[破]fonge's crackme 10.1
【破文作者】 hbqjxhw【文章题目】 [破]fonge's crackme 10.1
【下载地址】 http://bbs.pediy.com/showthread.php?s=&threadid=39590&perpage=10&highlight=&pagenumber=1
----------------------------------------------------------------------------------------------
【破解工具】 OD、DEDE
【破解平台】 WinXP SP2
----------------------------------------------------------------------------------------------
【破解过程】
用DEDE很快就可以找到004548A0（具体步骤就略了,主要是看算法）
004548A0 .55 PUSH EBP
004548A1 .8BEC MOV EBP,ESP
004548A3 .B9 13000000 MOV ECX,13
004548A8 /6A 00 PUSH 0
004548AA |6A 00 PUSH 0
004548AC |49 DEC ECX
004548AD^\75 F9 JNZ SHORT fonge's_.004548A8
004548AF 53 PUSH EBX
004548B0 56 PUSH ESI
004548B1 57 PUSH EDI
004548B2 8BD8 MOV EBX,EAX
004548B4 33C0 XOR EAX,EAX
004548B6 55 PUSH EBP
004548B7 68 B8514500 PUSH fonge's_.004551B8
004548BC 64:FF30 PUSH DWORD PTR FS:
004548BF 64:8920 MOV DWORD PTR FS:,ESP
004548C2 8D55 E0 LEA EDX,DWORD PTR SS:
004548C5 8B83 04030000 MOV EAX,DWORD PTR DS:
004548CB E8 ACF0FDFF CALL fonge's_.0043397C
004548D0 8D55 BC LEA EDX,DWORD PTR SS:
004548D3 8B83 08030000 MOV EAX,DWORD PTR DS:
004548D9 E8 9EF0FDFF CALL fonge's_.0043397C
004548DE 8D45 D4 LEA EAX,DWORD PTR SS:
004548E1 BA D0514500 MOV EDX,fonge's_.004551D0 ; ASCII "abcdefghijklmnopqrstuvwxyz "
004548E6 E8 35F6FAFF CALL fonge's_.00403F20
004548EB C645 AF 01 MOV BYTE PTR SS:,1
004548EF 33C0 XOR EAX,EAX
004548F1 8945 F8 MOV DWORD PTR SS:,EAX
004548F4 33C0 XOR EAX,EAX
004548F6 8945 F4 MOV DWORD PTR SS:,EAX
004548F9 33C0 XOR EAX,EAX
004548FB 8945 F0 MOV DWORD PTR SS:,EAX
004548FE 8B45 BC MOV EAX,DWORD PTR SS:
00454901 E8 42F8FAFF CALL fonge's_.00404148 ; 计算SN位数
00454906 83F8 05 CMP EAX,5 ; 比较SN位数是否大于等于5
00454909 0F8C 76080000 JL fonge's_.00455185
0045490F 8B45 E0 MOV EAX,DWORD PTR SS:
00454912 E8 31F8FAFF CALL fonge's_.00404148 ; 计算Name位数
00454917 83F8 06 CMP EAX,6 ; 比较Name位数是否大于等于6
0045491A 0F8C 21030000 JL fonge's_.00454C41
00454920 FF45 F4 INC DWORD PTR SS:
00454923 8B45 E0 MOV EAX,DWORD PTR SS:
00454926 E8 1DF8FAFF CALL fonge's_.00404148 ; 计算Name位数
0045492B 83F8 0A CMP EAX,0A ; 比较Name位数是否小于等于0xA
0045492E 0F8F 0D030000 JG fonge's_.00454C41
00454934 8B45 E0 MOV EAX,DWORD PTR SS:
00454937 0FB678 03 MOVZX EDI,BYTE PTR DS: ; 取Name的第4位的HEX值给EDI
0045493B 8B45 E0 MOV EAX,DWORD PTR SS:
0045493E E8 05F8FAFF CALL fonge's_.00404148 ; 计算Name位数
00454943 85C0 TEST EAX,EAX ; 再次判断Name是否为空
00454945 7E 64 JLE SHORT fonge's_.004549AB
00454947 8945 A8 MOV DWORD PTR SS:,EAX
0045494A C745 FC 0100000>MOV DWORD PTR SS:,1 ; 把循环值1给SS:for(i=0;i<strlen(name);i++)
