160 个 CrackMe 之 064 - execution (VB5 Native)算法分析和注册机实现

solly · 发表于 2019-7-12 09:53

本帖最后由 solly 于 2019-7-12 10:49 编辑

160 个 CrackMe 之 064 - execution 是一个 VB 编译的原生程序，不是 p-code 编译模式，并且没有加壳。
用 OD 载入 CrackMe，F9 直接运行，需要输入用户名和注册码进行验证，随便输入，如下图：

输入完后，按“Register”进行验证，由于输入的信息不对，会弹出错误提示对话框：

既然有字符串信息，先查查字符串资源，对于VB程序，字符资源都是 Unicode 的，所以需要点右键菜单：”Ultra String Reference"-->"2 Find UNICODE"，查找程序的字符串资源，如下图，找到我们所需的字符串了：

双击这一条字符串，来到下面所示位置：

具体代码位置如下：

[Asm] 纯文本查看 复制代码

0040DBFC   >  8B35 10F14000       mov     esi, dword ptr [<&MSVBVM50.__vbaStrCat>]       ;  MSVBVM50.__vbaStrCat
0040DC02   .  68 E8D44000         push    0040D4E8                                       ;  you lamer!!! cant crack this?!
0040DC07   .  68 6CD34000         push    0040D36C                                       ; /\n\n
0040DC0C   .  FFD6                call    esi                                            ; \__vbaStrCat()

是一个字符串拼接函数使用了这一字符串资源。

我们从这里开始回溯，如下图：

在0x0040DBFC这一行点右键选“转到”菜单中的（je 来自 0040DB9C）回溯到下图所示位置：

可以看到有提示注册成功的字符串引用：“nice going!!! you cracked the crackme!”，如果没有跳转，就表示注册成功，因此这里开始往上的代码就是注册验证的代码了。再往上一点点的位置，就可以找到调用了 VB 的字符串比较函数，如下图所示位置：

具体代码位置：

[Asm] 纯文本查看 复制代码

0040DB4C   .  8D4D D0             lea     ecx, dword ptr [ebp-30]
0040DB4F   .  FFD3                call    ebx                                            ;  (MSVBVM50.__vbaStrMove)
0040DB51   .  50                  push    eax                                            ;  StrCmp 参数1， eax ===> "17190"，
0040DB52   .  FF15 40F14000       call    dword ptr [<&MSVBVM50.__vbaStrCmp>]            ;  MSVBVM50.__vbaStrCmp
0040DB58   .  8BF0                mov     esi, eax                                       ;  eax == 0， 相等；eax == 1，不相等

这是一个明文比较注册码的操作，可以看到 eax 指向一个字符串：”17190“，这个就是正确的注册码了。
重新回到 CrackMe ，输入正确的注册码：”17190“，如下图：

