160个CrackMe之11

zbnysjwsnd8 发表于 2017-9-16 20:27

本帖最后由 zbnysjwsnd8 于 2017-9-17 08:46 编辑

第一次在我的博客中写关于CM的文章，直接放过来吧。
我不是大神，只是一个菜鸟，所以文章中有哪里不对的地方还请各位大佬们指出。
**0x0 寻找验证函数**
仔细看一下CM 发现没有任何验证的地方，于是我猜测应该有个时钟或者线程在一直验证注册码是否正确。
直接给SetWindowTextA下断点，然后点击按钮1即可断下。
![这里写图片描述](http://img.blog.csdn.net/20170916192338719?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvcXFfMTk0NTk4NTM=/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)
返回到0x004035A1处，向上滚动滚轮找到函数头0x004034E0处，下断点然后F9
再点击刚才的按钮即可断下。
这段函数中有点用的代码就几个主要就是获取编辑框中的注册码然后加上按钮的标题最后设置回去。

```
00403558 .8D4D E8    lea ecx,dword ptr ss:       ;lpBuffer
0040355B .51          push ecx
0040355C .56          push esi
0040355D .8B06       mov eax,dword ptr ds:             ;msvbvm60.6603475B
0040355F .FF90 A0000000 call dword ptr ds:          ;获取注册码的内容然后保存到lpBuffer处
00403565 .85C0       test eax,eax
00403567 .DBE2       fclex
00403569 .7D 12       jge short Andréna.0040357D
0040356B .68 A0000000 push 0xA0
00403570 .68 B81D4000 push Andréna.00401DB8
00403575 .56          push esi
00403576 .50          push eax
00403577 .FF15 2C104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;msvbvm60.__vbaHresultCheckObj
0040357D >8B55 E8    mov edx,dword ptr ss:       ;注册码
00403580 .8B37       mov esi,dword ptr ds:
00403582 .52          push edx                               ; /Arg2 = 00000010
00403583 .68 CC1D4000 push Andréna.00401DCC                ; |1
00403588 .FF15 28104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCa>; \__vbaStrCat
0040358E .8BD0       mov edx,eax
00403590 .8D4D E4    lea ecx,dword ptr ss:
00403593 .FF15 BC104000 call dword ptr ds:[<&MSVBVM60.__vbaStrMo>;msvbvm60.__vbaStrMove
00403599 .50          push eax
0040359A .57          push edi
0040359B .FF96 A4000000 call dword ptr ds:          ;设置回去
```
其他几个按钮干的事情几乎一样不过如果要寻找验证函数的地址，可以尝试一下这个办法。因为程序要一定要获取编辑框的内容来判断，只需要给VB中获取编辑框内容的函数下断点就可以了。

```
00403558 .8D4D E8    lea ecx,dword ptr ss:       ;lpBuffer
0040355B .51          push ecx
0040355C .56          push esi
0040355D .8B06       mov eax,dword ptr ds:             ;msvbvm60.6603475B
0040355F .FF90 A0000000 call dword ptr ds:          ;获取注册码的内容然后保存到lpBuffer处
```
只要能知道这个call转移到的地址即可。
给这里下断点再来一次。
![这里写图片描述](http://img.blog.csdn.net/20170916193151961?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvcXFfMTk0NTk4NTM=/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)
从图中可以得知:函数的地址是0x6603BCA3。
给这个函数下断点如果一直F9的话可以一直断下来。
那这个应该就是验证函数调用的了。
保险起见我这里直接将程序重新载入一遍再F9。
断下来以后返回到0x004047A5处，找到函数头0x00404650。
这个验证地址应该就在0x00404650处了。
**0x1 分析算法**
算法比较简单，大概就是取出注册码的前两个字符转换成整数(记为a1)，然后进行如下操作:
![这里写图片描述](http://img.blog.csdn.net/20170916194739106?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvcXFfMTk0NTk4NTM=/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)
a的取值范围我就不标记了，只是一个表达大致功能的代码段而已。
现在在OD中调试。

```
004048D1 .B8 01000000 mov eax,0x1
004048D6 .8D95 4CFFFFFF lea edx,dword ptr ss:
004048DC .8985 54FFFFFF mov dword ptr ss:,eax
004048E2 .8985 44FFFFFF mov dword ptr ss:,eax
004048E8 .8D45 BC    lea eax,dword ptr ss:                      ;Serial
004048EB .52          push edx
004048EC .8D4D 9C    lea ecx,dword ptr ss:
004048EF .50          push eax                                              ; /Arg2 = 0019FA40
004048F0 .51          push ecx                                              ; |Arg1 = 0000000C
004048F1 .89B5 4CFFFFFF mov dword ptr ss:,esi                      ; |msvbvm60.__vbaStrVarVal
004048F7 .89B5 3CFFFFFF mov dword ptr ss:,esi                      ; |msvbvm60.__vbaStrVarVal
