ƽ - LCG - LSG |׿ƽ||ƽܛ|ŷƱ  www.ykwek.com

 һܴa
 ע[Register]

QQ

ֻһ_ʼ

: ctf Ó ̳
12һ
б l
鿴: 1683|؏: 12
һ} һ}

篮球欧冠联赛 : [ԭ] CrackMeʮһ}㷨 + עԙC

  [朽]
Dָnj
growuphappily l 2020-3-2 13:21
growuphappily 2020-3-2 13:22 ݋

0x00 ǰ

ě]ʲôӺÌڟoаlF@
//www.ykwek.com/thread-709699-1-1.html
ҾʹÿһCrackMe}Ŀ
һ}//www.ykwek.com/forum.php?mod=viewthread&tid=1107523
ڶ}//www.ykwek.com/forum.php?mod=viewthread&tid=1107888
}//www.ykwek.com/thread-1108487-1-1.html
}//www.ykwek.com/thread-1109140-1-1.html
}̫׃B
}//www.ykwek.com/thread-1111030-1-1.html
}//www.ykwek.com/thread-1112318-1-1.html
ڰ}//www.ykwek.com/thread-1113163-1-1.html
ھ}㷨//www.ykwek.com/thread-1114003-1-1.html
ھ}ƣ//www.ykwek.com/thread-1113295-1-1.html
ʮ}//www.ykwek.com/thread-1116170-1-1.html
ʮһ}//www.ykwek.com/thread-1119813-1-1.html
ʮһ}㷨//www.ykwek.com/thread-1120768-1-1.html
ʮ}16λij]\(䌍ǿҊefy2333)
0x01


ϴαƵĕrlFһַֻһ16M
һVBDecomplierĴa
[Visual Basic] ı鿴 ƴa
 ŷƱ  www.ykwek.com   loc_004064A2: For var_24 = 1 To Len(var_44) Step 1
  loc_004064A8: 
  loc_004064AA: If var_24 = 0 Then GoTo loc_004065D9
  loc_004064C4: var_50 = CStr(Left(var_44, 2))
  loc_00406516: var_3A0 = Asc(Mid$(CStr(var_44), CLng(var_24), 1))
  loc_00406558: var_8C = Hex$((var_3A8 + var_CC))
  loc_00406585: var_34 = 0 & Hex$((var_3A8 + var_CC))
  loc_004065CE: Next var_24
  loc_004065D4: GoTo loc_004064A8
  loc_004065D9: 'Referenced from: 004064AA
  loc_00406601: If (var_34 = "0817E747D7A7D7C7F82836D74747A7F7E7B7C7D826D817E7B7C") = 0 Then GoTo loc_0040664F

