求大神给个思路破解一个CM

cirrus · 发表于 2016-6-5 19:39

本帖最后由 cirrus 于 2016-6-5 19:44 编辑

这个CM没有按钮,是自动循环检测的,破解成功后应该有个md5加密的key,求大神给个思路教我破解,新人上路请各位大神多多关照

CM下载http://pan.baidu.com/s/1dELBzt3

cirrus · 发表于 2016-6-5 19:41

本帖最后由 cirrus 于 2016-6-5 19:45 编辑

00401B39  |. E8 42C20100 CALL CrackMeC.0041DD80
00401B3E  |. 83C4 0C       ADD ESP,0C
00401B41  |. 6A 1F       PUSH 1F                               ; /Arg2 = 0000001F
00401B43  |. 68 84865E00 PUSH CrackMeC.005E8684                ; |Arg1 = 005E8684 ASCII "admin"
00401B48  |. 68 E9030000 PUSH 3E9                               ; |/Arg1 = 000003E9
00401B4D  |. 8B4D FC       MOV ECX,DWORD PTR SS:[EBP-4]          ; ||
00401B50  |. E8 0C250800 CALL CrackMeC.00484061                ; |\CrackMeC.00484061
00401B55  |. 8BC8          MOV ECX,EAX                            ; |
00401B57  |. E8 642C0800 CALL CrackMeC.004847C0                ; \CrackMeC.004847C0
00401B5C  |. 6A 1F       PUSH 1F                               ; /Arg2 = 0000001F
00401B5E  |. 68 A4865E00 PUSH CrackMeC.005E86A4                ; |Arg1 = 005E86A4 ASCII "abcabc"
00401B63  |. 68 E8030000 PUSH 3E8                               ; |/Arg1 = 000003E8
00401B68  |. 8B4D FC       MOV ECX,DWORD PTR SS:[EBP-4]          ; ||
00401B6B  |. E8 F1240800 CALL CrackMeC.00484061                ; |\CrackMeC.00484061
00401B70  |. 8BC8          MOV ECX,EAX                            ; |
00401B72  |. E8 492C0800 CALL CrackMeC.004847C0                ; \CrackMeC.004847C0
00401B77  |. 68 A4865E00 PUSH CrackMeC.005E86A4                ;  ASCII "abcabc"
00401B7C  |. E8 7FC10100 CALL CrackMeC.0041DD00
00401B81  |. 83C4 04       ADD ESP,4
00401B84  |. A3 C4865E00 MOV DWORD PTR DS:[5E86C4],EAX
00401B89  |. 833D C4865E00 >CMP DWORD PTR DS:[5E86C4],0
00401B90  |. 74 09       JE SHORT CrackMeC.00401B9B
00401B92  |. 833D C4865E00 >CMP DWORD PTR DS:[5E86C4],5
00401B99  |. 74 0F       JE SHORT CrackMeC.00401BAA
00401B9B  |> 8B55 FC       MOV EDX,DWORD PTR SS:[EBP-4]
00401B9E  |. C742 60 020000>MOV DWORD PTR DS:[EDX+60],2
00401BA5  |. E9 91000000 JMP CrackMeC.00401C3B
00401BAA  |> 8B45 FC       MOV EAX,DWORD PTR SS:[EBP-4]
00401BAD  |. 8B48 60       MOV ECX,DWORD PTR DS:[EAX+60]
00401BB0  |. 894D F8       MOV DWORD PTR SS:[EBP-8],ECX
00401BB3  |> 837D F8 05    /CMP DWORD PTR SS:[EBP-8],5
00401BB7  |. 7D 27       |JGE SHORT CrackMeC.00401BE0
00401BB9  |. 8B55 F8       |MOV EDX,DWORD PTR SS:[EBP-8]
00401BBC  |. 0FBE82 A4865E0>|MOVSX EAX,BYTE PTR DS:[EDX+5E86A4]
00401BC3  |. 8B4D FC       |MOV ECX,DWORD PTR SS:[EBP-4]
00401BC6  |. 2B41 60       |SUB EAX,DWORD PTR DS:[ECX+60]
00401BC9  |. 83E8 01       |SUB EAX,1
00401BCC  |. 8B55 F8       |MOV EDX,DWORD PTR SS:[EBP-8]
