160个练手CrackMe-034

全栈程序员-站长 • 2025年6月18日下午7:15 • 未分类 • 阅读 4

1、无壳

FileKey类型

2、OD载入

00 |. 6A 00 push 0x0 ; /hTemplateFile = NULL 00 |. 68 push 0x80 ; |Attributes = NORMAL 0040101D |. 6A 03 push 0x3 ; |Mode = OPEN_EXISTING 0040101F |. 6A 00 push 0x0 ; |pSecurity = NULL 00 |. 6A 03 push 0x3 ; |ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE 00 |. 68 000000C0 push 0xC0000000 ; |Access = GENERIC_READ|GENERIC_WRITE 00 |. 68 D push Cruehead.004020D7 ; |CRACKME3.KEY 0040102D |. E8 call <jmp.&KERNEL32.CreateFileA> ; \CreateFileA 00 |. 83F8 FF cmp eax,-0x1 00 |. 75 0C jnz XCruehead.00 00 |> 68 0E push Cruehead.0040210E ; CrackMe v3.0 0040103C |. E8 B call Cruehead.004012F5 ; " - Uncracked" 00 |. EB 6B jmp XCruehead.004010AE 00 |> A3 F mov dword ptr ds:[0x4020F5],eax ; 文件句柄 00 |. B8 mov eax,0x12 0040104D |. BB 0 mov ebx,Cruehead.00 ; ASCII " opqr" 00 |. 6A 00 push 0x0 ; /pOverlapped = NULL 00 |. 68 A0 push Cruehead.004021A0 ; |pBytesRead = Cruehead.004021A0 00 |. 50 push eax ; |BytesToRead => 12 (18.) 0040105A |. 53 push ebx ; |Buffer => Cruehead.00 0040105B |. FF35 F push dword ptr ds:[0x4020F5] ; |hFile = 000001E8 00 |. E8 call <jmp.&KERNEL32.ReadFile> ; \ReadFile 00 |. 833D A0>cmp dword ptr ds:[0x4021A0],0x12 ; 读取长度 0x12 0040106D |.^ 75 C8 jnz XCruehead.00 0040106F |. 68 0 push Cruehead.00 ;  00 |. E8 call Cruehead.00 ; 处理函数 1 00 |. 8135 F>xor dword ptr ds:[0x4020F9],0x 00 |. 83C4 04 add esp,0x4 00 |. 68 0 push Cruehead.00 ;  0040108B |. E8 AC020000 call Cruehead.0040133C ; 处理函数 2 00 |. 83C4 04 add esp,0x4 00 |. 3B05 F cmp eax,dword ptr ds:[0x4020F9] ; 比较 00 |. 0F94C0 sete al 0040109C |. 50 push eax 0040109D |. 84C0 test al,al 0040109F |.^ 74 96 je XCruehead.00 ; 跳向失败

call 00()处理Serial前14位得到一个值，和Serial的后4位比较，相同成功，不相同失败；

原型：

int call_00(char *serial){ int sum = 0; for(int i = 0; i < 0xE; i++){ serial[i] ^= 0x41 + i; sum += serial[i]; if(serial[i] == 0) break; } return sum ^ 0x; } if(call_00(serial) == *(int *)(serial + 14)) "Y"; else "N";

3、注册机

int call_00(char *serial){ int sum = 0; for(int i = 0; i < 0xE; i++){ serial[i] ^= 0x41 + i; sum += serial[i]; if(serial[i] == 0) break; } return sum ^ 0x; } int main(){ FILE *fp; char serial[15]; int ret; cout << "Please enter a string with a length of 14:" << endl; cin >> serial; fp = fopen("CRACKME3.KEY", "wb+"); fwrite(serial, 0x0E, 1, fp); fflush(fp); ret = call_00(serial); fwrite(&ret, 0x04, 1, fp); // cout << hex << ret; return 0; }