160 - 32 genocide1

环境
Windows xp sp3

工具
upx
exeinfope
ollydbg

查壳

发现是upx壳，手脱的话会不干净，影响OD分析。
所以就直接用 upx -d 脱了

手脱：

upx -d:

用upx -d 脱的版本进行分析。
第一次运行时显示这个：

缺少Reg.dat，所以无法打开。那就新建一个Reg.dat。

找到注册窗口：

估计是要serial正确的时候OK按钮才能点击。

OD载入：
直接搜字符串看看有没有什么有价值的

00437B33      00            db 00
00437B34      FC7D4300      dd crackme_.00437DFC
00437B38   .  0C            db 0C
00437B39   .  42 75 74 74 6>ascii "Button2Click"
00437B45      12            db 12
00437B46      00            db 00
00437B47      707E4300      dd crackme_.00437E70                             ;  这里是处理Edit1Change事件的函数，下面的也是同一个道理
00437B4B   .  0B            db 0B
00437B4C   .  45 64 69 74 3>ascii "Edit1Change"
00437B57      12            db 12
00437B58      00            db 00
00437B59      7C7E4300      dd crackme_.00437E7C
00437B5D   .  0B            db 0B
00437B5E   .  45 64 69 74 3>ascii "Edit2Change"
00437B69      12            db 12
00437B6A      00            db 00
00437B6B      887E4300      dd crackme_.00437E88
00437B6F   .  0B            db 0B
00437B70   .  45 64 69 74 3>ascii "Edit3Change"
00437B7B      12            db 12
00437B7C      00            db 00
00437B7D      947E4300      dd crackme_.00437E94
00437B81   .  0B            db 0B
00437B82   .  45 64 69 74 3>ascii "Edit4Change"
00437B8D      13            db 13
00437B8E      00            db 00
00437B8F      A07E4300      dd crackme_.00437EA0
00437B93   .  0C            db 0C
00437B94   .  42 75 74 74 6>ascii "Button1Click"
00437BA0   .  06            db 06
00437BA1   .  54 46 6F 72 6>ascii "TForm2"

至于为什么会找到这里，可以查看Button1Click的函数。

00437E70   .  B8 01000000   mov eax,0x1                                      ;  这里是Edit1Change的函数
00437E75   .  E8 A2FEFFFF   call crackme_.00437D1C
00437E7A   .  C3            retn
00437E7B      90            nop
00437E7C   .  B8 02000000   mov eax,0x2
00437E81   .  E8 96FEFFFF   call crackme_.00437D1C
00437E86   .  C3            retn
00437E87      90            nop
00437E88   .  B8 03000000   mov eax,0x3
00437E8D   .  E8 8AFEFFFF   call crackme_.00437D1C
00437E92   .  C3            retn
00437E93      90            nop
00437E94   .  B8 04000000   mov eax,0x4
00437E99   .  E8 7EFEFFFF   call crackme_.00437D1C
00437E9E   .  C3            retn
00437E9F      90            nop                                              ;  下面开始是Button1Click的函数
00437EA0   .  6A 00         push 0x0                                         ; /Style = MB_OK|MB_APPLMODAL
00437EA2   .  68 B47E4300   push crackme_.00437EB4                           ; |Title = "Success!"
00437EA7   .  68 C07E4300   push crackme_.00437EC0                           ; |Text = "Hey, Man, you did it!
You cracked my little proggie.
AAAAH! :("
00437EAC   .  6A 00         push 0x0                                         ; |hOwner = NULL
00437EAE   .  E8 31DBFCFF   call <jmp.&user32.MessageBoxA>                   ; \MessageBoxA
00437EB3   .  C3            retn

