继续crackme
经历过几个delphi的程序之后终于迎来了一个VB的程序，VB程序里面有很多神奇的库函数。
还是有大神总结了一下，这是一个很详细的介绍。
嗯，接下来还是进行逆向分析。
0X00 这是一个很简单的验证name的程序。
界面也很简单，随意输入发现弹窗。就是语言非常的神奇，总之是一种我没见过的语言。。
嗯，根据流程猜测一下大概就是输入key，然后对比验证。
0X01 接下来尝试爆破
对于这种典型的弹窗，我们一般都采用如下步骤：弹窗->暂停->alt+k查看栈情况->跟到messagebox->向上找到关键跳转->修改爆破
好的那么接下来拖到OD当中运行然后弹窗，alt+k查看
很明显最下面来自用户进程调用
跟进转到00401EA3，向上找到关键跳转
下断点运行到此处将标志位反转，即可实现爆破。此时弹出right字样的对话框
0X02 接下来分析算法
其实很简单，做一些标注
00401D6A . FF15 E4304000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj 00401D70 > 8B4D D8 mov ecx,dword ptr ss:[ebp-0x28] 00401D73 . 51 push ecx ; ecx=name 00401D74 . 68 541A4000 push Andréna.00401A54 ; UNICODE "SynTaX 2oo1" 00401D79 . FF15 08314000 call dword ptr ds:[<&MSVBVM50.__vbaStrCm>; msvbvm50.__vbaStrCmp 00401D7F . 8BF8 mov edi,eax 00401D81 . 8D4D D8 lea ecx,dword ptr ss:[ebp-0x28] 00401D84 . F7DF neg edi 00401D86 . 1BFF sbb edi,edi 00401D88 . 47 inc edi 00401D89 . F7DF neg edi 00401D8B . FF15 5C314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>; msvbvm50.__vbaFreeStr 00401D91 . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C] 00401D94 . FF15 60314000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>; msvbvm50.__vbaFreeObj 00401D9A . 66:3BFE cmp di,si 00401D9D . 0F84 A0000000 je Andréna.00401E43 00401DA3 . FF15 2C314000 call dword ptr ds:[<&MSVBVM50.#534>] ; msvbvm50.rtcBeep 00401DA9 . 8B3D 48314000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>; msvbvm50.__vbaVarDup 00401DAF . B9 04000280 mov ecx,0x80020004 00401DB4 . 894D 9C mov dword ptr ss:[ebp-0x64],ecx 00401DB7 . B8 0A000000 mov eax,0xA 00401DBC . 894D AC mov dword ptr ss:[ebp-0x54],ecx 00401DBF . BB 08000000 mov ebx,0x8 00401DC4 . 8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C] 00401DCA . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C] 00401DCD . 8945 94 mov dword ptr ss:[ebp-0x6C],eax 00401DD0 . 8945 A4 mov dword ptr ss:[ebp-0x5C],eax 00401DD3 . C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],Andréna.0040>; UNICODE "SuCCESFul !" 00401DDD . 899D 74FFFFFF mov dword ptr ss:[ebp-0x8C],ebx ; Andréna.004022F0 00401DE3 . FFD7 call edi ; <&MSVBVM50.__vbaVarDup> 00401DE5 . 8D55 84 lea edx,dword ptr ss:[ebp-0x7C] 00401DE8 . 8D4D C4 lea ecx,dword ptr ss:[ebp-0x3C] 00401DEB . C745 8C 701A4>mov dword ptr ss:[ebp-0x74],Andréna.0040>; UNICODE "RiCHtiG ! ...nun weiter zu CrackMe 2 !" 00401DF2 . 895D 84 mov dword ptr ss:[ebp-0x7C],ebx ; Andréna.004022F0 00401DF5 . FFD7 call edi 00401DF7 . 8D55 94 lea edx,dword ptr ss:[ebp-0x6C] 00401DFA . 8D45 A4 lea eax,dword ptr ss:[ebp-0x5C] 00401DFD . 52 push edx 00401DFE . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C] 00401E01 . 50 push eax 00401E02 . 51 push ecx 00401E03 . 8D55 C4 lea edx,dword ptr ss:[ebp-0x3C] 00401E06 . 6A 30 push 0x30 00401E08 . 52 push edx 00401E09 . FF15 F0304000 call dword ptr ds:[<&MSVBVM50.#595>] ; msvbvm50.rtcMsgBox 00401E0F . 8D95 44FFFFFF lea edx,dword ptr ss:[ebp-0xBC] 00401E15 . 8D4D DC lea ecx,dword ptr ss:[ebp-0x24] 00401E18 . 8985 4CFFFFFF mov dword ptr ss:[ebp-0xB4],eax 00401E1E . C785 44FFFFFF>mov dword ptr ss:[ebp-0xBC],0x3 00401E28 . FF15 D0304000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>; msvbvm50.__vbaVarMove 00401E2E . 8D45 94 lea eax,dword ptr ss:[ebp-0x6C] 00401E31 . 8D4D A4 lea ecx,dword ptr ss:[ebp-0x5C] 00401E34 . 50 push eax 00401E35 . 8D55 B4 lea edx,dword ptr ss:[ebp-0x4C] 00401E38 . 51 push ecx 00401E39 . 8D45 C4 lea eax,dword ptr ss:[ebp-0x3C] 00401E3C . 52 push edx 00401E3D . 50 push eax 00401E3E . E9 95000000 jmp Andréna.00401ED8 00401E43 > 8B3D 48314000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>; msvbvm50.__vbaVarDup 00401E49 . B9 04000280 mov ecx,0x80020004 00401E4E . 894D 9C mov dword ptr ss:[ebp-0x64],ecx 00401E51 . B8 0A000000 mov eax,0xA 00401E56 . 894D AC mov dword ptr ss:[ebp-0x54],ecx 00401E59 . BB 08000000 mov ebx,0x8 00401E5E . 8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C] 00401E64 . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C] 00401E67 . 8945 94 mov dword ptr ss:[ebp-0x6C],eax 00401E6A . 8945 A4 mov dword ptr ss:[ebp-0x5C],eax 00401E6D . C785 7CFFFFFF>mov dword ptr ss:[ebp-0x84],Andréna.0040>; UNICODE "leider NeiN !" 00401E77 . 899D 74FFFFFF mov dword ptr ss:[ebp-0x8C],ebx ; Andréna.004022F0 00401E7D . FFD7 call edi ; <&MSVBVM50.__vbaVarDup> 00401E7F . 8D55 84 lea edx,dword ptr ss:[ebp-0x7C] 00401E82 . 8D4D C4 lea ecx,dword ptr ss:[ebp-0x3C] 00401E85 . C745 8C E01A4>mov dword ptr ss:[ebp-0x74],Andréna.0040>; UNICODE "Leider Falsch ! Schau noch mal genau nach ..." 00401E8C . 895D 84 mov dword ptr ss:[ebp-0x7C],ebx ; Andréna.004022F0 00401E8F . FFD7 call edi 00401E91 . 8D4D 94 lea ecx,dword ptr ss:[ebp-0x6C] 00401E94 . 8D55 A4 lea edx,dword ptr ss:[ebp-0x5C] 00401E97 . 51 push ecx 00401E98 . 8D45 B4 lea eax,dword ptr ss:[ebp-0x4C] 00401E9B . 52 push edx 00401E9C . 50 push eax 00401E9D . 8D4D C4 lea ecx,dword ptr ss:[ebp-0x3C] 00401EA0 . 6A 10 push 0x10 00401EA2 . 51 push ecx 00401EA3 . FF15 F0304000 call dword ptr ds:[<&MSVBVM50.#595>] ; msvbvm50.rtcMsgBox 00401D6A . FF15 E4304000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj 和我们想象的一样，将name取出与key进行对比。 那么找到key=SynTaX 2oo1 成功。
