【答案提交】【吾爱破解2014CrackMe大赛】【第八组】

Avenshy

这个CM比较简单哈……
找按钮事件用了Delphi按钮事件脚本， 断在了00431C14
00431C14  |.  FF93 20010000 call dword ptr ds:[ebx+0x120]
F7跟进找到了验证。。。

[Asm] 纯文本查看 复制代码

00451F1C   .  55            push ebp
00451F1D   .  8BEC          mov ebp,esp
00451F1F   .  B9 06000000   mov ecx,0x6
00451F24   >  6A 00         push 0x0
00451F26   .  6A 00         push 0x0
00451F28   .  49            dec ecx
00451F29    ^ 75 F9         jnz XCrackMe.00451F24
00451F2B      53            push ebx
00451F2C      56            push esi
00451F2D      57            push edi
00451F2E   .  8BD8          mov ebx,eax
00451F30   .  BF 243D4500   mov edi,CrackMe.00453D24
00451F35   .  33C0          xor eax,eax
00451F37   .  55            push ebp
00451F38   .  68 00214500   push CrackMe.00452100
00451F3D   .  64:FF30       push dword ptr fs:[eax]
00451F40   .  64:8920       mov dword ptr fs:[eax],esp
00451F43   .  8D55 FC       lea edx,dword ptr ss:[ebp-0x4]
00451F46   .  8B83 04030000 mov eax,dword ptr ds:[ebx+0x304]
00451F4C   .  E8 1BE7FDFF   call CrackMe.0043066C
00451F51   .  8D55 F8       lea edx,dword ptr ss:[ebp-0x8]
00451F54   .  8B83 08030000 mov eax,dword ptr ds:[ebx+0x308]
00451F5A   .  E8 0DE7FDFF   call CrackMe.0043066C
00451F5F   .  8B45 F8       mov eax,dword ptr ss:[ebp-0x8]
00451F62   .  E8 3925FBFF   call CrackMe.004044A0
00451F67   .  8BF0          mov esi,eax
00451F69   .  D1FE          sar esi,1
00451F6B   .  79 03         jns XCrackMe.00451F70
00451F6D   .  83D6 00       adc esi,0x0
00451F70   >  33C9          xor ecx,ecx
00451F72   .  55            push ebp
00451F73   .  68 CE204500   push CrackMe.004520CE
00451F78   .  64:FF31       push dword ptr fs:[ecx]
00451F7B   .  64:8921       mov dword ptr fs:[ecx],esp
00451F7E   .  8D45 F0       lea eax,dword ptr ss:[ebp-0x10]
00451F81   .  E8 5A22FBFF   call CrackMe.004041E0
00451F86   .  8BDE          mov ebx,esi
00451F88   .  4B            dec ebx
00451F89   .  85DB          test ebx,ebx
00451F8B   .  7C 2C         jl XCrackMe.00451FB9
00451F8D   .  43            inc ebx
00451F8E   .  C745 E8 00000>mov dword ptr ss:[ebp-0x18],0x0
00451F95   >  8D45 E4       lea eax,dword ptr ss:[ebp-0x1C]
00451F98   .  8B55 E8       mov edx,dword ptr ss:[ebp-0x18]
00451F9B   .  03D2          add edx,edx
00451F9D   .  8B4D F8       mov ecx,dword ptr ss:[ebp-0x8]
00451FA0   .  8A1411        mov dl,byte ptr ds:[ecx+edx]
00451FA3   .  E8 2024FBFF   call CrackMe.004043C8
00451FA8   .  8B55 E4       mov edx,dword ptr ss:[ebp-0x1C]
00451FAB   .  8D45 F0       lea eax,dword ptr ss:[ebp-0x10]
00451FAE   .  E8 F524FBFF   call CrackMe.004044A8
00451FB3   .  FF45 E8       inc dword ptr ss:[ebp-0x18]
00451FB6   .  4B            dec ebx
00451FB7   .^ 75 DC         jnz XCrackMe.00451F95
00451FB9   >  8D45 F4       lea eax,dword ptr ss:[ebp-0xC]
00451FBC   .  E8 1F22FBFF   call CrackMe.004041E0
00451FC1   .  8BDE          mov ebx,esi
00451FC3   .  85DB          test ebx,ebx
00451FC5   .  7E 2C         jle XCrackMe.00451FF3
00451FC7   .  C745 E8 01000>mov dword ptr ss:[ebp-0x18],0x1
00451FCE   >  8D45 E0       lea eax,dword ptr ss:[ebp-0x20]
00451FD1   .  8B55 E8       mov edx,dword ptr ss:[ebp-0x18]
00451FD4   .  03D2          add edx,edx
00451FD6   .  8B4D F8       mov ecx,dword ptr ss:[ebp-0x8]
00451FD9   .  8A5411 FF     mov dl,byte ptr ds:[ecx+edx-0x1]
00451FDD   .  E8 E623FBFF   call CrackMe.004043C8
00451FE2   .  8B55 E0       mov edx,dword ptr ss:[ebp-0x20]
00451FE5   .  8D45 F4       lea eax,dword ptr ss:[ebp-0xC]
00451FE8   .  E8 BB24FBFF   call CrackMe.004044A8
00451FED   .  FF45 E8       inc dword ptr ss:[ebp-0x18]
00451FF0   .  4B            dec ebx
00451FF1   .^ 75 DB         jnz XCrackMe.00451FCE
00451FF3   >  8BDE          mov ebx,esi
00451FF5   .  85DB          test ebx,ebx
00451FF7   .  7E 48         jle XCrackMe.00452041
00451FF9   .  C745 E8 01000>mov dword ptr ss:[ebp-0x18],0x1
00452000   >  8D45 DC       lea eax,dword ptr ss:[ebp-0x24]
00452003   .  8B55 F4       mov edx,dword ptr ss:[ebp-0xC]
00452006   .  8B4D E8       mov ecx,dword ptr ss:[ebp-0x18]
00452009   .  8A540A FF     mov dl,byte ptr ds:[edx+ecx-0x1]
0045200D   .  E8 B623FBFF   call CrackMe.004043C8
00452012   .  8B45 DC       mov eax,dword ptr ss:[ebp-0x24]
00452015   .  E8 5E61FBFF   call CrackMe.00408178