在[00437E70][00437E7C][00437E88][00437E94]都下个断点，改变serial的时候发现断了下来
在下面的call跟进去

00437D1C  /$  55            push ebp
00437D1D  |.  8BEC          mov ebp,esp
00437D1F  |.  6A 00         push 0x0
00437D21  |.  53            push ebx
00437D22  |.  8BD8          mov ebx,eax
00437D24  |.  33C0          xor eax,eax
00437D26  |.  55            push ebp
00437D27  |.  68 EE7D4300   push crackme_.00437DEE
00437D2C  |.  64:FF30       push dword ptr fs:[eax]
00437D2F  |.  64:8920       mov dword ptr fs:[eax],esp
00437D32  |.  8BC3          mov eax,ebx
00437D34  |.  48            dec eax                                          ;  Switch (cases 1..4)
00437D35  |.  74 0E         je Xcrackme_.00437D45
00437D37  |.  48            dec eax
00437D38  |.  74 2F         je Xcrackme_.00437D69
00437D3A  |.  48            dec eax
00437D3B  |.  74 50         je Xcrackme_.00437D8D
00437D3D  |.  48            dec eax
00437D3E  |.  74 71         je Xcrackme_.00437DB1
00437D40  |.  E9 8E000000   jmp crackme_.00437DD3
00437D45  |>  8D55 FC       lea edx,[local.1]                                ;  Case 1 of switch 00437D34
00437D48  |.  A1 28A74300   mov eax,dword ptr ds:[0x43A728]
00437D4D  |.  8B80 E8010000 mov eax,dword ptr ds:[eax+0x1E8]
00437D53  |.  E8 6854FEFF   call crackme_.0041D1C0
00437D58  |.  8B45 FC       mov eax,[local.1]
00437D5B  |.  E8 D0EBFCFF   call crackme_.00406930
00437D60  |.  89049D 38A743>mov dword ptr ds:[ebx*4+0x43A738],eax
00437D67  |.  EB 6A         jmp Xcrackme_.00437DD3
00437D69  |>  8D55 FC       lea edx,[local.1]                                ;  Case 2 of switch 00437D34
00437D6C  |.  A1 28A74300   mov eax,dword ptr ds:[0x43A728]
00437D71  |.  8B80 EC010000 mov eax,dword ptr ds:[eax+0x1EC]
00437D77  |.  E8 4454FEFF   call crackme_.0041D1C0
00437D7C  |.  8B45 FC       mov eax,[local.1]
00437D7F  |.  E8 ACEBFCFF   call crackme_.00406930
00437D84  |.  89049D 38A743>mov dword ptr ds:[ebx*4+0x43A738],eax
00437D8B  |.  EB 46         jmp Xcrackme_.00437DD3
00437D8D  |>  8D55 FC       lea edx,[local.1]                                ;  Case 3 of switch 00437D34
00437D90  |.  A1 28A74300   mov eax,dword ptr ds:[0x43A728]
00437D95  |.  8B80 F0010000 mov eax,dword ptr ds:[eax+0x1F0]
00437D9B  |.  E8 2054FEFF   call crackme_.0041D1C0
00437DA0  |.  8B45 FC       mov eax,[local.1]
00437DA3  |.  E8 88EBFCFF   call crackme_.00406930
00437DA8  |.  89049D 38A743>mov dword ptr ds:[ebx*4+0x43A738],eax
00437DAF  |.  EB 22         jmp Xcrackme_.00437DD3
00437DB1  |>  8D55 FC       lea edx,[local.1]                                ;  Case 4 of switch 00437D34
00437DB4  |.  A1 28A74300   mov eax,dword ptr ds:[0x43A728]
00437DB9  |.  8B80 F4010000 mov eax,dword ptr ds:[eax+0x1F4]
00437DBF  |.  E8 FC53FEFF   call crackme_.0041D1C0
00437DC4  |.  8B45 FC       mov eax,[local.1]
00437DC7  |.  E8 64EBFCFF   call crackme_.00406930
00437DCC  |.  89049D 38A743>mov dword ptr ds:[ebx*4+0x43A738],eax
00437DD3  |>  E8 00FEFFFF   call crackme_.00437BD8                           ;  Default case of switch 00437D34
00437DD8  |.  33C0          xor eax,eax
00437DDA  |.  5A            pop edx
00437DDB  |.  59            pop ecx
00437DDC  |.  59            pop ecx
00437DDD  |.  64:8910       mov dword ptr fs:[eax],edx
00437DE0  |.  68 F57D4300   push crackme_.00437DF5
00437DE5  |>  8D45 FC       lea eax,[local.1]
00437DE8  |.  E8 0FB9FCFF   call crackme_.004036FC
00437DED  \.  C3            retn

