好友
阅读权限10
听众
最后登录1970-1-1
|
Kris
发表于 2011-8-5 14:27
004024A5 /. 55 push ebp ; 按钮事件
004024A6 |. 8BEC mov ebp,esp
004024A8 |. 81EC 18000000 sub esp,0x18
004024AE |. 68 08000000 push 0x8
004024B3 |. E8 97240000 call CrackMe_.0040494F
004024B8 |. 83C4 04 add esp,0x4
004024BB |. 8945 FC mov [local.1],eax
004024BE |. 8BF8 mov edi,eax
004024C0 |. BE 720E4700 mov esi,CrackMe_.00470E72
004024C5 |. AD lods dword ptr ds:[esi]
004024C6 |. AB stos dword ptr es:[edi]
004024C7 |. AD lods dword ptr ds:[esi]
004024C8 |. AB stos dword ptr es:[edi]
004024C9 |. 6A FF push -0x1
004024CB |. 6A 08 push 0x8
004024CD |. 68 27000116 push 0x16010027
004024D2 |. 68 01000152 push 0x52010001
004024D7 |. E8 7F240000 call CrackMe_.0040495B ; 获取输入的注册码
004024DC |. 83C4 10 add esp,0x10
004024DF |. 8945 F8 mov [local.2],eax
004024E2 |. 8D45 F8 lea eax,[local.2]
004024E5 |. 50 push eax
004024E6 |. E8 D8020000 call CrackMe_.004027C3
004024EB |. 8945 F4 mov [local.3],eax
004024EE |. 8B5D F8 mov ebx,[local.2]
004024F1 |. 85DB test ebx,ebx
004024F3 |. 74 09 je XCrackMe_.004024FE
004024F5 |. 53 push ebx
004024F6 |. E8 3C240000 call CrackMe_.00404937
004024FB |. 83C4 04 add esp,0x4
004024FE |> 68 05000080 push 0x80000005
00402503 |. 6A 00 push 0x0
00402505 |. 8B45 F4 mov eax,[local.3]
00402508 |. 85C0 test eax,eax
0040250A |. 75 05 jnz XCrackMe_.00402511
0040250C |. B8 720E4700 mov eax,CrackMe_.00470E72
00402511 |> 50 push eax
00402512 |. 68 01000000 push 0x1
00402517 |. BB 20544000 mov ebx,CrackMe_.00405420
0040251C |. E8 28240000 call CrackMe_.00404949 ; 输入的注册码作为十六进制转文本
00402521 |. 83C4 10 add esp,0x10
00402524 |. 8945 F0 mov [local.4],eax
00402527 |. 8B5D F4 mov ebx,[local.3]
0040252A |. 85DB test ebx,ebx
0040252C |. 74 09 je XCrackMe_.00402537
0040252E |. 53 push ebx
0040252F |. E8 03240000 call CrackMe_.00404937
00402534 |. 83C4 04 add esp,0x4
00402537 |> 6A 00 push 0x0
00402539 |. 6A 00 push 0x0
0040253B |. 6A 00 push 0x0
0040253D |. 68 04000080 push 0x80000004
00402542 |. 6A 00 push 0x0
00402544 |. 68 CDD24700 push CrackMe_.0047D2CD ; ASCII "
"
00402549 |. 68 04000080 push 0x80000004
0040254E |. 6A 00 push 0x0
00402550 |. 8B45 F0 mov eax,[local.4]
00402553 |. 85C0 test eax,eax
00402555 |. 75 05 jnz XCrackMe_.0040255C
00402557 |. B8 710E4700 mov eax,CrackMe_.00470E71
0040255C |> 50 push eax
0040255D |. 68 03000000 push 0x3
00402562 |. BB A04D4000 mov ebx,CrackMe_.00404DA0
00402567 |. E8 DD230000 call CrackMe_.00404949 ; 输入的注册码的十六进制转文本与0D0A(换行符)
0040256C |. 83C4 28 add esp,0x28 ; 做比较,必须存在0D0A(换行符),
