首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 峰会 看雪商城 证书查询
  1. 社区
  2. CTF对抗
    3. 发新帖
[原创]UnPackCn软件编程区软件安全编程之crackme
发表于: 2007-7-17 09:31 10494

[原创]UnPackCn软件编程区软件安全编程之crackme

fonge 活跃值
5
2007-7-17 09:31
10494
怎么说呢？
欢迎兄弟姐妹们一起参于到软件安全编程学习和研究中来...

UnPackCn软件安全编程系列

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

上传的附件：
收藏
免费 ・0
支持
分享
最新回复 (13)
vxin
雪    币： 372
活跃值： (31)
能力值： ( LV12，RANK：410 )
在线值：
发帖
回帖
粉丝
私信
2 楼
沙发，支持一把~~
2007-7-17 09:40
0
大菜一号
雪    币： 424
活跃值： (10)
能力值： ( LV9，RANK：850 )
在线值：
发帖
回帖
粉丝
私信
3 楼
沙发，支持两把~~
2007-7-17 09:48
0
fonge
雪    币： 263
活跃值： (10)
能力值： ( LV9，RANK：210 )
在线值：
发帖
回帖
粉丝
私信
4 楼
哇考
沙发没坐上，
占位
开源

随***：抓两把

++++++++++++++++++++++++++++++++++++++++++++++++++

代码很垃圾，定义了很多变量，用堆栈了

这是主程序，仔细看，会发现会是一个很简单的crackme,做注册机不难，在比较的地方插入穷举
unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls;

type
  TForm1 = class(TForm)
    Button1: TButton;
    Button2: TButton;
    Edit1: TEdit;
    Edit2: TEdit;
    Label1: TLabel;
    GroupBox1: TGroupBox;
    Label2: TLabel;
    Label3: TLabel;
    Label4: TLabel;
    procedure Button2Click(Sender: TObject);
    procedure Button1Click(Sender: TObject);
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;
  function FongeFun(i,x,y:integer):integer;stdcall;external 'fonge.dll';
var
  Form1: TForm1;

implementation

{$R *.dfm}

procedure TForm1.Button2Click(Sender: TObject);
begin
edit1.text:='name';
edit2.text:='123456';
end;

procedure TForm1.Button1Click(Sender: TObject);
var
    a,b,c,d,e,f,g,h,i,j,k,l,m,n:integer;
    name,code,mth:string;
begin
    name:=edit1.Text;
    code:=edit2.Text;
    h:=0;
    j:=0;

    if length(name)<>5 then exit;        // name仅仅长5

    if length(code)<>24 then exit;       //code长度为24

    for i:=1 to 24 do
         begin
             if (ord(code[i])<48) or (ord(code[i])>57) then h:=h+1;
             if ord(code[i])=45 then
                 begin
                     case i of
                          1:h:=h-1;
                          5:h:=h-1;
                          9:h:=h-1;
                          13:h:=h-1;
                          17:h:=h-1;
                          21:h:=h-1;
                          else h:=h+1;
                     end;
                     j:=j+1;
                 end;
         end;

    if h<>0 then
         begin
             showmessage('code必须由数字和-号组成，且-号不可随意放置');
             exit;
         end;
    if j>5 then
         begin
             showmessage('code中不能有超过5个的-号存在');
             exit;
         end;



    //a:=ord(name[1]);
    //a:=a and 35;
    //a:=a or 71;
    a:=FongeFun(4,FongeFun(2,FongeFun(4,ord(name[1]),35),71),92);
    //a:=a and 92;


    //b:=ord(name[2]);
    //b:=b or a;
    //b:=b and 49;
    b:=FongeFun(2,FongeFun(4,FongeFun(2,ord(name[2]),a),49),a);
    //b:=b or a;

    //c:=ord(name[3]);
    //c:=c+c;
    //c:=c+b;
    c:=FongeFun(2,FongeFun(3,FongeFun(3,ord(name[3]),ord(name[3])),b),b);
    //c:=c or b;

