使用VB Decompiler静态分析，找到关键函数入口点402AC4 ida跳转至402AC4，按F5反汇编，发现有407行代码，配合VB Decompiler得到的代码耐心分析 首先在137行得到var_44 = 101 动调至212行，发现v19 = 0x2DC Private Sub Command1_Click() '402AC4
Dim var_138 As Variant
loc_00402B19: On Error GoTo loc_00403491
loc_00402B93: Serial_1 = Serial
loc_00402B9B: serial_2 = Serial_1
loc_00402C27: For i = 1 To Len(Serial_1) Step 1 'serial每个字符ascii码乘2的值相加,最终值重命名为serial_sum
loc_00402C2C: var_184 = i
loc_00402C42: GoTo loc_00402D83
loc_00402C77: serial_1 = Serial
loc_00402C7F: serial_2 = serial_1
loc_00402D21: serial_i = Asc(CStr(Mid(serial_1, CLng(i), 1)))
loc_00402D2C: serial_sum = serial_sum + serial_i
loc_00402D34: serial_sum = serial_sum + serial_i '错误代码，删除
loc_00402D78: Next i
loc_00402D7D: var_184 = Next i
loc_00402D83: ' Referenced from: 00402C42
loc_00402D8A: If var_184 Then GoTo loc_00402C47
loc_00402D93: var_20 = var_20 + var_44 '通过动调得到var_44 = 0x65
loc_00402D9C: var_20+var_44 = var_20+var_44 + var_50
loc_00402DA5: var_20+var_44+var_50 = var_20+var_44+var_50 + var_44
loc_00402DAE: var_20+var_44+var_50+var_44 = var_20+var_44+var_50+var_44 + var_34
loc_00402DB7: var_20+var_44+var_50+var_44+var_34 = var_20+var_44+var_50+var_44+var_34 + var_3C
loc_00402DD2: If serial_sum = var_20+var_44+var_50+var_44+var_34+var_3C+var_44 Then '条件1：serial_sum要等于固定值，通过动调得到固定值为0x2dc
loc_00402E08: serial_1 = Serial
loc_00402E10: serial_2 = serial_1
loc_00402E79: serial_3 = Serial
loc_00402E81: serial_4 = serial_3
loc_00402EEA: serial_5 = Serial
loc_00402EF2: serial_6 = serial_5
loc_00403090: var_150 = (((Asc(CStr(Mid(serial_1, 2, 1))) - var_44) + 1 And (Asc(CStr(Mid(serial_3, 4, 1))) - var_44) + 1) And (Asc(CStr(Mid(serial_5, 7, 1))) - var_44) + 1) '条件2：serial第2、4、7的ascii码值=var_44=0x65,即字母'e'
loc_00403115: If var_150 Then
loc_0040313E: var_48 = var_48 * var_20 * var_44
loc_00403147: If var_48 = var_4C Then '动调得到var_48和var_4C为固定值，一定相等
loc_00403165: var_138 = Form1.Text1
loc_0040317E: var_138.Text = "You have cracked it!!"
loc_00403186: serial_2 = var_138
loc_004031DF: var_138 = Form1.Text1
loc_004031F5: var_138.Enabled = False
loc_004031FD: serial_2 = var_138
loc_00403256: var_138 = Form1.Command1
loc_0040326C: var_138.Visible = False
loc_00403274: serial_2 = var_138
loc_004032CD: var_138 = Form1.Command3
loc_004032E3: var_138.Visible = True
loc_004032EB: serial_2 = var_138
loc_00403344: var_138 = Form1.Command3
loc_0040335A: var_138.Enabled = True
loc_00403362: serial_2 = var_138
loc_004033BB: var_138 = Form1.Command3
loc_004033D4: var_138.Caption = "&Again!"
loc_004033D9: serial_2 = var_138
loc_0040342F: var_138 = Form1.Command2
loc_00403443: var_138.SetFocus
loc_0040344B: serial_2 = var_138.SetFocus
loc_00403491: Else
loc_00403491: End If
loc_00403491: End If
loc_004034A9: var_138 = Form1.Text1
loc_004034C2: var_138.Text = "Wrong! Try Again!!"
loc_004034CA: serial_2 = var_138
loc_00403523: var_138 = Form1.Text1
loc_00403539: var_138.Enabled = False
loc_00403541: serial_2 = var_138
loc_0040359A: var_138 = Form1.Command1
loc_004035B0: var_138.Visible = False
loc_004035B8: serial_2 = var_138
loc_00403611: var_138 = Form1.Command3
loc_00403627: var_138.Visible = True
loc_0040362F: serial_2 = var_138
loc_00403688: var_138 = Form1.Command3
loc_0040369E: var_138.Enabled = True
loc_004036A6: serial_2 = var_138
loc_004036FF: var_138 = Form1.Command3
loc_00403713: var_138.SetFocus
loc_0040371B: serial_2 = var_138.SetFocus
loc_0040375C: End If
loc_0040375C: Exit Sub
loc_00403766: GoTo loc_004037ED
loc_004037EC: Exit Sub
loc_004037ED: ' Referenced from: 00403766
End Sub
对VB Decompiler得到的代码进行分析，满足正确Serial需满足以下条件： 1、将serial每个字符ascii码的值相加，最终值为serial_sum = v19 = 0x2dc 2、serial第2、4、7的ascii码值 = var_44=0x65，即字母’e’ for serial_0 in range ( 33 , 127 ) :
for serial_2 in range ( 33 , 127 ) :
for serial_4 in range ( 33 , 127 ) :
for serial_5 in range ( 33 , 127 ) :
serial = chr ( serial_0) + 'e' + chr ( serial_2) + 'e' + chr ( serial_4) + chr ( serial_5) + 'e'
serial_sum = 0
for i in range ( len ( serial) ) :
serial_sum += ord ( serial[ i] )
if serial_sum == 0x2dc :
print ( '正确Serial为：' + serial)
仅考虑serial为7位的情况 仅考虑可见字符，即ascii码为33~127
