160个CrackMe之017

zbnysjwsnd8 · 发表于 2017-8-26 17:57

本帖最后由 zbnysjwsnd8 于 2017-8-27 22:26 编辑

CM正脸照一张:
QQ截图20170826163546.jpg

我并不是大神就是一个菜鸟所以哪里有错误还请大佬们指出来。
0x0 寻找按钮事件
首先PEID查壳:
QQ截图20170826221302.jpg

可以发现这个CM是使用VB编写。
打开CM,随便输入一串注册码,然后点击[Check it]可以发现程序弹出一个信息框
QQ截图20170826164015.jpg

在OD中给rtcMsgBox下断点然后回到程序领空，找到函数头00404230即可。
0x1 拆解反调试-时间戳检测
这个CM中有检测是否被单步调试用的是msvbvm60!rtcGetTimer
检测方法大致是这样的:

[C] 纯文本查看 复制代码

a = rtcGetTimer();
... //进行其他操作
b = rtcGetTimer();
if(b - a > 5)
        DEBUGGED;
else
        NODEBUGGED;

其实这个方法绕过去很简单只需要在判断的地方下断点然后F9就可以了。
在这个CM中这个判断是在这里:

[Asm] 纯文本查看 复制代码

00404476   .  83F8 05       cmp eax,0x5

那么给这条指令下断然后F9直接运行到这里就可以了。
QQ截图20170826164909.jpg

0x2 分析算法

首先:CM取出用户输入的Serial

[Asm] 纯文本查看 复制代码

0040454B   .  51            push ecx
0040454C   .  53            push ebx
0040454D   .  8B03          mov eax,dword ptr ds:[ebx]
0040454F   .  FF90 A0000000 call dword ptr ds:[eax+0xA0]                          ;  获取Serial

然后取出长度检测大小是否小于5,如果小于5就失败。

[Asm] 纯文本查看 复制代码

0040456D   > \8B95 7CFFFFFF mov edx,dword ptr ss:[ebp-0x84]
00404573   .  52            push edx                                              ;  Serial
00404574   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBstr>]          ;  msvbvm60.__vbaLenBstr
0040457A   .  33DB          xor ebx,ebx
0040457C   .  83F8 05       cmp eax,0x5
0040457F   .  0f9cc3        setl bl
00404582   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404588   .  F7DB          neg ebx
0040458A   .  FF15 F0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]          ;  msvbvm60.__vbaFreeStr
00404590   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
00404596   .  FF15 F4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>]          ;  msvbvm60.__vbaFreeObj
0040459C   .  66:3BDF       cmp bx,di                                             ;  如果Serial的长度小于5则转移
0040459F   .  0F85 39090000 jnz BJCM30A.00404EDE                                  ;  失败

然后检测Serial的每个字节是不是都相等(例如:111111111)

(代码中的循环次数是从0开始)