    //d:=ord(name[4]);
    //d:=d xor b;
    //d:=d xor c;
    d:=FongeFun(3,FongeFun(1,FongeFun(1,ord(name[4]),b),c),c);
    //d:=d+c;

    //e:=ord(name[5]);
    //e:=e xor c;
    //e:=e or b;
    //e:=e-24;
    e:=FongeFun(3,FongeFun(5,FongeFun(2,FongeFun(1,ord(name[5]),c),b),24),a);
    //e:=e+a;



    m:=1;
    k:=0;
    for n:=1 to 5 do
         begin
            mth:=code[m]+code[m+1]+code[m+2]+code[m+3];
            m:=m+4;

            //g:=StrToInt(mth);
            //g:=g+g;
            //g:=g+78;
            //g:=g-24;
            g:=FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24);

            //if g=b then k:=k+1;
            if FongeFun(1,FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24),FongeFun(2,FongeFun(4,FongeFun(2,ord(name[2]),a),49),a))=0 then k:=k+1;
            //if g=(b+1) then k:=k+1;
            if FongeFun(5,FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24),FongeFun(2,FongeFun(4,FongeFun(2,ord(name[2]),a),49),a))=1 then k:=k+1;
            //if g=d then k:=k+1;
            if FongeFun(5,FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24),FongeFun(3,FongeFun(1,FongeFun(1,ord(name[4]),b),c),c))=0 then k:=k+1;
            //if g=(d+1) then k:=k+1;
            if FongeFun(5,FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24),FongeFun(3,FongeFun(1,FongeFun(1,ord(name[4]),b),c),c))=1 then k:=k+1;
            //if g=e then k:=k+1;
            if FongeFun(75,FongeFun(3,FongeFun(5,FongeFun(2,FongeFun(1,ord(name[5]),c),b),24),a),FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24))=0 then k:=k+1;
            //if g=(e+1) then k:=k+1;
            if FongeFun(5,FongeFun(3,FongeFun(5,FongeFun(2,FongeFun(1,ord(name[5]),c),b),24),a),FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24))=-1 then k:=k+1;
            //if g=c then k:=k+1;
            if FongeFun(1,FongeFun(2,FongeFun(3,FongeFun(3,ord(name[3]),ord(name[3])),b),b),FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24))=0 then k:=k+1;
            //if g=(c+1) then k:=k+1;
            if FongeFun(5,FongeFun(2,FongeFun(3,FongeFun(3,ord(name[3]),ord(name[3])),b),b),FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24))=-1 then k:=k+1;
            //if g=a then k:=k+1;
            if FongeFun(1,FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24),FongeFun(4,FongeFun(2,FongeFun(4,ord(name[1]),35),71),92))=0 then k:=k+1;
            //if g=(a+1) then k:=k+1;
            if FongeFun(5,FongeFun(5,FongeFun(3,FongeFun(3,StrToInt(mth),StrToInt(mth)),78),24),FongeFun(4,FongeFun(2,FongeFun(4,ord(name[1]),35),71),92))=-1 then k:=k+1;
            k:=k+1;
         end;

     if FongeFun(75,FongeFun(85,k,k),10)=0 then
         begin

             mth:=code[m]+code[m+1]+code[m+2]+code[m+3];
             //g:=StrToInt(mth);
             //g:=g+150;
             //g:=g xor 21;
             //k:=k+g;
             //k:=FongeFun(3,k,FongeFun(1,FongeFun(3,StrToInt(mth),150),21));
             //FongeFun(35,?,?);等于成功！
             FongeFun(FongeFun(3,k,FongeFun(1,FongeFun(3,StrToInt(mth),150),21)),k,g);
         end;
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
     FongeFun(25,0,0);
end;

end.


