0x01 准备工作

扔到die里面看一下

die

开幕雷击

开幕雷击
没事，要啥给啥。打开exe长这样：
mainpage
image.png

0x02 ida分析

.text:0040258B                 jz      short loc_4025E5
.text:0040258D                 push    offset aYouGetIt ; "You Get It"
.text:00402592                 push    offset asc_401B9C ; "\r\n"
.text:00402597                 call    edi ; __vbaStrCat
.text:00402599                 mov     edx, eax
.text:0040259B                 lea     ecx, [ebp-18h]
.text:0040259E                 call    ebx ; __vbaStrMove
.text:004025A0                 push    eax
.text:004025A1                 push    offset aKeygenItNow ; "KeyGen It Now"
.text:004025A6                 call    edi ; __vbaStrCat
.text:004025A8                 lea     ecx, [ebp-6Ch]
.text:004025AB                 mov     [ebp-34h], eax
.text:004025AE                 lea     edx, [ebp-5Ch]
.text:004025B1                 push    ecx
.text:004025B2                 lea     eax, [ebp-4Ch]
.text:004025B5                 push    edx
.text:004025B6                 push    eax
.text:004025B7                 lea     ecx, [ebp-3Ch]
.text:004025BA                 push    0
.text:004025BC                 push    ecx
.text:004025BD                 mov     dword ptr [ebp-3Ch], 8
.text:004025C4                 call    ds:rtcMsgBox
.text:004025CA                 lea     ecx, [ebp-18h]
.text:004025CD                 call    ds:__vbaFreeStr
.text:004025D3                 lea     edx, [ebp-6Ch]
.text:004025D6                 lea     eax, [ebp-5Ch]
.text:004025D9                 push    edx
.text:004025DA                 lea     ecx, [ebp-4Ch]
.text:004025DD                 push    eax
.text:004025DE                 lea     edx, [ebp-3Ch]
.text:004025E1                 push    ecx
.text:004025E2                 push    edx
.text:004025E3                 jmp     short loc_40263B
.text:004025E5 ; ---------------------------------------------------------------------------
.text:004025E5
.text:004025E5 loc_4025E5:                             ; CODE XREF: .text:0040258B↑j
.text:004025E5                 push    offset aYouGetWrong ; "You Get Wrong"
.text:004025EA                 push    offset asc_401B9C ; "\r\n"
.text:004025EF                 call    edi ; __vbaStrCat
.text:004025F1                 mov     edx, eax
.text:004025F3                 lea     ecx, [ebp-18h]
.text:004025F6                 call    ebx ; __vbaStrMove
.text:004025F8                 push    eax
.text:004025F9                 push    offset aTryAgain ; "Try Again"

.text:0040258B jz short loc_4025E5这个是判断分支，nop之即可。

nop
keygen it now告诉我程序还是包含了注册码生成算法，但在ida中无法反汇编。上od。

0x03 od分析

查找字符串锁定位置，马上发现

0040250A   .  FF15 04414000 call dword ptr ds:[<&MSVBVM50.__vbaHresultCheckObj>] ;  Msvbvm50.__vbaHresultCheckObj
00402510   >  8B45 E8       mov eax,dword ptr ss:[ebp-0x18]                      ;  transfer name to eax
00402513   .  8B4D E4       mov ecx,dword ptr ss:[ebp-0x1C]
00402516   .  8B3D 00414000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaStrCat>]       ;  Msvbvm50.__vbaStrCat
0040251C   .  50            push eax
0040251D   .  68 701B4000   push Afkayasb.00401B70                               ;  UNICODE "AKA-"
00402522   .  51            push ecx
00402523   .  FFD7          call edi                                             ;  Msvbvm50.__vbaStrCat; <&MSVBVM50.__vbaStrCat>
00402525   .  8B1D 70414000 mov ebx,dword ptr ds:[<&MSVBVM50.__vbaStrMove>]      ;  Msvbvm50.__vbaStrMove
0040252B   .  8BD0          mov edx,eax
0040252D   .  8D4D E0       lea ecx,dword ptr ss:[ebp-0x20]
00402530   .  FFD3          call ebx                                             ;  Msvbvm50.__vbaObjSet; <&MSVBVM50.__vbaStrMove>
00402532   .  50            push eax
00402533   .  FF15 28414000 call dword ptr ds:[<&MSVBVM50.__vbaStrCmp>]          ;  Msvbvm50.__vbaStrCmp