0040256F |. 8945 EC mov [local.5],eax ; 但是它不能在开始位置,也不能在结束位置
00402572 |. 8B5D F0 mov ebx,[local.4] ; 要在中间
00402575 |. 85DB test ebx,ebx ; 返回的时候,dword [eax+4]>1,就正确了
00402577 |. 74 09 je XCrackMe_.00402582
00402579 |. 53 push ebx
0040257A |. E8 B8230000 call CrackMe_.00404937
0040257F |. 83C4 04 add esp,0x4
00402582 |> 8B45 EC mov eax,[local.5]
00402585 |. 50 push eax
00402586 |. 8B5D FC mov ebx,[local.1]
00402589 |. 53 push ebx
0040258A |. 8B0B mov ecx,dword ptr ds:[ebx]
0040258C |. 83C3 04 add ebx,0x4
0040258F |. 85C9 test ecx,ecx
00402591 |. 74 11 je XCrackMe_.004025A4
00402593 |. 8B03 mov eax,dword ptr ds:[ebx]
00402595 |> 83C3 04 /add ebx,0x4
00402598 |. 49 |dec ecx
00402599 |. 74 05 |je XCrackMe_.004025A0
0040259B |. 0FAF03 |imul eax,dword ptr ds:[ebx]
0040259E |.^ EB F5 \jmp XCrackMe_.00402595
004025A0 |> 8BC8 mov ecx,eax
004025A2 |. 85C9 test ecx,ecx
004025A4 |> 0F84 19000000 je CrackMe_.004025C3
004025AA |> 51 /push ecx
004025AB |. 8B03 |mov eax,dword ptr ds:[ebx]
004025AD |. 85C0 |test eax,eax
004025AF |. 74 0B |je XCrackMe_.004025BC
004025B1 |. 53 |push ebx
004025B2 |. 50 |push eax
004025B3 |. E8 7F230000 |call CrackMe_.00404937
004025B8 |. 83C4 04 |add esp,0x4
004025BB |. 5B |pop ebx
004025BC |> 83C3 04 |add ebx,0x4
004025BF |. 59 |pop ecx
004025C0 |. 49 |dec ecx
004025C1 |.^ 75 E7 \jnz XCrackMe_.004025AA
004025C3 |> E8 6F230000 call CrackMe_.00404937
004025C8 |. 83C4 04 add esp,0x4
004025CB |. 58 pop eax
004025CC |. 8945 FC mov [local.1],eax
004025CF |. 8B5D FC mov ebx,[local.1]
004025D2 |. E8 B5FEFFFF call CrackMe_.0040248C
004025D7 |. 8945 F4 mov [local.3],eax
004025DA |. 837D F4 01 cmp [local.3],0x1 ; 比较刚才是不是大于2
004025DE |. 0F8E 5C010000 jle CrackMe_.00402740 ; 大于2就跳走了,关键跳,NOP
004025E4 |. 8B5D FC mov ebx,[local.1]
004025E7 |. E8 8CF6FFFF call CrackMe_.00401C78
004025EC |. B8 00000000 mov eax,0x0
004025F1 |. 3BC1 cmp eax,ecx
004025F3 |. 7C 0D jl XCrackMe_.00402602
004025F5 |. 68 01000000 push 0x1
004025FA |. E8 3E230000 call CrackMe_.0040493D
004025FF |. 83C4 04 add esp,0x4
00402602 |> C1E0 02 shl eax,0x2
00402605 |. 03D8 add ebx,eax
00402607 |. 895D F8 mov [local.2],ebx
0040260A |. 6A FF push -0x1
0040260C |. 6A 08 push 0x8
0040260E |. 68 24000116 push 0x16010024
00402613 |. 68 01000152 push 0x52010001
00402618 |. E8 3E230000 call CrackMe_.0040495B ; 获取输入的用户名
0040261D |. 83C4 10 add esp,0x10
00402620 |. 8945 F4 mov [local.3],eax
00402623 |. 8B45 F4 mov eax,[local.3]
00402626 |. 50 push eax ; eax=用户名
00402627 |. 8B5D F8 mov ebx,[local.2]
0040262A |. FF33 push dword ptr ds:[ebx] ; [ebx]=注册码