在[00437DD3]位置的call再跟进去，发现是这里比较。

00437BD8  /$  55            push ebp
00437BD9  |.  8BEC          mov ebp,esp
00437BDB  |.  6A 00         push 0x0
00437BDD  |.  6A 00         push 0x0
00437BDF  |.  53            push ebx
00437BE0  |.  56            push esi
00437BE1  |.  33C0          xor eax,eax
00437BE3  |.  55            push ebp
00437BE4  |.  68 0C7D4300   push crackme_.00437D0C
00437BE9  |.  64:FF30       push dword ptr fs:[eax]
00437BEC  |.  64:8920       mov dword ptr fs:[eax],esp
00437BEF  |.  8D55 FC       lea edx,[local.1]
00437BF2  |.  A1 28A74300   mov eax,dword ptr ds:[0x43A728]
00437BF7  |.  8B80 0C020000 mov eax,dword ptr ds:[eax+0x20C]
00437BFD  |.  E8 BE55FEFF   call crackme_.0041D1C0
00437C02  |.  8B45 FC       mov eax,[local.1]
00437C05  |.  E8 6EBDFCFF   call crackme_.00403978
00437C0A  |.  83F8 05       cmp eax,0x5                                      ;  这里是比较输入的name的长度
00437C0D  |.  0F8C AF000000 jl crackme_.00437CC2
00437C13  |.  8B45 FC       mov eax,[local.1]                                ;  下面是取name特定位置上的字符进行运算
00437C16  |.  0FB600        movzx eax,byte ptr ds:[eax]
00437C19  |.  B9 0A000000   mov ecx,0xA
00437C1E  |.  99            cdq
00437C1F  |.  F7F9          idiv ecx                                         ;  第一个字符 / 0xA
00437C21  |.  A3 2CA74300   mov dword ptr ds:[0x43A72C],eax
00437C26  |.  8B45 FC       mov eax,[local.1]
00437C29  |.  0FB640 02     movzx eax,byte ptr ds:[eax+0x2]
00437C2D  |.  B9 0A000000   mov ecx,0xA
00437C32  |.  99            cdq
00437C33  |.  F7F9          idiv ecx                                         ;  第三个字符 / 0xA
00437C35  |.  A3 30A74300   mov dword ptr ds:[0x43A730],eax
00437C3A  |.  8B45 FC       mov eax,[local.1]
00437C3D  |.  0FB640 03     movzx eax,byte ptr ds:[eax+0x3]
00437C41  |.  B9 0A000000   mov ecx,0xA
00437C46  |.  99            cdq
00437C47  |.  F7F9          idiv ecx                                         ;  第四个字符 / 0xA
00437C49  |.  A3 34A74300   mov dword ptr ds:[0x43A734],eax
00437C4E  |.  8B45 FC       mov eax,[local.1]
00437C51  |.  0FB640 04     movzx eax,byte ptr ds:[eax+0x4]
00437C55  |.  B9 0A000000   mov ecx,0xA
00437C5A  |.  99            cdq
00437C5B  |.  F7F9          idiv ecx                                         ;  第五个字符 / 0xA
00437C5D  |.  A3 38A74300   mov dword ptr ds:[0x43A738],eax
00437C62  |.  BE 01000000   mov esi,0x1
00437C67  |.  BB 2CA74300   mov ebx,crackme_.0043A72C
00437C6C  |>  8D55 F8       /lea edx,[local.2]                               ;  这里是将上面的商的结果取出来，如果大于等于10的都要再除0xA
00437C6F  |.  8B03          |mov eax,dword ptr ds:[ebx]