[Asm] 纯文本查看 复制代码

00404616   > \8B8D 7CFFFFFF mov ecx,dword ptr ss:[ebp-0x84]                           ;  Serial
0040461C   .  51            push ecx
0040461D   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBstr>]              ;  msvbvm60.__vbaLenBstr
00404623   .  8985 00FFFFFF mov dword ptr ss:[ebp-0x100],eax                          ;  Serial的长度 当做循环总次数
00404629   .  8D95 08FFFFFF lea edx,dword ptr ss:[ebp-0xF8]
0040462F   .  8D85 F8FEFFFF lea eax,dword ptr ss:[ebp-0x108]
00404635   .  52            push edx
00404636   .  8D8D E8FEFFFF lea ecx,dword ptr ss:[ebp-0x118]
0040463C   .  50            push eax
0040463D   .  8D95 64FEFFFF lea edx,dword ptr ss:[ebp-0x19C]
00404643   .  51            push ecx
00404644   .  8D85 74FEFFFF lea eax,dword ptr ss:[ebp-0x18C]
0040464A   .  52            push edx
0040464B   .  8D4D 94       lea ecx,dword ptr ss:[ebp-0x6C]
0040464E   .  50            push eax
0040464F   .  51            push ecx
00404650   .  C785 F8FEFFFF>mov dword ptr ss:[ebp-0x108],0x3
0040465A   .  C785 F0FEFFFF>mov dword ptr ss:[ebp-0x110],0x1
00404664   .  C785 E8FEFFFF>mov dword ptr ss:[ebp-0x118],0x2
0040466E   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>]           ;  msvbvm60.__vbaVarForInit
00404674   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
0040467A   .  8985 30FEFFFF mov dword ptr ss:[ebp-0x1D0],eax
00404680   .  FF15 F0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]              ;  msvbvm60.__vbaFreeStr
00404686   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
0040468C   .  FF15 F4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>]              ;  msvbvm60.__vbaFreeObj
00404692   .  8B1D DC104000 mov ebx,dword ptr ds:[<&MSVBVM60.__vbaStrMove>]           ;  msvbvm60.__vbaStrMove
00404698   >  39BD 30FEFFFF cmp dword ptr ss:[ebp-0x1D0],edi                          ;  msvbvm60.rtcMidCharBstr
0040469E   .  0F84 F5010000 je BJCM30A.00404899
004046A4   .  8B16          mov edx,dword ptr ds:[esi]                                ;  BJCM30A.00406A74
004046A6   .  56            push esi
004046A7   .  FF92 08030000 call dword ptr ds:[edx+0x308]
004046AD   .  50            push eax
004046AE   .  8D85 5CFFFFFF lea eax,dword ptr ss:[ebp-0xA4]
004046B4   .  50            push eax
004046B5   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSet>]               ;  msvbvm60.__vbaObjSet
004046BB   .  8B08          mov ecx,dword ptr ds:[eax]
004046BD   .  8D95 7CFFFFFF lea edx,dword ptr ss:[ebp-0x84]
004046C3   .  52            push edx
004046C4   .  50            push eax
004046C5   .  8985 D4FEFFFF mov dword ptr ss:[ebp-0x12C],eax
004046CB   .  FF91 A0000000 call dword ptr ds:[ecx+0xA0]
004046D1   .  3BC7          cmp eax,edi                                               ;  msvbvm60.rtcMidCharBstr
004046D3   .  DBE2          fclex
004046D5   .  7D 18         jge short BJCM30A.004046EF
004046D7   .  8B8D D4FEFFFF mov ecx,dword ptr ss:[ebp-0x12C]
004046DD   .  68 A0000000   push 0xA0
004046E2   .  68 442B4000   push BJCM30A.00402B44
004046E7   .  51            push ecx
004046E8   .  50            push eax
004046E9   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckObj>]      ;  msvbvm60.__vbaHresultCheckObj
004046EF   >  8B16          mov edx,dword ptr ds:[esi]                                ;  BJCM30A.00406A74
004046F1   .  56            push esi
004046F2   .  FF92 08030000 call dword ptr ds:[edx+0x308]
004046F8   .  50            push eax
004046F9   .  8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]
004046FF   .  50            push eax
00404700   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSet>]               ;  msvbvm60.__vbaObjSet
00404706   .  8B08          mov ecx,dword ptr ds:[eax]
00404708   .  8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]
0040470E   .  52            push edx
0040470F   .  50            push eax
00404710   .  8985 CCFEFFFF mov dword ptr ss:[ebp-0x134],eax
00404716   .  FF91 A0000000 call dword ptr ds:[ecx+0xA0]
0040471C   .  3BC7          cmp eax,edi                                               ;  msvbvm60.rtcMidCharBstr
0040471E   .  DBE2          fclex
00404720   .  7D 18         jge short BJCM30A.0040473A
00404722   .  8B8D CCFEFFFF mov ecx,dword ptr ss:[ebp-0x134]
00404728   .  68 A0000000   push 0xA0
0040472D   .  68 442B4000   push BJCM30A.00402B44
00404732   .  51            push ecx
00404733   .  50            push eax
00404734   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckObj>]      ;  msvbvm60.__vbaHresultCheckObj
0040473A   >  B8 01000000   mov eax,0x1
0040473F   .  8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]
00404745   .  8985 50FFFFFF mov dword ptr ss:[ebp-0xB0],eax
0040474B   .  8985 30FFFFFF mov dword ptr ss:[ebp-0xD0],eax
00404751   .  8985 00FFFFFF mov dword ptr ss:[ebp-0x100],eax
00404757   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
0040475A   .  B9 02000000   mov ecx,0x2
0040475F   .  52            push edx
00404760   .  50            push eax
00404761   .  898D 48FFFFFF mov dword ptr ss:[ebp-0xB8],ecx
00404767   .  898D 28FFFFFF mov dword ptr ss:[ebp-0xD8],ecx
0040476D   .  898D F8FEFFFF mov dword ptr ss:[ebp-0x108],ecx
00404773   .  FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]                ;  msvbvm60.__vbaI4Var
00404779   .  8B8D 7CFFFFFF mov ecx,dword ptr ss:[ebp-0x84]                           ;  Serial
0040477F   .  8B3D 54104000 mov edi,dword ptr ds:[<&MSVBVM60.#rtcMidCharBstr_631>]    ;  msvbvm60.rtcMidCharBstr
00404785   .  50            push eax
00404786   .  51            push ecx
00404787   .  FFD7          call edi                                                  ;  msvbvm60.rtcMidCharBstr
00404789   .  8BD0          mov edx,eax                                               ;  Serial[循环次数]
0040478B   .  8D8D 74FFFFFF lea ecx,dword ptr ss:[ebp-0x8C]
00404791   .  FFD3          call ebx                                                  ;  msvbvm60.__vbaStrMove
00404793   .  50            push eax
00404794   .  8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]
0040479A   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
0040479D   .  52            push edx
0040479E   .  8D8D F8FEFFFF lea ecx,dword ptr ss:[ebp-0x108]
004047A4   .  50            push eax
004047A5   .  8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
004047AB   .  51            push ecx
004047AC   .  52            push edx
004047AD   .  FF15 C8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]               ;  msvbvm60.__vbaVarAdd
004047B3   .  50            push eax
004047B4   .  FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]                ;  msvbvm60.__vbaI4Var
004047BA   .  50            push eax
004047BB   .  8B85 78FFFFFF mov eax,dword ptr ss:[ebp-0x88]
004047C1   .  50            push eax
004047C2   .  FFD7          call edi                                                  ;  msvbvm60.rtcMidCharBstr
004047C4   .  8BD0          mov edx,eax                                               ;  Serial[循环次数 + 1]
004047C6   .  8D8D 70FFFFFF lea ecx,dword ptr ss:[ebp-0x90]
004047CC   .  FFD3          call ebx                                                  ;  msvbvm60.__vbaStrMove
004047CE   .  50            push eax
004047CF   .  FF15 68104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCmp>]               ;  msvbvm60.__vbaStrCmp
004047D5   .  8BF8          mov edi,eax                                               ;  如果相等则返回0
004047D7   .  8D8D 70FFFFFF lea ecx,dword ptr ss:[ebp-0x90]
004047DD   .  F7DF          neg edi                                                   ;  msvbvm60.rtcMidCharBstr
004047DF   .  8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C]
004047E5   .  51            push ecx
004047E6   .  8D85 78FFFFFF lea eax,dword ptr ss:[ebp-0x88]
004047EC   .  52            push edx
004047ED   .  1BFF          sbb edi,edi                                               ;  msvbvm60.rtcMidCharBstr
004047EF   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
004047F5   .  50            push eax
004047F6   .  47            inc edi                                                   ;  msvbvm60.rtcMidCharBstr
004047F7   .  51            push ecx
004047F8   .  6A 04         push 0x4
004047FA   .  F7DF          neg edi                                                   ;  msvbvm60.rtcMidCharBstr
004047FC   .  FF15 B4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>]          ;  msvbvm60.__vbaFreeStrList
00404802   .  8D95 58FFFFFF lea edx,dword ptr ss:[ebp-0xA8]
00404808   .  8D85 5CFFFFFF lea eax,dword ptr ss:[ebp-0xA4]
0040480E   .  52            push edx
0040480F   .  50            push eax
00404810   .  6A 02         push 0x2
00404812   .  FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObjList>]          ;  msvbvm60.__vbaFreeObjList
00404818   .  8D8D 28FFFFFF lea ecx,dword ptr ss:[ebp-0xD8]
0040481E   .  8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
00404824   .  51            push ecx
00404825   .  8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
0040482B   .  52            push edx
0040482C   .  50            push eax
0040482D   .  6A 03         push 0x3
0040482F   .  FF15 18104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>]          ;  msvbvm60.__vbaFreeVarList
00404835   .  83C4 30       add esp,0x30
00404838   .  66:85FF       test di,di
0040483B   .  74 37         je short BJCM30A.00404874                                 ;  不相等则转移
0040483D   .  8D4D B8       lea ecx,dword ptr ss:[ebp-0x48]                           ;  相等则记录循环次数(从0开始)
00404840   .  8D95 08FFFFFF lea edx,dword ptr ss:[ebp-0xF8]
00404846   .  51            push ecx
00404847   .  8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
0040484D   .  52            push edx
0040484E   .  50            push eax
0040484F   .  C785 10FFFFFF>mov dword ptr ss:[ebp-0xF0],0x1
00404859   .  C785 08FFFFFF>mov dword ptr ss:[ebp-0xF8],0x2
00404863   .  FF15 C8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]               ;  msvbvm60.__vbaVarAdd
00404869   .  8BD0          mov edx,eax
0040486B   .  8D4D B8       lea ecx,dword ptr ss:[ebp-0x48]
0040486E   .  FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMove>]              ;  msvbvm60.__vbaVarMove
00404874   >  8D8D 64FEFFFF lea ecx,dword ptr ss:[ebp-0x19C]
0040487A   .  8D95 74FEFFFF lea edx,dword ptr ss:[ebp-0x18C]
00404880   .  51            push ecx
00404881   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00404884   .  52            push edx
00404885   .  50            push eax
00404886   .  FF15 E8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>]           ;  msvbvm60.__vbaVarForNext
0040488C   .  8985 30FEFFFF mov dword ptr ss:[ebp-0x1D0],eax
00404892   .  33FF          xor edi,edi                                               ;  msvbvm60.rtcMidCharBstr
00404894   .^ E9 FFFDFFFF   jmp BJCM30A.00404698