00454951 8B45 E0 MOV EAX,DWORD PTR SS:
00454954 E8 EFF7FAFF CALL fonge's_.00404148
00454959 8BD8 MOV EBX,EAX
0045495B 85DB TEST EBX,EBX
0045495D 7E 2B JLE SHORT fonge's_.0045498A
0045495F BE 01000000 MOV ESI,1 ; 循环值1给ESI for (m=0;m<strlen(name);m++)
00454964 8B45 E0 MOV EAX,DWORD PTR SS:
00454967 E8 DCF7FAFF CALL fonge's_.00404148
0045496C 2B45 FC SUB EAX,DWORD PTR SS: ; Name位数减去循环值SS:
0045496F 8B55 E0 MOV EDX,DWORD PTR SS:
00454972 0FB64402 FF MOVZX EAX,BYTE PTR DS: ; 取Name的(strlen(name)-i-2)位的HEX值给EAX
00454977 8B55 E0 MOV EDX,DWORD PTR SS:
0045497A 0FB65432 FF MOVZX EDX,BYTE PTR DS: ; 取Name的m位的HEX值给EDX
0045497F F7EA IMUL EDX ; 两个HEX值相乘
00454981 C1E8 06 SHR EAX,6 ; 右移6
00454984 03F8 ADD EDI,EAX ; 相加
00454986 46 INC ESI ; 循环值ESI加1
00454987 4B DEC EBX ; 循环值EBX减1
00454988^ 75 DA JNZ SHORT fonge's_.00454964
0045498A 017D F8 ADD DWORD PTR SS:,EDI ;累加
0045498D 8D55 A4 LEA EDX,DWORD PTR SS:
00454990 8B45 F8 MOV EAX,DWORD PTR SS:
00454993 E8 8C33FBFF CALL fonge's_.00407D24 ; 十六进制转换为十进制
00454998 8B55 A4 MOV EDX,DWORD PTR SS:
0045499B 8D45 DC LEA EAX,DWORD PTR SS:
0045499E E8 ADF7FAFF CALL fonge's_.00404150
004549A3 FF45 FC INC DWORD PTR SS: ; 循环值SS:加1
004549A6 FF4D A8 DEC DWORD PTR SS: ; 循环值SS:减1
004549A9^ 75 A6 JNZ SHORT fonge's_.00454951
004549AB 33C0 XOR EAX,EAX
004549AD 8945 E4 MOV DWORD PTR SS:,EAX
004549B0 33C0 XOR EAX,EAX
004549B2 8945 E8 MOV DWORD PTR SS:,EAX
004549B5 C745 EC 0100000>MOV DWORD PTR SS:,1
004549BC 837D EC 02 CMP DWORD PTR SS:,2
004549C0 7D 23 JGE SHORT fonge's_.004549E5
004549C2 B8 01000000 MOV EAX,1
004549C7 8B55 DC MOV EDX,DWORD PTR SS:
004549CA 0FB65402 FF MOVZX EDX,BYTE PTR DS:
004549CF 0155 E8 ADD DWORD PTR SS:,EDX
004549D2 8B55 BC MOV EDX,DWORD PTR SS:
004549D5 0FB65402 FF MOVZX EDX,BYTE PTR DS:
004549DA 0155 E4 ADD DWORD PTR SS:,EDX
004549DD 40 INC EAX
004549DE 83F8 06 CMP EAX,6
004549E1^ 75 E4 JNZ SHORT fonge's_.004549C7
004549E3 EB 63 JMP SHORT fonge's_.00454A48
004549E5 837D EC 02 CMP DWORD PTR SS:,2
004549E9 75 2B JNZ SHORT fonge's_.00454A16
004549EB B8 06000000 MOV EAX,6
004549F0 8B55 DC MOV EDX,DWORD PTR SS:
004549F3 0FB65402 FF MOVZX EDX,BYTE PTR DS:
004549F8 0355 E8 ADD EDX,DWORD PTR SS:
004549FB 42 INC EDX
004549FC 8955 E8 MOV DWORD PTR SS:,EDX
004549FF 8B55 BC MOV EDX,DWORD PTR SS:
00454A02 0FB65402 FF MOVZX EDX,BYTE PTR DS:
00454A07 0155 E4 ADD DWORD PTR SS:,EDX
00454A0A 40 INC EAX
00454A0B 83F8 0D CMP EAX,0D
00454A0E^ 75 E0 JNZ SHORT fonge's_.004549F0
00454A10 8345 E4 07 ADD DWORD PTR SS:,7
00454A14 EB 32 JMP SHORT fonge's_.00454A48
00454A16 8B45 DC MOV EAX,DWORD PTR SS:
00454A19 E8 2AF7FAFF CALL fonge's_.00404148
00454A1E 83E8 10 SUB EAX,10
00454A21 7C 25 JL SHORT fonge's_.00454A48
00454A23 40 INC EAX
00454A24 8945 A8 MOV DWORD PTR SS:,EAX
00454A27 B8 10000000 MOV EAX,10
00454A2C 8B55 DC MOV EDX,DWORD PTR SS:
00454A2F 0FB65402 FF MOVZX EDX,BYTE PTR DS:
00454A34 0155 E8 ADD DWORD PTR SS:,EDX
00454A37 8B55 BC MOV EDX,DWORD PTR SS:
00454A3A 0FB65402 FF MOVZX EDX,BYTE PTR DS:
00454A3F 0155 E4 ADD DWORD PTR SS:,EDX
00454A42 40 INC EAX
00454A43 FF4D A8 DEC DWORD PTR SS:
00454A46^ 75 E4 JNZ SHORT fonge's_.00454A2C
00454A48 33C0 XOR EAX,EAX
00454A4A 55 PUSH EBP
00454A4B 68 764A4500 PUSH fonge's_.00454A76
00454A50 64:FF30 PUSH DWORD PTR FS:
00454A53 64:8920 MOV DWORD PTR FS:,ESP
00454A56 8B45 E8 MOV EAX,DWORD PTR SS:
00454A59 3345 E4 XOR EAX,DWORD PTR SS:
00454A5C 50 PUSH EAX
00454A5D 8B45 F4 MOV EAX,DWORD PTR SS:
00454A60 5A POP EDX
00454A61 8BCA MOV ECX,EDX
00454A63 99 CDQ
00454A64 F7F9 IDIV ECX
00454A66 8945 F0 MOV DWORD PTR SS:,EAX
00454A69 FF45 F0 INC DWORD PTR SS:
00454A6C 33C0 XOR EAX,EAX
00454A6E 5A POP EDX
00454A6F 59 POP ECX
00454A70 59 POP ECX
00454A71 64:8910 MOV DWORD PTR FS:,EDX
00454A74 EB 19 JMP SHORT fonge's_.00454A8F
00454A76^ E9 89ECFAFF JMP fonge's_.00403704
00454A7B 0100 ADD DWORD PTR DS:,EAX
00454A7D 0000 ADD BYTE PTR DS:,AL
00454A7F FC CLD
00454A80 6F OUTS DX,DWORD PTR ES: ; I/O 命令
00454A81 40 INC EAX
00454A82 0087 4A4500FF ADD BYTE PTR DS:,AL
00454A88 45 INC EBP
00454A89 F4 HLT ; 特权命令
00454A8A E8 B1EEFAFF CALL fonge's_.00403940
00454A8F FF45 EC INC DWORD PTR SS: ; SS:内的数下面将要用到
00454A92 837D EC 04 CMP DWORD PTR SS:,4
00454A96^ 0F85 20FFFFFF JNZ fonge's_.004549BC
00454A9C EB 03 JMP SHORT fonge's_.00454AA1
----------------------------------------------------------------------------------------------
ASCII "abcdefghijklmnopqrstuvwxyz "这一段字符串下面将用到，主要是生成注册的信息。
00454AA1 8B45 BC MOV EAX,DWORD PTR SS:
00454AA4 33DB XOR EBX,EBX
00454AA6 8A58 0C MOV BL,BYTE PTR DS: ; 取Name的13位给BL
00454AA9 83EB 1F SUB EBX,1F ; 减去0x1F(EBX的值一定为0X12,后面将要用到)
00454AAC 8B45 BC MOV EAX,DWORD PTR SS:
00454AAF 0FB670 0E MOVZX ESI,BYTE PTR DS: ; 取Name的15位给ESI
00454AB3 83EE 24 SUB ESI,24 ; 减去0x24(ESI的值一定为0X14,后面将要用到)
00454AB6 8B45 BC MOV EAX,DWORD PTR SS:
00454AB9 0FB678 0D MOVZX EDI,BYTE PTR DS: ; 取Name的14位给EDI
00454ABD 83EF 31 SUB EDI,31 ; 减去0x31(EDI的值一定为0X5,后面将要用到)
00454AC0 8D45 A0 LEA EAX,DWORD PTR SS:
00454AC3 8B55 D4 MOV EDX,DWORD PTR SS:
00454AC6 8A541A FF MOV DL,BYTE PTR DS: ; 这里将用到EBX
00454ACA 8850 01 MOV BYTE PTR DS:,DL
00454ACD C600 01 MOV BYTE PTR DS:,1
00454AD0 8D55 A0 LEA EDX,DWORD PTR SS:
00454AD3 8D45 9C LEA EAX,DWORD PTR SS:
00454AD6 E8 5DDFFAFF CALL fonge's_.00402A38
00454ADB 8D45 98 LEA EAX,DWORD PTR SS:
00454ADE 8B55 D4 MOV EDX,DWORD PTR SS:
00454AE1 8A52 04 MOV DL,BYTE PTR DS:
00454AE4 8850 01 MOV BYTE PTR DS:,DL
00454AE7 C600 01 MOV BYTE PTR DS:,1
00454AEA 8D55 98 LEA EDX,DWORD PTR SS:
00454AED 8D45 9C LEA EAX,DWORD PTR SS:
00454AF0 B1 02 MOV CL,2
00454AF2 E8 11DFFAFF CALL fonge's_.00402A08
00454AF7 8D55 9C LEA EDX,DWORD PTR SS:
00454AFA 8D45 94 LEA EAX,DWORD PTR SS:
00454AFD E8 36DFFAFF CALL fonge's_.00402A38
00454B02 8D45 98 LEA EAX,DWORD PTR SS:
00454B05 8B55 D4 MOV EDX,DWORD PTR SS:
00454B08 8A52 06 MOV DL,BYTE PTR DS:
00454B0B 8850 01 MOV BYTE PTR DS:,DL
00454B0E C600 01 MOV BYTE PTR DS:,1
00454B11 8D55 98 LEA EDX,DWORD PTR SS:
00454B14 8D45 94 LEA EAX,DWORD PTR SS:
00454B17 B1 03 MOV CL,3
00454B19 E8 EADEFAFF CALL fonge's_.00402A08
00454B1E 8D55 94 LEA EDX,DWORD PTR SS:
00454B21 8D45 8C LEA EAX,DWORD PTR SS:
00454B24 E8 0FDFFAFF CALL fonge's_.00402A38
00454B29 8D45 98 LEA EAX,DWORD PTR SS:
00454B2C 8B55 D4 MOV EDX,DWORD PTR SS:
00454B2F 8A52 08 MOV DL,BYTE PTR DS:
00454B32 8850 01 MOV BYTE PTR DS:,DL
00454B35 C600 01 MOV BYTE PTR DS:,1
00454B38 8D55 98 LEA EDX,DWORD PTR SS:
00454B3B 8D45 8C LEA EAX,DWORD PTR SS:
00454B3E B1 04 MOV CL,4
00454B40 E8 C3DEFAFF CALL fonge's_.00402A08
00454B45 8D55 8C LEA EDX,DWORD PTR SS:
00454B48 8D45 84 LEA EAX,DWORD PTR SS:
00454B4B E8 E8DEFAFF CALL fonge's_.00402A38
00454B50 8D45 98 LEA EAX,DWORD PTR SS:
00454B53 8B55 D4 MOV EDX,DWORD PTR SS:
00454B56 8A52 12 MOV DL,BYTE PTR DS:
00454B59 8850 01 MOV BYTE PTR DS:,DL
00454B5C C600 01 MOV BYTE PTR DS:,1
00454B5F 8D55 98 LEA EDX,DWORD PTR SS:
00454B62 8D45 84 LEA EAX,DWORD PTR SS:
00454B65 B1 05 MOV CL,5
00454B67 E8 9CDEFAFF CALL fonge's_.00402A08
00454B6C 8D55 84 LEA EDX,DWORD PTR SS:
00454B6F 8D85 7CFFFFFF LEA EAX,DWORD PTR SS:
00454B75 E8 BEDEFAFF CALL fonge's_.00402A38
00454B7A 8D45 98 LEA EAX,DWORD PTR SS:
00454B7D 8B55 D4 MOV EDX,DWORD PTR SS:
00454B80 8A5432 FF MOV DL,BYTE PTR DS: ; 这里将用到ESI
00454B84 8850 01 MOV BYTE PTR DS:,DL
00454B87 C600 01 MOV BYTE PTR DS:,1
00454B8A 8D55 98 LEA EDX,DWORD PTR SS:
00454B8D 8D85 7CFFFFFF LEA EAX,DWORD PTR SS:
00454B93 B1 06 MOV CL,6
00454B95 E8 6EDEFAFF CALL fonge's_.00402A08
00454B9A 8D95 7CFFFFFF LEA EDX,DWORD PTR SS:
00454BA0 8D45 B4 LEA EAX,DWORD PTR SS:
00454BA3 E8 44F5FAFF CALL fonge's_.004040EC
00454BA8 8D45 A0 LEA EAX,DWORD PTR SS:
00454BAB 8B55 D4 MOV EDX,DWORD PTR SS:
00454BAE 8A543A FF MOV DL,BYTE PTR DS: ; 这里将用到EDI
00454BB2 8850 01 MOV BYTE PTR DS:,DL