004048FD .FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaLenVar>]          ; \__vbaLenVar
00404903 .50          push eax                                              ;循环次数:Serial长度
00404904 .8D95 3CFFFFFF lea edx,dword ptr ss:
0040490A .8D85 08FFFFFF lea eax,dword ptr ss:
00404910 .52          push edx
00404911 .8D8D 18FFFFFF lea ecx,dword ptr ss:
00404917 .50          push eax
00404918 .8D55 DC    lea edx,dword ptr ss:
0040491B .51          push ecx
0040491C .52          push edx
0040491D .FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>]       ;msvbvm60.__vbaVarForInit
00404923 .8B35 80104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaStrVarVal>]    ;msvbvm60.__vbaStrVarVal
00404929 .8B1D B4104000 mov ebx,dword ptr ds:[<&MSVBVM60.#rtcLeftCharVar_617>] ;msvbvm60.rtcLeftCharVar
0040492F >85C0       test eax,eax
00404931 .0F84 29010000 je Andréna.00404A60
00404937 .8D45 BC    lea eax,dword ptr ss:
0040493A .6A 01       push 0x1
0040493C .8D4D 8C    lea ecx,dword ptr ss:                      ;注册码的第一个字节
0040493F .50          push eax
00404940 .51          push ecx
00404941 .FFD3       call ebx                                              ;msvbvm60.rtcLeftCharVar
00404943 .8D55 8C    lea edx,dword ptr ss:
00404946 .8D45 B0    lea eax,dword ptr ss:
00404949 .52          push edx
0040494A .50          push eax
0040494B .FFD6       call esi                                              ;msvbvm60.__vbaStrVarVal
0040494D .50          push eax
0040494E .FF15 D8104000 call dword ptr ds:[<&MSVBVM60.#rtcR8ValFromBstr_581>] ;转换成十进制整数(记为a1)
00404954 .DD9D 34FFFFFF fstp qword ptr ss:
0040495A .8D4D 9C    lea ecx,dword ptr ss:
0040495D .8D55 DC    lea edx,dword ptr ss:
00404960 .51          push ecx
00404961 .52          push edx
00404962 .C745 A4 01000>mov dword ptr ss:,0x1
00404969 .C745 9C 02000>mov dword ptr ss:,0x2
00404970 .FF15 AC104000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]             ;msvbvm60.__vbaI4Var
00404976 .50          push eax
00404977 .8D45 BC    lea eax,dword ptr ss:
0040497A .8D4D B8    lea ecx,dword ptr ss:
0040497D .50          push eax
0040497E .51          push ecx
0040497F .FFD6       call esi                                              ;msvbvm60.__vbaStrVarVal
00404981 .50          push eax
00404982 .FF15 4C104000 call dword ptr ds:[<&MSVBVM60.#rtcMidCharBstr_631>]    ;msvbvm60.rtcMidCharBstr
00404988 .8BD0       mov edx,eax
0040498A .8D4D B4    lea ecx,dword ptr ss:
0040498D .FF15 BC104000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]          ;msvbvm60.__vbaStrMove
00404993 .50          push eax
00404994 .FF15 20104000 call dword ptr ds:[<&MSVBVM60.#rtcAnsiValueBstr_516>] ;msvbvm60.rtcAnsiValueBstr
0040499A .0FBFD0    movsx edx,ax
0040499D .8995 FCFCFFFF mov dword ptr ss:,edx
004049A3 .C785 7CFFFFFF>mov dword ptr ss:,0x5
004049AD .DB85 FCFCFFFF fild dword ptr ss:
004049B3 .DD9D F4FCFFFF fstp qword ptr ss:
004049B9 .DD85 F4FCFFFF fld qword ptr ss:
004049BF .DC85 34FFFFFF fadd qword ptr ss:                         ;注册码的一个字节 + a1
004049C5 .DD5D 84    fstp qword ptr ss:
004049C8 .DFE0       fstsw ax
004049CA .A8 0D       test al,0xD
004049CC .0F85 FA1F0000 jnz Andréna.004069CC
004049D2 .8D85 7CFFFFFF lea eax,dword ptr ss:                      ;然后转换成十六进制文本
004049D8 .50          push eax
004049D9 .FF15 94104000 call dword ptr ds:[<&MSVBVM60.#rtcHexBstrFromVar_572>] ;msvbvm60.rtcHexBstrFromVar
004049DF .8D4D CC    lea ecx,dword ptr ss:
004049E2 .8985 74FFFFFF mov dword ptr ss:,eax
004049E8 .8D95 6CFFFFFF lea edx,dword ptr ss:
004049EE .51          push ecx                                              ; /Arg3 = 0000000C
004049EF .8D85 5CFFFFFF lea eax,dword ptr ss:                      ; |
004049F5 .52          push edx                                              ; |Arg2 = 0019FAC0
004049F6 .50          push eax                                              ; |Arg1 = 0019FA40
004049F7 .C785 6CFFFFFF>mov dword ptr ss:,0x8                      ; |
00404A01 .FF15 84104000 call dword ptr ds:[<&MSVBVM60.__vbaVarCat>]          ; \__vbaVarCat
00404A07 .8BD0       mov edx,eax                                           ;str1 = str1 + 转换成十六进制后的文本
00404A09 .8D4D CC    lea ecx,dword ptr ss:
00404A0C .FFD7       call edi                                              ;msvbvm60.__vbaVarMove
00404A0E .8D4D B0    lea ecx,dword ptr ss:
00404A11 .8D55 B4    lea edx,dword ptr ss:
00404A14 .51          push ecx
00404A15 .8D45 B8    lea eax,dword ptr ss:
00404A18 .52          push edx
00404A19 .50          push eax
00404A1A .6A 03       push 0x3
00404A1C .FF15 9C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>]       ;msvbvm60.__vbaFreeStrList
00404A22 .8D8D 6CFFFFFF lea ecx,dword ptr ss:
00404A28 .8D95 7CFFFFFF lea edx,dword ptr ss:
00404A2E .51          push ecx
00404A2F .8D45 8C    lea eax,dword ptr ss:
00404A32 .52          push edx
00404A33 .8D4D 9C    lea ecx,dword ptr ss:
00404A36 .50          push eax
00404A37 .51          push ecx
00404A38 .6A 04       push 0x4
00404A3A .FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>]       ;msvbvm60.__vbaFreeVarList
00404A40 .83C4 24    add esp,0x24
00404A43 .8D95 08FFFFFF lea edx,dword ptr ss:
00404A49 .52          push edx
00404A4A .8D85 18FFFFFF lea eax,dword ptr ss:
00404A50 .8D4D DC    lea ecx,dword ptr ss:
00404A53 .50          push eax
00404A54 .51          push ecx
00404A55 .FF15 C8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>]       ;msvbvm60.__vbaVarForNext
00404A5B .^ E9 CFFEFFFF jmp Andréna.0040492F
00404A60 >8D55 CC    lea edx,dword ptr ss:
00404A63 .8D85 4CFFFFFF lea eax,dword ptr ss:
00404A69 .52          push edx                                              ;str1
00404A6A .50          push eax                                              ;固定的字符串
00404A6B .C785 54FFFFFF>mov dword ptr ss:,Andréna.00401E50          ;0817E747D7AFF7C7F82836D74RR7A7F7E7B7C7D826D81KE7B7C
00404A75 .C785 4CFFFFFF>mov dword ptr ss:,0x8008
00404A7F .FF15 5C104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>]          ;str1和固定的字符串比较相等则成功
00404A85 .66:85C0    test ax,ax
00404A88 .74 4C       je short Andréna.00404AD6                            ;如果转移则继续比较
```
看一下这段代码预定好的字符串。
0817E747D7AFF7C7F82836D74RR7A7F7E7B7C7D826D81KE7B7C
可以发现有一个RR和K。16进制中并不存在这两个字母，因此这段不是我们找的。
结果继续跟踪发现后面还有一堆类似的代码算法都是一样的，只是比较的字符串不一样。
搜索一下字符串。
![这里写图片描述](http://img.blog.csdn.net/20170916200215487?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvcXFfMTk0NTk4NTM=/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)
可以发现一个符合条件的字符串:
0817E747D7A7D7C7F82836D74747A7F7E7B7C7D826D817E7B7C
来到0x004065E4处，向上寻找距离这个最近的__vbaVarForInit函数，再向上一段距离，来到0x00406451处，下断点。
这时就能在这里断下。

```
00406451 .B8 02000000 mov eax,0x2
00406456 .B9 01000000 mov ecx,0x1
0040645B .8985 4CFFFFFF mov dword ptr ss:,eax
00406461 .8985 3CFFFFFF mov dword ptr ss:,eax
00406467 .898D 54FFFFFF mov dword ptr ss:,ecx
0040646D .898D 44FFFFFF mov dword ptr ss:,ecx