再次点击”Register“，就会看成功的提示：

至此，我们找到了注册验证的代码了，下面具体分析一下这个注册过程，完整的过程如下：

[Asm] 纯文本查看 复制代码

0040D8F0   > \55                  push    ebp
0040D8F1   .  8BEC                mov     ebp, esp
0040D8F3   .  83EC 0C             sub     esp, 0C
0040D8F6   .  68 36104000         push    <jmp.&MSVBVM50.__vbaExceptHandler>             ;  SE 处理程序安装
0040D8FB   .  64:A1 00000000      mov     eax, dword ptr fs:[0]
0040D901   .  50                  push    eax
0040D902   .  64:8925 00000000    mov     dword ptr fs:[0], esp
0040D909   .  81EC AC000000       sub     esp, 0AC
0040D90F   .  53                  push    ebx
0040D910   .  8B5D 08             mov     ebx, dword ptr [ebp+8]
0040D913   .  8BC3                mov     eax, ebx
0040D915   .  56                  push    esi
0040D916   .  83E3 FE             and     ebx, FFFFFFFE
0040D919   .  57                  push    edi
0040D91A   .  8965 F4             mov     dword ptr [ebp-C], esp
0040D91D   .  83E0 01             and     eax, 1
0040D920   .  8B33                mov     esi, dword ptr [ebx]
0040D922   .  C745 F8 10104000    mov     dword ptr [ebp-8], 00401010
0040D929   .  53                  push    ebx
0040D92A   .  8945 FC             mov     dword ptr [ebp-4], eax
0040D92D   .  895D 08             mov     dword ptr [ebp+8], ebx
0040D930   .  FF56 04             call    dword ptr [esi+4]                              ;  ds:[0040E2F8]=740C25FE (MSVBVM50.BASIC_CLASS_AddRef)
0040D933   .  33FF                xor     edi, edi                                       ;  edi == 0, int sum = 0
0040D935   .  53                  push    ebx
0040D936   .  897D E8             mov     dword ptr [ebp-18], edi
0040D939   .  897D D8             mov     dword ptr [ebp-28], edi
0040D93C   .  897D D4             mov     dword ptr [ebp-2C], edi
0040D93F   .  897D D0             mov     dword ptr [ebp-30], edi
0040D942   .  897D CC             mov     dword ptr [ebp-34], edi
0040D945   .  897D BC             mov     dword ptr [ebp-44], edi                        ;  name
0040D948   .  897D AC             mov     dword ptr [ebp-54], edi
0040D94B   .  897D 9C             mov     dword ptr [ebp-64], edi
0040D94E   .  897D 8C             mov     dword ptr [ebp-74], edi
0040D951   .  89BD 7CFFFFFF       mov     dword ptr [ebp-84], edi
0040D957   .  FF96 04030000       call    dword ptr [esi+304]                            ;  ds:[0040E5F8]=741CC350 (MSVBVM50.741CC350), Get Object
0040D95D   .  8D4D BC             lea     ecx, dword ptr [ebp-44]                        ;  Var_0019F18C:  09 00 00 00 18 F2 19 00 FC A8 72 02 00 00 00 00
0040D960   .  8D55 AC             lea     edx, dword ptr [ebp-54]
0040D963   .  51                  push    ecx                                            ;  参数值 ECX
0040D964   .  52                  push    edx                                            ;  返回值（VT_BSTR） Var_0019F17C  (08 00) 00 00 F4 E2 40 00 (74 48 6C 00) FC A8 72 02，指向大写的用户名
0040D965   .  8945 C4             mov     dword ptr [ebp-3C], eax                        ;  引用地址
0040D968   .  C745 BC 09000000    mov     dword ptr [ebp-44], 9                          ;  数据类型: VT_DISPATCH
0040D96F   .  FF15 3CF14000       call    dword ptr [<&MSVBVM50.#528>]                   ;  ds:[0040F13C]=7419F8B3 (MSVBVM50.rtcUpperCaseVar)，将用户名转换成大写
0040D975   .  8D45 AC             lea     eax, dword ptr [ebp-54]
0040D978   .  50                  push    eax                                            ;  eax == （VT_BSTR） Var_0019F17C  (08 00) 00 00 F4 E2 40 00 (74 48 6C 00) FC A8 72 02，指向大写的用户名
0040D979   .  FF15 F4F04000       call    dword ptr [<&MSVBVM50.__vbaStrVarMove>]        ;  (MSVBVM50.__vbaStrVarMove), EAX ===> "SOLLY"
0040D97F   .  8B1D 8CF14000       mov     ebx, dword ptr [<&MSVBVM50.__vbaStrMove>]      ;  MSVBVM50.__vbaStrMove
0040D985   .  8BD0                mov     edx, eax                                       ;  src (edx)
0040D987   .  8D4D D8             lea     ecx, dword ptr [ebp-28]                        ;  dest (ecx) ecx ===> "SOLLY"
0040D98A   .  FFD3                call    ebx                                            ;  (MSVBVM50.__vbaStrVarMove); <&MSVBVM50.__vbaStrMove>
0040D98C   .  8D4D AC             lea     ecx, dword ptr [ebp-54]
0040D98F   .  8D55 BC             lea     edx, dword ptr [ebp-44]
0040D992   .  51                  push    ecx
0040D993   .  52                  push    edx
0040D994   .  6A 02               push    2
0040D996   .  FF15 FCF04000       call    dword ptr [<&MSVBVM50.__vbaFreeVarList>]       ;  MSVBVM50.__vbaFreeVarList
0040D99C   .  8B45 D8             mov     eax, dword ptr [ebp-28]                        ;  eax ===> "SOLLY"
0040D99F   .  83C4 0C             add     esp, 0C
0040D9A2   .  50                  push    eax                                            ; /String
0040D9A3   .  FF15 F8F04000       call    dword ptr [<&MSVBVM50.__vbaLenBstr>]           ; \__vbaLenBstr，这里取得用户名的长度