ȡַеַDQASCIIavar_CCٰϲһǰς0
@var_CCʲô߀֪ҪȥODĴa
var_CCODеebp-0xCC
ODĴa
[Asm] ı鿴 ƴa
00406432   > \8D95 4CFFFFFF lea edx,dword ptr ss:[ebp-0xB4]
00406438   .  8D4D CC       lea ecx,dword ptr ss:[ebp-0x34]
0040643B   .  C785 54FFFFFF>mov dword ptr ss:[ebp-0xAC],0x0
00406445   .  C785 4CFFFFFF>mov dword ptr ss:[ebp-0xB4],0x2
0040644F   .  FFD7          call edi                                 ;  user32.PeekMessageA
00406451   .  B8 02000000   mov eax,0x2
00406456   .  B9 01000000   mov ecx,0x1
0040645B   .  8985 4CFFFFFF mov dword ptr ss:[ebp-0xB4],eax          ;  msvbvm60.6601A3C8
00406461   .  8985 3CFFFFFF mov dword ptr ss:[ebp-0xC4],eax          ;  msvbvm60.6601A3C8
00406467   .  898D 54FFFFFF mov dword ptr ss:[ebp-0xAC],ecx
0040646D   .  898D 44FFFFFF mov dword ptr ss:[ebp-0xBC],ecx
00406473   .  8D85 4CFFFFFF lea eax,dword ptr ss:[ebp-0xB4]
00406479   .  8D4D BC       lea ecx,dword ptr ss:[ebp-0x44]
0040647C   .  50            push eax                                 ; /Step8 = msvbvm60.6601A3C8
0040647D   .  8D55 9C       lea edx,dword ptr ss:[ebp-0x64]          ; |
00406480   .  51            push ecx                                 ; |/var18 = C71CB2C8
00406481   .  52            push edx                                 ; ||retBuffer8 = NULL
00406482   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaLenVa>; |\__vbaLenVar
00406488   .  50            push eax                                 ; |End8 = msvbvm60.6601A3C8
00406489   .  8D85 3CFFFFFF lea eax,dword ptr ss:[ebp-0xC4]          ; |
0040648F   .  8D8D 68FDFFFF lea ecx,dword ptr ss:[ebp-0x298]         ; |
00406495   .  50            push eax                                 ; |Start8 = msvbvm60.6601A3C8
00406496   .  8D95 78FDFFFF lea edx,dword ptr ss:[ebp-0x288]         ; |
0040649C   .  51            push ecx                                 ; |TMPend8 = C71CB2C8
0040649D   .  8D45 DC       lea eax,dword ptr ss:[ebp-0x24]          ; |
004064A0   .  52            push edx                                 ; |TMPstep8 = NULL
004064A1   .  50            push eax                                 ; |Counter8 = msvbvm60.6601A3C8
004064A2   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaVarFo>; \__vbaVarForInit
004064A8   >  85C0          test eax,eax                             ;  msvbvm60.6601A3C8
004064AA   .  0F84 29010000 je Andrna.004065D9
004064B0   .  8D4D BC       lea ecx,dword ptr ss:[ebp-0x44]
004064B3   .  6A 02         push 0x2 ; push2fֻȡǰλ
004064B5   .  8D55 8C       lea edx,dword ptr ss:[ebp-0x74]
004064B8   .  51            push ecx
004064B9   .  52            push edx
004064BA   .  FFD3          call ebx ; @callVBLeft()ȡһַǰλpush2fȡǰλ
004064BC   .  8D45 8C       lea eax,dword ptr ss:[ebp-0x74]
004064BF   .  8D4D B0       lea ecx,dword ptr ss:[ebp-0x50]
004064C2   .  50            push eax                                 ;  msvbvm60.6601A3C8
004064C3   .  51            push ecx
004064C4   .  FFD6          call esi ; @callǰǰȡַŵһȴַѵַeax
004064C6   .  50            push eax                                 ;  msvbvm60.6601A3C8
004064C7   .  FF15 D8104000 call dword ptr ds:[<&MSVBVM60.#581>]     ; ȡַDQ16MƷŵcĴ   ע⣺10MƵ16Meӣݔ12ݔ0x12
004064CD   .  DD9D 34FFFFFF fstp qword ptr ss:[ebp-0xCC]    ;@фDQʮMƔxֵoebp-0xCC
004064D3   .  8D55 9C       lea edx,dword ptr ss:[ebp-0x64] 
004064D6   .  8D45 DC       lea eax,dword ptr ss:[ebp-0x24]
004064D9   .  52            push edx
004064DA   .  50            push eax                                 ;  msvbvm60.6601A3C8
004064DB   .  C745 A4 01000>mov dword ptr ss:[ebp-0x5C],0x1
004064E2   .  C745 9C 02000>mov dword ptr ss:[ebp-0x64],0x2
004064E9   .  FF15 AC104000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>;  msvbvm60.__vbaI4Var
004064EF   .  8D4D BC       lea ecx,dword ptr ss:[ebp-0x44]
004064F2   .  50            push eax                                 ;  msvbvm60.6601A3C8
004064F3   .  8D55 B8       lea edx,dword ptr ss:[ebp-0x48]
004064F6   .  51            push ecx
004064F7   .  52            push edx
004064F8   .  FFD6          call esi
004064FA   .  50            push eax                                 ;  msvbvm60.6601A3C8
004064FB   .  FF15 4C104000 call dword ptr ds:[<&MSVBVM60.#631>]     ;  msvbvm60.rtcMidCharBstr
00406501   .  8BD0          mov edx,eax                              ;  msvbvm60.6601A3C8
