判断 ss:[ebp-0xD0]，和dword ptr ss:[ebp-0x80]的值是否相等，d0中存储的是一个64位float类型的值，值为++的增长基数1与0x02进行异或然后转化成为ascii码然后转化成为10进制然后减掉48变成浮点数，然后与输入的serial进行对比。。。。。。。好像比较扯淡，但是汇编来看就这么个意思。。。。。

004038F1   > \66:8B45 E8    mov ax,word ptr ss:[ebp-0x18]004038F5   .  8B1D 74104000 mov ebx,dword ptr ds:[<&MSVBVM60.#536>]              ;  msvbvm60.rtcStrFromVar004038FB   .  66:35 0200    xor ax,0x2004038FF   .  8D4D A0       lea ecx,dword ptr ss:[ebp-0x60]00403902   .  0F80 A4020000 jo bjanes_1.00403BAC00403908   .  51            push ecx00403909   .  66:8945 A8    mov word ptr ss:[ebp-0x58],ax

注册码为：

for len in range(1,10):    j = len ^ 0x2    print j

得到3 0 1 6 7 4 5 10 11，也就是301674501

阅读全文

0 0