0045201A   .  50            push eax
0045201B   .  8D45 D8       lea eax,dword ptr ss:[ebp-0x28]
0045201E   .  8B55 F0       mov edx,dword ptr ss:[ebp-0x10]
00452021   .  8B4D E8       mov ecx,dword ptr ss:[ebp-0x18]
00452024   .  8A540A FF     mov dl,byte ptr ds:[edx+ecx-0x1]
00452028   .  E8 9B23FBFF   call CrackMe.004043C8
0045202D   .  8B45 D8       mov eax,dword ptr ss:[ebp-0x28]
00452030   .  E8 4361FBFF   call CrackMe.00408178
00452035   .  5A            pop edx
00452036   .  E8 E9F7FFFF   call CrackMe.00451824
0045203B   .  FF45 E8       inc dword ptr ss:[ebp-0x18]
0045203E   .  4B            dec ebx
0045203F   .^ 75 BF         jnz XCrackMe.00452000
00452041   >  8B47 38       mov eax,dword ptr ds:[edi+0x38]
00452044   .  8B57 34       mov edx,dword ptr ds:[edi+0x34]
00452047   .  3BC2          cmp eax,edx
00452049   .  75 79         jnz XCrackMe.004520C4
0045204B   .  3B47 44       cmp eax,dword ptr ds:[edi+0x44]
0045204E   .  75 74         jnz XCrackMe.004520C4
00452050   .  3B47 48       cmp eax,dword ptr ds:[edi+0x48]
00452053   .  75 6F         jnz XCrackMe.004520C4
00452055   .  83FA 09       cmp edx,0x9
00452058   .  75 6A         jnz XCrackMe.004520C4
0045205A   .  33C0          xor eax,eax
0045205C   .  55            push ebp
0045205D   .  68 7F204500   push CrackMe.0045207F
00452062   .  64:FF30       push dword ptr fs:[eax]
00452065   .  64:8920       mov dword ptr fs:[eax],esp
00452068   .  8B45 E8       mov eax,dword ptr ss:[ebp-0x18]
0045206B   .  99            cdq
0045206C   .  F73D 743D4500 idiv dword ptr ds:[0x453D74]
00452072   .  8945 E8       mov dword ptr ss:[ebp-0x18],eax
00452075   .  33C0          xor eax,eax
00452077   .  5A            pop edx
00452078   .  59            pop ecx
00452079   .  59            pop ecx
0045207A   .  64:8910       mov dword ptr fs:[eax],edx
0045207D   .  EB 1D         jmp XCrackMe.0045209C
0045207F   .^ E9 8418FBFF   jmp CrackMe.00403908
00452084   .  6A 00         push 0x0                                 ; /Style = MB_OK|MB_APPLMODAL
00452086   .  68 10214500   push CrackMe.00452110                    ; |提示
0045208B   .  68 18214500   push CrackMe.00452118                    ; |注册成功！
00452090   .  6A 00         push 0x0                                 ; |hOwner = NULL
00452092   .  E8 BD48FBFF   call <jmp.&user32.MessageBoxA>           ; \MessageBoxA
00452097      E8 D41BFBFF   call CrackMe.00403C70
0045209C   >  8D55 D4       lea edx,dword ptr ss:[ebp-0x2C]
0045209F   .  8B45 E8       mov eax,dword ptr ss:[ebp-0x18]
004520A2   .  E8 955FFBFF   call CrackMe.0040803C
004520A7   .  8B45 D4       mov eax,dword ptr ss:[ebp-0x2C]
004520AA   .  50            push eax
004520AB   .  8D55 D0       lea edx,dword ptr ss:[ebp-0x30]
004520AE   .  A1 743D4500   mov eax,dword ptr ds:[0x453D74]
004520B3   .  E8 845FFBFF   call CrackMe.0040803C
004520B8   .  8B55 D0       mov edx,dword ptr ss:[ebp-0x30]
004520BB   .  8D45 EC       lea eax,dword ptr ss:[ebp-0x14]
004520BE   .  59            pop ecx
004520BF   .  E8 2824FBFF   call CrackMe.004044EC
004520C4   >  33C0          xor eax,eax
004520C6   .  5A            pop edx
004520C7   .  59            pop ecx
004520C8   .  59            pop ecx
004520C9   .  64:8910       mov dword ptr fs:[eax],edx
004520CC   .  EB 0A         jmp XCrackMe.004520D8
004520CE   .^ E9 3518FBFF   jmp CrackMe.00403908
004520D3   .  E8 981BFBFF   call CrackMe.00403C70
004520D8   >  33C0          xor eax,eax
004520DA   .  5A            pop edx
004520DB   .  59            pop ecx
004520DC   .  59            pop ecx
004520DD   .  64:8910       mov dword ptr fs:[eax],edx
004520E0   .  68 07214500   push CrackMe.00452107
004520E5   >  8D45 D0       lea eax,dword ptr ss:[ebp-0x30]
004520E8   .  BA 06000000   mov edx,0x6
004520ED   .  E8 1221FBFF   call CrackMe.00404204
004520F2   .  8D45 EC       lea eax,dword ptr ss:[ebp-0x14]
004520F5   .  BA 05000000   mov edx,0x5
004520FA   .  E8 0521FBFF   call CrackMe.00404204
004520FF   .  C3            retn
00452100   .^ E9 B71AFBFF   jmp CrackMe.00403BBC
00452105   .^ EB DE         jmp XCrackMe.004520E5
00452107   .  5F            pop edi
00452108   .  5E            pop esi
00452109   .  5B            pop ebx
0045210A   .  8BE5          mov esp,ebp
0045210C   .  5D            pop ebp
0045210D   .  C3            retn