然后将之前记录的循环次数和Serial的长度 - 1比较如果相等则失败(即Serial的每个字节都相等)

[Asm] 纯文本查看 复制代码

004048E4   > \8B95 7CFFFFFF mov edx,dword ptr ss:[ebp-0x84]                           ;  Serial
004048EA   .  52            push edx
004048EB   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBstr>]              ;  msvbvm60.__vbaLenBstr
004048F1   .  83E8 01       sub eax,0x1                                               ;  Serial的长度 - 1
004048F4   .  8D8D 08FFFFFF lea ecx,dword ptr ss:[ebp-0xF8]
004048FA   .  0F80 AA070000 jo BJCM30A.004050AA
00404900   .  8985 10FFFFFF mov dword ptr ss:[ebp-0xF0],eax
00404906   .  8D45 B8       lea eax,dword ptr ss:[ebp-0x48]
00404909   .  50            push eax
0040490A   .  51            push ecx
0040490B   .  C785 08FFFFFF>mov dword ptr ss:[ebp-0xF8],0x8003                        ;  已记录循环的次数和Serial的长度 - 1比较
00404915   .  FF15 6C104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>]             ;  msvbvm60.__vbaVarTstEq
0040491B   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404921   .  66:8985 CCFEF>mov word ptr ss:[ebp-0x134],ax                            ;  不相等返回0
00404928   .  FF15 F0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]              ;  msvbvm60.__vbaFreeStr
0040492E   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
00404934   .  FF15 F4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>]              ;  msvbvm60.__vbaFreeObj
0040493A   .  66:39BD CCFEF>cmp word ptr ss:[ebp-0x134],di                            ;  di = 0
00404941   .  0F85 97050000 jnz BJCM30A.00404EDE                                      ;  相等则提示失败

