【破文标题】abexcm5的分析
【破文作者】delcpp
【作者邮箱】delcpp@gmail.com
【破解工具】OD
【破解平台】windows xp sp3
【软件名称】abexcm5.exe
【软件大小】8K
【保护方式】无
【软件简介】软件来自FpX的CrackMe
------------------------------------------------------------------------------------------------
【破解过程】
0040106C |> \6A 25 push 25 ; /Count = 25 (37.)
0040106E |. 68 24234000 push 00402324 ; |Buffer = abexcm5.00402324
00401073 |. 6A 68 push 68 ; |ControlID = 68 (104.)
00401075 |. FF75 08 push dword ptr [ebp+8] ; |hWnd
00401078 |. E8 F4000000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
0040107D |. 6A 00 push 0 ; /pFileSystemNameSize = NULL
0040107F |. 6A 00 push 0 ; |pFileSystemNameBuffer = NULL
00401081 |. 68 C8204000 push 004020C8 ; |pFileSystemFlags = abexcm5.004020C8
00401086 |. 68 90214000 push 00402190 ; |pMaxFilenameLength = abexcm5.00402190
0040108B |. 68 94214000 push 00402194 ; |pVolumeSerialNumber = abexcm5.00402194
00401090 |. 6A 32 push 32 ; |MaxVolumeNameSize = 32 (50.)
00401092 |. 68 5C224000 push 0040225C ; |VolumeNameBuffer = abexcm5.0040225C
00401097 |. 6A 00 push 0 ; |RootPathName = NULL
00401099 |. E8 B5000000 call <jmp.&KERNEL32.GetVolumeInformat>; \GetVolumeInformationA
0040109E |. 68 F3234000 push 004023F3 ; /StringToAdd = "4562-ABEX"
004010A3 |. 68 5C224000 push 0040225C ; |ConcatString = ""
004010A8 |. E8 94000000 call <jmp.&KERNEL32.lstrcatA> ; \lstrcatA
004010AD |. B2 02 mov dl, 2
004010AF |> 8305 5C224000>/add dword ptr [40225C], 1
004010B6 |. 8305 5D224000>|add dword ptr [40225D], 1
004010BD |. 8305 5E224000>|add dword ptr [40225E], 1
004010C4 |. 8305 5F224000>|add dword ptr [40225F], 1
004010CB |. FECA |dec dl
004010CD |.^ 75 E0 \jnz short 004010AF
004010CF |. 68 FD234000 push 004023FD ; /StringToAdd = "L2C-5781"
004010D4 |. 68 00204000 push 00402000 ; |ConcatString = ""
004010D9 |. E8 63000000 call <jmp.&KERNEL32.lstrcatA> ; \lstrcatA
004010DE |. 68 5C224000 push 0040225C ; /StringToAdd = ""
004010E3 |. 68 00204000 push 00402000 ; |ConcatString = ""
004010E8 |. E8 54000000 call <jmp.&KERNEL32.lstrcatA> ; \lstrcatA
004010ED |. 68 24234000 push 00402324 ; /String2 = ""
004010F2 |. 68 00204000 push 00402000 ; |String1 = ""
004010F7 |. E8 51000000 call <jmp.&KERNEL32.lstrcmpiA> ; \lstrcmpiA
004010FC |. 83F8 00 cmp eax, 0
004010FF |. 74 16 je short 00401117
00401101 |. 6A 00 push 0 ; /Style = MB_OK|MB_APPLMODAL
00401103 |. 68 34244000 push 00402434 ; |Title = "Error!"
00401108 |. 68 3B244000 push 0040243B ; |Text = "The serial you entered is not correct!"
0040110D |. FF75 08 push dword ptr [ebp+8] ; |hOwner
00401110 |. E8 56000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401115 |. EB 16 jmp short 0040112D
00401117 |> 6A 00 push 0 ; /Style = MB_OK|MB_APPLMODAL
00401119 |. 68 06244000 push 00402406 ; |Title = "Well Done!"
0040111E |. 68 11244000 push 00402411 ; |Text = "Yep, you entered a correct serial!"
00401123 |. FF75 08 push dword ptr [ebp+8] ; |hOwner
00401126 |. E8 40000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
0040112B |. EB 00 jmp short 0040112D
0040112D |$ 6A 00 push 0 ; /Result = 0
0040112F |. FF75 08 push dword ptr [ebp+8] ; |hWnd
00401132 |. E8 22000000 call <jmp.&USER32.EndDialog> ; \EndDialog
00401137 |. C9 leave
00401138 \. C2 1000 retn 10
------------------------------------------------------------------------------------------------
【破解总结】
这个CrackMe很简单，大致算法是：
1、取出来CrackMe所在盘的盘符，然后和4562-ABEX合并。
2、将合并后的字符串前4个字符，依次累加2。算出新字符
3、将L2C-5781和步骤2中算出来的字符合并，得出注册码。
使用Delphi XE大致还原了一下算法:
procedure TForm1.btn1Click(Sender: TObject);
var
lpRootPathName:array[0..255] of ansiChar;
str1:array[0..255] of ansiChar; //获取盘符
lpVolumeSerialNumber: DWORD;
lpMaximumComponentLength:DWORD;
lpFileSystemFlags:DWORD;
lpFileSystemNameBuffer: array[0..255] of ansiChar;
i:Integer;
str2:array[0..255] of ansiChar;
begin
//lpRootPathName := 'E:\';
GetVolumeInformationA(0,str1,255,
@lpVolumeSerialNumber,lpMaximumComponentLength,
lpFileSystemFlags,lpFileSystemNameBuffer,
255);
lstrcatA(str1,'4562-ABEX'); //和"4562-ABEX"合并
str1[0] := ansiChar(ord(str1[0])+2); //前四个字符，每个加2
str1[1] := ansiChar(ord(str1[1])+2);
str1[2] := ansiChar(ord(str1[2])+2);
str1[3] := ansiChar(ord(str1[3])+2);
str2 := 'L2C-5781'; //再合并L2C_5781字符
lstrcatA(str2,str1);
edt1.Text := str2;
end;