00406473 .8D85 4CFFFFFF lea eax,dword ptr ss:
00406479 .8D4D BC    lea ecx,dword ptr ss:                      ;Serial
0040647C .50          push eax
0040647D .8D55 9C    lea edx,dword ptr ss:
00406480 .51          push ecx                                              ; /Arg2 = 0019FA40
00406481 .52          push edx                                              ; |Arg1 = 80000000
00406482 .FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaLenVar>]          ; \__vbaLenVar
00406488 .50          push eax                                              ;循环次数:Serial长度
00406489 .8D85 3CFFFFFF lea eax,dword ptr ss:
0040648F .8D8D 68FDFFFF lea ecx,dword ptr ss:
00406495 .50          push eax
00406496 .8D95 78FDFFFF lea edx,dword ptr ss:
0040649C .51          push ecx
0040649D .8D45 DC    lea eax,dword ptr ss:
004064A0 .52          push edx
004064A1 .50          push eax
004064A2 .FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>]       ;msvbvm60.__vbaVarForInit
004064A8 >85C0       test eax,eax
004064AA .0F84 29010000 je Andréna.004065D9
004064B0 .8D4D BC    lea ecx,dword ptr ss:
004064B3 .6A 02       push 0x2
004064B5 .8D55 8C    lea edx,dword ptr ss:
004064B8 .51          push ecx
004064B9 .52          push edx
004064BA .FFD3       call ebx                                              ;msvbvm60.rtcLeftCharVar
004064BC .8D45 8C    lea eax,dword ptr ss:
004064BF .8D4D B0    lea ecx,dword ptr ss:
004064C2 .50          push eax
004064C3 .51          push ecx
004064C4 .FFD6       call esi                                              ;msvbvm60.__vbaStrVarVal
004064C6 .50          push eax                                              ;Serial的前两个字节
004064C7 .FF15 D8104000 call dword ptr ds:[<&MSVBVM60.#rtcR8ValFromBstr_581>] ;转换成整数(记为a1)
004064CD .DD9D 34FFFFFF fstp qword ptr ss:
004064D3 .8D55 9C    lea edx,dword ptr ss:
004064D6 .8D45 DC    lea eax,dword ptr ss:
004064D9 .52          push edx
004064DA .50          push eax
004064DB .C745 A4 01000>mov dword ptr ss:,0x1
004064E2 .C745 9C 02000>mov dword ptr ss:,0x2
004064E9 .FF15 AC104000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]             ;msvbvm60.__vbaI4Var
004064EF .8D4D BC    lea ecx,dword ptr ss:
004064F2 .50          push eax
004064F3 .8D55 B8    lea edx,dword ptr ss:
004064F6 .51          push ecx
004064F7 .52          push edx
004064F8 .FFD6       call esi                                              ;msvbvm60.__vbaStrVarVal
004064FA .50          push eax
004064FB .FF15 4C104000 call dword ptr ds:[<&MSVBVM60.#rtcMidCharBstr_631>]    ;Serial的一个字节
00406501 .8BD0       mov edx,eax
00406503 .8D4D B4    lea ecx,dword ptr ss:
00406506 .FF15 BC104000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]          ;msvbvm60.__vbaStrMove
0040650C .50          push eax
0040650D .FF15 20104000 call dword ptr ds:[<&MSVBVM60.#rtcAnsiValueBstr_516>] ;取出其ASCII码
00406513 .0FBFC0    movsx eax,ax
00406516 .8985 60FCFFFF mov dword ptr ss:,eax
0040651C .8D8D 7CFFFFFF lea ecx,dword ptr ss:
00406522 .DB85 60FCFFFF fild dword ptr ss:
00406528 .51          push ecx
00406529 .C785 7CFFFFFF>mov dword ptr ss:,0x5
00406533 .DD9D 58FCFFFF fstp qword ptr ss:
00406539 .DD85 58FCFFFF fld qword ptr ss:
0040653F .DC85 34FFFFFF fadd qword ptr ss:                         ;Serial的一个字节 + a1
00406545 .DD5D 84    fstp qword ptr ss:
00406548 .DFE0       fstsw ax
0040654A .A8 0D       test al,0xD
0040654C .0F85 7A040000 jnz Andréna.004069CC
00406552 .FF15 94104000 call dword ptr ds:[<&MSVBVM60.#rtcHexBstrFromVar_572>] ;转换成十六进制字符串
