C++无壳CrackMe or KeyGenMe

一只小凡凡

https://xiaofans.lanzouq.com/ijUpU1ncs9mb


补充：
难度中等偏下，无壳、有反调试、激活码生成算法
你需要逆向算法尝试复原算法的C++或其他语言代码

solly

那个 mod 计算有点小坑，编译器优化后不明显了：

[C] 纯文本查看 复制代码

#include <iostream>
#include <time.h>
//#include <ctime>
//#include <chrono>

size_t calculateOffset();

char mappingTable[] = "!)+LA0K>\"}*|Z=$G\\?#VBM6:4X9P,'254LCJ";
int getFlag(size_t offset, char * flag);

int main(int argc, char** argv) {
    char flag[10];
    size_t offset = calculateOffset();
  
    ///// get current flag with minutes of hour
    printf("Minutes of hour = %d\n", offset);
    getFlag(offset, flag);
    printf("Current flag = %s\n\n", flag);

    ///// get all flags
        printf("All flags:\n");
    for(int i=0; i<60; i++) {
        getFlag(i, flag);
        printf("  Minute = %02d, flag = %s\n", i, flag);
    }
        
    return 0;
}

size_t calculateOffset()
{
    /*
    /// c++ lib
    auto now = std::chrono::system_clock::now();
    auto nanoseconds = std::chrono::duration_cast<std::chrono::nanoseconds>(now.time_since_epoch());
    auto minutes = std::chrono::duration_cast<std::chrono::minutes>(std::chrono::duration_cast<std::chrono::seconds>(nanoseconds));

    //printf("time = 0x%I64X\n", minutes);

    return (minutes.count() % 60);
    */
    /// c lib
    time_t rawtime;
    struct tm *currTM;
 
    time(&rawtime);
    currTM = gmtime(&rawtime);
   
    return currTM->tm_min;
}

#define LENGTH 8

int getFlag(size_t offset, char * flag) {
  char idx_base[] = "52pojie\0";
  
  for(int i=0; i<LENGTH; i++) {
    int idx0 = (idx_base[i] - 0x30 + offset);
    //unsigned int idx1 = ((unsigned)idx0) % 36;
    unsigned int idx1 = (idx0>=0) ? ((unsigned)idx0 % 36) : ((unsigned)(0x34+idx0) % 36);
    //printf("idx%d = 0x%08X ==> 0x%08X\n", i, idx0, idx1);
    flag[i] = mappingTable[idx1];
  }
  flag[LENGTH] = '\0';

  return 0;
}

按分钟计算的码，0~59共60个码：

[Shell] 纯文本查看 复制代码

  Minute = 00, flag = 0+,P6M?A
  Minute = 01, flag = KL',:6#0
  Minute = 02, flag = >A2'4:VK
  Minute = 03, flag = "052X4B>
  Minute = 04, flag = }K459XM"
  Minute = 05, flag = *>L4P96}
  Minute = 06, flag = |"CL,P:*
  Minute = 07, flag = Z}JC',4|
  Minute = 08, flag = =*!J2'XZ
  Minute = 09, flag = $|)!529=
  Minute = 10, flag = GZ+)45P$
  Minute = 11, flag = \=L+L4,G
  Minute = 12, flag = ?$ALCL'\
  Minute = 13, flag = #G0AJC2?
  Minute = 14, flag = V\K0!J5#
  Minute = 15, flag = B?>K)!4V
  Minute = 16, flag = M#">+)LB
  Minute = 17, flag = 6V}"L+CM
  Minute = 18, flag = :B*}ALJ6
  Minute = 19, flag = 4M|*0A!:
  Minute = 20, flag = X6Z|K0)4
  Minute = 21, flag = 9:=Z>K+X
  Minute = 22, flag = P4$=">L9
  Minute = 23, flag = ,XG$}"AP
  Minute = 24, flag = '9\G*}0,
  Minute = 25, flag = 2P?\|*K'
  Minute = 26, flag = 5,#?Z|>2
  Minute = 27, flag = 4'V#=Z"5
  Minute = 28, flag = L2BV$=}4
  Minute = 29, flag = C5MBG$*L
  Minute = 30, flag = J46M\G|C
  Minute = 31, flag = !L:6?\ZJ
  Minute = 32, flag = )C4:#?=!
  Minute = 33, flag = +JX4V#$)
  Minute = 34, flag = L!9XBVG+
  Minute = 35, flag = A)P9MB\L
  Minute = 36, flag = 0+,P6M?A
  Minute = 37, flag = KL',:6#0
  Minute = 38, flag = >A2'4:VK
  Minute = 39, flag = "052X4B>
  Minute = 40, flag = }K459XM"
  Minute = 41, flag = *>L4P96}
  Minute = 42, flag = |"CL,P:*
  Minute = 43, flag = Z}JC',4|
  Minute = 44, flag = =*!J2'XZ
  Minute = 45, flag = $|)!529=
  Minute = 46, flag = GZ+)45P$
  Minute = 47, flag = \=L+L4,G
  Minute = 48, flag = ?$ALCL'!
  Minute = 49, flag = #G0AJC2)
  Minute = 50, flag = V\K0!J5+
  Minute = 51, flag = B?>K)!4L
  Minute = 52, flag = M#">+)LA
  Minute = 53, flag = 6V}"L+C0
  Minute = 54, flag = :B*}ALJK
  Minute = 55, flag = 4M|*0A!>
  Minute = 56, flag = X6Z|K0)"
  Minute = 57, flag = 9:=Z>K+}
  Minute = 58, flag = P4$=">L*
  Minute = 59, flag = ,XG$}"A|