看明显的地方，比如“AKA-”和一堆vb函数，其中__vbaStrCat应该是keygen的拼接，因此在之前已经生成。通过下断点也发现00402513 . 8B4D E4 mov ecx,dword ptr ss:[ebp-0x1C]将AKA-后的数字部分传入了ecx。继续向上找。

00402403   .  FF15 04414000 call dword ptr ds:[<&MSVBVM50.__vbaHresultCheckObj>] ;  Msvbvm50.__vbaHresultCheckObj
00402409   >  8B95 50FFFFFF mov edx,dword ptr ss:[ebp-0xB0]
0040240F   .  8B45 E4       mov eax,dword ptr ss:[ebp-0x1C]                      ;  transfer name to eax
00402412   .  50            push eax
00402413   .  8B1A          mov ebx,dword ptr ds:[edx]
00402415   .  FF15 E4404000 call dword ptr ds:[<&MSVBVM50.__vbaLenBstr>]         ;  Msvbvm50.__vbaLenBstr
0040241B   .  8BF8          mov edi,eax                                          ;  nameLength
0040241D   .  8B4D E8       mov ecx,dword ptr ss:[ebp-0x18]                      ;  ecx = name
00402420   .  69FF FB7C0100 imul edi,edi,0x17CFB                                 ;  edi * 0x17cfb
00402426   .  51            push ecx
00402427   .  0F80 91020000 jo Afkayasb.004026BE
0040242D   .  FF15 F8404000 call dword ptr ds:[<&MSVBVM50.#rtcAnsiValueBstr_516>>;  Msvbvm50.rtcAnsiValueBstr
00402433   .  0FBFD0        movsx edx,ax
00402436   .  03FA          add edi,edx
00402438   .  0F80 80020000 jo Afkayasb.004026BE
0040243E   .  57            push edi
0040243F   .  FF15 E0404000 call dword ptr ds:[<&MSVBVM50.__vbaStrI4>]           ;  keygen

执行_vbaStrI4函数后发现keygen生成，看函数名猜测可能是字符操作，往前看发现有对name操作的指令。根据注释，先将name字符串传给eax，取字符串长度*0x17cfb。

0040242D   .  FF15 F8404000 call dword ptr ds:[<&MSVBVM50.#rtcAnsiValueBstr_516>>;  Msvbvm50.rtcAnsiValueBstr
00402433   .  0FBFD0        movsx edx,ax
00402436   .  03FA          add edi,edx
00402438   .  0F80 80020000 jo Afkayasb.004026BE

这一块取了name首字符ascii，与之前得到结果相加，压栈，调用_vbaStrI4函数。

75589E71    8BC1            mov eax,ecx
75589E73    33D2            xor edx,edx
75589E75    6A 0A           push 0xA
75589E77    59              pop ecx                                              ; 0019F0D8
75589E78    F7F1            div ecx
75589E7A    8BC8            mov ecx,eax
75589E7C    8D42 30         lea eax,dword ptr ds:[edx+0x30]
75589E7F    66:8907         mov word ptr ds:[edi],ax
75589E82    83C7 02         add edi,0x2
75589E85    85C9            test ecx,ecx
75589E87  ^ 75 E8           jnz short oleaut32.75589E71

函数中的这个循环，执行了数值转化为字符的操作，从75589E7C 8D42 30 lea eax,dword ptr ds:[edx+0x30]容易看出

0x04 总结

注册机算法：
用户输入name，首先读取字符长度，字符长度*0x17cfb，加上name首字符的ascii。得到的数值转化为十进制文本，拼接AKA-即可。
当然有现成的VB Decompiler可以使用，8过我比较懒了…