crackeme3.exe部分注解

image.png

1：fun触发提示错误的

00440EB0  /.  55            push ebp
00440EB1  |.  8BEC          mov ebp,esp
00440EB3  |.  6A 00         push 0x0
00440EB5  |.  53            push ebx
00440EB6  |.  8BD8          mov ebx,eax
00440EB8  |.  33C0          xor eax,eax
00440EBA  |.  55            push ebp
00440EBB  |.  68 BA0F4400   push crackme3.00440FBA
00440EC0  |.  64:FF30       push dword ptr fs:[eax]
00440EC3  |.  64:8920       mov dword ptr fs:[eax],esp
00440EC6  |.  8D55 FC       lea edx,[local.1]
00440EC9  |.  8B83 C4020000 mov eax,dword ptr ds:[ebx+0x2C4]
00440ECF  |.  E8 4CFFFDFF   call crackme3.00420E20
00440ED4  |.  837D FC 00    cmp [local.1],0x0
00440ED8  |.  75 18         jnz short crackme3.00440EF2
00440EDA  |.  6A 00         push 0x0
00440EDC  |.  B9 C80F4400   mov ecx,crackme3.00440FC8                ;  ASCII "No Name entered"
00440EE1  |.  BA D80F4400   mov edx,crackme3.00440FD8                ;  ASCII "Enter a Name!"
00440EE6  |.  A1 442C4400   mov eax,dword ptr ds:[0x442C44]
00440EEB  |.  8B00          mov eax,dword ptr ds:[eax]
00440EED  |.  E8 76C1FFFF   call crackme3.0043D068
00440EF2  |>  8D55 FC       lea edx,[local.1]
00440EF5  |.  8B83 C8020000 mov eax,dword ptr ds:[ebx+0x2C8]
00440EFB  |.  E8 20FFFDFF   call crackme3.00420E20
00440F00  |.  837D FC 00    cmp [local.1],0x0
00440F04  |.  75 18         jnz short crackme3.00440F1E
00440F06  |.  6A 00         push 0x0
00440F08  |.  B9 E80F4400   mov ecx,crackme3.00440FE8                ;  ASCII "No Serial entered"
00440F0D  |.  BA FC0F4400   mov edx,crackme3.00440FFC                ;  ASCII "Enter a Serial!"
00440F12  |.  A1 442C4400   mov eax,dword ptr ds:[0x442C44]
00440F17  |.  8B00          mov eax,dword ptr ds:[eax]
00440F19  |.  E8 4AC1FFFF   call crackme3.0043D068
00440F1E  |>  8D55 FC       lea edx,[local.1]
00440F21  |.  8B83 C4020000 mov eax,dword ptr ds:[ebx+0x2C4]
00440F27  |.  E8 F4FEFDFF   call crackme3.00420E20
00440F2C  |.  8B45 FC       mov eax,[local.1]                        ;  把我们输入的内容送到EAX，我这里是“CCDebuger”
00440F2F  |.  BA 14104400   mov edx,crackme3.00441014                ;  ASCII "Registered User"
00440F34  |.  E8 F32BFCFF   call crackme3.00403B2C                   ;  fun-关键，要用F7跟进去-判断用户名与Registered User是否一致
00440F39  |.  75 51         jnz short crackme3.00440F8C              ;  跳走，提示Wrong Serial;ry again
00440F3B  |.  8D55 FC       lea edx,[local.1]