0040D9A9   .  8BC8                mov     ecx, eax                                       ;  ecx == 0x00000005，用户名的长度
0040D9AB   .  FF15 44F14000       call    dword ptr [<&MSVBVM50.__vbaI2I4>]              ;  MSVBVM50.__vbaI2I4
0040D9B1   .  8985 48FFFFFF       mov     dword ptr [ebp-B8], eax                        ;  eax == 0x0005，用户名的长度
0040D9B7   .  BE 01000000         mov     esi, 1                                         ;  int i=1
0040D9BC   >  66:3BB5 48FFFFFF    cmp     si, word ptr [ebp-B8]                          ;  while (i<=len(name)) //// 开始循环计算
0040D9C3   .  0F8F 3A010000       jg      0040DB03
0040D9C9   .  8D4D D8             lea     ecx, dword ptr [ebp-28]                        ;  [ecx] ===> "SOLLY"
0040D9CC   .  8D55 BC             lea     edx, dword ptr [ebp-44]
0040D9CF   .  0FBFC6              movsx   eax, si                                        ;  int index = i
0040D9D2   .  894D 84             mov     dword ptr [ebp-7C], ecx
0040D9D5   .  52                  push    edx                                            ; /Length8, [edx] === 0
0040D9D6   .  8D8D 7CFFFFFF       lea     ecx, dword ptr [ebp-84]                        ; |
0040D9DC   .  50                  push    eax                                            ; |Start == i
0040D9DD   .  8D55 AC             lea     edx, dword ptr [ebp-54]                        ; |
0040D9E0   .  51                  push    ecx                                            ; |dString8, [[eax]] ===> "SOLLY"
0040D9E1   .  52                  push    edx                                            ; |RetBUFFER
0040D9E2   .  C745 C4 01000000    mov     dword ptr [ebp-3C], 1                          ; |
0040D9E9   .  C745 BC 02000000    mov     dword ptr [ebp-44], 2                          ; |
0040D9F0   .  C785 7CFFFFFF 08400>mov     dword ptr [ebp-84], 4008                       ; |
0040D9FA   .  FF15 30F14000       call    dword ptr [<&MSVBVM50.#632>]                   ; \rtcMidCharVar(name, i, 1)，在循环中依次取出用户名的字符，并取得其 ASCII 码值
0040DA00   .  8D45 AC             lea     eax, dword ptr [ebp-54]
0040DA03   .  50                  push    eax                                            ;  eax === (0019F17C  (08 00) 72 02 02 00 00 00 (CC 43 6C 00) 00 00 00 00) ===> "S"
0040DA04   .  FF15 F4F04000       call    dword ptr [<&MSVBVM50.__vbaStrVarMove>]        ;  MSVBVM50.__vbaStrVarMove
0040DA0A   .  8BD0                mov     edx, eax                                       ;  eax ===> "S"
0040DA0C   .  8D4D E8             lea     ecx, dword ptr [ebp-18]                        ;  ecx ===> "S"
0040DA0F   .  FFD3                call    ebx                                            ;  ebx=740DF8DA (MSVBVM50.__vbaStrMove)
0040DA11   .  8D4D AC             lea     ecx, dword ptr [ebp-54]
0040DA14   .  8D55 BC             lea     edx, dword ptr [ebp-44]
0040DA17   .  51                  push    ecx
0040DA18   .  52                  push    edx
0040DA19   .  6A 02               push    2
0040DA1B   .  FF15 FCF04000       call    dword ptr [<&MSVBVM50.__vbaFreeVarList>]       ;  MSVBVM50.__vbaFreeVarList
0040DA21   .  8B45 E8             mov     eax, dword ptr [ebp-18]                        ;  eax ===> "S"，name[i]。
0040DA24   .  83C4 0C             add     esp, 0C
0040DA27   .  50                  push    eax                                            ; /String
0040DA28   .  FF15 08F14000       call    dword ptr [<&MSVBVM50.#516>]                   ; \(MSVBVM50.rtcAnsiValueBstr), EAX == ASC(name[i])，取得用户名中字符的 ASCII 码值
0040DA2E   .  66:2D 4000          sub     ax, 40                                         ;  EAX == ASC(name[i]) - 0x40
0040DA32   .  0F80 A1020000       jo      0040DCD9
0040DA38   .  66:69C0 8200        imul    ax, ax, 82                                     ;  AX = ((ASC(name[i]) - 0x40) * 0x82)
0040DA3D   .  0F80 96020000       jo      0040DCD9
0040DA43   .  66:03C7             add     ax, di
0040DA46   .  0F80 8D020000       jo      0040DCD9
0040DA4C   .  66:05 5000          add     ax, 50
0040DA50   .  0F80 83020000       jo      0040DCD9
0040DA56   .  66:05 5000          add     ax, 50
0040DA5A   .  0F80 79020000       jo      0040DCD9
0040DA60   .  66:05 5000          add     ax, 50
0040DA64   .  0F80 6F020000       jo      0040DCD9
0040DA6A   .  66:05 5000          add     ax, 50
0040DA6E   .  0F80 65020000       jo      0040DCD9
0040DA74   .  66:05 5000          add     ax, 50
0040DA78   .  0F80 5B020000       jo      0040DCD9
0040DA7E   .  66:05 5000          add     ax, 50
0040DA82   .  0F80 51020000       jo      0040DCD9
0040DA88   .  66:05 5000          add     ax, 50
0040DA8C   .  0F80 47020000       jo      0040DCD9
0040DA92   .  66:05 5000          add     ax, 50
0040DA96   .  0F80 3D020000       jo      0040DCD9
0040DA9C   .  66:05 5000          add     ax, 50
0040DAA0   .  0F80 33020000       jo      0040DCD9
0040DAA6   .  66:05 5000          add     ax, 50
0040DAAA   .  0F80 29020000       jo      0040DCD9
