破解，运行下断点 bp MessgeBoxA，输入52PoJie.Cn，check
断在
00007FFD1C8236A0 | sub rsp,38 |
00007FFD1C8236A4 | xor r11d,r11d |
00007FFD1C8236A7 | cmp dword ptr ds:[7FFD1C839104],r11d |
00007FFD1C8236AE | je user32.7FFD1C8236DE |
00007FFD1C8236B0 | mov rax,qword ptr gs:[30]
看堆栈返回到 00000001400010EB
00000001400010E6 | E8 15 FF FF FF | call 140001000 |
00000001400010EB | EB F1 | jmp 1400010DE
重载，跟进call 140001000 ，找到key的计算
000000014000101B | call qword ptr ds:[<&GetDlgItemTextA>] |
0000000140001021 | cmp byte ptr ds:[140015820],0 | ;比较长度是否=0
0000000140001028 | je 140001060 |
000000014000102A | lea rdx,qword ptr ds:[140015820] | ;140015820:"52KjEd.>i"</span><br/><span class="line">0000000140001031 | mov cl,byte ptr ds:[rdx] | ;取一字节</span><br/><span class="line">0000000140001033 | lea eax,dword ptr ds:[rcx-61] |</span><br/><span class="line">0000000140001036 | cmp al,19 | ;大于19则跳</span><br/><span class="line">0000000140001038 | ja 140001042 |</span><br/><span class="line">000000014000103A | sub cl,5 |</span><br/><span class="line">000000014000103D | cmp cl,7A |</span><br/><span class="line">0000000140001040 | jmp 14000104F |</span><br/><span class="line">0000000140001042 | lea eax,dword ptr ds:[rcx-41] |</span><br/><span class="line">0000000140001045 | cmp al,19 | ;大于19跳</span><br/><span class="line">0000000140001047 | ja 140001058 |</span><br/><span class="line">0000000140001049 | sub cl,5 |</span><br/><span class="line">000000014000104C | cmp cl,5A |</span><br/><span class="line">000000014000104F | mov byte ptr ds:[rdx],cl |</span><br/><span class="line">0000000140001051 | jle 140001058 | ;小于等于7A跳</span><br/><span class="line">0000000140001053 | sub cl,1A |</span><br/><span class="line">0000000140001056 | mov byte ptr ds:[rdx],cl |</span><br/><span class="line">0000000140001058 | inc rdx |</span><br/><span class="line">000000014000105B | cmp byte ptr ds:[rdx],0 |</span><br/><span class="line">000000014000105E | jnz 140001031 |</span><br/><span class="line"/><br/><span class="line">计算完，比较</span><br/><span class="line">0000000140001060 | lea rdx,qword ptr ds:[140015820] | ;140015820:"52KjEd.>i"
0000000140001067 | lea rcx,qword ptr ds:[1400112F0] | ;1400112F0:"52PoJie.Cn"
000000014000106E | call 14000B900 | ;与计算后的比较
0000000140001073 | mov rcx,rbx |
0000000140001076 | test eax,eax |
0000000140001078 | jnz 14000108D | ;不等跳走
000000014000107A | xor r9d,r9d |
000000014000107D | lea r8,qword ptr ds:[1400112FC] | ;1400112FC:"Boom!"
0000000140001084 | lea rdx,qword ptr ds:[140011308] | ;140011308:"Congratulations! You have successfully Registered"
000000014000108B | jmp 1400010A1 |
000000014000108D | mov r9d,10 |
0000000140001093 | lea r8,qword ptr ds:[140011340] | ;140011340:"Boomshakalaka"
000000014000109A | lea rdx,qword ptr ds:[140011350] | ;140011350:"You Failed!"
通过计算得出注册码：52UtOnj.Hs
|
近期评论