环境
Windows xp sp3
工具
exeinfope
ollydbg
查壳
无壳VB程序
测试
输入1234567
OD载入字符串搜素，往上翻就看到这里，我截取部分片段：
00402C26 . 8D55 98 lea edx,dword ptr ss:[ebp-0x68] ; 取serial长度
00402C29 . 51 push ecx ; /var18
00402C2A . 52 push edx ; |retBuffer8
00402C2B . FF15 20614000 call dword ptr ds:[<&MSVBVM50.__vbaLenVa>; \__vbaLenVar
00402C31 . 50 push eax
00402C32 . FF15 7C614000 call dword ptr ds:[<&MSVBVM50.__vbaI2Var>; MSVBVM50.__vbaI2Var
00402C38 . 8B35 14614000 mov esi,dword ptr ds:[<&MSVBVM50.#516>] ; MSVBVM50.rtcAnsiValueBstr
00402C3E . 8B3D 74614000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaSt>; MSVBVM50.__vbaStrVarVal
00402C44 . 8985 E8FEFFFF mov dword ptr ss:[ebp-0x118],eax
00402C4A . B8 01000000 mov eax,0x1
00402C4F . 8945 C4 mov dword ptr ss:[ebp-0x3C],eax
00402C52 > 66:3B85 E8FEF>cmp ax,word ptr ss:[ebp-0x118] ; 循环次数
...
00402CC9 . 50 push eax
00402CCA . FFD6 call esi
00402CCC . 0FBFD0 movsx edx,ax
00402CCF . 33DA xor ebx,edx ; 第i个字符与一个值异或
00402CD1 . 8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]
00402CD7 . 53 push ebx
00402CD8 . 50 push eax
00402CD9 . FF15 6C614000 call dword ptr ds:[<&MSVBVM50.#608>] ; MSVBVM50.rtcVarBstrFromAnsi
00402CDF . 8D4D C8 lea ecx,dword ptr ss:[ebp-0x38]
00402CE2 . 8D95 58FFFFFF lea edx,dword ptr ss:[ebp-0xA8]
00402CE8 . 51 push ecx
00402CE9 . 8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
00402CEF . 52 push edx
00402CF0 . 50 push eax
00402CF1 . FF15 78614000 call dword ptr ds:[<&MSVBVM50.__vbaVarCa>; MSVBVM50.__vbaVarCat
00402CF7 . 8BD0 mov edx,eax
00402CF9 . 8D4D C8 lea ecx,dword ptr ss:[ebp-0x38]
...
;上面是第一个循环，下面是第二个循环
00402E14 . 33D9 xor ebx,ecx
00402E16 . 8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]
00402E1C . 53 push ebx
00402E1D . 52 push edx
00402E1E . FF15 6C614000 call dword ptr ds:[<&MSVBVM50.#608>] ; MSVBVM50.rtcVarBstrFromAnsi
00402E24 . 8D45 B4 lea eax,dword ptr ss:[ebp-0x4C]
00402E27 . 8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-0xB8]
00402E2D . 50 push eax
00402E2E . 8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
00402E34 . 51 push ecx
00402E35 . 52 push edx
00402E36 . FF15 78614000 call dword ptr ds:[<&MSVBVM50.__vbaVarCa>; MSVBVM50.__vbaVarCat
00402E3C . 8BD0 mov edx,eax
00402E3E . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C]
00402E41 . FF15 00614000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>; MSVBVM50.__vbaVarMove
...
;比较
00402EBD . 8D8D 28FFFFFF lea ecx,dword ptr ss:[ebp-0xD8]
00402EC3 . 50 push eax ; /var18
00402EC4 . 51 push ecx ; |var28
00402EC5 . C785 30FFFFFF>mov dword ptr ss:[ebp-0xD0],cracking.004>; |UNICODE "VeiajeEjbavwij"
00402ECF . C785 28FFFFFF>mov dword ptr ss:[ebp-0xD8],0x8008 ; |
00402ED9 . FF15 A4614000 call dword ptr ds:[<&MSVBVM50.__vbaVarTs>; \__vbaVarTstNe
00402EDF . 66:85C0 test ax,ax
00402EE2 . 0F84 A1000000 je cracking.00402F89
仔细看一看很容易发现，第一个循环是将输入的serial变成另一个字符串，第二个循环将新的字符串再变成另一个字符串，比较。
至于变成另一个字符串的方法是异或，第一个循环的异或内容是0x34，第二个循环异或的内容是一个数组，
{0x34,0x30,0x30,0x30}
所以将比较的字符反过来运算就能得出结果。
PamelaAnderson
