【破文标题】glts-CrackMe
【破文作者】lvcaolhx
【作者邮箱】[email]hafiwu@sohu.com[/email]
【作者主页】lvcaolhx.blog.51cto.com
【破解工具】OD/PEID
【破解平台】XPsp2
【软件名称】glts-CrackMe
【软件大小】
【原版下载】
【保护方式】
【软件简介】
【破解声明】菜鸟破解，无技术可言!
------------------------------------------------------------------------
【破解过程】
一、脱壳
00521130 >  60              PUSHAD
00521131    BE 00D04C00     MOV ESI,CrackMe.004CD000//用ESP定律
005212CE    8D4424 80       LEA EAX,DWORD PTR SS:[ESP-80]//到这里
005212D2    6A 00           PUSH 0
005212D4    39C4            CMP ESP,EAX
005212D6  ^ 75 FA           JNZ SHORT CrackMe.005212D2
005212D8    83EC 80         SUB ESP,-80//F4，不让它回跳
005212DB  ^ E9 37D9FFFF     JMP CrackMe.0051EC17
0051EC17    90              NOP
0051EC18    90              NOP
0051EC19    B8 68894900     MOV EAX,CrackMe.00498968
0051EC1E    FFE0            JMP EAX
00498968    B8 20EC5100     MOV EAX,CrackMe.0051EC20
0049896D    FFE0            JMP EAX
0051EC20    BA 68894900     MOV EDX,CrackMe.00498968
0051EC25    90              NOP
0051EC26    90              NOP
0051EC27    90              NOP
0051EC28    90              NOP
0051EC29    B8 6BB5D2BD     MOV EAX,BDD2B56B
0051EC2E    8902            MOV DWORD PTR DS:[EDX],EAX
0051EC30    83C2 04         ADD EDX,4
0051EC33    B8 FACE862E     MOV EAX,2E86CEFA
0051EC38    8902            MOV DWORD PTR DS:[EDX],EAX
0051EC3A    B8 00EC5100     MOV EAX,CrackMe.0051EC00
0051EC3F    90              NOP
0051EC40    90              NOP
0051EC41    90              NOP
0051EC42    90              NOP
0051EC43    90              NOP
0051EC44    90              NOP
0051EC45    90              NOP
0051EC46    90              NOP
0051EC47    FFE0            JMP EAX//让它跳
0051EC49    60              PUSHAD
0051EC4A    E8 00000000     CALL CrackMe.0051EC4F
0051EC4F    5D              POP EBP
0051EC50    81ED 06000000   SUB EBP,6
0051EC56    EB 05           JMP SHORT CrackMe.0051EC5D
0051EC00    B8 67894900     MOV EAX,CrackMe.00498967//跳到这里
0051EC05    B9 10000000     MOV ECX,10
0051EC0A    803408 3E       XOR BYTE PTR DS:[EAX+ECX],3E
0051EC0E  ^ E2 FA           LOOPD SHORT CrackMe.0051EC0A//不让它返回　
0051EC10    B8 68894900     MOV EAX,CrackMe.00498968
0051EC15    FFE0            JMP EAX//跳向OEP
00498968    55              PUSH EBP//OEP，用OD插件DUMP掉,不需修复
00498969    8BEC            MOV EBP,ESP
0049896B    83C4 F0         ADD ESP,-10
0049896E    B8 10864900     MOV EAX,CrackMe.00498610
00498973    E8 24D9F6FF     CALL CrackMe.0040629C
二、暴破+算法
查找字符串“输入有误！”

00498412    55              PUSH EBP//这里下断
00498413    68 82854900     PUSH dump.00498582
00498418    64:FF30         PUSH DWORD PTR FS:[EAX]
0049841B    64:8920         MOV DWORD PTR FS:[EAX],ESP
0049841E    8D55 E8         LEA EDX,DWORD PTR SS:[EBP-18]
00498421    8B87 2C030000   MOV EAX,DWORD PTR DS:[EDI+32C]
00498427    E8 3446FDFF     CALL dump.0046CA60
0049842C    8B45 E8         MOV EAX,DWORD PTR SS:[EBP-18]            ; 假用户名入EAX
0049842F    E8 7CBFF6FF     CALL dump.004043B0                       ; 判断用户名是否为空
00498434    85C0            TEST EAX,EAX
00498436    75 18           JNZ SHORT dump.00498450                  ; 不用空就跳
00498438    6A 30           PUSH 30
0049843A    68 90854900     PUSH dump.00498590                       ; 提示
0049843F    68 98854900     PUSH dump.00498598                       ; 输入有误！
00498444    6A 00           PUSH 0
00498446    E8 61E8F6FF     CALL <JMP.&USER32.MessageBoxA>
0049844B    E9 02010000     JMP dump.00498552
00498450    33C0            XOR EAX,EAX
00498452    8945 FC         MOV DWORD PTR SS:[EBP-4],EAX
00498455    8D55 E4         LEA EDX,DWORD PTR SS:[EBP-1C]