00401BCF  |. 8882 A4865E00  |MOV BYTE PTR DS:[EDX+5E86A4],AL
00401BD5  |. 8B45 F8       |MOV EAX,DWORD PTR SS:[EBP-8]
00401BD8  |. 83C0 02       |ADD EAX,2
00401BDB  |. 8945 F8       |MOV DWORD PTR SS:[EBP-8],EAX
00401BDE  |.^EB D3       \JMP SHORT CrackMeC.00401BB3
00401BE0  |> EB 59       JMP SHORT CrackMeC.00401C3B
00401BE2  |> 68 A4865E00 PUSH CrackMeC.005E86A4                ;  ASCII "abcabc"
00401BE7  |. 68 84865E00 PUSH CrackMeC.005E8684                ;  ASCII "admin"
00401BEC  |. E8 7FC00100 CALL CrackMeC.0041DC70
00401BF1  |. 83C4 08       ADD ESP,8
00401BF4  |. F7D8          NEG EAX
00401BF6  |. 1BC0          SBB EAX,EAX
00401BF8  |. 40          INC EAX
00401BF9  |. 8845 F4       MOV BYTE PTR SS:[EBP-C],AL
00401BFC  |. 8B4D FC       MOV ECX,DWORD PTR SS:[EBP-4]
00401BFF  |. 33D2          XOR EDX,EDX
00401C01  |. 8A51 5C       MOV DL,BYTE PTR DS:[ECX+5C]
00401C04  |. 8B45 F4       MOV EAX,DWORD PTR SS:[EBP-C]
00401C07  |. 25 FF000000 AND EAX,0FF
00401C0C  |. 3BD0          CMP EDX,EAX
00401C0E  |. 74 2B       JE SHORT CrackMeC.00401C3B
00401C10  |. 8B4D FC       MOV ECX,DWORD PTR SS:[EBP-4]
00401C13  |. 33D2          XOR EDX,EDX
00401C15  |. 8A51 5C       MOV DL,BYTE PTR DS:[ECX+5C]
00401C18  |. F7DA          NEG EDX
00401C1A  |. 1BD2          SBB EDX,EDX
00401C1C  |. 42          INC EDX
00401C1D  |. 8B45 FC       MOV EAX,DWORD PTR SS:[EBP-4]
00401C20  |. 8850 5C       MOV BYTE PTR DS:[EAX+5C],DL
00401C23  |. 8B4D FC       MOV ECX,DWORD PTR SS:[EBP-4]
00401C26  |. 33D2          XOR EDX,EDX
00401C28  |. 8A51 5C       MOV DL,BYTE PTR DS:[ECX+5C]
00401C2B  |. 52          PUSH EDX                               ; /Arg3
00401C2C  |. 6A 00       PUSH 0                                  ; |Arg2 = 00000000
00401C2E  |. 68 01040000 PUSH 401                               ; |Arg1 = 00000401
00401C33  |. 8B4D FC       MOV ECX,DWORD PTR SS:[EBP-4]          ; |
00401C36  |. E8 0E610D00 CALL CrackMeC.004D7D49                ; \CrackMeC.004D7D49
00401C3B  |> 8B45 FC       MOV EAX,DWORD PTR SS:[EBP-4]
00401C3E  |. 8B40 60       MOV EAX,DWORD PTR DS:[EAX+60]
00401C41  |. 83C0 01       ADD EAX,1
00401C44  |. 99          CDQ
00401C45  |. B9 03000000 MOV ECX,3
00401C4A  |. F7F9          IDIV ECX
00401C4C  |. 8B45 FC       MOV EAX,DWORD PTR SS:[EBP-4]
00401C4F  |. 8950 60       MOV DWORD PTR DS:[EAX+60],EDX
00401C52  |> 5F          POP EDI
00401C53  |. 5E          POP ESI
00401C54  |. 5B          POP EBX
00401C55  |. 83C4 50       ADD ESP,50
00401C58  |. 3BEC          CMP EBP,ESP
00401C5A  |. E8 D1B90100 CALL CrackMeC.0041D630
00401C5F  |. 8BE5          MOV ESP,EBP
00401C61  |. 5D          POP EBP
00401C62  \. C2 0400       RETN 4