然后计算Serial的第一个字节的ASCII码 * Serial的长度和Serial的ASCII码总和(代码中的循环次数是从0开始)

[Asm] 纯文本查看 复制代码

004049A6   > \8B95 7CFFFFFF mov edx,dword ptr ss:[ebp-0x84]                           ;  Serial
004049AC   .  52            push edx                                                  ;  BJCM30A.00406A74
004049AD   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBstr>]              ;  Serial的长度
004049B3   .  8985 00FFFFFF mov dword ptr ss:[ebp-0x100],eax                          ;  当做循环总次数
004049B9   .  8D85 08FFFFFF lea eax,dword ptr ss:[ebp-0xF8]
004049BF   .  8D8D F8FEFFFF lea ecx,dword ptr ss:[ebp-0x108]
004049C5   .  50            push eax
004049C6   .  8D95 E8FEFFFF lea edx,dword ptr ss:[ebp-0x118]
004049CC   .  51            push ecx
004049CD   .  8D85 44FEFFFF lea eax,dword ptr ss:[ebp-0x1BC]
004049D3   .  52            push edx                                                  ;  BJCM30A.00406A74
004049D4   .  8D8D 54FEFFFF lea ecx,dword ptr ss:[ebp-0x1AC]
004049DA   .  50            push eax
004049DB   .  8D55 94       lea edx,dword ptr ss:[ebp-0x6C]
004049DE   .  51            push ecx
004049DF   .  52            push edx                                                  ;  BJCM30A.00406A74
004049E0   .  C785 F8FEFFFF>mov dword ptr ss:[ebp-0x108],0x3
004049EA   .  C785 F0FEFFFF>mov dword ptr ss:[ebp-0x110],0x1
004049F4   .  C785 E8FEFFFF>mov dword ptr ss:[ebp-0x118],0x2
004049FE   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>]           ;  msvbvm60.__vbaVarForInit
00404A04   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404A0A   .  8985 2CFEFFFF mov dword ptr ss:[ebp-0x1D4],eax
00404A10   .  FF15 F0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]              ;  msvbvm60.__vbaFreeStr
00404A16   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
00404A1C   .  FF15 F4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>]              ;  msvbvm60.__vbaFreeObj
00404A22   >  39BD 2CFEFFFF cmp dword ptr ss:[ebp-0x1D4],edi
00404A28   .  0F84 1D030000 je BJCM30A.00404D4B
00404A2E   .  8B06          mov eax,dword ptr ds:[esi]                                ;  BJCM30A.00406A74
00404A30   .  56            push esi
00404A31   .  FF90 08030000 call dword ptr ds:[eax+0x308]
00404A37   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
00404A3D   .  50            push eax
00404A3E   .  51            push ecx
00404A3F   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSet>]               ;  msvbvm60.__vbaObjSet
00404A45   .  8B10          mov edx,dword ptr ds:[eax]
00404A47   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404A4D   .  51            push ecx
00404A4E   .  50            push eax
00404A4F   .  8985 D4FEFFFF mov dword ptr ss:[ebp-0x12C],eax
00404A55   .  FF92 A0000000 call dword ptr ds:[edx+0xA0]                              ;  msvbvm60.66103DF8
00404A5B   .  3BC7          cmp eax,edi
00404A5D   .  DBE2          fclex
00404A5F   .  7D 18         jge short BJCM30A.00404A79
00404A61   .  8B95 D4FEFFFF mov edx,dword ptr ss:[ebp-0x12C]
00404A67   .  68 A0000000   push 0xA0
00404A6C   .  68 442B4000   push BJCM30A.00402B44
00404A71   .  52            push edx                                                  ;  BJCM30A.00406A74
00404A72   .  50            push eax
00404A73   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckObj>]      ;  msvbvm60.__vbaHresultCheckObj
00404A79   >  8B85 7CFFFFFF mov eax,dword ptr ss:[ebp-0x84]                           ;  Serial
00404A7F   .  50            push eax
00404A80   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBstr>]              ;  取出Serial的长度
00404A86   .  8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-0xB8]
00404A8C   .  8985 50FFFFFF mov dword ptr ss:[ebp-0xB0],eax
00404A92   .  51            push ecx
00404A93   .  C785 48FFFFFF>mov dword ptr ss:[ebp-0xB8],0x3
00404A9D   .  FF15 A8104000 call dword ptr ds:[<&MSVBVM60.#rtcHexBstrFromVar_572>]    ;  msvbvm60.rtcHexBstrFromVar
00404AA3   .  8BD0          mov edx,eax                                               ;  将Serial的长度转换成文本
00404AA5   .  8D8D 64FFFFFF lea ecx,dword ptr ss:[ebp-0x9C]
00404AAB   .  FFD3          call ebx                                                  ;  msvbvm60.__vbaStrMove
00404AAD   .  8B16          mov edx,dword ptr ds:[esi]                                ;  BJCM30A.00406A74
00404AAF   .  56            push esi
00404AB0   .  FF92 08030000 call dword ptr ds:[edx+0x308]                             ;  msvbvm60.661042C8
00404AB6   .  50            push eax
00404AB7   .  8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]
00404ABD   .  50            push eax
00404ABE   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSet>]               ;  msvbvm60.__vbaObjSet
00404AC4   .  8B85 58FFFFFF mov eax,dword ptr ss:[ebp-0xA8]
00404ACA   .  8D8D 38FFFFFF lea ecx,dword ptr ss:[ebp-0xC8]
00404AD0   .  6A 01         push 0x1
00404AD2   .  8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]
00404AD8   .  51            push ecx
00404AD9   .  52            push edx                                                  ;  BJCM30A.00406A74
00404ADA   .  89BD 58FFFFFF mov dword ptr ss:[ebp-0xA8],edi
00404AE0   .  8985 40FFFFFF mov dword ptr ss:[ebp-0xC0],eax
00404AE6   .  C785 38FFFFFF>mov dword ptr ss:[ebp-0xC8],0x9
00404AF0   .  FF15 D4104000 call dword ptr ds:[<&MSVBVM60.#rtcLeftCharVar_617>]       ;  msvbvm60.rtcLeftCharVar