00406558 .8985 74FFFFFF mov dword ptr ss:,eax
0040655E .8D55 CC    lea edx,dword ptr ss:
00406561 .8D85 6CFFFFFF lea eax,dword ptr ss:
00406567 .52          push edx                                              ; /Arg3 = 80000000
00406568 .8D8D 5CFFFFFF lea ecx,dword ptr ss:                      ; |
0040656E .50          push eax                                              ; |Arg2 = 0019FAC0
0040656F .51          push ecx                                              ; |Arg1 = 0019FA40
00406570 .C785 6CFFFFFF>mov dword ptr ss:,0x8                      ; |
0040657A .FF15 84104000 call dword ptr ds:[<&MSVBVM60.__vbaVarCat>]          ; \__vbaVarCat
00406580 .8BD0       mov edx,eax                                           ;str1 = str1 + 转换后的十六进制字符串
00406582 .8D4D CC    lea ecx,dword ptr ss:
00406585 .FFD7       call edi                                              ;msvbvm60.__vbaVarMove
00406587 .8D55 B0    lea edx,dword ptr ss:
0040658A .8D45 B4    lea eax,dword ptr ss:
0040658D .52          push edx
0040658E .8D4D B8    lea ecx,dword ptr ss:
00406591 .50          push eax
00406592 .51          push ecx
00406593 .6A 03       push 0x3
00406595 .FF15 9C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>]       ;msvbvm60.__vbaFreeStrList
0040659B .8D95 6CFFFFFF lea edx,dword ptr ss:
004065A1 .8D85 7CFFFFFF lea eax,dword ptr ss:
004065A7 .52          push edx
004065A8 .8D4D 8C    lea ecx,dword ptr ss:
004065AB .50          push eax
004065AC .8D55 9C    lea edx,dword ptr ss:
004065AF .51          push ecx
004065B0 .52          push edx
004065B1 .6A 04       push 0x4
004065B3 .FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>]       ;msvbvm60.__vbaFreeVarList
004065B9 .83C4 24    add esp,0x24
004065BC .8D85 68FDFFFF lea eax,dword ptr ss:
004065C2 .50          push eax
004065C3 .8D8D 78FDFFFF lea ecx,dword ptr ss:
004065C9 .8D55 DC    lea edx,dword ptr ss:
004065CC .51          push ecx
004065CD .52          push edx
004065CE .FF15 C8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>]       ;msvbvm60.__vbaVarForNext
004065D4 .^ E9 CFFEFFFF jmp Andréna.004064A8
004065D9 >8D45 CC    lea eax,dword ptr ss:
004065DC .8D8D 4CFFFFFF lea ecx,dword ptr ss:
004065E2 .50          push eax                                              ;转换后的十六进制字符串
004065E3 .51          push ecx                                              ;预设的字符串
004065E4 .C785 54FFFFFF>mov dword ptr ss:,Andréna.00402390          ;0817E747D7A7D7C7F82836D74747A7F7E7B7C7D826D817E7B7C
004065EE .C785 4CFFFFFF>mov dword ptr ss:,0x8008
004065F8 .FF15 5C104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>]          ;比较相等则成功
004065FE .66:85C0    test ax,ax
00406601 .74 4C       je short Andréna.0040664F                            ;不相等则转移
```
**0x2 计算注册码**
在这个字符串("0817E747D7A7D7C7F82836D74747A7F7E7B7C7D826D817E7B7C")中，'0'是系统自己加上去的，我们不需要注意它，只需要注意后面几个即可，即"817E747D7A7D7C7F82836D74747A7F7E7B7C7D826D817E7B7C"
首先将这个字符串每隔两个字符就用空格分开。
得到字符串:"81 7E 74 7D 7A 7D 7C 7F 82 83 6D 74 74 7A 7F 7E 7B 7C 7D 82 6D 81 7E 7B 7C"
根据注册码的验证方式可以得知:我们只要知道了注册码的前两个字符，就可以用减法来推算出注册码的剩下的字节了。
问题就在于如何推算注册码的前两个字符。如果仔细想想的话，其实很简单的，就是一个很简单的三元一次方程组的应用。
> 设:注册码的前两个字节的整数形式为a,注册码的第一个字节为b,注册码的第二个字节为c
则有:
a = 10(b - 48) + c - 48(1)
a + b = 0x81(2)
a + c = 0x7E(3).
化简(1),得a = 10b + c - 528(4)
将(4)带入(2)(3)中,得:
10b + c - 528 + b = 0x81(5)
10b + c - 528 + c = 0x7E(6)
解方程组(5)(6),得:b = 55('7'),c = 52('4')
将b = 55,c = 52带入(1),得a = 74
则该方程组的解为:a = 74,b = 55,c = 52