00406503   .  8D4D B4       lea ecx,dword ptr ss:[ebp-0x4C]
00406506   .  FF15 BC104000 call dword ptr ds:[<&MSVBVM60.__vbaStrMo>;  msvbvm60.__vbaStrMove
0040650C   .  50            push eax                                 ; /String = "tl"
0040650D   .  FF15 20104000 call dword ptr ds:[<&MSVBVM60.#516>]     ; \rtcAnsiValueBstr
00406513   .  0FBFC0        movsx eax,ax
00406516   .  8985 60FCFFFF mov dword ptr ss:[ebp-0x3A0],eax         ;  msvbvm60.6601A3C8
0040651C   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00406522   .  DB85 60FCFFFF fild dword ptr ss:[ebp-0x3A0]
00406528   .  51            push ecx
00406529   .  C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],0x5
00406533   .  DD9D 58FCFFFF fstp qword ptr ss:[ebp-0x3A8]
00406539   .  DD85 58FCFFFF fld qword ptr ss:[ebp-0x3A8]
0040653F   .  DC85 34FFFFFF fadd qword ptr ss:[ebp-0xCC]
00406545   .  DD5D 84       fstp qword ptr ss:[ebp-0x7C]
00406548   .  DFE0          fstsw ax
0040654A   .  A8 0D         test al,0xD
0040654C   .  0F85 7A040000 jnz Andrna.004069CC
00406552   .  FF15 94104000 call dword ptr ds:[<&MSVBVM60.#572>]     ;  msvbvm60.rtcHexBstrFromVar
00406558   .  8985 74FFFFFF mov dword ptr ss:[ebp-0x8C],eax          ;  msvbvm60.6601A3C8
0040655E   .  8D55 CC       lea edx,dword ptr ss:[ebp-0x34]
00406561   .  8D85 6CFFFFFF lea eax,dword ptr ss:[ebp-0x94]
00406567   .  52            push edx
00406568   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
0040656E   .  50            push eax                                 ;  msvbvm60.6601A3C8
0040656F   .  51            push ecx
00406570   .  C785 6CFFFFFF>mov dword ptr ss:[ebp-0x94],0x8
0040657A   .  FF15 84104000 call dword ptr ds:[<&MSVBVM60.__vbaVarCa>;  msvbvm60.__vbaVarCat
00406580   .  8BD0          mov edx,eax                              ;  msvbvm60.6601A3C8
00406582   .  8D4D CC       lea ecx,dword ptr ss:[ebp-0x34]
00406585   .  FFD7          call edi                                 ;  user32.PeekMessageA
00406587   .  8D55 B0       lea edx,dword ptr ss:[ebp-0x50]
0040658A   .  8D45 B4       lea eax,dword ptr ss:[ebp-0x4C]
0040658D   .  52            push edx
0040658E   .  8D4D B8       lea ecx,dword ptr ss:[ebp-0x48]
00406591   .  50            push eax                                 ;  msvbvm60.6601A3C8
00406592   .  51            push ecx
00406593   .  6A 03         push 0x3
00406595   .  FF15 9C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStrList
0040659B   .  8D95 6CFFFFFF lea edx,dword ptr ss:[ebp-0x94]
004065A1   .  8D85 7CFFFFFF lea eax,dword ptr ss:[ebp-0x84]
004065A7   .  52            push edx
004065A8   .  8D4D 8C       lea ecx,dword ptr ss:[ebp-0x74]
004065AB   .  50            push eax                                 ;  msvbvm60.6601A3C8
004065AC   .  8D55 9C       lea edx,dword ptr ss:[ebp-0x64]
004065AF   .  51            push ecx
004065B0   .  52            push edx
004065B1   .  6A 04         push 0x4
004065B3   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeV>;  msvbvm60.__vbaFreeVarList
004065B9   .  83C4 24       add esp,0x24
004065BC   .  8D85 68FDFFFF lea eax,dword ptr ss:[ebp-0x298]
004065C2   .  50            push eax                                 ; /TMPend8 = msvbvm60.6601A3C8
004065C3   .  8D8D 78FDFFFF lea ecx,dword ptr ss:[ebp-0x288]         ; |
004065C9   .  8D55 DC       lea edx,dword ptr ss:[ebp-0x24]          ; |
004065CC   .  51            push ecx                                 ; |TMPstep8 = C71CB2C8
004065CD   .  52            push edx                                 ; |Counter8 = NULL
004065CE   .  FF15 C8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarFo>; \__vbaVarForNext
004065D4   .^ E9 CFFEFFFF   jmp Andrna.004064A8
004065D9   >  8D45 CC       lea eax,dword ptr ss:[ebp-0x34]
004065DC   .  8D8D 4CFFFFFF lea ecx,dword ptr ss:[ebp-0xB4]
004065E2   .  50            push eax                                 ; /var18 = msvbvm60.6601A3C8
004065E3   .  51            push ecx                                 ; |var28 = C71CB2C8
004065E4   .  C785 54FFFFFF>mov dword ptr ss:[ebp-0xAC],Andrna.0040>; |0817E747D7A7D7C7F82836D74747A7F7E7B7C7D826D817E7B7C
004065EE   .  C785 4CFFFFFF>mov dword ptr ss:[ebp-0xB4],0x8008       ; |
004065F8   .  FF15 5C104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTs>; \__vbaVarTstEq