0040DAB0   .  66:05 5000          add     ax, 50
0040DAB4   .  0F80 1F020000       jo      0040DCD9
0040DABA   .  66:05 5000          add     ax, 50
0040DABE   .  0F80 15020000       jo      0040DCD9
0040DAC4   .  66:05 5000          add     ax, 50
0040DAC8   .  0F80 0B020000       jo      0040DCD9
0040DACE   .  66:05 5000          add     ax, 50
0040DAD2   .  0F80 01020000       jo      0040DCD9
0040DAD8   .  66:05 5000          add     ax, 50
0040DADC   .  0F80 F7010000       jo      0040DCD9
0040DAE2   .  66:05 5000          add     ax, 50
0040DAE6   .  0F80 ED010000       jo      0040DCD9
0040DAEC   .  8BF8                mov     edi, eax                                       ;  sum = sum + ((ASC(name[i]) - 0x40) * 0x82) + 0x50*0x10
0040DAEE   .  B8 01000000         mov     eax, 1
0040DAF3   .  66:03C6             add     ax, si                                         ;  i++
0040DAF6   .  0F80 DD010000       jo      0040DCD9
0040DAFC   .  8BF0                mov     esi, eax
0040DAFE   .^ E9 B9FEFFFF         jmp     0040D9BC                                       ;  Wend ///循环结束，计算累加值 sum = sum + 0x50*0x10 + ((ASC(name[i]) - 0x40) * 0x82), 循环次数为用户名长度, edi == sum == 0x00004326 == 17190
0040DB03   >  8B45 08             mov     eax, dword ptr [ebp+8]
0040DB06   .  50                  push    eax
0040DB07   .  8B08                mov     ecx, dword ptr [eax]
0040DB09   .  FF91 FC020000       call    dword ptr [ecx+2FC]                            ;  ds:[0040E5F0]=741CC340 (MSVBVM50.741CC340)
0040DB0F   .  8D55 CC             lea     edx, dword ptr [ebp-34]
0040DB12   .  50                  push    eax
0040DB13   .  52                  push    edx
0040DB14   .  FF15 20F14000       call    dword ptr [<&MSVBVM50.__vbaObjSet>]            ;  MSVBVM50.__vbaObjSet
0040DB1A   .  8BF0                mov     esi, eax
0040DB1C   .  8D4D D4             lea     ecx, dword ptr [ebp-2C]
0040DB1F   .  51                  push    ecx
0040DB20   .  56                  push    esi
0040DB21   .  8B06                mov     eax, dword ptr [esi]
0040DB23   .  FF90 A0000000       call    dword ptr [eax+A0]                             ;  ds:[02723378]=7411A5B6 (MSVBVM50.7411A5B6)，Get TextBox.Text
0040DB29   .  85C0                test    eax, eax
0040DB2B   .  7D 12               jge     short 0040DB3F
0040DB2D   .  68 A0000000         push    0A0
0040DB32   .  68 10D44000         push    0040D410
0040DB37   .  56                  push    esi
0040DB38   .  50                  push    eax
0040DB39   .  FF15 14F14000       call    dword ptr [<&MSVBVM50.__vbaHresultCheckObj>]   ;  MSVBVM50.__vbaHresultCheckObj
0040DB3F   >  8B55 D4             mov     edx, dword ptr [ebp-2C]                        ;  edx ===> "7878787878"
0040DB42   .  52                  push    edx                                            ;  StrCmp 参数2, edx ===> "7878787878"
0040DB43   .  57                  push    edi                                            ;  str(sum)参数
0040DB44   .  FF15 E8F04000       call    dword ptr [<&MSVBVM50.__vbaStrI2>]             ;  MSVBVM50.__vbaStrI2
0040DB4A   .  8BD0                mov     edx, eax                                       ;  eax ===> "17190"
0040DB4C   .  8D4D D0             lea     ecx, dword ptr [ebp-30]
0040DB4F   .  FFD3                call    ebx                                            ;  (MSVBVM50.__vbaStrMove)
0040DB51   .  50                  push    eax                                            ;  StrCmp 参数1， eax ===> "17190"，
0040DB52   .  FF15 40F14000       call    dword ptr [<&MSVBVM50.__vbaStrCmp>]            ;  MSVBVM50.__vbaStrCmp
0040DB58   .  8BF0                mov     esi, eax                                       ;  eax == 0， 相等；eax == 1，不相等
0040DB5A   .  8D45 D0             lea     eax, dword ptr [ebp-30]
0040DB5D   .  F7DE                neg     esi
0040DB5F   .  1BF6                sbb     esi, esi
0040DB61   .  8D4D D4             lea     ecx, dword ptr [ebp-2C]
0040DB64   .  50                  push    eax
0040DB65   .  46                  inc     esi
0040DB66   .  51                  push    ecx
0040DB67   .  6A 02               push    2
0040DB69   .  F7DE                neg     esi                                            ;  esi == 0，不相等
0040DB6B   .  FF15 78F14000       call    dword ptr [<&MSVBVM50.__vbaFreeStrList>]       ;  MSVBVM50.__vbaFreeStrList
0040DB71   .  83C4 0C             add     esp, 0C
0040DB74   .  8D4D CC             lea     ecx, dword ptr [ebp-34]
0040DB77   .  FF15 9CF14000       call    dword ptr [<&MSVBVM50.__vbaFreeObj>]           ;  MSVBVM50.__vbaFreeObj
0040DB7D   .  B9 04000280         mov     ecx, 80020004
0040DB82   .  B8 0A000000         mov     eax, 0A
0040DB87   .  66:85F6             test    si, si                                         ;  检查注册码校验结果, si == 0，不相等
0040DB8A   .  894D 94             mov     dword ptr [ebp-6C], ecx
0040DB8D   .  8945 8C             mov     dword ptr [ebp-74], eax
0040DB90   .  894D A4             mov     dword ptr [ebp-5C], ecx