00404AF6   .  8D85 28FFFFFF lea eax,dword ptr ss:[ebp-0xD8]
00404AFC   .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]
00404B02   .  50            push eax
00404B03   .  51            push ecx
00404B04   .  FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaStrVarVal>]            ;  msvbvm60.__vbaStrVarVal
00404B0A   .  50            push eax                                                  ;  Serial[0]
00404B0B   .  FF15 28104000 call dword ptr ds:[<&MSVBVM60.#rtcAnsiValueBstr_516>]     ;  msvbvm60.rtcAnsiValueBstr
00404B11   .  8D95 18FFFFFF lea edx,dword ptr ss:[ebp-0xE8]                           ;  转换成ASCII码
00404B17   .  66:8985 20FFF>mov word ptr ss:[ebp-0xE0],ax
00404B1E   .  52            push edx                                                  ;  BJCM30A.00406A74
00404B1F   .  C785 18FFFFFF>mov dword ptr ss:[ebp-0xE8],0x2
00404B29   .  FF15 A8104000 call dword ptr ds:[<&MSVBVM60.#rtcHexBstrFromVar_572>]    ;  msvbvm60.rtcHexBstrFromVar
00404B2F   .  8BD0          mov edx,eax
00404B31   .  8D8D 60FFFFFF lea ecx,dword ptr ss:[ebp-0xA0]
00404B37   .  FFD3          call ebx                                                  ;  msvbvm60.__vbaStrMove
00404B39   .  BA 6C294000   mov edx,BJCM30A.0040296C                                  ;  UNICODE "*"
00404B3E   .  8D8D 6CFFFFFF lea ecx,dword ptr ss:[ebp-0x94]
00404B44   .  FF15 B0104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCopy>]              ;  msvbvm60.__vbaStrCopy
00404B4A   .  8B95 60FFFFFF mov edx,dword ptr ss:[ebp-0xA0]
00404B50   .  8D8D 70FFFFFF lea ecx,dword ptr ss:[ebp-0x90]
00404B56   .  89BD 60FFFFFF mov dword ptr ss:[ebp-0xA0],edi
00404B5C   .  FFD3          call ebx                                                  ;  msvbvm60.__vbaStrMove
00404B5E   .  8B95 64FFFFFF mov edx,dword ptr ss:[ebp-0x9C]                           ;  Serial的长度(文本型)
00404B64   .  8D8D 74FFFFFF lea ecx,dword ptr ss:[ebp-0x8C]                           ;  复制到ebp - 0x8C处
00404B6A   .  89BD 64FFFFFF mov dword ptr ss:[ebp-0x9C],edi
00404B70   .  FFD3          call ebx                                                  ;  msvbvm60.__vbaStrMove
00404B72   .  8B06          mov eax,dword ptr ds:[esi]                                ;  BJCM30A.00406A74
00404B74   .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-0x98]                           ;  结果保存到ebp - 0x98处
00404B7A   .  8D95 6CFFFFFF lea edx,dword ptr ss:[ebp-0x94]
00404B80   .  51            push ecx
00404B81   .  52            push edx                                                  ;  '*'
00404B82   .  8D8D 70FFFFFF lea ecx,dword ptr ss:[ebp-0x90]
00404B88   .  8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C]
00404B8E   .  51            push ecx                                                  ;  Serial的第一个字节的ASCII码
00404B8F   .  52            push edx                                                  ;  Serial的长度
00404B90   .  56            push esi
00404B91   .  FF90 F8060000 call dword ptr ds:[eax+0x6F8]                             ;  计算表达式:(Serial[0] * Serial的长度)
00404B97   .  3BC7          cmp eax,edi
00404B99   .  7D 12         jge short BJCM30A.00404BAD
00404B9B   .  68 F8060000   push 0x6F8
00404BA0   .  68 B4274000   push BJCM30A.004027B4
00404BA5   .  56            push esi
00404BA6   .  50            push eax
00404BA7   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckObj>]      ;  msvbvm60.__vbaHresultCheckObj
00404BAD   >  8B95 68FFFFFF mov edx,dword ptr ss:[ebp-0x98]
00404BB3   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
00404BB6   .  89BD 68FFFFFF mov dword ptr ss:[ebp-0x98],edi
00404BBC   .  FFD3          call ebx                                                  ;  将运算结果复制到ebp - 0x38处
00404BBE   .  8D85 60FFFFFF lea eax,dword ptr ss:[ebp-0xA0]
00404BC4   .  8D8D 64FFFFFF lea ecx,dword ptr ss:[ebp-0x9C]
00404BCA   .  50            push eax
00404BCB   .  8D95 6CFFFFFF lea edx,dword ptr ss:[ebp-0x94]
00404BD1   .  51            push ecx
00404BD2   .  8D85 70FFFFFF lea eax,dword ptr ss:[ebp-0x90]
00404BD8   .  52            push edx                                                  ;  BJCM30A.00406A74
00404BD9   .  8D8D 74FFFFFF lea ecx,dword ptr ss:[ebp-0x8C]
00404BDF   .  50            push eax
00404BE0   .  8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]
00404BE6   .  51            push ecx
00404BE7   .  8D85 7CFFFFFF lea eax,dword ptr ss:[ebp-0x84]
00404BED   .  52            push edx                                                  ;  BJCM30A.00406A74
00404BEE   .  50            push eax
00404BEF   .  6A 07         push 0x7
00404BF1   .  FF15 B4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>]          ;  msvbvm60.__vbaFreeStrList
00404BF7   .  8D8D 58FFFFFF lea ecx,dword ptr ss:[ebp-0xA8]
00404BFD   .  8D95 5CFFFFFF lea edx,dword ptr ss:[ebp-0xA4]
00404C03   .  51            push ecx
00404C04   .  52            push edx                                                  ;  BJCM30A.00406A74
00404C05   .  6A 02         push 0x2
00404C07   .  FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObjList>]          ;  msvbvm60.__vbaFreeObjList
00404C0D   .  8D85 18FFFFFF lea eax,dword ptr ss:[ebp-0xE8]
00404C13   .  8D8D 28FFFFFF lea ecx,dword ptr ss:[ebp-0xD8]
00404C19   .  50            push eax
00404C1A   .  8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
