【答案提交】【吾爱破解2014CrackMe大赛】【第八组】

苏紫方璇

首先先查一下什么语言写得  发现是delphi  然后使用dede或者od搜索事件特征码定位按钮按下事件。
在od按钮按下事件处下断

[Asm] 纯文本查看 复制代码

00451F1C > .  55            push ebp                                 ;  <-TForm1@Button1Click
00451F1D   .  8BEC          mov ebp,esp
00451F1F   .  B9 06000000   mov ecx,0x6
00451F24 > >  6A 00         push 0x0
00451F26   .  6A 00         push 0x0
00451F28   .  49            dec ecx
00451F29   .^ 75 F9         jnz X<CrackMe.loc_451F24>
00451F2B   .  53            push ebx
00451F2C   .  56            push esi
00451F2D   .  57            push edi
00451F2E   .  8BD8          mov ebx,eax
00451F30   .  BF 243D4500   mov edi,offset <CrackMe.dword_453D24>
00451F35   .  33C0          xor eax,eax
00451F37   .  55            push ebp
00451F38   .  68 00214500   push <CrackMe.->System.@HandleFinally;>  ;  错误处理  _try
00451F3D   .  64:FF30       push dword ptr fs:[eax]
00451F40   .  64:8920       mov dword ptr fs:[eax],esp
00451F43   .  8D55 FC       lea edx,dword ptr ss:[ebp-0x4]
00451F46 > .  8B83 04030000 mov eax,dword ptr ds:[ebx+0x304]
00451F4C > .  E8 1BE7FDFF   call <CrackMe.Controls::TControl::GetTex>
00451F51   .  8D55 F8       lea edx,dword ptr ss:[ebp-0x8]           ;  取注册名
00451F54 > .  8B83 08030000 mov eax,dword ptr ds:[ebx+0x308]
00451F5A > .  E8 0DE7FDFF   call <CrackMe.Controls::TControl::GetTex>
00451F5F   .  8B45 F8       mov eax,dword ptr ss:[ebp-0x8]           ;  取注册码
00451F62 > .  E8 3925FBFF   call <CrackMe.unknown_libname_53>
00451F67      8BF0          mov esi,eax                              ;  取注册码长度
00451F69      D1FE          sar esi,1
00451F6B      79 03         jns X<CrackMe.loc_451F70>
00451F6D   .  83D6 00       adc esi,0x0
00451F70 > >  33C9          xor ecx,ecx
00451F72   .  55            push ebp
00451F73   .  68 CE204500   push <CrackMe.->System.@HandleAnyExcepti>
00451F78   .  64:FF31       push dword ptr fs:[ecx]                  ;  错误处理
00451F7B   .  64:8921       mov dword ptr fs:[ecx],esp
00451F7E   .  8D45 F0       lea eax,dword ptr ss:[ebp-0x10]
00451F81 > .  E8 5A22FBFF   call <CrackMe.System::__linkproc__ LStrC>
00451F86   .  8BDE          mov ebx,esi
00451F88   .  4B            dec ebx
00451F89   .  85DB          test ebx,ebx
00451F8B   .  7C 2C         jl X<CrackMe.loc_451FB9>
00451F8D   .  43            inc ebx
00451F8E   .  C745 E8 00000>mov dword ptr ss:[ebp-0x18],0x0
00451F95 > >  8D45 E4       lea eax,dword ptr ss:[ebp-0x1C]
00451F98   .  8B55 E8       mov edx,dword ptr ss:[ebp-0x18]
00451F9B   .  03D2          add edx,edx
00451F9D   .  8B4D F8       mov ecx,dword ptr ss:[ebp-0x8]
00451FA0   .  8A1411        mov dl,byte ptr ds:[ecx+edx]             ;  取奇数位并连接
00451FA3 > .  E8 2024FBFF   call <CrackMe.unknown_libname_48>
00451FA8   .  8B55 E4       mov edx,dword ptr ss:[ebp-0x1C]
00451FAB   .  8D45 F0       lea eax,dword ptr ss:[ebp-0x10]
00451FAE > .  E8 F524FBFF   call <CrackMe.System::__linkproc__ LStrC>
00451FB3   .  FF45 E8       inc dword ptr ss:[ebp-0x18]
00451FB6   .  4B            dec ebx
00451FB7   .^ 75 DC         jnz X<CrackMe.loc_451F95>
00451FB9 > >  8D45 F4       lea eax,dword ptr ss:[ebp-0xC]
00451FBC > .  E8 1F22FBFF   call <CrackMe.System::__linkproc__ LStrC>
00451FC1   .  8BDE          mov ebx,esi
00451FC3   .  85DB          test ebx,ebx
00451FC5   .  7E 2C         jle X<CrackMe.loc_451FF3>
00451FC7   .  C745 E8 01000>mov dword ptr ss:[ebp-0x18],0x1
00451FCE > >  8D45 E0       lea eax,dword ptr ss:[ebp-0x20]
00451FD1   .  8B55 E8       mov edx,dword ptr ss:[ebp-0x18]
00451FD4   .  03D2          add edx,edx
00451FD6   .  8B4D F8       mov ecx,dword ptr ss:[ebp-0x8]
00451FD9   .  8A5411 FF     mov dl,byte ptr ds:[ecx+edx-0x1]         ;  取偶数位并连接
00451FDD > .  E8 E623FBFF   call <CrackMe.unknown_libname_48>
00451FE2   .  8B55 E0       mov edx,dword ptr ss:[ebp-0x20]
00451FE5   .  8D45 F4       lea eax,dword ptr ss:[ebp-0xC]