0040DB93   .  8945 9C             mov     dword ptr [ebp-64], eax
0040DB96   .  894D B4             mov     dword ptr [ebp-4C], ecx
0040DB99   .  8945 AC             mov     dword ptr [ebp-54], eax
0040DB9C   .  74 5E               je      short 0040DBFC
0040DB9E   .  8B35 10F14000       mov     esi, dword ptr [<&MSVBVM50.__vbaStrCat>]       ;  MSVBVM50.__vbaStrCat
0040DBA4   .  68 24D44000         push    0040D424                                       ;  nice going!!! you cracked the crackme!
0040DBA9   .  68 6CD34000         push    0040D36C                                       ; /\n\n
0040DBAE   .  FFD6                call    esi                                            ; \__vbaStrCat
0040DBB0   .  8BD0                mov     edx, eax
0040DBB2   .  8D4D D4             lea     ecx, dword ptr [ebp-2C]
0040DBB5   .  FFD3                call    ebx
0040DBB7   .  50                  push    eax
0040DBB8   .  68 84D44000         push    0040D484                                       ;  contact hackerg or death to get your present...
0040DBBD   .  FFD6                call    esi
0040DBBF   .  8945 C4             mov     dword ptr [ebp-3C], eax
0040DBC2   .  8D55 8C             lea     edx, dword ptr [ebp-74]
0040DBC5   .  8D45 9C             lea     eax, dword ptr [ebp-64]
0040DBC8   .  52                  push    edx
0040DBC9   .  8D4D AC             lea     ecx, dword ptr [ebp-54]
0040DBCC   .  50                  push    eax
0040DBCD   .  51                  push    ecx
0040DBCE   .  8D55 BC             lea     edx, dword ptr [ebp-44]
0040DBD1   .  6A 00               push    0
0040DBD3   .  52                  push    edx
0040DBD4   .  C745 BC 08000000    mov     dword ptr [ebp-44], 8
0040DBDB   .  FF15 1CF14000       call    dword ptr [<&MSVBVM50.#595>]                   ;  MSVBVM50.rtcMsgBox
0040DBE1   .  8D4D D4             lea     ecx, dword ptr [ebp-2C]
0040DBE4   .  FF15 A0F14000       call    dword ptr [<&MSVBVM50.__vbaFreeStr>]           ;  MSVBVM50.__vbaFreeStr
0040DBEA   .  8D45 8C             lea     eax, dword ptr [ebp-74]
0040DBED   .  8D4D 9C             lea     ecx, dword ptr [ebp-64]
0040DBF0   .  50                  push    eax
0040DBF1   .  8D55 AC             lea     edx, dword ptr [ebp-54]
0040DBF4   .  51                  push    ecx
0040DBF5   .  8D45 BC             lea     eax, dword ptr [ebp-44]
0040DBF8   .  52                  push    edx
0040DBF9   .  50                  push    eax
0040DBFA   .  EB 5C               jmp     short 0040DC58
0040DBFC   >  8B35 10F14000       mov     esi, dword ptr [<&MSVBVM50.__vbaStrCat>]       ;  MSVBVM50.__vbaStrCat
0040DC02   .  68 E8D44000         push    0040D4E8                                       ;  you lamer!!! cant crack this?!
0040DC07   .  68 6CD34000         push    0040D36C                                       ; /\n\n
0040DC0C   .  FFD6                call    esi                                            ; \__vbaStrCat()
0040DC0E   .  8BD0                mov     edx, eax
0040DC10   .  8D4D D4             lea     ecx, dword ptr [ebp-2C]
0040DC13   .  FFD3                call    ebx
0040DC15   .  50                  push    eax
0040DC16   .  68 2CD54000         push    0040D52C                                       ;  try again...
0040DC1B   .  FFD6                call    esi                                            ;  __vbaStrCat()
0040DC1D   .  8D4D 8C             lea     ecx, dword ptr [ebp-74]
0040DC20   .  8945 C4             mov     dword ptr [ebp-3C], eax
0040DC23   .  8D55 9C             lea     edx, dword ptr [ebp-64]
0040DC26   .  51                  push    ecx
0040DC27   .  8D45 AC             lea     eax, dword ptr [ebp-54]
0040DC2A   .  52                  push    edx
0040DC2B   .  50                  push    eax
0040DC2C   .  8D4D BC             lea     ecx, dword ptr [ebp-44]
0040DC2F   .  6A 00               push    0
0040DC31   .  51                  push    ecx
0040DC32   .  C745 BC 08000000    mov     dword ptr [ebp-44], 8
0040DC39   .  FF15 1CF14000       call    dword ptr [<&MSVBVM50.#595>]                   ;  (MSVBVM50.rtcMsgBox)
0040DC3F   .  8D4D D4             lea     ecx, dword ptr [ebp-2C]
0040DC42   .  FF15 A0F14000       call    dword ptr [<&MSVBVM50.__vbaFreeStr>]           ;  MSVBVM50.__vbaFreeStr
0040DC48   .  8D55 8C             lea     edx, dword ptr [ebp-74]
0040DC4B   .  8D45 9C             lea     eax, dword ptr [ebp-64]
0040DC4E   .  52                  push    edx
0040DC4F   .  8D4D AC             lea     ecx, dword ptr [ebp-54]
0040DC52   .  50                  push    eax
0040DC53   .  8D55 BC             lea     edx, dword ptr [ebp-44]
0040DC56   .  51                  push    ecx
0040DC57   .  52                  push    edx
0040DC58   >  6A 04               push    4
0040DC5A   .  FF15 FCF04000       call    dword ptr [<&MSVBVM50.__vbaFreeVarList>]       ;  MSVBVM50.__vbaFreeVarList
0040DC60   .  83C4 14             add     esp, 14