直接jmp到提示注册成功的地方却报错，于是再想办法，
跳转nop掉也不行。。
最后找到方法
00451F8B     /7C 2C         jl XCrackMe.00451FB9 ; 改为jmp
00451FC5     /7E 2C         jle XCrackMe.00451FF3 ; 改为jmp
00451FF7     /7E 48         jle XCrackMe.00452041 ; 改为jmp
00452049   .  75 79         jnz XCrackMe.004520C4 ; nop掉
0045204E   .  75 74         jnz XCrackMe.004520C4 ; nop掉
00452053   .  75 6F         jnz XCrackMe.004520C4 ; nop掉
00452058   .  75 6A         jnz XCrackMe.004520C4 ; nop掉
0045207D   . /EB 1D         jmp XCrackMe.0045209C ; 改为jmp 00452084
运行发现还是报错
终于发现
00452097      E8 D41BFBFF   call CrackMe.00403C70 ; 改为retn
完美运行无报错。

爆破后的附件：
【答案提交】【吾爱破解2014CrackMe大赛】【第八组】-- 小试锋芒.zip (198.74 KB, 下载次数: 23)

2014-10-29 19:47 上传

点击文件名下载附件

L4Nce

爆破有效
得分：6
在后续题目中继续加油！

淡然丶

厉害  学习了。

恍惚状态

直接jmp到提示注册成功的地方却报错，于是再想办法，
跳转nop掉也不行。。
最后找到方法
00451F8B     /7C 2C         jl XCrackMe.00451FB9 ; 改为jmp
00451FC5     /7E 2C         jle XCrackMe.00451FF3 ; 改为jmp
00451FF7     /7E 48         jle XCrackMe.00452041 ; 改为jmp
00452049   .  75 79         jnz XCrackMe.004520C4 ; nop掉
0045204E   .  75 74         jnz XCrackMe.004520C4 ; nop掉
00452053   .  75 6F         jnz XCrackMe.004520C4 ; nop掉
00452058   .  75 6A         jnz XCrackMe.004520C4 ; nop掉
0045207D   . /EB 1D         jmp XCrackMe.0045209C ; 改为jmp 00452084

ft5486

看了很多帖，一点点都不懂

男人必须荇

感谢发帖

男人必须荇

感谢分享