00404C20   .  51            push ecx
00404C21   .  8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
00404C27   .  52            push edx                                                  ;  BJCM30A.00406A74
00404C28   .  50            push eax
00404C29   .  6A 04         push 0x4
00404C2B   .  FF15 18104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>]          ;  msvbvm60.__vbaFreeVarList
00404C31   .  8B0E          mov ecx,dword ptr ds:[esi]                                ;  BJCM30A.00406A74
00404C33   .  83C4 40       add esp,0x40
00404C36   .  56            push esi
00404C37   .  FF91 08030000 call dword ptr ds:[ecx+0x308]
00404C3D   .  8D95 5CFFFFFF lea edx,dword ptr ss:[ebp-0xA4]
00404C43   .  50            push eax
00404C44   .  52            push edx                                                  ;  BJCM30A.00406A74
00404C45   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSet>]               ;  msvbvm60.__vbaObjSet
00404C4B   .  8B08          mov ecx,dword ptr ds:[eax]
00404C4D   .  8D95 7CFFFFFF lea edx,dword ptr ss:[ebp-0x84]
00404C53   .  52            push edx                                                  ;  BJCM30A.00406A74
00404C54   .  50            push eax
00404C55   .  8985 D4FEFFFF mov dword ptr ss:[ebp-0x12C],eax
00404C5B   .  FF91 A0000000 call dword ptr ds:[ecx+0xA0]
00404C61   .  3BC7          cmp eax,edi
00404C63   .  DBE2          fclex
00404C65   .  7D 18         jge short BJCM30A.00404C7F
00404C67   .  8B8D D4FEFFFF mov ecx,dword ptr ss:[ebp-0x12C]
00404C6D   .  68 A0000000   push 0xA0
00404C72   .  68 442B4000   push BJCM30A.00402B44
00404C77   .  51            push ecx
00404C78   .  50            push eax
00404C79   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckObj>]      ;  msvbvm60.__vbaHresultCheckObj
00404C7F   >  8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]
00404C85   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00404C88   .  52            push edx                                                  ;  BJCM30A.00406A74
00404C89   .  50            push eax
00404C8A   .  C785 50FFFFFF>mov dword ptr ss:[ebp-0xB0],0x1
00404C94   .  C785 48FFFFFF>mov dword ptr ss:[ebp-0xB8],0x2
00404C9E   .  FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]                ;  msvbvm60.__vbaI4Var
00404CA4   .  8B8D 7CFFFFFF mov ecx,dword ptr ss:[ebp-0x84]                           ;  Serial
00404CAA   .  50            push eax                                                  ;  循环次数 + 1
00404CAB   .  51            push ecx
00404CAC   .  FF15 54104000 call dword ptr ds:[<&MSVBVM60.#rtcMidCharBstr_631>]       ;  Serial[循环次数]
00404CB2   .  8BD0          mov edx,eax
00404CB4   .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]
00404CBA   .  FFD3          call ebx                                                  ;  msvbvm60.__vbaStrMove
00404CBC   .  50            push eax
00404CBD   .  FF15 28104000 call dword ptr ds:[<&MSVBVM60.#rtcAnsiValueBstr_516>]     ;  转换成ASCII码
00404CC3   .  66:8985 00FFF>mov word ptr ss:[ebp-0x100],ax
00404CCA   .  8D55 CC       lea edx,dword ptr ss:[ebp-0x34]                           ;  第一次循环时 结果是0
00404CCD   .  8D85 F8FEFFFF lea eax,dword ptr ss:[ebp-0x108]
00404CD3   .  52            push edx                                                  ;  BJCM30A.00406A74
00404CD4   .  8D8D 38FFFFFF lea ecx,dword ptr ss:[ebp-0xC8]
00404CDA   .  50            push eax                                                  ;  Serial[循环次数]
00404CDB   .  51            push ecx
00404CDC   .  C785 F8FEFFFF>mov dword ptr ss:[ebp-0x108],0x2
00404CE6   .  FF15 C8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]               ;  msvbvm60.__vbaVarAdd
00404CEC   .  8BD0          mov edx,eax
00404CEE   .  8D4D CC       lea ecx,dword ptr ss:[ebp-0x34]
00404CF1   .  FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMove>]              ;  将结果保存到ebp - 0x34处(结果 = 结果 + Serial[循环次数])
00404CF7   .  8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]
00404CFD   .  8D85 7CFFFFFF lea eax,dword ptr ss:[ebp-0x84]
00404D03   .  52            push edx                                                  ;  BJCM30A.00406A74
00404D04   .  50            push eax
00404D05   .  6A 02         push 0x2
00404D07   .  FF15 B4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>]          ;  msvbvm60.__vbaFreeStrList
00404D0D   .  83C4 0C       add esp,0xC
00404D10   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
00404D16   .  FF15 F4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>]              ;  msvbvm60.__vbaFreeObj
00404D1C   .  8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-0xB8]
00404D22   .  FF15 10104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]              ;  msvbvm60.__vbaFreeVar
00404D28   .  8D8D 44FEFFFF lea ecx,dword ptr ss:[ebp-0x1BC]
00404D2E   .  8D95 54FEFFFF lea edx,dword ptr ss:[ebp-0x1AC]
00404D34   .  51            push ecx
00404D35   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00404D38   .  52            push edx                                                  ;  BJCM30A.00406A74
00404D39   .  50            push eax
00404D3A   .  FF15 E8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>]           ;  msvbvm60.__vbaVarForNext
00404D40   .  8985 2CFEFFFF mov dword ptr ss:[ebp-0x1D4],eax
00404D46   .^ E9 D7FCFFFF   jmp BJCM30A.00404A22