solly

更正一下mod，应该是 64 位无符号整数的 mod ，前面用的32位，所以需要加0x34修正，改成64位即可：

[C] 纯文本查看 复制代码

int getFlag(size_t offset, char * flag) {
  char idx_base[] = "52pojie\0";
  
  for(int i=0; i<LENGTH; i++) {
    //int idx0 = (idx_base[i] - 0x30 + offset);
    //int idx1 = (idx0>=0) ? ((idx0) % 36) : ((idx0+0x34) % 36);
    //printf("idx%d = 0x%08X ==> 0x%08X\n", i, idx0, idx1);
    long long idx0 = (long long)((signed int)idx_base[i] - 0x30) + offset;
    unsigned long long idx1 = ((unsigned long long)idx0) % 36;
    //printf("idx%d = 0x%I64X ==> 0x%I64X\n", i, idx0, idx1);
    flag[i] = mappingTable[idx1];
  }
  flag[LENGTH] = '\0';

  return 0;
}

你好，再见

x64呃呃那还是算了

qq465881818

darksied

[C++] 纯文本查看 复制代码

bool __cdecl is52pojie(const std::string *input)
{
  char *v1; // rax
  bool v2; // bl
  std::string currentString; // [rsp+20h] [rbp-50h] BYREF
  char ch_0; // [rsp+4Fh] [rbp-21h]
  const char *__for_end; // [rsp+50h] [rbp-20h]
  const char (*__for_range)[8]; // [rsp+58h] [rbp-18h]
  size_t offset; // [rsp+60h] [rbp-10h]
  const char *__for_begin; // [rsp+68h] [rbp-8h]

  offset = calculateOffset();
  std::string::basic_string(¤tString);
  __for_range = (const char (*)[8])"52pojie";
  __for_begin = "52pojie";
  __for_end = "title CrackMe 52pojie";
  while ( __for_begin != __for_end )
  {
    ch_0 = *__for_begin;
    v1 = (char *)std::string::operator[](&mappingTable[(ch_0 - 48 + offset) % 0x24], 0i64);
    std::string::operator+=(¤tString, (unsigned int)*v1);
    ++__for_begin;
  }
  v2 = std::operator==<char>(input, ¤tString);
  std::string::~string(¤tString);
  return v2;
}

2370177068

看了半天有个mappingTable变量看不懂

吾爱破解1111

有符号，难度为0

5151diy

用这个c32asm v0.8.8 进行操作,就退出

Jar36

这是用mingw写的吧 COFF符号表都在里面

Jar36

Jar36 发表于 2024-2-10 09:53
这是用mingw写的吧 COFF符号表都在里面

以后写crackme记得strip

n5012346

适合我这样的新手