00440F3E  |.  8B83 C8020000 mov eax,dword ptr ds:[ebx+0x2C8]
00440F44  |.  E8 D7FEFDFF   call crackme3.00420E20
00440F49  |.  8B45 FC       mov eax,[local.1]
00440F4C  |.  BA 2C104400   mov edx,crackme3.0044102C                ;  ASCII "GFX-754-IER-954"
00440F51  |.  E8 D62BFCFF   call crackme3.00403B2C                   ;  fun--同上用户名和系列号通用fun判断密码关键，要用F7跟进去
00440F56  |.  75 1A         jnz short crackme3.00440F72              ;  跳走，提示Wrong Serial;ry again
00440F58  |.  6A 00         push 0x0
00440F5A  |.  B9 3C104400   mov ecx,crackme3.0044103C                ;  ASCII "CrackMe cracked successfully"
00440F5F  |.  BA 5C104400   mov edx,crackme3.0044105C                ;  ASCII "Congrats! You cracked this CrackMe!"
00440F64  |.  A1 442C4400   mov eax,dword ptr ds:[0x442C44]
00440F69  |.  8B00          mov eax,dword ptr ds:[eax]
00440F6B  |.  E8 F8C0FFFF   call crackme3.0043D068
00440F70  |.  EB 32         jmp short crackme3.00440FA4
00440F72  |>  6A 00         push 0x0
00440F74  |.  B9 80104400   mov ecx,crackme3.00441080                ;  ASCII "Beggar off!"
00440F79  |.  BA 8C104400   mov edx,crackme3.0044108C                ;  ASCII "Wrong Serial,try again!"
00440F7E  |.  A1 442C4400   mov eax,dword ptr ds:[0x442C44]
00440F83  |.  8B00          mov eax,dword ptr ds:[eax]
00440F85  |.  E8 DEC0FFFF   call crackme3.0043D068                   ;  err-窗口
00440F8A  |.  EB 18         jmp short crackme3.00440FA4
00440F8C  |>  6A 00         push 0x0
00440F8E  |.  B9 80104400   mov ecx,crackme3.00441080                ;  ASCII "Beggar off!"
00440F93  |.  BA 8C104400   mov edx,crackme3.0044108C                ;  ASCII "Wrong Serial,try again!"
00440F98  |.  A1 442C4400   mov eax,dword ptr ds:[0x442C44]
00440F9D  |.  8B00          mov eax,dword ptr ds:[eax]
00440F9F  |.  E8 C4C0FFFF   call crackme3.0043D068
00440FA4  |>  33C0          xor eax,eax
00440FA6  |.  5A            pop edx                                  ;  0019FA74
00440FA7  |.  59            pop ecx                                  ;  0019FA74
00440FA8  |.  59            pop ecx                                  ;  0019FA74
00440FA9  |.  64:8910       mov dword ptr fs:[eax],edx               ;  crackme3.0044102C
00440FAC  |.  68 C10F4400   push crackme3.00440FC1
00440FB1  |>  8D45 FC       lea eax,[local.1]
00440FB4  |.  E8 E727FCFF   call crackme3.004037A0
00440FB9  \.  C3            retn