0040262C |. E8 39EAFFFF call CrackMe_.0040106A ; 注册码中不存在用户名就返回-1,存在(正确)返回0
00402631 |. 83C4 08 add esp,0x8
00402634 |. 83F8 00 cmp eax,0x0
00402637 |. B8 00000000 mov eax,0x0
0040263C |. 0F94C0 sete al
0040263F |. 8945 F0 mov [local.4],eax
00402642 |. 8B5D F4 mov ebx,[local.3]
00402645 |. 85DB test ebx,ebx
00402647 |. 74 09 je XCrackMe_.00402652
00402649 |. 53 push ebx
0040264A |. E8 E8220000 call CrackMe_.00404937
0040264F |. 83C4 04 add esp,0x4
00402652 |> 837D F0 00 cmp [local.4],0x0
00402656 |. 0F84 E4000000 je CrackMe_.00402740 ; 如果刚才返回-1就跳走了,关键跳,NOP
0040265C |. 8B5D FC mov ebx,[local.1] ; 之后是DES算法解码的的事情了的
0040265F |. E8 14F6FFFF call CrackMe_.00401C78 ; 总之:
00402664 |. B8 01000000 mov eax,0x1 ; 没有一组正确的Key,是无法破解的!
00402669 |. 3BC1 cmp eax,ecx ; 因为它就是用注册码来解码的
0040266B |. 7C 0D jl XCrackMe_.0040267A
0040266D |. 68 01000000 push 0x1
00402672 |. E8 C6220000 call CrackMe_.0040493D
00402677 |. 83C4 04 add esp,0x4
0040267A |> C1E0 02 shl eax,0x2
0040267D |. 03D8 add ebx,eax
0040267F |. 895D F8 mov [local.2],ebx
00402682 |. 68 04000080 push 0x80000004
00402687 |. 6A 00 push 0x0
00402689 |. 8B5D F8 mov ebx,[local.2]
0040268C |. 8B03 mov eax,dword ptr ds:[ebx]
0040268E |. 85C0 test eax,eax
00402690 |. 75 05 jnz XCrackMe_.00402697
00402692 |. B8 710E4700 mov eax,CrackMe_.00470E71
00402697 |> 50 push eax
00402698 |. 68 01000000 push 0x1
0040269D |. BB 304F4000 mov ebx,CrackMe_.00404F30
004026A2 |. E8 A2220000 call CrackMe_.00404949
004026A7 |. 83C4 10 add esp,0x10
004026AA |. 8945 F4 mov [local.3],eax
004026AD |. 8D45 F4 lea eax,[local.3]
004026B0 |. 50 push eax
004026B1 |. B8 D0D24700 mov eax,CrackMe_.0047D2D0
004026B6 |. 8945 F0 mov [local.4],eax
004026B9 |. 8D45 F0 lea eax,[local.4]
004026BC |. 50 push eax
004026BD |. E8 D5050000 call CrackMe_.00402C97
004026C2 |. 8945 EC mov [local.5],eax
004026C5 |. 8B5D F0 mov ebx,[local.4]
004026C8 |. 85DB test ebx,ebx
004026CA |. 74 09 je XCrackMe_.004026D5
004026CC |. 53 push ebx
004026CD |. E8 65220000 call CrackMe_.00404937
004026D2 |. 83C4 04 add esp,0x4
004026D5 |> 8B5D F4 mov ebx,[local.3]
004026D8 |. 85DB test ebx,ebx
004026DA |. 74 09 je XCrackMe_.004026E5
004026DC |. 53 push ebx
004026DD |. E8 55220000 call CrackMe_.00404937
004026E2 |. 83C4 04 add esp,0x4
004026E5 |> 68 05000080 push 0x80000005
004026EA |. 6A 00 push 0x0
004026EC |. 8B45 EC mov eax,[local.5]
004026EF |. 85C0 test eax,eax
004026F1 |. 75 05 jnz XCrackMe_.004026F8
004026F3 |. B8 720E4700 mov eax,CrackMe_.00470E72
004026F8 |> 50 push eax
004026F9 |. 68 01000000 push 0x1