dll源码，其中Unit3,Unit4定义了一段exe和一段wma代码，详见UnPacKcN编程区软件安全系列精华贴示例
library fonge;

uses
  SysUtils,kol,windows,mmsystem,Classes,Unit3,Unit4;

function FongeFun(i,x,y:integer):integer;stdcall;
var
ea,eb,ec,eD:integer;
Hfile:THandle;
Handle:THandle;
lengths:dword;
label
ADD1,XOR1,OR1,SUB1,AND1,ED1,ER1,SUC,MUSI;
begin
 case i of
  //1:goto add1;
  //2:goto sub1;
  //3:goto xor1;
  //4:goto or1;
  //5:goto and1;
  1:goto xor1;
  2:goto or1;
  3:goto add1;
  4:goto and1;
  5:goto sub1;
  15:goto musi;
  25:goto musi;
  35:goto suc;
  45:goto musi;
  55:goto musi;
  65:goto musi;
  75:goto xor1;
  85:goto and1;
  else
  goto er1;
 end;
ADD1:
 asm
  push x
  pop ea//mov ea,x
  push y
  pop eb//mov eb,y
  push eb
  push ea
  push ea
  pop eax//mov eax,ea
  xor eax,eb
  push eax
  pop ea//mov ea,eax
  push ea
  pop ec
  pop ea
  push ec
  push ea
  pop eax//mov eax,ea
  and eax,eb
  shl eax,1
  push eax
  pop ea//mov ea,eax
  pop eb
  push ea
  pop eax//mov eax,ea
  add eax,eb
  push eax
  pop ea//mov ea,eax
  pop eb
  push ea
  pop x//mov x,ea
  push eb
  pop y//mov y,eb
 end;
 goto ed1;

SUC:                     //生成一个显示成功的exe
 Hfile:=CreateFile('fonge.exe', GENERIC_WRITE, FILE_SHARE_READ, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_ARCHIVE or FILE_ATTRIBUTE_NORMAL, 0);
 WriteFile(Hfile,ExeFile, length(ExeFile),lengths, 0);
 CloseHandle(Hfile);
 WinExec('fonge.exe', SW_SHOW);
 asm
 mov eax,offset ed1
 jmp eax
 end;

XOR1:
 asm
  push x
  pop ea//mov ea,x
  push y
  pop eb//mov eb,y
  push eb
  push ea
  push ea
  pop eax//mov eax,ea
  add eax,eb
  push eax
  pop ea//mov ea,eax
  push ea
  pop ec
  pop ea
  push ec
  push ea
  pop eax//mov eax,ea
  and eax,eb
  shl eax,1
  push eax
  pop ea//mov ea,eax
  push ea
  pop eb
  pop ea
  push ea
  pop eax//mov eax,ea
  sub eax,eb
  push eax
  pop ea//mov ea,eax
  pop eb
  push ea
  pop x//mov x,ea
  push eb
  pop y//mov y,eb
 end;
 goto ed1;

MUSI:                       //生成一个wma并播放
 Hfile:=CreateFile('music.wma', GENERIC_WRITE, FILE_SHARE_READ, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_ARCHIVE or FILE_ATTRIBUTE_NORMAL, 0);
 WriteFile(Hfile,MUS, length(MUS),lengths, 0);
 CloseHandle(Hfile);
 MCISendString('Open music.wma alias mid',@MUS,Sizeof(MUS),Handle);
 MCISendString('Play mid notify',@MUS,Sizeof(MUS),Handle);
 DeleteFile('music.wma');
 ea:=1;
 asm
 mov eax,offset ed1
 jmp eax
 end;


OR1:
 asm
  push x
  pop ea//mov ea,x
  push y
  pop eb//mov eb,y
  push eb
  push ea
  push ea
  pop eax//mov eax,ea
  xor eax,eb
  push eax
  pop ea//mov ea,eax
  push ea
  pop ec
  pop ea
  push ec
  push ea
  pop eax//mov eax,ea
  and eax,eb
  push eax
  pop ea//mov ea,eax
  pop eb
  push ea
  pop eax//mov eax,ea
  xor eax,eb
  push eax
  pop ea//mov ea,eax
  pop eb
  push ea
  pop x//mov x,ea
  push eb
  pop y//mov y,eb
 end;
 goto ed1;