0040DC63   .  C745 FC 00000000    mov     dword ptr [ebp-4], 0
0040DC6A   .  68 BADC4000         push    0040DCBA
0040DC6F   .  EB 38               jmp     short 0040DCA9
0040DC71   .  8D45 D0             lea     eax, dword ptr [ebp-30]
0040DC74   .  8D4D D4             lea     ecx, dword ptr [ebp-2C]
0040DC77   .  50                  push    eax
0040DC78   .  51                  push    ecx
0040DC79   .  6A 02               push    2
0040DC7B   .  FF15 78F14000       call    dword ptr [<&MSVBVM50.__vbaFreeStrList>]       ;  MSVBVM50.__vbaFreeStrList
0040DC81   .  83C4 0C             add     esp, 0C
0040DC84   .  8D4D CC             lea     ecx, dword ptr [ebp-34]
0040DC87   .  FF15 9CF14000       call    dword ptr [<&MSVBVM50.__vbaFreeObj>]           ;  MSVBVM50.__vbaFreeObj
0040DC8D   .  8D55 8C             lea     edx, dword ptr [ebp-74]
0040DC90   .  8D45 9C             lea     eax, dword ptr [ebp-64]
0040DC93   .  52                  push    edx
0040DC94   .  8D4D AC             lea     ecx, dword ptr [ebp-54]
0040DC97   .  50                  push    eax
0040DC98   .  8D55 BC             lea     edx, dword ptr [ebp-44]
0040DC9B   .  51                  push    ecx
0040DC9C   .  52                  push    edx
0040DC9D   .  6A 04               push    4
0040DC9F   .  FF15 FCF04000       call    dword ptr [<&MSVBVM50.__vbaFreeVarList>]       ;  MSVBVM50.__vbaFreeVarList
0040DCA5   .  83C4 14             add     esp, 14
0040DCA8   .  C3                  retn
0040DCA9   >  8B35 A0F14000       mov     esi, dword ptr [<&MSVBVM50.__vbaFreeStr>]      ;  MSVBVM50.__vbaFreeStr
0040DCAF   .  8D4D E8             lea     ecx, dword ptr [ebp-18]
0040DCB2   .  FFD6                call    esi                                            ;  <&MSVBVM50.__vbaFreeStr>
0040DCB4   .  8D4D D8             lea     ecx, dword ptr [ebp-28]
0040DCB7   .  FFE6                jmp     esi
0040DCB9   .  C3                  retn
0040DCBA   .  8B45 08             mov     eax, dword ptr [ebp+8]
0040DCBD   .  50                  push    eax
0040DCBE   .  8B08                mov     ecx, dword ptr [eax]
0040DCC0   .  FF51 08             call    dword ptr [ecx+8]
0040DCC3   .  8B4D EC             mov     ecx, dword ptr [ebp-14]
0040DCC6   .  8B45 FC             mov     eax, dword ptr [ebp-4]
0040DCC9   .  5F                  pop     edi
0040DCCA   .  5E                  pop     esi
0040DCCB   .  64:890D 00000000    mov     dword ptr fs:[0], ecx
0040DCD2   .  5B                  pop     ebx
0040DCD3   .  8BE5                mov     esp, ebp
0040DCD5   .  5D                  pop     ebp
0040DCD6   .  C2 0400             retn    4
0040DCD9   >  FF15 6CF14000       call    dword ptr [<&MSVBVM50.__vbaErrorOverflow>]     ;  MSVBVM50.__vbaErrorOverflow
0040DCDF   .  90                  nop
0040DCE0   >  55                  push    ebp
0040DCE1   .  8BEC                mov     ebp, esp
0040DCE3   .  83EC 0C             sub     esp, 0C
0040DCE6   .  68 36104000         push    <jmp.&MSVBVM50.__vbaExceptHandler>             ;  SE 处理程序安装
0040DCEB   .  64:A1 00000000      mov     eax, dword ptr fs:[0]
0040DCF1   .  50                  push    eax
0040DCF2   .  64:8925 00000000    mov     dword ptr fs:[0], esp
0040DCF9   .  83EC 08             sub     esp, 8
0040DCFC   .  8B45 08             mov     eax, dword ptr [ebp+8]
0040DCFF   .  53                  push    ebx
0040DD00   .  8BC8                mov     ecx, eax
0040DD02   .  56                  push    esi
0040DD03   .  24 FE               and     al, 0FE
0040DD05   .  57                  push    edi
0040DD06   .  8965 F4             mov     dword ptr [ebp-C], esp
0040DD09   .  83E1 01             and     ecx, 1
0040DD0C   .  8B10                mov     edx, dword ptr [eax]
0040DD0E   .  C745 F8 20104000    mov     dword ptr [ebp-8], 00401020
0040DD15   .  50                  push    eax
0040DD16   .  894D FC             mov     dword ptr [ebp-4], ecx
0040DD19   .  8945 08             mov     dword ptr [ebp+8], eax
0040DD1C   .  FF52 04             call    dword ptr [edx+4]
0040DD1F   .  FF15 00F14000       call    dword ptr [<&MSVBVM50.__vbaEnd>]               ;  MSVBVM50.__vbaEnd
0040DD25   .  C745 FC 00000000    mov     dword ptr [ebp-4], 0
0040DD2C   .  8B45 08             mov     eax, dword ptr [ebp+8]
0040DD2F   .  50                  push    eax
0040DD30   .  8B08                mov     ecx, dword ptr [eax]
0040DD32   .  FF51 08             call    dword ptr [ecx+8]
0040DD35   .  8B4D EC             mov     ecx, dword ptr [ebp-14]
0040DD38   .  8B45 FC             mov     eax, dword ptr [ebp-4]
0040DD3B   .  5F                  pop     edi
0040DD3C   .  5E                  pop     esi
0040DD3D   .  64:890D 00000000    mov     dword ptr fs:[0], ecx
0040DD44   .  5B                  pop     ebx
0040DD45   .  8BE5                mov     esp, ebp
0040DD47   .  5D                  pop     ebp
0040DD48   .  C2 0800             retn    8

