吾爱破解crackme 018 019

最新推荐文章于 2023-08-29 16:25:27 发布

原创最新推荐文章于 2023-08-29 16:25:27 发布 · 527 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#破解

本文通过VC++代码示例，详细解析了一个简单的注册码生成算法，并提供了Python实现方式。通过对汇编指令的逐行解读，展示了如何计算特定字符串的注册码。

vc++编写比较简单，第一个是单纯的serial,比较容易找出来，然后第二个有写算法，认真分析一下：

004015C5  |. /EB 09         jmp short Brad_Sob.004015D0
004015C7  |> |8B55 E0       /mov edx,[local.8]
004015CA  |. |83C2 01       |add edx,0x1
004015CD  |. |8955 E0       |mov [local.8],edx
004015D0  |> \8B45 E0        mov eax,[local.8]
004015D3  |.  3B45 E4       |cmp eax,[local.7]
004015D6  |.  7D 42         |jge short Brad_Sob.0040161A
004015D8  |.  8B4D E0       |mov ecx,[local.8]
004015DB  |.  51            |push ecx
004015DC  |.  8D4D EC       |lea ecx,[local.5]
004015DF  |.  E8 1C030000   |call Brad_Sob.00401900
004015E4  |.  0FBED0        |movsx edx,al
004015E7  |.  8B45 F0       |mov eax,[local.4]
004015EA  |.  03C2          |add eax,edx
004015EC  |.  8945 F0       |mov [local.4],eax
004015EF  |.  8B4D E0       |mov ecx,[local.8]
004015F2  |.  C1E1 08       |shl ecx,0x8
004015F5  |.  8B55 F0       |mov edx,[local.4]
004015F8  |.  33D1          |xor edx,ecx
004015FA  |.  8955 F0       |mov [local.4],edx
004015FD  |.  8B45 E0       |mov eax,[local.8]
00401600  |.  83C0 01       |add eax,0x1
00401603  |.  8B4D E4       |mov ecx,[local.7]
00401606  |.  0FAF4D E0     |imul ecx,[local.8]
0040160A  |.  F7D1          |not ecx
0040160C  |.  0FAFC1        |imul eax,ecx
0040160F  |.  8B55 F0       |mov edx,[local.4]
00401612  |.  0FAFD0        |imul edx,eax
00401615  |.  8955 F0       |mov [local.4],edx
00401618  |.^ EB AD         \jmp short Brad_Sob.004015C7

写出注册码如下：

from ctypes import *
name = 'foyjog'
local4 = 0x81276345
local8=0x0

for i in name:
    local4 = (local4 + ord(i)) ^ ((local8) << 8)
    local4 = c_uint(c_uint((c_uint ((~(local8 * len(name))))).value * (local8 +1)).value * local4).value
    local8 = local8 + 1
    print hex(local4)