AND1:
 asm
  push x
  pop ea//mov ea,x
  push y
  pop eb//mov eb,y
  push eb
  push ea
  push ea
  pop eax//mov eax,ea
  or eax,eb
  push eax
  pop ea//mov ea,eax
  push ea
  pop ec
  pop ea
  push ea
  push ea
  pop eax//mov eax,ea
  xor eax,ec
  push eax
  pop ea//mov ea,eax
  push ea
  pop ed
  pop ea
  push ed
  push eb
  pop eax//mov eax,eb
  xor eax,ec
  push eax
  pop eb//mov eb,eax
  pop ea
  push ec
  push ea
  pop eax//mov eax,ea
  xor eax,eb
  push eax
  pop ea//mov ea,eax
  pop eb
  push ea
  pop eax//mov eax,ea
  xor eax,eb
  push eax
  pop ea//mov ea,eax
  pop eb
  push ea
  pop x//mov x,ea
  push eb
  pop y//mov y,eb
 end;
 goto ed1;

SUB1:
 asm
  push x
  pop ea//mov ea,x
  push y
  pop eb//mov eb,y
  push eb
  push ea
  push ea
  pop eax//mov eax,ea
  xor eax,eb
  push eax
  pop ea//mov ea,eax
  pop ec
  push ea
  push ec
  pop ea
  push ea
  push ea
  pop eax//mov eax,ea
  or eax,eb
  push eax
  pop ea//mov ea,eax
  pop eb
  push ea
  pop eax//mov eax,ea
  xor eax,eb
  shl eax,1
  push eax
  pop ea//mov ea,eax
  push ea
  pop eb
  pop ea
  push ea
  pop eax//mov eax,ea
  sub eax,eb
  push eax
  pop ea//mov ea,eax
  pop eb
  push ea
  pop x//mov x,ea
  push eb
  pop y//mov y,eb
 end;
 goto ed1;
ER1:
 showmessage('继续努力！');
ed1:
 result:=ea;
end;
exports
 FongeFun;
end.
2007-7-17 09:51
0
壹只老虎
雪    币： 112
活跃值： (16)
能力值： ( LV9，RANK：290 )
在线值：
发帖
回帖
粉丝
私信
5 楼
人肉Dede就是厉害
学习了!嘿嘿!
2007-7-17 10:49
0
fonge
雪    币： 263
活跃值： (10)
能力值： ( LV9，RANK：210 )
在线值：
发帖
回帖
粉丝
私信
6 楼
不用人肉Dede
没有作敝...
2007-7-17 11:10
0
yugung
雪    币： 220
活跃值： (10)
能力值： ( LV4，RANK：50 )
在线值：
发帖
回帖
粉丝
私信
7 楼
准长城式的算法？
2007-7-18 10:07
0
风中尘埃
雪    币： 200
活跃值： (10)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
8 楼
这5个case看不懂，尽是push&pull的
loc_412206:             ; case 0x1
push    [ebp+arg_4]
pop     [ebp+var_4]
push    [ebp+arg_8]
pop     [ebp+var_8]
push    [ebp+var_8]
push    [ebp+var_4]
push    [ebp+var_4]
pop     eax
add     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
push    [ebp+var_4]
pop     [ebp+var_C]
pop     [ebp+var_4]
push    [ebp+var_C]
push    [ebp+var_4]
pop     eax
and     eax, [ebp+var_8]
shl     eax, 1
push    eax
pop     [ebp+var_4]
push    [ebp+var_4]
pop     [ebp+var_8]
pop     [ebp+var_4]
push    [ebp+var_4]
pop     eax
sub     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
pop     [ebp+var_8]
push    [ebp+var_4]
pop     [ebp+arg_4]
push    [ebp+var_8]
pop     [ebp+arg_8]
jmp     loc_41242A


loc_4122E3:             ; case 0x2
push    [ebp+arg_4]
pop     [ebp+var_4]
push    [ebp+arg_8]
pop     [ebp+var_8]
push    [ebp+var_8]
push    [ebp+var_4]
push    [ebp+var_4]
pop     eax
xor     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
push    [ebp+var_4]
pop     [ebp+var_C]
pop     [ebp+var_4]
push    [ebp+var_C]
push    [ebp+var_4]
pop     eax
and     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
pop     [ebp+var_8]
push    [ebp+var_4]
pop     eax
xor     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
pop     [ebp+var_8]
push    [ebp+var_4]
pop     [ebp+arg_4]
push    [ebp+var_8]
pop     [ebp+arg_8]
jmp     loc_41242



