software analysis
program download
1
First open it and have a look, and found that there are only two text boxes, nothing else, not even buttons. At this time, I guess this is because the program has been matching characters in the background, and compare the results. If the comparison is the same, it will jump out of success and so on. something to come.
2
od loaded in, run.
Now this program has two situations:
1. Both Nombre and Codigo are specific, that is to say, the two input must be correct to be correct.
2. Nombre and Codigo change accordingly, that is, if you input different Nombre, then Codigo is also different.
These two situations do not affect my random input of characters in the Nombre box. So I input "wang" in the Nombre box, and then power off at the translatemessage function, as shown in the figure below:
①. Search for all functions in the current module
②. Find translatemessage and set a breakpoint
③. Click b to view the breakpoint
Double-click to go in and see separately. I deleted the jmp above according to the situation. Obviously it is a jump.
Why should it be broken at the translatemessage function? Because this function is to convert the virtual key message into a character message , the message input by the keyboard must go through this function.
Click on the program, enter an 8 (the number 8 of the small keyboard I entered), and view the stack, as shown in the figure below:
Key=UK_NUMPAD8 , which is the number 8 of the small keyboard.
3
Tracing method using memory
①. Delete all breakpoints, reload, and run, enter wang, and 9876 (press whatever you want).
②. Click m in od , right click to find "9876", as shown below, a total of two places are found:
③. Set a memory access breakpoint at the first place, click in, run f8, and find that it seems to be a copying process, so I can't keep up. . . (Impatient)
Set a memory access breakpoint at the second place, press F8, enter 5, and find a string similar to the answer in the stack, enter it again, and you can check it in the register, the 987654 I entered is indeed in the same This string comparison is as follows:
④, reload this program, enter whether this is the serial number, it is true