00498458    8B87 2C030000   MOV EAX,DWORD PTR DS:[EDI+32C]
0049845E    E8 FD45FDFF     CALL dump.0046CA60
00498463    8B45 E4         MOV EAX,DWORD PTR SS:[EBP-1C]
00498466    E8 45BFF6FF     CALL dump.004043B0
0049846B >  8BD8            MOV EBX,EAX
0049846D    85DB            TEST EBX,EBX                             ; 用户名位数检查
0049846F    7E 22           JLE SHORT dump.00498493
00498471    BE 01000000     MOV ESI,1
00498476    8D55 E0         LEA EDX,DWORD PTR SS:[EBP-20]  ; 第一次循环，用户名逐位ASCII码相
加,结果为361
00498479    8B87 2C030000   MOV EAX,DWORD PTR DS:[EDI+32C]
0049847F    E8 DC45FDFF     CALL dump.0046CA60
00498484    8B45 E0         MOV EAX,DWORD PTR SS:[EBP-20]
00498487    0FB64430 FF     MOVZX EAX,BYTE PTR DS:[EAX+ESI-1]
0049848C    0145 FC         ADD DWORD PTR SS:[EBP-4],EAX
0049848F    46              INC ESI                                  ; 累加器
00498490    4B              DEC EBX
00498491  ^ 75 E3           JNZ SHORT dump.00498476                  ; 循环
00498493    8D55 DC         LEA EDX,DWORD PTR SS:[EBP-24]
00498496    8B87 2C030000   MOV EAX,DWORD PTR DS:[EDI+32C]
0049849C    E8 BF45FDFF     CALL dump.0046CA60
004984A1    8B45 DC         MOV EAX,DWORD PTR SS:[EBP-24]
004984A4    E8 07BFF6FF     CALL dump.004043B0
004984A9    8BD8            MOV EBX,EAX                        ; 用户名位数赋值给EBX，作为下
次循环的计数器
004984AB    85DB            TEST EBX,EBX
004984AD    7E 12           JLE SHORT dump.004984C1
004984AF    BE 01000000     MOV ESI,1
004984B4    69C6 06020000   IMUL EAX,ESI,206  //第二次循环,用户名位值与十六进制206相乘，结果
为1030
004984BA    8945 F8         MOV DWORD PTR SS:[EBP-8],EAX
004984BD    46              INC ESI
004984BE    4B              DEC EBX
004984BF  ^ 75 F3           JNZ SHORT dump.004984B4//循环
004984C1    8B45 FC         MOV EAX,DWORD PTR SS:[EBP-4]
004984C4    8B55 F8         MOV EDX,DWORD PTR SS:[EBP-8]
004984C7    03C2            ADD EAX,EDX                              ; 二次循环结果相加，结
果为1391
004984C9    05 9F860100     ADD EAX,1869F//与固定值相加，结果为19a30
004984CE    8D4D F4         LEA ECX,DWORD PTR SS:[EBP-C]
004984D1    BA 01000000     MOV EDX,1
004984D6    E8 0101F7FF     CALL dump.004085DC
004984DB    8D45 D8         LEA EAX,DWORD PTR SS:[EBP-28]
004984DE    8B4D F4         MOV ECX,DWORD PTR SS:[EBP-C]
004984E1    BA AC854900     MOV EDX,dump.004985AC                    ; $
004984E6    E8 11BFF6FF     CALL dump.004043FC
004984EB    8B45 D8         MOV EAX,DWORD PTR SS:[EBP-28]
004984EE    E8 1101F7FF     CALL dump.00408604
004984F3    8D55 F0         LEA EDX,DWORD PTR SS:[EBP-10]
004984F6    E8 CDFFF6FF     CALL dump.004084C8                       ; 算法CALL
004984FB    8D55 EC         LEA EDX,DWORD PTR SS:[EBP-14]
004984FE    8B87 30030000   MOV EAX,DWORD PTR DS:[EDI+330]
00498504    E8 5745FDFF     CALL dump.0046CA60
00498509    8B45 EC         MOV EAX,DWORD PTR SS:[EBP-14]            ; 假码
0049850C    8B55 F0         MOV EDX,DWORD PTR SS:[EBP-10]            ; 真码
0049850F    E8 E8BFF6FF     CALL dump.004044FC                       ; 真假码比较
00498514    74 15           JE SHORT dump.0049852B                   ; 相等就跳，暴破时将JE
改为JMP
00498516    6A 30           PUSH 30
00498518    68 90854900     PUSH dump.00498590                       ; 提示
0049851D    68 98854900     PUSH dump.00498598                       ; 输入有误！//返回这里
，向上找地方下断
------------------------------------------------------------------------
【算法总结】1.第一次循环，用户名逐位ASCII码相加,结果为361
2.第二次循环,用户名位值与十六进制206相乘，结果为1030，然后再与固定值1869F相加，得到19a30
3.算法CALL：将1.2结果19a30除以A，所有的余数作为注册码，注册码为105008

------------------------------------------------------------------------
【版权声明】本破文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢! 版权归PYG所有