00451FE8 > .  E8 BB24FBFF   call <CrackMe.System::__linkproc__ LStrC>
00451FED   .  FF45 E8       inc dword ptr ss:[ebp-0x18]
00451FF0   .  4B            dec ebx
00451FF1   .^ 75 DB         jnz X<CrackMe.loc_451FCE>
00451FF3 > >  8BDE          mov ebx,esi
00451FF5   .  85DB          test ebx,ebx
00451FF7   .  7E 48         jle X<CrackMe.loc_452041>
00451FF9   .  C745 E8 01000>mov dword ptr ss:[ebp-0x18],0x1
00452000 > >  8D45 DC       lea eax,dword ptr ss:[ebp-0x24]
00452003   .  8B55 F4       mov edx,dword ptr ss:[ebp-0xC]
00452006   .  8B4D E8       mov ecx,dword ptr ss:[ebp-0x18]
00452009   .  8A540A FF     mov dl,byte ptr ds:[edx+ecx-0x1]         ;  偶数字符串单位转换
0045200D > .  E8 B623FBFF   call <CrackMe.unknown_libname_48>
00452012   .  8B45 DC       mov eax,dword ptr ss:[ebp-0x24]
00452015 > .  E8 5E61FBFF   call <CrackMe.Sysutils::StrToInt(System:>
0045201A   .  50            push eax
0045201B   .  8D45 D8       lea eax,dword ptr ss:[ebp-0x28]
0045201E   .  8B55 F0       mov edx,dword ptr ss:[ebp-0x10]
00452021   .  8B4D E8       mov ecx,dword ptr ss:[ebp-0x18]
00452024   .  8A540A FF     mov dl,byte ptr ds:[edx+ecx-0x1]         ;  奇数字符串单位转换
00452028 > .  E8 9B23FBFF   call <CrackMe.unknown_libname_48>
0045202D   .  8B45 D8       mov eax,dword ptr ss:[ebp-0x28]
00452030 > .  E8 4361FBFF   call <CrackMe.Sysutils::StrToInt(System:>
00452035   .  5A            pop edx
00452036   .  E8 E9F7FFFF   call <CrackMe.sub_451824>                ;  算法（单位奇数，单位偶数）
0045203B   .  FF45 E8       inc dword ptr ss:[ebp-0x18]
0045203E   .  4B            dec ebx
0045203F   .^ 75 BF         jnz X<CrackMe.loc_452000>                ;  上跳循环
00452041 >    8B47 38       mov eax,dword ptr ds:[edi+0x38]
00452044   .  8B57 34       mov edx,dword ptr ds:[edi+0x34]          ;  全局数组中两位应该为9
00452047   .  3BC2          cmp eax,edx
00452049      75 79         jnz X<CrackMe.loc_4520C4>
0045204B      3B47 44       cmp eax,dword ptr ds:[edi+0x44]
0045204E      75 74         jnz X<CrackMe.loc_4520C4>
00452050      3B47 48       cmp eax,dword ptr ds:[edi+0x48]
00452053      75 6F         jnz X<CrackMe.loc_4520C4>
00452055      83FA 09       cmp edx,0x9
00452058      75 6A         jnz X<CrackMe.loc_4520C4>
0045205A   .  33C0          xor eax,eax
0045205C   .  55            push ebp
0045205D   .  68 7F204500   push <CrackMe.->System.@HandleAnyExcepti>;  错误处理---指向正确的提示
00452062   .  64:FF30       push dword ptr fs:[eax]
00452065   .  64:8920       mov dword ptr fs:[eax],esp
00452068      8B45 E8       mov eax,dword ptr ss:[ebp-0x18]          ;  在这里可以故意构造错误跳转到正确的提示
0045206B      99            cdq
0045206C      F73D 743D4500 idiv dword ptr ds:[<dword_453D74>]
00452072      8945 E8       mov dword ptr ss:[ebp-0x18],eax
00452075   .  33C0          xor eax,eax
00452077   .  5A            pop edx
00452078   .  59            pop ecx
00452079   .  59            pop ecx
0045207A   .  64:8910       mov dword ptr fs:[eax],edx
0045207D   .  EB 1D         jmp X<CrackMe.loc_45209C>
0045207F > .^ E9 8418FBFF   jmp <CrackMe.System::__linkproc__ Handle>
00452084   .  6A 00         push 0x0                                 ; /Style = MB_OK|MB_APPLMODAL
00452086   .  68 10214500   push <CrackMe.aS>                        ; |提示
0045208B   .  68 18214500   push <CrackMe.aVSJgb>                    ; |注册成功！
00452090   .  6A 00         push 0x0                                 ; |hOwner = NULL
00452092 > .  E8 BD48FBFF   call <CrackMe.MessageBoxA_0>             ; \->user32.MessageBoxA()
00452097 > .  E8 D41BFBFF   call <CrackMe.System::__linkproc__ DoneE>
0045209C > >  8D55 D4       lea edx,dword ptr ss:[ebp-0x2C]
0045209F   .  8B45 E8       mov eax,dword ptr ss:[ebp-0x18]
004520A2 > .  E8 955FFBFF   call <CrackMe.Sysutils::IntToStr(int)>
004520A7   .  8B45 D4       mov eax,dword ptr ss:[ebp-0x2C]
004520AA   .  50            push eax

