新160个crackme - 111-execution

运行分析

• 需破解Name和Code

---

PE分析

• VB程序，32位，无壳

---

静态分析&动态调试

• 使用VB compiler进行静态分析，发现关键判断地址为0x40DB9C

---

• ida打开程序，跳转至0x40DB9C位置，进行动调调试，逻辑如下：
• 1、通过Name每一位累加计算获得di
• 2、比较di和Code是否相等（这里ida伪代码无法正确识别__vbaStrCmp函数的参数，查看汇编代码，发现两个参数在push edx和push eax处传入堆栈，前一个是Code，后面一个是di转str），相等返回成功

---

算法分析

Name = 'concealbear'

Name = Name.upper()
Name = [ord(i)for i in Name]

di = 0
for i in range(len(Name)):
    Name[i] = Name[i] - 0x40
    Name[i] = Name[i] * 0x82
    Name[i] = Name[i] + di
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    Name[i] = Name[i] + 0x50
    di = Name[i]

Code = di

print(di)

• 验证成功