渐入佳境wp
### # 注册机
```
#include <stdio.h>
#include <Windows.h>
int main()
{
char name = { "nmshq" };
char password = { 0 };
int val10 = 1;
for (int k = 0; k < 5; k++)
{
password = name - (0x1D / (val10 + 0x2) + 0x1E);
password = k + password;
val10 += 2;
}
printf("password:%s\n", password);
system("pause");
return 0;
}
```
#### 程序
```
004013C5 8D76 00 lea esi,dword ptr ds:
004013C8 55 push ebp
004013C9 89E5 mov ebp,esp
004013CB 83EC 50 sub esp,0x50
004013CE 56 push esi
004013CF 53 push ebx
-----------------------------------------------------------------------------------------
004013D0 C74 mov value,0x1
004013DA 8B45 0C mov eax,name
004013DE E8 15040000 namestrlen(5) = msvcrt.strlen(name)
004013EC 8B45 10 mov eax,password
004013F0 E8 03040000 passwordstrlen(a) = msvcrt.strlen(password)
004013FB mov dword ptr ss:,0x1
00401402 837D F8 05 if( namestrlen(5) != 0x5) jnz MessageBoxExA
0040140C 8B45 F8 mov eax,namestrlen(5)
00401411 8D0412 lea eax(10)
00401414 3945 FC if( passwordstrlen(a) != 0xa) jnz MessageBoxExA
--------------------------------------------------------------
00401420 83C0 FD value , namestrlen(5) = add namestrlen(5),-0x3=> 2
0040142D 8D76 00 lea esi,dword ptr ds:
do{
mov value,0x0
if( value > 0x6)
{
jmp JIANRUJI.00401500
lea esi,dword ptr ds:
}
var i;
add i,value
if(name > 0x60(a) && name <= 0x7A(z)) jg JIANRUJI.004014F0
{
if( password >= 0x41(A) && password <= 0x5A(Z))
{
movsx eax,password ]
movsx edx,password - 0x1]
if(( eax - edx) == value)
{
movsx ecx,name[ i + value ]
movsx edx,password - 0x1]
mov value,(ecx - edx)
if( value == (0x1D / (value + 0x2) + 0x1E)
{
add value,0x2
mov passwordstrlen(a) = passwordstrlen(a) + passwordstrlen(a)
}
jmp short JIANRUJI.004014F4
}
}
}
--->JIANRUJI.004014F0
add passwordstrlen(a),-0x19
value++
}while(true)
-----------------------------------------------------------------------------------
004014FC 8D7426 00 lea esi,dword ptr ds:
00401500 83C4 F8 add esp,-0x8
00401509 8D1400 lea edx,(passwordstrlen(a)-0x9) * 0x2
0040150C 52 push edx
0040150D 8B45 08 mov eax,dword ptr ss:
00401510 50 push eax
00401511 E8 32000000 call JIANRUJI.00401548
00401516 83C4 10 add esp,0x10
00401519 EB 1F jmp short JIANRUJI.0040153A
0040151B 90 nop
-----------------------------------------------------------MessageBoxExA---------------------------------
0040151C 8D7426 00 lea esi,dword ptr ds:
00401520 83C4 F4 add esp,-0xC
00401523 6A 04 push 0x4
00401525 6A 10 push 0x10
00401527 6A 00 push 0x0
00401529 68 08134000 push JIANRUJI.00401308
0040152E 8B45 08 mov eax,dword ptr ss:
00401531 50 push eax
00401532 E8 01030000 call JIANRUJI.00401838 ; jmpuser32.MessageBoxExA
00401537 83C4 0C add esp,0xC
0040153A EB 04 jmp short JIANRUJI.00401540
0040153C EB 02 jmp short JIANRUJI.00401540
0040153E 89F6 mov esi,esi
00401540 8D65 A8 lea esp,dword ptr ss:
00401543 5B pop ebx
00401544 5E pop esi
00401545 C9 leave
00401546 C3 retn
```
页:
[1]