最后就开始验证:Serial的第一个字节的ASCII码 * Serial的长度是否等于Serial的ASCII码总和，如果相等则成功，不相等则失败

[Asm] 纯文本查看 复制代码

00404D4B   > \8D4D CC       lea ecx,dword ptr ss:[ebp-0x34]
00404D4E   .  51            push ecx                                
00404D4F   .  FF15 A8104000 call dword ptr ds:[<&MSVBVM60.#rtcHexBst>;  取出结果(Serial的ASCII码总和)
00404D55   .  8BD0          mov edx,eax
00404D57   .  8D8D 70FFFFFF lea ecx,dword ptr ss:[ebp-0x90]
00404D5D   .  FFD3          call ebx
00404D5F   .  BA 0C294000   mov edx,BJCM30A.0040290C                 ;  UNICODE "="
00404D64   .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]
00404D6A   .  FF15 B0104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCo>;  msvbvm60.__vbaStrCopy
00404D70   .  8B95 70FFFFFF mov edx,dword ptr ss:[ebp-0x90]
00404D76   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404D7C   .  89BD 70FFFFFF mov dword ptr ss:[ebp-0x90],edi          
00404D82   .  FFD3          call ebx
00404D84   .  8B16          mov edx,dword ptr ds:[esi]
00404D86   .  8D85 74FFFFFF lea eax,dword ptr ss:[ebp-0x8C]          ;  结果保存到ebp - 0x8C处(不相等则是'0' 相等则是'FFFF')
00404D8C   .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]
00404D92   .  50            push eax
00404D93   .  51            push ecx                                 ;  '='
00404D94   .  8D85 7CFFFFFF lea eax,dword ptr ss:[ebp-0x84]
00404D9A   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
00404D9D   .  50            push eax                                 ;  Serial中的ASCII码和
00404D9E   .  51            push ecx                                 ;  Serial[0] * Serial的长度
00404D9F   .  56            push esi                                 
00404DA0   .  FF92 F8060000 call dword ptr ds:[edx+0x6F8]            ;  验证 Serial[0] * Serial的长度 == Serial中的ASCII码和 是否成立
00404DA6   .  3BC7          cmp eax,edi

