CrackMe

CrackMe

32bit,无壳

运行一下程序，让我们输入一串注册码

用32位IDA打开，查看字符串

在rdata段（资源数据段）找到了’TRUE’和’‘FALSE’’,ctrl+x跟进

int __thiscall sub_401730(CWnd *this)
{
    
    
  int v2; // edi
  HMODULE v3; // eax
  int v4; // edx
  struct CWnd *v5; // eax
  int v6; // esi
  int i; // eax
  int v8; // eax
  CWnd *v9; // eax
  char v11[4]; // [esp+10h] [ebp-1D0h] BYREF
  int v12; // [esp+14h] [ebp-1CCh]
  int v13; // [esp+18h] [ebp-1C8h]
  int v14; // [esp+1Ch] [ebp-1C4h] BYREF
  int v15; // [esp+20h] [ebp-1C0h]
  char v16[396]; // [esp+24h] [ebp-1BCh] BYREF
  int v17[8]; // [esp+1B0h] [ebp-30h]
  int v18; // [esp+1DCh] [ebp-4h]

  v17[0] = 14;
  v17[1] = 40;
  v17[2] = 12;
  v17[3] = 57;
  v17[4] = 6;
  v17[5] = 5;
  v17[6] = 32;
  v17[7] = 31;
  ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>(&v14);
  v2 = 0;
  v18 = 0;
  ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>(v11);
  LOBYTE(v18) = 1;
  v3 = GetModuleHandleW(0);
  v4 = *((unsigned __int8 *)v3 + 1);
  v12 = *(_BYTE *)v3;
  v13 = v4;
  CWnd::UpdateData(this, 1);
  v5 = CWnd::GetDlgItem(this, 1000);
  CWnd::GetWindowTextW(v5);
  v6 = *(_DWORD *)(v14 - 12);
  v15 = 0;
  memset(v16, 0, sizeof(v16));
  if ( v6 > 0 )
  {
    
    
    do
    {
    
    
      *(&v15 + v2) = (unsigned __int16)ATL::CSimpleStringT<wchar_t,1>::GetAt(&v14, v2);
      ++v2;
    }
    while ( v2 < v6 );
  }
  for ( i = 0; i < v6; ++i )
  {
    
    
    if ( (i & 1) != 0 )
      *(&v15 + i) ^= v13;
    else
      *(&v15 + i) ^= v12;
  }
  v8 = 0;
  if ( v6 <= 0 )
    goto LABEL_14;
  do
  {
    
    
    if ( *(&v15 + v8) != v17[v8] )
      break;
    ++v8;
  }
  while ( v8 < v6 );
  if ( v8 == 8 && v6 == 8 )
  {
    
    
    MessageBoxW(0, L"TRUE", &Caption, 0);
  }
  else
  {
    
    
LABEL_14:
    MessageBoxW(0, L"FALSE", &word_4037A8, 0);
    ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>::operator=(&v14, &unk_4037C0);
    v9 = CWnd::GetDlgItem(this, 1000);
    CWnd::SetWindowTextW(v9);
  }
  ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>::~CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>(v11);
  return ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>::~CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>(&v14);
}

程序先初始化了一个数据，下面把数据交错与v13和v12进行异或操作，再进行比较

for ( i = 0; i < v6; ++i )
  {
    
    
    if ( (i & 1) != 0 )
      *(&v15 + i) ^= v13;
    else
      *(&v15 + i) ^= v12;
  }

就是把我们输入的数据错位跟v13和v12进行异或操作，最后得到初始化的那个数组。所以将初始化的那个数组跟v13还有v12异或一下，就能得到正确的输入值。

找到v13和v12