環境
Windows xp sp3

工具
exeinfope
ollydbg

查殼

無殼VB程序

測試

輸入1234567

OD載入字符串搜素，往上翻就看到這里，我截取部分片段：

00402C26   .  8D55 98       lea edx,dword ptr ss:[ebp-0x68]          ;  取serial長度
00402C29   .  51            push ecx                                 ; /var18
00402C2A   .  52            push edx                                 ; |retBuffer8
00402C2B   .  FF15 20614000 call dword ptr ds:[<&MSVBVM50.__vbaLenVa>; \__vbaLenVar
00402C31   .  50            push eax
00402C32   .  FF15 7C614000 call dword ptr ds:[<&MSVBVM50.__vbaI2Var>;  MSVBVM50.__vbaI2Var
00402C38   .  8B35 14614000 mov esi,dword ptr ds:[<&MSVBVM50.#516>]  ;  MSVBVM50.rtcAnsiValueBstr
00402C3E   .  8B3D 74614000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaSt>;  MSVBVM50.__vbaStrVarVal
00402C44   .  8985 E8FEFFFF mov dword ptr ss:[ebp-0x118],eax
00402C4A   .  B8 01000000   mov eax,0x1
00402C4F   .  8945 C4       mov dword ptr ss:[ebp-0x3C],eax
00402C52   >  66:3B85 E8FEF>cmp ax,word ptr ss:[ebp-0x118]           ;  循環次數
...
00402CC9   .  50            push eax
00402CCA   .  FFD6          call esi
00402CCC   .  0FBFD0        movsx edx,ax
00402CCF   .  33DA          xor ebx,edx                              ;  第i個字符與一個值異或
00402CD1   .  8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]
00402CD7   .  53            push ebx
00402CD8   .  50            push eax
00402CD9   .  FF15 6C614000 call dword ptr ds:[<&MSVBVM50.#608>]     ;  MSVBVM50.rtcVarBstrFromAnsi
00402CDF   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
00402CE2   .  8D95 58FFFFFF lea edx,dword ptr ss:[ebp-0xA8]
00402CE8   .  51            push ecx
00402CE9   .  8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
00402CEF   .  52            push edx
00402CF0   .  50            push eax
00402CF1   .  FF15 78614000 call dword ptr ds:[<&MSVBVM50.__vbaVarCa>;  MSVBVM50.__vbaVarCat
00402CF7   .  8BD0          mov edx,eax
00402CF9   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
...
;上面是第一個循環，下面是第二個循環
00402E14   .  33D9          xor ebx,ecx
00402E16   .  8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]
00402E1C   .  53            push ebx
00402E1D   .  52            push edx
00402E1E   .  FF15 6C614000 call dword ptr ds:[<&MSVBVM50.#608>]     ;  MSVBVM50.rtcVarBstrFromAnsi
00402E24   .  8D45 B4       lea eax,dword ptr ss:[ebp-0x4C]
00402E27   .  8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-0xB8]
00402E2D   .  50            push eax
00402E2E   .  8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
00402E34   .  51            push ecx
00402E35   .  52            push edx
00402E36   .  FF15 78614000 call dword ptr ds:[<&MSVBVM50.__vbaVarCa>;  MSVBVM50.__vbaVarCat
00402E3C   .  8BD0          mov edx,eax
00402E3E   .  8D4D B4       lea ecx,dword ptr ss:[ebp-0x4C]
00402E41   .  FF15 00614000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>;  MSVBVM50.__vbaVarMove
...
;比較
00402EBD   .  8D8D 28FFFFFF lea ecx,dword ptr ss:[ebp-0xD8]
00402EC3   .  50            push eax                                 ; /var18
00402EC4   .  51            push ecx                                 ; |var28
00402EC5   .  C785 30FFFFFF>mov dword ptr ss:[ebp-0xD0],cracking.004>; |UNICODE "VeiajeEjbavwij"
00402ECF   .  C785 28FFFFFF>mov dword ptr ss:[ebp-0xD8],0x8008       ; |
00402ED9   .  FF15 A4614000 call dword ptr ds:[<&MSVBVM50.__vbaVarTs>; \__vbaVarTstNe
00402EDF   .  66:85C0       test ax,ax
00402EE2   .  0F84 A1000000 je cracking.00402F89

仔細看一看很容易發現，第一個循環是將輸入的serial變成另一個字符串，第二個循環將新的字符串再變成另一個字符串，比較。
至于變成另一個字符串的方法是異或，第一個循環的異或內容是0x34，第二個循環異或的內容是一個數組，
{0x34,0x30,0x30,0x30}
所以將比較的字符反過來運算就能得出結果。

PamelaAnderson