00437C71  |.  E8 8AECFCFF   |call crackme_.00406900
00437C76  |.  8B45 F8       |mov eax,[local.2]
00437C79  |.  E8 FABCFCFF   |call crackme_.00403978
00437C7E  |.  48            |dec eax
00437C7F  |.  74 0C         |je Xcrackme_.00437C8D
00437C81  |.  8B03          |mov eax,dword ptr ds:[ebx]
00437C83  |.  B9 0A000000   |mov ecx,0xA
00437C88  |.  99            |cdq
00437C89  |.  F7F9          |idiv ecx
00437C8B  |.  8903          |mov dword ptr ds:[ebx],eax
00437C8D  |>  46            |inc esi
00437C8E  |.  83C3 04       |add ebx,0x4
00437C91  |.  83FE 05       |cmp esi,0x5
00437C94  |.^ 75 D6         \jnz Xcrackme_.00437C6C
00437C96  |.  BE 01000000   mov esi,0x1
00437C9B  |.  B8 2CA74300   mov eax,crackme_.0043A72C
00437CA0  |.  BA 3CA74300   mov edx,crackme_.0043A73C
00437CA5  |>  8B0A          /mov ecx,dword ptr ds:[edx]                      ;  这里是将输入的serial与上面的计算结果比较
00437CA7  |.  3B08          |cmp ecx,dword ptr ds:[eax]
00437CA9  |.  74 07         |je Xcrackme_.00437CB2                           ;  如果比较结果不同，就会跳出循环
00437CAB  |.  B9 01000000   |mov ecx,0x1
00437CB0  |.  EB 15         |jmp Xcrackme_.00437CC7
00437CB2  |>  33C9          |xor ecx,ecx
00437CB4  |.  46            |inc esi
00437CB5  |.  83C2 04       |add edx,0x4
00437CB8  |.  83C0 04       |add eax,0x4
00437CBB  |.  83FE 05       |cmp esi,0x5
00437CBE  |.^ 75 E5         \jnz Xcrackme_.00437CA5
00437CC0  |.  EB 05         jmp Xcrackme_.00437CC7                           ;  如果比较内容完全一样，就会来到这里
00437CC2  |>  B9 01000000   mov ecx,0x1
00437CC7  |>  85C9          test ecx,ecx
00437CC9  |.  75 14         jnz Xcrackme_.00437CDF
00437CCB  |.  A1 28A74300   mov eax,dword ptr ds:[0x43A728]
00437CD0  |.  8B80 E0010000 mov eax,dword ptr ds:[eax+0x1E0]
00437CD6  |.  B2 01         mov dl,0x1
00437CD8  |.  E8 7B54FEFF   call crackme_.0041D158                           ;  猜测这个是用来使得OK按钮Enable的，前提是调用前dl为1
00437CDD  |.  EB 12         jmp Xcrackme_.00437CF1                           ;  否则还是disable
00437CDF  |>  A1 28A74300   mov eax,dword ptr ds:[0x43A728]
00437CE4  |.  8B80 E0010000 mov eax,dword ptr ds:[eax+0x1E0]
00437CEA  |.  33D2          xor edx,edx
00437CEC  |.  E8 6754FEFF   call crackme_.0041D158
00437CF1  |>  33C0          xor eax,eax
00437CF3  |.  5A            pop edx
00437CF4  |.  59            pop ecx
00437CF5  |.  59            pop ecx
00437CF6  |.  64:8910       mov dword ptr fs:[eax],edx
00437CF9  |.  68 137D4300   push crackme_.00437D13
00437CFE  |>  8D45 F8       lea eax,[local.2]
00437D01  |.  BA 02000000   mov edx,0x2
00437D06  |.  E8 15BAFCFF   call crackme_.00403720
00437D0B  \.  C3            retn