160个练手CrackMe-034
2017-12-03 15:32
197 查看
1、无壳
FileKey类型
2、OD载入
00401016 |. 6A 00 push 0x0 ; /hTemplateFile = NULL 00401018 |. 68 80000000 push 0x80 ; |Attributes = NORMAL 0040101D |. 6A 03 push 0x3 ; |Mode = OPEN_EXISTING 0040101F |. 6A 00 push 0x0 ; |pSecurity = NULL 00401021 |. 6A 03 push 0x3 ; |ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE 00401023 |. 68 000000C0 push 0xC0000000 ; |Access = GENERIC_READ|GENERIC_WRITE 00401028 |. 68 D7204000 push Cruehead.004020D7 ; |CRACKME3.KEY 0040102D |. E8 76040000 call <jmp.&KERNEL32.CreateFileA> ; \CreateFileA 00401032 |. 83F8 FF cmp eax,-0x1 00401035 |. 75 0C jnz XCruehead.00401043 00401037 |> 68 0E214000 push Cruehead.0040210E ; CrackMe v3.0 0040103C |. E8 B4020000 call Cruehead.004012F5 ; " - Uncracked" 00401041 |. EB 6B jmp XCruehead.004010AE 00401043 |> A3 F5204000 mov dword ptr ds:[0x4020F5],eax ; 文件句柄 00401048 |. B8 12000000 mov eax,0x12 0040104D |. BB 08204000 mov ebx,Cruehead.00402008 ; ASCII " opqr" 00401052 |. 6A 00 push 0x0 ; /pOverlapped = NULL 00401054 |. 68 A0214000 push Cruehead.004021A0 ; |pBytesRead = Cruehead.004021A0 00401059 |. 50 push eax ; |BytesToRead => 12 (18.) 0040105A |. 53 push ebx ; |Buffer => Cruehead.00402008 0040105B |. FF35 F5204000 push dword ptr ds:[0x4020F5] ; |hFile = 000001E8 00401061 |. E8 30040000 call <jmp.&KERNEL32.ReadFile> ; \ReadFile 00401066 |. 833D A0214000>cmp dword ptr ds:[0x4021A0],0x12 ; 读取长度 0x12 0040106D |.^ 75 C8 jnz XCruehead.00401037 0040106F |. 68 08204000 push Cruehead.00402008 ; 00401074 |. E8 98020000 call Cruehead.00401311 ; 处理函数 1 00401079 |. 8135 F9204000>xor dword ptr ds:[0x4020F9],0x12345678 00401083 |. 83C4 04 add esp,0x4 00401086 |. 68 08204000 push Cruehead.00402008 ; 0040108B |. E8 AC020000 call Cruehead.0040133C ; 处理函数 2 00401090 |. 83C4 04 add esp,0x4 00401093 |. 3B05 F9204000 cmp eax,dword ptr ds:[0x4020F9] ; 比较 00401099 |. 0F94C0 sete al 0040109C |. 50 push eax 0040109D |. 84C0 test al,al 0040109F |.^ 74 96 je XCruehead.00401037 ; 跳向失败
call 00401311()处理Serial前14位得到一个值,和Serial的后4位比较,相同成功,不相同失败;
原型:
int call_00401311(char *serial){ int sum = 0; for(int i = 0; i < 0xE; i++){ serial[i] ^= 0x41 + i; sum += serial[i]; if(serial[i] == 0) break; } return sum ^ 0x12345678; } if(call_00401311(serial) == *(int *)(serial + 14)) "Y"; else "N";
3、注册机
int call_00401311(char *serial){ int sum = 0; for(int i = 0; i < 0xE; i++){ serial[i] ^= 0x41 + i; sum += serial[i]; if(serial[i] == 0) break; } return sum ^ 0x12345678; } int main(){ FILE *fp; char serial[15]; int ret; cout << "Please enter a string with a length of 14:" << endl; cin >> serial; fp = fopen("CRACKME3.KEY", "wb+"); fwrite(serial, 0x0E, 1, fp); fflush(fp); ret = call_00401311(serial); fwrite(&ret, 0x04, 1, fp); // cout << hex << ret; return 0; }
相关文章推荐
- 160个练手CrackMe-010
- 160个练手CrackMe-022
- 160个练手CrackMe-028
- 160个练手CrackMe-049
- 160个练手CrackMe-029
- 160个练手CrackMe-035
- 160个练手CrackMe-050
- 160个练手CrackMe-011
- 160个练手CrackMe-023
- 160个练手CrackMe-030
- 160个练手CrackMe-036
- 160个练手CrackMe-041
- 160个练手CrackMe-051
- 160个练手CrackMe-012
- 160个练手CrackMe-042
- 160个练手CrackMe-005
- 160个练手CrackMe-013
- 160个练手CrackMe-037
- 160个练手CrackMe-043
- 160个练手CrackMe-006