这样就可以得知注册码的前两个字节为'7'和'4'，连接在一起就是"74"。
这样就可以写一个程序来帮我计算注册码了。
![这里写图片描述](http://img.blog.csdn.net/20170916202150416?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvcXFfMTk0NTk4NTM=/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)
运行效果如图:
![这里写图片描述](http://img.blog.csdn.net/20170916202222930?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvcXFfMTk0NTk4NTM=/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)

得到注册码:74*3032589#**0541238#7412
放到CM中测试一下，可以通过。
![这里写图片描述](http://img.blog.csdn.net/20170916202348553?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvcXFfMTk0NTk4NTM=/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast)
全文完。

18023474704 发表于 2017-9-17 00:35

ajm3 发表于 2017-9-16 21:11
这是什么语言没看懂，是C++吗

貌似是反编译过来的，但是楼主用的是c语言不是c++

sunnyweir 发表于 2017-9-16 20:47

很实用，帮助很大。谢谢

wang65424773 发表于 2017-9-16 21:02

有帮助，学习了

ajm3 发表于 2017-9-16 21:11

这是什么语言没看懂，是C++吗

52_aha 发表于 2017-9-16 21:24

找验证学到了

SomnusXZY 发表于 2017-9-16 21:44

很实用，帮助很大。谢谢

mimi10911 发表于 2017-9-17 11:44

楼主牛逼了 {:1_921:}

KaQqi 发表于 2017-9-17 15:07

星斗日常逆天

games 发表于 2017-9-17 17:00

写的不错，增长见识，通俗

页: [1] 2

吾爱破解 - 52pojie.cn's Archiver

160个CrackMe之11