004026FE |. BB 20544000 mov ebx,CrackMe_.00405420
00402703 |. E8 41220000 call CrackMe_.00404949
00402708 |. 83C4 10 add esp,0x10
0040270B |. 8945 E8 mov [local.6],eax
0040270E |. 8B5D EC mov ebx,[local.5]
00402711 |. 85DB test ebx,ebx
00402713 |. 74 09 je XCrackMe_.0040271E
00402715 |. 53 push ebx
00402716 |. E8 1C220000 call CrackMe_.00404937
0040271B |. 83C4 04 add esp,0x4
0040271E |> 8B45 E8 mov eax,[local.6]
00402721 |. 50 push eax
00402722 |. 8B1D 600D4A00 mov ebx,dword ptr ds:[0x4A0D60]
00402728 |. 85DB test ebx,ebx
0040272A |. 74 09 je XCrackMe_.00402735
0040272C |. 53 push ebx
0040272D |. E8 05220000 call CrackMe_.00404937
00402732 |. 83C4 04 add esp,0x4
00402735 |> 58 pop eax
00402736 |. A3 600D4A00 mov dword ptr ds:[0x4A0D60],eax
0040273B |. E9 00000000 jmp CrackMe_.00402740
00402740 |> 6A 00 push 0x0
00402742 |. 6A 00 push 0x0
00402744 |. 6A 00 push 0x0
00402746 |. 68 01030080 push 0x80000301
0040274B |. 6A 00 push 0x0
0040274D |. 68 00000000 push 0x0
00402752 |. 68 04000080 push 0x80000004
00402757 |. 6A 00 push 0x0
00402759 |. A1 600D4A00 mov eax,dword ptr ds:[0x4A0D60]
0040275E |. 85C0 test eax,eax
00402760 |. 75 05 jnz XCrackMe_.00402767
00402762 |. B8 710E4700 mov eax,CrackMe_.00470E71
00402767 |> 50 push eax
00402768 |. 68 03000000 push 0x3
0040276D |. BB A0564000 mov ebx,CrackMe_.004056A0
00402772 |. E8 D2210000 call CrackMe_.00404949
00402777 |. 83C4 28 add esp,0x28
0040277A |. 8B5D FC mov ebx,[local.1]
0040277D |. 53 push ebx
0040277E |. 8B0B mov ecx,dword ptr ds:[ebx]
00402780 |. 83C3 04 add ebx,0x4
00402783 |. 85C9 test ecx,ecx
00402785 |. 74 11 je XCrackMe_.00402798
00402787 |. 8B03 mov eax,dword ptr ds:[ebx]
00402789 |> 83C3 04 /add ebx,0x4
0040278C |. 49 |dec ecx
0040278D |. 74 05 |je XCrackMe_.00402794
0040278F |. 0FAF03 |imul eax,dword ptr ds:[ebx]
00402792 |.^ EB F5 \jmp XCrackMe_.00402789
00402794 |> 8BC8 mov ecx,eax
00402796 |. 85C9 test ecx,ecx
00402798 |> 0F84 19000000 je CrackMe_.004027B7
0040279E |> 51 /push ecx
0040279F |. 8B03 |mov eax,dword ptr ds:[ebx]
004027A1 |. 85C0 |test eax,eax
004027A3 |. 74 0B |je XCrackMe_.004027B0
004027A5 |. 53 |push ebx
004027A6 |. 50 |push eax
004027A7 |. E8 8B210000 |call CrackMe_.00404937
004027AC |. 83C4 04 |add esp,0x4
004027AF |. 5B |pop ebx
004027B0 |> 83C3 04 |add ebx,0x4
004027B3 |. 59 |pop ecx
004027B4 |. 49 |dec ecx
004027B5 |.^ 75 E7 \jnz XCrackMe_.0040279E
004027B7 |> E8 7B210000 call CrackMe_.00404937
004027BC |. 83C4 04 add esp,0x4
004027BF |. 8BE5 mov esp,ebp
004027C1 |. 5D pop ebp
004027C2 \. C3 retn
|
|