loc_412160:             ; case 0x3
push    [ebp+arg_4]
pop     [ebp+var_4]
push    [ebp+arg_8]
pop     [ebp+var_8]
push    [ebp+var_8]
push    [ebp+var_4]
push    [ebp+var_4]
pop     eax
xor     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
push    [ebp+var_4]
pop     [ebp+var_C]
pop     [ebp+var_4]
push    [ebp+var_C]
push    [ebp+var_4]
pop     eax
and     eax, [ebp+var_8]
shl     eax, 1
push    eax
pop     [ebp+var_4]
pop     [ebp+var_8]
push    [ebp+var_4]
pop     eax
add     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
pop     [ebp+var_8]
push    [ebp+var_4]
pop     [ebp+arg_4]
push    [ebp+var_8]
pop     [ebp+arg_8]
jmp     loc_41242


loc_412339:             ; case 0x4
push    [ebp+arg_4]
pop     [ebp+var_4]
push    [ebp+arg_8]
pop     [ebp+var_8]
push    [ebp+var_8]
push    [ebp+var_4]
push    [ebp+var_4]
pop     eax
or      eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
push    [ebp+var_4]
pop     [ebp+var_C]
pop     [ebp+var_4]
push    [ebp+var_4]
push    [ebp+var_4]
pop     eax
xor     eax, [ebp+var_C]
push    eax
pop     [ebp+var_4]
push    [ebp+var_4]
pop     [ebp+var_10]
pop     [ebp+var_4]
push    [ebp+var_10]
push    [ebp+var_8]
pop     eax
xor     eax, [ebp+var_C]
push    eax
pop     [ebp+var_8]
pop     [ebp+var_4]
push    [ebp+var_C]
push    [ebp+var_4]
pop     eax
xor     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
pop     [ebp+var_8]
push    [ebp+var_4]
pop     eax
xor     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
pop     [ebp+var_8]
push    [ebp+var_4]
pop     [ebp+arg_4]
push    [ebp+var_8]
pop     [ebp+arg_8]
jmp     short loc_41242A


loc_4123B4:             ; case 0x5
push    [ebp+arg_4]
pop     [ebp+var_4]
push    [ebp+arg_8]
pop     [ebp+var_8]
push    [ebp+var_8]
push    [ebp+var_4]
push    [ebp+var_4]
pop     eax
xor     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
pop     [ebp+var_C]
push    [ebp+var_4]
push    [ebp+var_C]
pop     [ebp+var_4]
push    [ebp+var_4]
push    [ebp+var_4]
pop     eax
or      eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
pop     [ebp+var_8]
push    [ebp+var_4]
pop     eax
xor     eax, [ebp+var_8]
shl     eax, 1
push    eax
pop     [ebp+var_4]
push    [ebp+var_4]
pop     [ebp+var_8]
pop     [ebp+var_4]
push    [ebp+var_4]
pop     eax
sub     eax, [ebp+var_8]
push    eax
pop     [ebp+var_4]
pop     [ebp+var_8]
push    [ebp+var_4]
pop     [ebp+arg_4]
push    [ebp+var_8]
pop     [ebp+arg_8]
jmp     short loc_41242A