lianfeng0421 · 发表于 2016-6-5 19:56

这个是VB写的吗啊

cirrus · 发表于 2016-6-5 19:58

lianfeng0421 发表于 2016-6-5 19:56
这个是VB写的吗啊

VC++写的

Catshark · 发表于 2016-6-5 21:08

支持楼主

XKQ · 发表于 2016-6-7 18:13

我小菜只会爆破,不会分析算法

SeriousSnow · 发表于 2016-7-8 21:42

介个意思？？

cirrus · 发表于 2016-7-9 09:03

wjdxs1 发表于 2016-7-8 21:42
介个意思？？

是啊,大神能告诉我怎么破解的吗

SeriousSnow · 发表于 2016-7-9 10:52

我很暴力

[Asm] 纯文本查看 复制代码

00401055   $ /E9 06050000   jmp CrackMeC.00401560
0040105A   . |E9 71070000   jmp CrackMeC.004017D0
0040105F   . |E9 1C070000   jmp CrackMeC.00401780
00401064   . |E9 47050000   jmp CrackMeC.004015B0
00401069   $ |E9 A2010000   jmp CrackMeC.00401210
0040106E     |E9 5D0C0000   jmp CrackMeC.00401CD0                    ;  计时器事件 直接让他去结果显示的代码
00401073   . |E9 88000000   jmp CrackMeC.00401100
00401078   . |E9 530C0000   jmp CrackMeC.00401CD0                    ;  结果显示
0040107D   . |E9 7E050000   jmp CrackMeC.00401600

[Asm] 纯文本查看 复制代码

00401CD0  /> \55            push ebp
00401CD1  |.  8BEC          mov ebp,esp
00401CD3  |.  83EC 44       sub esp,0x44
00401CD6  |.  53            push ebx
00401CD7  |.  56            push esi
00401CD8  |.  57            push edi
00401CD9  |.  51            push ecx
00401CDA  |.  8D7D BC       lea edi,[local.17]
00401CDD  |.  B9 11000000   mov ecx,0x11
00401CE2  |.  B8 CCCCCCCC   mov eax,0xCCCCCCCC
00401CE7  |.  F3:AB         rep stos dword ptr es:[edi]
00401CE9  |.  59            pop ecx                                  ;  CrackMeC.004804F6
00401CEA  |.  894D FC       mov [local.1],ecx
00401CED  |.  837D 0C 00    cmp [arg.2],0x0
00401CF1      90            nop                                      ;  不解释了吧
00401CF2      90            nop
00401CF3  |.  68 4C445B00   push CrackMeC.005B444C                   ;  vaild serial!
00401CF8  |.  68 EA030000   push 0x3EA
00401CFD  |.  8B4D FC       mov ecx,[local.1]
00401D00  |.  E8 5C230800   call CrackMeC.00484061
00401D05  |.  8BC8          mov ecx,eax
00401D07  |.  E8 422A0800   call CrackMeC.0048474E
00401D0C  |.  EB 19         jmp short CrackMeC.00401D27
00401D0E  |>  68 2C445B00   push CrackMeC.005B442C                   ;  your serial is Invaild !
00401D13  |.  68 EA030000   push 0x3EA
00401D18  |.  8B4D FC       mov ecx,[local.1]
00401D1B  |.  E8 41230800   call CrackMeC.00484061
00401D20  |.  8BC8          mov ecx,eax
00401D22  |.  E8 272A0800   call CrackMeC.0048474E
00401D27  |>  5F            pop edi                                  ;  CrackMeC.004804F6
00401D28  |.  5E            pop esi                                  ;  CrackMeC.004804F6
00401D29  |.  5B            pop ebx                                  ;  CrackMeC.004804F6
00401D2A  |.  83C4 44       add esp,0x44
00401D2D  |.  3BEC          cmp ebp,esp
00401D2F  |.  E8 FCB80100   call CrackMeC.0041D630
00401D34  |.  8BE5          mov esp,ebp
00401D36  |.  5D            pop ebp                                  ;  CrackMeC.004804F6
00401D37  \.  C2 0800       retn 0x8

帐号		自动登录	找回密码
密码			注册[Register]

[CrackMe] 求大神给个思路破解一个CM

本帖子中包含更多资源

本帖子中包含更多资源