00454BB5 C600 01 MOV BYTE PTR DS:,1
00454BB8 8D55 A0 LEA EDX,DWORD PTR SS:
00454BBB 8D45 9C LEA EAX,DWORD PTR SS:
00454BBE E8 75DEFAFF CALL fonge's_.00402A38
00454BC3 8D45 98 LEA EAX,DWORD PTR SS:
00454BC6 8B55 D4 MOV EDX,DWORD PTR SS:
00454BC9 8A541A FF MOV DL,BYTE PTR DS: ; 这里将用到EBX
00454BCD 8850 01 MOV BYTE PTR DS:,DL
00454BD0 C600 01 MOV BYTE PTR DS:,1
00454BD3 8D55 98 LEA EDX,DWORD PTR SS:
00454BD6 8D45 9C LEA EAX,DWORD PTR SS:
00454BD9 B1 02 MOV CL,2
00454BDB E8 28DEFAFF CALL fonge's_.00402A08
00454BE0 8D55 9C LEA EDX,DWORD PTR SS:
00454BE3 8D45 94 LEA EAX,DWORD PTR SS:
00454BE6 E8 4DDEFAFF CALL fonge's_.00402A38
00454BEB 8D45 98 LEA EAX,DWORD PTR SS:
00454BEE 8B55 D4 MOV EDX,DWORD PTR SS:
00454BF1 8A52 04 MOV DL,BYTE PTR DS:
00454BF4 8850 01 MOV BYTE PTR DS:,DL
00454BF7 C600 01 MOV BYTE PTR DS:,1
00454BFA 8D55 98 LEA EDX,DWORD PTR SS:
00454BFD 8D45 94 LEA EAX,DWORD PTR SS:
00454C00 B1 03 MOV CL,3
00454C02 E8 01DEFAFF CALL fonge's_.00402A08
00454C07 8D55 94 LEA EDX,DWORD PTR SS:
00454C0A 8D45 8C LEA EAX,DWORD PTR SS:
00454C0D E8 26DEFAFF CALL fonge's_.00402A38
00454C12 8D45 98 LEA EAX,DWORD PTR SS:
00454C15 8B55 D4 MOV EDX,DWORD PTR SS:
00454C18 8B4D F4 MOV ECX,DWORD PTR SS:
00454C1B 8A540A FF MOV DL,BYTE PTR DS: ; 这里将用到ECX (SS:)
00454C1F 8850 01 MOV BYTE PTR DS:,DL
00454C22 C600 01 MOV BYTE PTR DS:,1
00454C25 8D55 98 LEA EDX,DWORD PTR SS:
00454C28 8D45 8C LEA EAX,DWORD PTR SS:
00454C2B B1 04 MOV CL,4
00454C2D E8 D6DDFAFF CALL fonge's_.00402A08
00454C32 8D55 8C LEA EDX,DWORD PTR SS:
00454C35 8D45 B0 LEA EAX,DWORD PTR SS:
00454C38 E8 AFF4FAFF CALL fonge's_.004040EC
----------------------------------------------------------------------------------------------
【破解总结】
注册码部分源码：
#include <stdio.h>
#include <string.h>
main()
{
long int sum,i,temp=0,m;
char name;
printf("请输入Name:");
gets(name);
int len=strlen(name);
sum=name;
printf("Serial:");
for(i=0;i<len;i++)
{
for(m=0;m<len;m++)
sum+=(name*name)>>0x6;
printf("%d",sum+temp);
temp+=sum;
}
printf("\n");
}
把上面生成的注册码的第13、14、15改为"一路发"即168就OK了。
例如：
Name:PEDIY.COM
Serial：8682411441571681095015269202832610431925
详细的讨论在http://bbs.pediy.com/showthread.php?s=&threadid=39590&perpage=10&highlight=&pagenumber=1
----------------------------------------------------------------------------------------------
【破解声明】 我是一只小菜鸟，偶得一点心得，愿与大家分享:)
【版权声明】 本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
----------------------------------------------------------------------------------------------
文章写于2007-2-16 2:58:27 站个位置恭喜下.... 是啊，我这里也不错，顶一下
页:
[1]