image.png

2：fun判断用户名、系列号同一个函数

00403B2C  /$  53            push ebx                                 ;  fun入口判断注册用户 --Registered User”与输入用户
00403B2D  |.  56            push esi
00403B2E  |.  57            push edi
00403B2F  |.  89C6          mov esi,eax                              ;  把EAX内我们输入的用户名送到 ESI
00403B31  |.  89D7          mov edi,edx                              ;  把EDX内的数据“Registered User”送到EDI
00403B33  |.  39D0          cmp eax,edx                              ;  用“Registered User”和我们输入的用户名作比较
00403B35  |.  0F84 8F000000 je crackme3.00403BCA                     ;  相同则跳转
00403B3B  |.  85F6          test esi,esi                             ;  看看ESI中输入的用户名是否有数据
00403B3D  |.  74 68         je short crackme3.00403BA7               ;   用户名为空则跳
00403B3F  |.  85FF          test edi,edi
00403B41  |.  74 6B         je short crackme3.00403BAE
00403B43  |.  8B46 FC       mov eax,dword ptr ds:[esi-0x4]           ;  用户名长度送EAX
00403B46  |.  8B57 FC       mov edx,dword ptr ds:[edi-0x4]           ;  Registered User”字串的长度送EDX
00403B49  |.  29D0          sub eax,edx                              ;  crackme3.0044102C
00403B4B  |.  77 02         ja short crackme3.00403B4F               ;  用户名长度大于“Registered User”长度则跳
00403B4D  |.  01C2          add edx,eax                              ;  把减后值与“Registered User”长度相加，即用户名长度
00403B4F  |>  52            push edx                                 ;  crackme3.0044102C
00403B50  |.  C1EA 02       shr edx,0x2                              ;  用户名长度值右移2位，这里相当于长度除以4
00403B53  |.  74 26         je short crackme3.00403B7B               ;  上面的指令及这条指令就是判断用户名长度最少不能低于4
00403B55  |>  8B0E          /mov ecx,dword ptr ds:[esi]              ;  ????把我们输入的用户名送到ECX
00403B57  |.  8B1F          |mov ebx,dword ptr ds:[edi]
00403B59  |.  39D9          |cmp ecx,ebx
00403B5B  |.  75 58         |jnz short crackme3.00403BB5             ;  不等则完蛋
00403B5D  |.  4A            |dec edx                                 ;  crackme3.0044102C
00403B5E  |.  74 15         |je short crackme3.00403B75
00403B60  |.  8B4E 04       |mov ecx,dword ptr ds:[esi+0x4]
00403B63  |.  8B5F 04       |mov ebx,dword ptr ds:[edi+0x4]
00403B66  |.  39D9          |cmp ecx,ebx
00403B68  |.  75 4B         |jnz short crackme3.00403BB5
00403B6A  |.  83C6 08       |add esi,0x8
00403B6D  |.  83C7 08       |add edi,0x8
00403B70  |.  4A            |dec edx                                 ;  crackme3.0044102C
00403B71  |.^ 75 E2         \jnz short crackme3.00403B55
00403B73  |.  EB 06         jmp short crackme3.00403B7B
00403B75  |>  83C6 04       add esi,0x4
00403B78  |.  83C7 04       add edi,0x4
00403B7B  |>  5A            pop edx                                  ;  crackme3.00440F56
00403B7C  |.  83E2 03       and edx,0x3
00403B7F  |.  74 22         je short crackme3.00403BA3
00403B81  |.  8B0E          mov ecx,dword ptr ds:[esi]               ;  crackme3.0043EB70
00403B83  |.  8B1F          mov ebx,dword ptr ds:[edi]
00403B85  |.  38D9          cmp cl,bl
00403B87  |.  75 41         jnz short crackme3.00403BCA
00403B89  |.  4A            dec edx                                  ;  crackme3.0044102C
00403B8A  |.  74 17         je short crackme3.00403BA3
00403B8C  |.  38FD          cmp ch,bh
00403B8E  |.  75 3A         jnz short crackme3.00403BCA
00403B90  |.  4A            dec edx                                  ;  crackme3.0044102C
00403B91  |.  74 10         je short crackme3.00403BA3
00403B93  |.  81E3 0000FF00 and ebx,0xFF0000
00403B99  |.  81E1 0000FF00 and ecx,0xFF0000
00403B9F  |.  39D9          cmp ecx,ebx
00403BA1  |.  75 27         jnz short crackme3.00403BCA
00403BA3  |>  01C0          add eax,eax
00403BA5  |.  EB 23         jmp short crackme3.00403BCA
00403BA7  |>  8B57 FC       mov edx,dword ptr ds:[edi-0x4]
00403BAA  |.  29D0          sub eax,edx                              ;  crackme3.0044102C
00403BAC  |.  EB 1C         jmp short crackme3.00403BCA
00403BAE  |>  8B46 FC       mov eax,dword ptr ds:[esi-0x4]
00403BB1  |.  29D0          sub eax,edx                              ;  crackme3.0044102C
00403BB3  |.  EB 15         jmp short crackme3.00403BCA
00403BB5  |>  5A            pop edx                                  ;  crackme3.00440F56
00403BB6  |.  38D9          cmp cl,bl
00403BB8  |.  75 10         jnz short crackme3.00403BCA
00403BBA  |.  38FD          cmp ch,bh
00403BBC  |.  75 0C         jnz short crackme3.00403BCA
00403BBE  |.  C1E9 10       shr ecx,0x10
00403BC1  |.  C1EB 10       shr ebx,0x10
00403BC4  |.  38D9          cmp cl,bl
00403BC6  |.  75 02         jnz short crackme3.00403BCA
00403BC8  |.  38FD          cmp ch,bh
00403BCA  |>  5F            pop edi                                  ;  crackme3.00440F56
00403BCB  |.  5E            pop esi                                  ;  crackme3.00440F56
00403BCC  |.  5B            pop ebx                                  ;  crackme3.00440F56
00403BCD  \.  C3            retn

3：正确结果

用户：Registered User
系列号：GFX-754-IER-954

image.png