其中，关键是下面这一段：

[Asm] 纯文本查看 复制代码

0040D99C   .  8B45 D8            mov     eax, dword ptr [ebp-28]                          ;  eax ===> "SOLLY"
0040D99F   .  83C4 0C            add     esp, 0C
0040D9A2   .  50                 push    eax                                              ; /String
0040D9A3   .  FF15 F8F04000      call    dword ptr [<&MSVBVM50.__vbaLenBstr>]             ; \__vbaLenBstr，这里取得用户名的长度
0040D9A9   .  8BC8               mov     ecx, eax                                         ;  ecx == 0x00000005，用户名的长度
0040D9AB   .  FF15 44F14000      call    dword ptr [<&MSVBVM50.__vbaI2I4>]                ;  MSVBVM50.__vbaI2I4
0040D9B1   .  8985 48FFFFFF      mov     dword ptr [ebp-B8], eax                          ;  eax == 0x0005，用户名的长度
0040D9B7   .  BE 01000000        mov     esi, 1                                           ;  int i=1
0040D9BC   >  66:3BB5 48FFFFFF   cmp     si, word ptr [ebp-B8]                            ;  While (i<=len(name))  //// 开始循环计算
0040D9C3   .  0F8F 3A010000      jg      0040DB03
0040D9C9   .  8D4D D8            lea     ecx, dword ptr [ebp-28]                          ;  [ecx] ===> "SOLLY"
0040D9CC   .  8D55 BC            lea     edx, dword ptr [ebp-44]
0040D9CF   .  0FBFC6             movsx   eax, si                                          ;  int index = i
0040D9D2   .  894D 84            mov     dword ptr [ebp-7C], ecx
0040D9D5   .  52                 push    edx                                              ; /Length8, [edx] === 0
0040D9D6   .  8D8D 7CFFFFFF      lea     ecx, dword ptr [ebp-84]                          ; |
0040D9DC   .  50                 push    eax                                              ; |Start == i
0040D9DD   .  8D55 AC            lea     edx, dword ptr [ebp-54]                          ; |
0040D9E0   .  51                 push    ecx                                              ; |dString8, [[eax]] ===> "SOLLY"
0040D9E1   .  52                 push    edx                                              ; |RetBUFFER
0040D9E2   .  C745 C4 01000000   mov     dword ptr [ebp-3C], 1                            ; |
0040D9E9   .  C745 BC 02000000   mov     dword ptr [ebp-44], 2                            ; |
0040D9F0   .  C785 7CFFFFFF 0840>mov     dword ptr [ebp-84], 4008                         ; |
0040D9FA   .  FF15 30F14000      call    dword ptr [<&MSVBVM50.#632>]                     ; \rtcMidCharVar(name, i, 1)，在循环中依次取出用户名的字符，并取得其 ASCII 码值
0040DA00   .  8D45 AC            lea     eax, dword ptr [ebp-54]
0040DA03   .  50                 push    eax                                              ;  eax === (0019F17C  (08 00) 72 02 02 00 00 00 (CC 43 6C 00) 00 00 00 00) ===> "S"
0040DA04   .  FF15 F4F04000      call    dword ptr [<&MSVBVM50.__vbaStrVarMove>]          ;  MSVBVM50.__vbaStrVarMove
0040DA0A   .  8BD0               mov     edx, eax                                         ;  eax ===> "S"
0040DA0C   .  8D4D E8            lea     ecx, dword ptr [ebp-18]                          ;  ecx ===> "S"
0040DA0F   .  FFD3               call    ebx                                              ;  ebx=740DF8DA (MSVBVM50.__vbaStrMove)
0040DA11   .  8D4D AC            lea     ecx, dword ptr [ebp-54]
0040DA14   .  8D55 BC            lea     edx, dword ptr [ebp-44]
0040DA17   .  51                 push    ecx
0040DA18   .  52                 push    edx
0040DA19   .  6A 02              push    2
0040DA1B   .  FF15 FCF04000      call    dword ptr [<&MSVBVM50.__vbaFreeVarList>]         ;  MSVBVM50.__vbaFreeVarList
0040DA21   .  8B45 E8            mov     eax, dword ptr [ebp-18]                          ;  eax ===> "S" ，name[i]
0040DA24   .  83C4 0C            add     esp, 0C
0040DA27   .  50                 push    eax                                              ; /String
0040DA28   .  FF15 08F14000      call    dword ptr [<&MSVBVM50.#516>]                     ; \(MSVBVM50.rtcAnsiValueBstr)，取得用户名中字符的 ASCII 码值
0040DA2E   .  66:2D 4000         sub     ax, 40                                           ;  EAX == ASC(name[i]) - 0x40
0040DA32   .  0F80 A1020000      jo      0040DCD9
0040DA38   .  66:69C0 8200       imul    ax, ax, 82                                       ;  AX = ((ASC(name[i]) - 0x40) * 0x82)
0040DA3D   .  0F80 96020000      jo      0040DCD9
0040DA43   .  66:03C7            add     ax, di
0040DA46   .  0F80 8D020000      jo      0040DCD9
0040DA4C   .  66:05 5000         add     ax, 50
0040DA50   .  0F80 83020000      jo      0040DCD9
0040DA56   .  66:05 5000         add     ax, 50
0040DA5A   .  0F80 79020000      jo      0040DCD9
0040DA60   .  66:05 5000         add     ax, 50
0040DA64   .  0F80 6F020000      jo      0040DCD9
0040DA6A   .  66:05 5000         add     ax, 50
0040DA6E   .  0F80 65020000      jo      0040DCD9
0040DA74   .  66:05 5000         add     ax, 50
0040DA78   .  0F80 5B020000      jo      0040DCD9
0040DA7E   .  66:05 5000         add     ax, 50
0040DA82   .  0F80 51020000      jo      0040DCD9
0040DA88   .  66:05 5000         add     ax, 50
0040DA8C   .  0F80 47020000      jo      0040DCD9
0040DA92   .  66:05 5000         add     ax, 50
0040DA96   .  0F80 3D020000      jo      0040DCD9
0040DA9C   .  66:05 5000         add     ax, 50
0040DAA0   .  0F80 33020000      jo      0040DCD9
0040DAA6   .  66:05 5000         add     ax, 50
0040DAAA   .  0F80 29020000      jo      0040DCD9
0040DAB0   .  66:05 5000         add     ax, 50
0040DAB4   .  0F80 1F020000      jo      0040DCD9
0040DABA   .  66:05 5000         add     ax, 50
0040DABE   .  0F80 15020000      jo      0040DCD9
0040DAC4   .  66:05 5000         add     ax, 50
0040DAC8   .  0F80 0B020000      jo      0040DCD9
0040DACE   .  66:05 5000         add     ax, 50
0040DAD2   .  0F80 01020000      jo      0040DCD9
0040DAD8   .  66:05 5000         add     ax, 50
0040DADC   .  0F80 F7010000      jo      0040DCD9
0040DAE2   .  66:05 5000         add     ax, 50
0040DAE6   .  0F80 ED010000      jo      0040DCD9
0040DAEC   .  8BF8               mov     edi, eax                                         ;  sum = sum + 0x50*0x10 + ((ASC(name[i]) - 0x40) * 0x82)
0040DAEE   .  B8 01000000        mov     eax, 1
0040DAF3   .  66:03C6            add     ax, si                                           ;  i++
0040DAF6   .  0F80 DD010000      jo      0040DCD9
0040DAFC   .  8BF0               mov     esi, eax
0040DAFE   .^ E9 B9FEFFFF        jmp     0040D9BC                                         ;  Wend ///循环结束，计算累加值 sum = sum + 0x50*0x10 + ((ASC(name[i]) - 0x40) * 0x82), 循环次数为用户名长度, edi == sum == 0x00004326 == 17190