var_CCāԴ
(wע)
Ҫ̣ȡݔkeyȡڶλȻǰĽYDQɔٰݔÿַASCIIǰӋõĔDQ16MַȻϲһǰ0c0817E747D7A7D7C7F82836D74747A7F7E7B7C7D826D817E7B7C^
@҂øFe(ͨһcһһԇ)
עԙC
[Python] ı鿴 ƴa
key = "81,7E,74,7D,7A,7D,7C,7F,82,83,6D,74,74,7A,7F,7E,7B,7C,7D,82,6D,81,7E,7B,7C"
keys = []
for i in key.split(','):
    keys.append(int(i,16))
t = 1
for i in ['0','1','2','3','4','5','6','7','8','9']:
    for ii in ['0','1','2','3','4','5','6','7','8','9']:
        a = i + ii
        if chr(keys[0] - int(a)) in ['1','2','3','4','5','6','7','8','9']:
            print('ܳ{0}:'.format(t),end='')
            for iii in keys:
                print(chr(iii-int(a)),end='')
            print('')
            t += 1

Y
[Python] ı鿴 ƴa
ܳ1:96,52547:;%,,276345:%9634
ܳ2:85+414369:$++1652349$8523
ܳ3:74*3032589#**0541238#7412
ܳ4:63)2/21478"))/430127"6301
ܳ5:52(1.10367!((.32/016!52/0
ܳ6:41'0-0/256 ''-21./05 41./
ܳ7:30&/,/.145&&,10-./430-.
ܳ8:2/%.+.-034%%+0/,-.32/,-
ܳ9:1.$-*-,/23$$*/.+,-21.+,

оłܳ
ֻеǿݔ
ܳ׾74*3032589#**0541238#7412
ЧD

0x03

uֲҪXuֲҪXuֲҪX

Mu

14ێ +18 ֵ +10
Hmily + 7 + 1 gӭӑՓƽՓ
HG/ww + 1 ӑՓ@
+ 1 + 1 xČFh҂Ŭȡø
A- + 1 + 1 gӭӑՓƽՓ
Theseaway + 1 Һٝͬ
Id!0tNe + 1 Һٝͬ
A999999 + 1 Ļ؏
jun198510 + 1 + 1 x[email protected]
δ + 1 + 1 x[email protected]
minchang + 1 + 1 Ļ؏
jinyif + 1 Һٝͬ
lingyunbbs + 1 + 1 ĄDNܛȫߺęn
+ 1 Ļ؏
quick7 + 1 + 1 ӑՓ@

鿴ȫu

lǰҪՓܕҪҵĴ𰸻ѽ˰l^ͬՈ؏Ͱl

؏

e

]
wuyaqing981206 l 2020-3-2 18:45
ɱεā±Ƶ
3#
jinyif l 2020-3-2 14:54
4#
SyliaL l 2020-3-2 16:49
5#
DJesues l 2020-3-2 21:58
e@}....Ҳ....
6#
l 2020-3-2 22:49
ŶeŶ
7#
kao2288 l 2020-3-3 00:40
ô㷨
8#
nj2004 l 2020-3-3 08:45
úÌWôŪ
9#
huyifan311 l 2020-3-3 09:40
10#
ij~ l 2020-3-3 10:00
дд
12һ
б l

eҎt 棺Kֹˮ؏c}oP`P

ٻ؏ ղ б

RSSӆ|С|“ϵ҂|ŷƱ ( ICP16042023̖ | W 11010502030087̖ )

GMT+8, 2020-4-7 01:00

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

ٻ؏ ŷƱ б