新160个crackme - 059-Dope2112.1

运行分析

• 输入Name和Serial，点击Registrieren按钮，显示疑似错误提示
  
• 百度翻译查看一下，发现是德语

---

PE分析

• Delphi程序，32位，无壳

---

静态分析&动态调试

• ida字符串发现正确提示，双击跟进

---

• 来到关键函数，进行动态调试，发现要想跳转至成功提示，需要使136行cmp(v21,Names)相等，分析计算过程如下：
• 1、提取Name前6位进行计算，得到低位v5
• 2、将Name长度乘19070的结果为v20
• 3、v5十六进制转十进制，得到v17
• 3、拼接字符串，v21 = v20 + dword_421DD8 + v17
• 4、dword_421DD8 的值为’-’

---

算法分析

Name = 'concealbear'
Serial = ''
dword_421DD8 = '-'v5 = 93
for i in range(0,5):if Name[i] == 'a':v7 = 24elif Name[i] == 'b':v7 = 37elif Name[i] == 'c':v7 = 66elif Name[i] == 'd':v7 = 12elif Name[i] == 'e':v7 = 13elif Name[i] == 'f':v7 = 6elif Name[i] == 'g':v7 = 54elif Name[i] == 'h':v7 = 43elif Name[i] == 'i':v7 = 23elif Name[i] == 'j':v7 = 47elif Name[i] == 'k':v7 = 19elif Name[i] == 'l':v7 = -126elif Name[i] == 'm':v7 = -101elif Name[i] == 'n':v7 = -110elif Name[i] == 'o':v7 = 3elif Name[i] == 'p':v7 = 99elif Name[i] == 'q':v7 = 33elif Name[i] == 'r':v7 = 66elif Name[i] == 's':v7 = 92elif Name[i] == 't':v7 = 41elif Name[i] == 'u':v7 = -57elif Name[i] == 'v':v7 = 102elif Name[i] == 'w':v7 = 88elif Name[i] == 'x':v7 = 10elif Name[i] == 'y':v7 = 40elif Name[i] == 'z':v7 = 80else:v7 = 93v5 = (v5 + v7) & 0xffv20 = len(Name) * 19070
v17 = v5Serial = str(v17) + dword_421DD8 + str(v20)print(Name + '的Serial为：\n' + Serial)

• 验证成功