这一段代码，首先得用户名的长度（call __vbaLenBstr()），然后一个循环，把用户名中的字符转换成大写后，进行计算，并累加后，就得到了注册码，累加公式如下：

[Visual Basic] 纯文本查看 复制代码

sum = sum + &H50*&H10 + ((ASC(name[i]) - &H40) * &H82)

下面是用 C ++ 实现的注册机，用 Dev-C++ 调试通过：

[C++] 纯文本查看 复制代码

#include <iostream>
#include <string.h>

int getSN(char *name);

int main(int argc, char** argv) {
        char name[] = "solly"; /// 名字自定义 
        getSN(name);
        
        return 0;
}

int getSN(char *name) {
        char uprName[256]; 
        int sum = 0;
        int n = strlen(name);
        if(n>255) {
                n = 255;
        }
        strncpy(uprName, name, n);
        uprName[n] = '\0';
        strupr(uprName);   /// 转换成大写 
        for (int i=0; i<n; i++) {
                //sum += ((int)uprName[i] - 0x40) * 0x82 + 0x50*0x10;
                sum += ((int)uprName[i] - 64) * 130 + 1280;
        }
        printf("name: %s\ncode: %d", name, sum);
        
        return 0;
}

完毕！！！

yjian415 · 发表于 2019-7-12 15:45

厉害，顶一个

无为无敌 · 发表于 2019-7-13 11:44

老哥，C++学习的可以

帐号		自动登录	找回密码
密码			注册[Register]

[原创] 160 个 CrackMe 之 064 - execution (VB5 Native)算法分析和注册机实现

免费评分