160cracked-1
2024-05-06 03:48:19
serial/name 突破
输入test/test1234
停留在MessageBox判断错误页面上 看栈回溯 找到用户态代码下的 MessageBox处下断 找到关键call
0042FAE0 |. BA 05000000 mov edx,0x5
0042FAE5 |. E8 C23EFDFF call Acid_bur.004039AC
0042FAEA |. 8D55 F0 lea edx,[local.4]
0042FAED |. 8B83 E0010000 mov eax,dword ptr ds:[ebx+0x1E0]
0042FAF3 |. E8 60AFFEFF call Acid_bur.0041AA58
0042FAF8 |. 8B55 F0 mov edx,[local.4]
0042FAFB |. 8B45 F4 mov eax,[local.3]
0042FAFE |. E8 F93EFDFF call Acid_bur.004039FC ; 关键call 字符串比较 决定是否通过 要返回0
0042FB03 |. 75 1A jnz short Acid_bur.0042FB1F
0042FB05 |. 6A 00 push 0x0
0042FB07 |. B9 CCFB4200 mov ecx,Acid_bur.0042FBCC ; ASCII "Congratz !!"
0042FB0C |. BA D8FB4200 mov edx,Acid_bur.0042FBD8 ; ASCII "Good job dude =)"
0042FB11 |. A1 480A4300 mov eax,dword ptr ds:[0x430A48]
0042FB16 |. 8B00 mov eax,dword ptr ds:[eax]观察关键call时 寄存器状态EAX 013FA528 ASCII "CW-9512-CRACKED"
EDX 013FA544 ASCII "test1234"显然此时真正的序列号已经出来了 此call为字符串比较函数回到关键call所在函数 网上找 观察 产生注册码过程
0042FA4D |. A1 6C174300 mov eax,dword ptr ds:[0x43176C]
0042FA52 |. E8 D96EFDFF call Acid_bur.00406930 ; 判断serial 是否合格
0042FA57 |. 83F8 04 cmp eax,0x4 ; 5
0042FA5A |. 7D 1D jge short Acid_bur.0042FA79 ; 这里大于等于成立
0042FA5C |. 6A 00 push 0x0
0042FA5E |. B9 74FB4200 mov ecx,Acid_bur.0042FB74 ; ASCII "Try Again!"
0042FA63 |. BA 80FB4200 mov edx,Acid_bur.0042FB80 ; ASCII "Sorry , The serial is incorect !"
0042FA68 |. A1 480A4300 mov eax,dword ptr ds:[0x430A48]
0042FA6D |. 8B00 mov eax,dword ptr ds:[eax]
0042FA6F |. E8 FCA6FFFF call Acid_bur.0042A170
0042FA74 |. E9 BE000000 jmp Acid_bur.0042FB37
0042FA79 |> 8D55 F0 lea edx,[local.4]
0042FA7C |. 8B83 DC010000 mov eax,dword ptr ds:[ebx+0x1DC]
0042FA82 |. E8 D1AFFEFF call Acid_bur.0041AA58
0042FA87 |. 8B45 F0 mov eax,[local.4] ; eax local.4 test的地址
0042FA8A |. 0FB600 movzx eax,byte ptr ds:[eax] ; eax 第一个字母
0042FA8D |. F72D 50174300 imul dword ptr ds:[0x431750] ; eax*0x29
0042FA93 |. A3 50174300 mov dword ptr ds:[0x431750],eax
0042FA98 |. A1 50174300 mov eax,dword ptr ds:[0x431750]
0042FA9D |. 0105 50174300 add dword ptr ds:[0x431750],eax ; eax+=eax 此时eax为9512 是注册码的一部分
0042FAA3 |. 8D45 FC lea eax,[local.1]
0042FAA6 |. BA ACFB4200 mov edx,Acid_bur.0042FBAC ; ASCII "CW"
0042FAAB |. E8 583CFDFF call Acid_bur.00403708
0042FAB0 |. 8D45 F8 lea eax,[local.2]
0042FAB3 |. BA B8FB4200 mov edx,Acid_bur.0042FBB8 ; ASCII "CRACKED"
0042FAB8 |. E8 4B3CFDFF call Acid_bur.00403708
0042FABD |. FF75 FC push [local.1] ; Acid_bur.0042FBAC
0042FAC0 |. 68 C8FB4200 push Acid_bur.0042FBC8
0042FAC5 |. 8D55 E8 lea edx,[local.6]
0042FAC8 |. A1 50174300 mov eax,dword ptr ds:[0x431750]
0042FACD |. E8 466CFDFF call Acid_bur.00406718
0042FAD2 |. FF75 E8 push [local.6]
0042FAD5 |. 68 C8FB4200 push Acid_bur.0042FBC8
0042FADA |. FF75 F8 push [local.2] ; Acid_bur.0042FBB8
0042FADD |. 8D45 F4 lea eax,[local.3]
0042FAE0 |. BA 05000000 mov edx,0x5
0042FAE5 |. E8 C23EFDFF call Acid_bur.004039AC
0042FAEA |. 8D55 F0 lea edx,[local.4]
0042FAED |. 8B83 E0010000 mov eax,dword ptr ds:[ebx+0x1E0]
0042FAF3 |. E8 60AFFEFF call Acid_bur.0041AA58
0042FAF8 |. 8B55 F0 mov edx,[local.4]
0042FAFB |. 8B45 F4 mov eax,[local.3]
0042FAFE |. E8 F93EFDFF call Acid_bur.004039FC ; 关键call 字符串比较 决定是否通过 要返回0
0042FB03 |. 75 1A jnz short Acid_bur.0042FB1F
0042FB05 |. 6A 00 push 0x0
0042FB07 |. B9 CCFB4200 mov ecx,Acid_bur.0042FBCC ; ASCII "Congratz !!"
0042FB0C |. BA D8FB4200 mov edx,Acid_bur.0042FBD8 ; ASCII "Good job dude =)"
0042FB11 |. A1 480A4300 mov eax,dword ptr ds:[0x430A48]
0042FB16 |. 8B00 mov eax,dword ptr ds:[eax]
0042FB18 |. E8 53A6FFFF call Acid_bur.0042A170分析过程 写出注册机
“`
include
最新文章
- 拿下中科大的计算机课程全靠它了！
- CentOS镜像下载地址
- Oracle Dataguard之Real-Time Apply
- c++之五谷杂粮---2
- How to Map Distinct Value Types Using Java Generics--reference
- android activity详解一：概述
- sscanf一小用法
- OO第二单元作业分析
- 在html编辑器中插入css,怎么给kindeditor编辑器添加引用（blockquote）标签，并选择css样式...
- VBA-使用inputbox方法
- mysql加减时间-函数-时间加减
- 人有见识就不轻易发怒；宽恕人的过失便是自己的荣耀。
- Mac 安装MySQL到移动硬盘
- 高级防火墙规则-Direct Rules
- 前端体系必备的软技能和知识点
- tesseract-ocr 识别图片中的数字
- F矩阵的自由度是多少？
- 腾讯QQ登录“无法访问个人文件夹”解决方法
- 10个月接私单赚了60多万，加工资年入百万，同学：你在做灰产吗？
- oracle求字段中指定字符串出现个数