[Asm] 纯文本查看 复制代码

00404DBC   > \8B85 74FFFFFF mov eax,dword ptr ss:[ebp-0x8C]                           ;  验证结果
00404DC2   .  BE 08000000   mov esi,0x8
00404DC7   .  8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]
00404DCD   .  8D4D CC       lea ecx,dword ptr ss:[ebp-0x34]
00404DD0   .  89BD 74FFFFFF mov dword ptr ss:[ebp-0x8C],edi
00404DD6   .  8985 50FFFFFF mov dword ptr ss:[ebp-0xB0],eax
00404DDC   .  89B5 48FFFFFF mov dword ptr ss:[ebp-0xB8],esi
00404DE2   .  FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMove>]              ;  将验证结果复制到ecx处
00404DE8   .  8D95 70FFFFFF lea edx,dword ptr ss:[ebp-0x90]
00404DEE   .  8D85 78FFFFFF lea eax,dword ptr ss:[ebp-0x88]
00404DF4   .  52            push edx                                                  ;  BJCM30A.00406A74
00404DF5   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404DFB   .  50            push eax
00404DFC   .  51            push ecx
00404DFD   .  6A 03         push 0x3
00404DFF   .  FF15 B4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>]          ;  msvbvm60.__vbaFreeStrList
00404E05   .  83C4 10       add esp,0x10
00404E08   .  8D55 CC       lea edx,dword ptr ss:[ebp-0x34]
00404E0B   .  8D85 08FFFFFF lea eax,dword ptr ss:[ebp-0xF8]
00404E11   .  C785 10FFFFFF>mov dword ptr ss:[ebp-0xF0],BJCM30A.00402B58              ;  UNICODE "FFFF"
00404E1B   .  52            push edx                                                  ;  BJCM30A.00406A74
00404E1C   .  50            push eax
00404E1D   .  C785 08FFFFFF>mov dword ptr ss:[ebp-0xF8],0x8008
00404E27   .  FF15 6C104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>]             ;  变量比较 不相等返回0
00404E2D   .  66:85C0       test ax,ax
00404E30   .  0F84 AD000000 je BJCM30A.00404EE3                                       ;  失败则转移

0x3 计算注册码

由上述代码我们可以知道

成功的条件是:Serial的第一个字节的ASCII码 * Serial的长度等于Serial的ASCII码总和

我们可以随便设一个Serial，然后在这个Serial的基础上添加新的字符串来达到注册的目的。

设:Serial为"_KaQqi" + z(z是后添加的字符串);
Serial的长度为6 + y(6是"_KaQqi"的长度);
Serial的ASCII码和为566 + x(566是"_KaQqi"的ASCII码总和)
其中:Serial的第一个字符是'_' 这个字符的ASCII码是95
则有如下表达式:
95 * (6 + y) = 566 + x(1)

由(1)得:

95y = x - 4

不妨假设y = 1

这时x就等于95 * 1 + 4,即x = 99('c')

即z = "c"

即Serial为"_KaQqic"

如果假设y = 2那么x = 194
可以将x = 194看成x = 126('~') + 68('D')
即z = "~D"或z = "D~"
即Serial为"_KaQqi~D"或"_KaQqiD~"

不过我比较喜欢"_KaQqi~D"的形式
附:第17个CM(BJCM30A)

BJCM30A.zip (7.37 KB, 下载次数: 6)

xuanjie · 发表于 2017-8-26 18:16

顶你这漂亮的帖子

屿圪 · 发表于 2017-8-26 18:17

很好很强大赞一个

846530637 · 发表于 2017-8-27 09:03

都是英文，怎么看得懂

shj2k · 发表于 2017-8-28 09:22

很详细，有时间也研究一下

hejialong · 发表于 2017-8-28 14:58

提示: 作者被禁止或删除内容自动屏蔽

仙梦 · 发表于 2017-9-20 17:18

这种大佬写防破解，那6了

tang12347 · 发表于 2017-9-20 22:50

学习了。！

pk8900 · 发表于 2017-11-28 20:42

研究了一个下午，就卡在那取第一个字符*字符串长度那，按常理这代码没必要放循环里啊。

zbnysjwsnd8 · 发表于 2017-11-28 20:44

pk8900 发表于 2017-11-28 20:42
研究了一个下午，就卡在那取第一个字符*字符串长度那，按常理这代码没必要放循环里啊。

作者就放在这里了。。。你也只能这么看了那个好像是大数运算。

帐号		自动登录	找回密码
密码			注册[Register]

[原创] 160个CrackMe之017

免费评分

本帖被以下淘专辑推荐:

hejialong hejialong 当前离线好友阅读权限 0 听众最后登录 1970-1-1 头像被屏蔽	hejialong 发表于 2017-8-28 14:58 提示: 作者被禁止或删除内容自动屏蔽

	回复支持举报