还是那句。。。。算法什么的真的不会，看不懂，理不清。。。。
要爆破的话就是在算法calll下边
把下边这4行改为nop。

[Asm] 纯文本查看 复制代码

00452049 75 79 jnz X<CrackMe.loc_4520C4>
0045204E 75 74 jnz X<CrackMe.loc_4520C4>
00452053 75 6F jnz X<CrackMe.loc_4520C4>
00452058 75 6A jnz X<CrackMe.loc_4520C4>

只改这几个还是不行，下边紧接着就是又一个错误处理，然后就是个无条件转移，按正常步骤走肯定永远无法到达提示部分，所以肯定要人为构造错误才可以
所以把00452068 8B45 E8 mov eax,dword ptr ss:[ebp-0x18]改成mov eax,dword ptr ss:[0]让程序执行错误处理就可以了
爆破文件 CrackMe1.rar (166.12 KB, 下载次数: 25)

2014-10-29 12:17 上传

点击文件名下载附件

L4Nce

爆破有效
得分：6
在后续题目中继续加油！

chaojiak47

膜拜大神。。。。。。。

wincorry

大神真厉害

o6o7o5

大神厉害!!!!!

长剑相思

活到老，学到老

szac29964

666666666666666621

tds007

过来学习 ~~~~~谢谢 分享~

淡然丶

谢谢  学习了。