chenx221/Reverse
1
0
Fork 0
Code Pull Requests Activity

solved new crackme

Browse Source
This commit is contained in:
Chenx221 2024-09-25 13:27:46 +08:00
parent f489ed7540
commit c7b02f95d3
Signed by: chenx221
GPG Key ID: D7A9EC07024C3021
3 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
Am0kCM_2/Am0kCM_2.exe Normal file
View File

Binary file not shown.

BIN
Am0kCM_2/Am0kCM_2_Patched.exe Normal file
View File

Binary file not shown.

39
Am0kCM_2/solve.md Normal file
View File

@ -0,0 +1,39 @@
1. 直接看Main函数
```assembly
00401000 | 68 FFE77648 | push 4876E7FF |
00401005 | E8 56000000 | call am0kcm_2.401060 |
0040100A | 83C4 04 | add esp,4 |
0040100D | E8 58000000 | call <am0kcm_2.random> |
00401012 | 99 | cdq |
00401013 | 3D FFE77648 | cmp eax,4876E7FF | <--
00401018 | 75 1E | jne <am0kcm_2.Fail> |
0040101A | 83FA 17 | cmp edx,17 | <--
0040101D | 75 19 | jne <am0kcm_2.Fail> |
0040101F | 6A 00 | push 0 |
00401021 | 68 98504000 | push am0kcm_2.405098 | 405098:"Good Job"
00401026 | 68 68504000 | push am0kcm_2.405068 | 405068:"You re one the good way to become a cracker ;)"
0040102B | 6A 00 | push 0 |
0040102D | FF15 94404000 | call dword ptr ds:[<MessageBoxA>] |
00401033 | 33C0 | xor eax,eax |
00401035 | C2 1000 | ret 10 |
00401038 | 6A 00 | push 0 |
0040103A | 68 60504000 | push am0kcm_2.405060 | 405060:"Bad Job"
0040103F | 68 30504000 | push am0kcm_2.405030 | 405030:"Hehe, don't stop trying :P\nStill not cracked.."
00401044 | 6A 00 | push 0 |
00401046 | FF15 94404000 | call dword ptr ds:[<MessageBoxA>] |
0040104C | 33C0 | xor eax,eax |
0040104E | C2 1000 | ret 10 |
```
`00401013`和`0040101A` 这两个的比较结果永远不会相等
2. 要么NOP掉两个jne跳转，要么jne改je
这里我选择后者
```assembly
00401018 | 74 1E | je <am0kcm_2.Fail> |
0040101A | 83FA 17 | cmp edx,17 |
0040101D | 74 19 | je <am0kcm_2.Fail> |
```