Initial use to crack ollydbg

Crack is "encryption and decryption third edition of" The traceme.exe, download address will be given at the end.

image.png

This is the main interface software, the software is the main process, when the press Check, reads the content of the user name and serial number, and then checks the user name is more than five, not more than the elastic block error. After than, it will read the user name and serial number. Is generated based on the user name correct serial number, and then do comparison with the correct serial number and serial number input box, if the content is displayed consistent success. If not, try again is displayed.


First, open the traceme with ollydbg. According to say on the course, which reads the input box contents exe usually used GetDlgItemTextA method of user32.dll. Therefore, using the transfer window Ctrl + G

image.png

Enter the expression you want to track input GetDlgItemTextA and find it in the code segment in user32.dll

image.png

Red represents the upper left corner I have set a breakpoint in GetDlgItemTextA, once the program is running GetDlgItemTextA, it will stop. Then you start to run the exe program.

image.png

I was blind lose the serial number, and then press the check to start testing. Sure stopped at the 75e66b36. Then you can stop pressing the F7 key,

image.png

Until here, you can see the call command has run twice GetDlgItemTextA, can determine the program has a user name and serial number input box read, then you can guess the test method is to compare the serial number. But that is not the result I phenomena. test method below je of a jump. I clicked on it.

image.png

There is a red arrow immediately, the arrow leading into

image.png

The original name of the user to check the number of characters, then keep looking down.

image.png

The first arrow was the first arrow I just look at the second arrow is a test of the method, I see it jump gone,

image.png

Ah yes the jump to the address shown is wrong serial number, description of the test is to determine the place of the serial number is correct, it is wrong to jump to the wrong part of the serial number, if you do not jump it?

image.png

The jump is not successful, then put the jump obliterate try. Right

image.png

image.png

Yes, I did it, this is the legendary blast. It allows to determine the failure is still running after the failure of a successful outcome. But this no matter what the results are successful input. In this place you can right click and select "Copy to Executable File" menu and select "Modify all." In the new pop-up window, save the file.

image.png

Generated a new traceme.exe, no matter what the serial number of the exe input are successful.

Of course, we can not afford to continue the program through the use F8 to observe the phenomenon, until this place.

image.png

There is an obvious place to the right of the serial number of my input, and there are even a 2360, and the use of a method called lstrcmpA to use these two parameters. This may be true guess the serial number and a verification process than the number of inputs.

image.pngObviously this lstrcmpA using a method called CompareStringA they really are comparing are the same.

In the case where the program can be normally open, and try to enter the serial number 2360 admin

image.png

This is when the program operation, see this the correct answer in memory.


Of course, there is a method based on inverse assembler code to launch the user name method generates a serial number, but at present I have not studied this out.


traceme.exe download address: https: //u19693866.ctfile.com/fs/19693866-388338607

Guess you like

Origin blog.51cto.com/181647568/2421560