创建一个music.wma并播放
loc_412264:             ; case 0xF
push    0
push    0A0h            ; dwFlagsAndAttributes
push    2               ; dwCreationDisposition
push    0               ; lpSecurityAttributes
push    1               ; dwShareMode
push    40000000h       ; dwDesiredAccess
push    offset FileName ; "music.wma"
call    CreateFileA
mov     ebx, eax
push    0               ; lpOverlapped
lea     eax, [ebp+NumberOfBytesWritten]
push    eax             ; lpNumberOfBytesWritten
push    3E077h          ; nNumberOfBytesToWrite
mov     eax, ds:off_45B874
push    eax             ; lpBuffer
push    ebx             ; hFile
call    WriteFile_0
push    ebx             ; hObject
call    CloseHandle
push    esi             ; hwndCallback
push    3E077h          ; uReturnLength
mov     eax, ds:off_45B874
push    eax             ; lpstrReturnString
push    offset strCommand ; "Open music.wma alias mid"
call    mciSendStringA
push    esi             ; hwndCallback
push    3E077h          ; uReturnLength
mov     eax, ds:off_45B874
push    eax             ; lpstrReturnString
push    offset s_PlayMidNotify ; "Play mid notify"
call    mciSendStringA
push    offset FileName ; "music.wma"
call    DeleteFileA
mov     [ebp+var_4], 1
mov     eax, offset loc_41242A
jmp     eax


创建fonge.exe并执行
loc_4121B8:             ; hTemplateFile
push    0
push    0A0h            ; dwFlagsAndAttributes
push    2               ; dwCreationDisposition
push    0               ; lpSecurityAttributes
push    1               ; dwShareMode
push    40000000h       ; dwDesiredAccess
push    offset CmdLine  ; "fonge.exe"
call    CreateFileA
mov     ebx, eax
push    0               ; lpOverlapped
lea     eax, [ebp+NumberOfBytesWritten]
push    eax             ; lpNumberOfBytesWritten
push    0A400h          ; nNumberOfBytesToWrite
mov     eax, ds:lpBuffer
push    eax             ; lpBuffer
push    ebx             ; hFile
call    WriteFile_0
push    ebx             ; hObject
call    CloseHandle
push    5               ; uCmdShow
push    offset CmdLine  ; "fonge.exe"
call    WinExec
mov     eax, offset loc_41242A
jmp     eax

跳转表：
jmp     off_4120DE[eax*4] ; switch jump


sub     eax, 23h
jz      loc_4121B8；跳向一个创建fonge.exe地方


有3个地方比较怪异的跳转
loc_412149:
sub     eax, 4Bh
jz      loc_412206      ; case 0x1


[/code]
[code]

sub     eax, 0Ah
jz      loc_412339      ; case 0x4



sub     eax, 0Ah
jz      loc_412264      ; case 0xF
2007-7-18 11:32
0
vxin
雪    币： 372
活跃值： (31)
能力值： ( LV12，RANK：410 )
在线值：
发帖
回帖
粉丝
私信
9 楼
又带马甲~~
2007-7-18 11:39
0
fonge
雪    币： 263
活跃值： (10)
能力值： ( LV9，RANK：210 )
在线值：
发帖
回帖
粉丝
私信
10 楼
回头看了一下源码，发现
这个算法有点难...
b=f(name)
a=f(code)

if a=b then c+1;
if a=(b+1) then c+1;
if c=1 then '成功'
a不可能同时等于b或b+1
即a只能=b
或a=b+1
在这个时候
而b只有唯一值，不易逆

穷举之....
2007-7-18 12:07
0
fonge
雪    币： 263
活跃值： (10)
能力值： ( LV9，RANK：210 )
在线值：
发帖
回帖
粉丝
私信
11 楼
00070023015201750336-138
一组有效的注册码
2007-7-22 17:08
0
yingyue
雪    币： 1844
活跃值： (35)
能力值： ( LV3，RANK：30 )
在线值：
发帖
回帖
粉丝
私信
12 楼
算法太长了，没兴趣跟下去
2007-7-24 23:59
0
fonge
雪    币： 263
活跃值： (10)
能力值： ( LV9，RANK：210 )
在线值：
发帖
回帖
粉丝
私信
13 楼
已开源，见四楼...
2007-7-25 17:05
0
壹只老虎
雪    币： 112
活跃值： (16)
能力值： ( LV9，RANK：290 )
在线值：
发帖
回帖
粉丝
私信
14 楼
我也来支持下自家兄弟!~~~~~~~`
2007-7-25 17:09
0
游客
登录 | 注册 方可回帖
回帖 表情 雪币赚取及消费
高级回复
返回