MAC平臺下的crackme兩例分析

作者：creantan 小葡萄爸爸

工具列表：
Hopper disassembler（靜態(tài)分析）
lldb （動態(tài)調(diào)試）

擼起：
先來個最簡單的，直接用Hopper disassembler分析：
直接把第一個crackme拖到Hopper里面骆撇，看下左邊窗口，看下這個crackme的Labels

很容易就找到這個methed實現(xiàn)methImpl_AppDelegate_checkifisok_
點擊它看下匯編：

0x0000000100001110 55                              push       rbp
0x0000000100001111 4889E5                          mov        rbp, rsp
0x0000000100001114 4883EC70                        sub        rsp, 0x70
0x0000000100001118 488D0551180000                  lea        rax, qword [ds:cfstring_Length_of_the_serial_string_is___lx] ; @"Length of the serial string is: %lx"
0x000000010000111f 488D0DBA160000                  lea        rcx, qword [ds:objc_msg_length] ; @selector(length)
0x0000000100001126 4C8D0523180000                  lea        r8, qword [ds:cfstring_Length_of_the_name_string_is___lx] ; @"Length of the name string is: %lx"
0x000000010000112d 4C8D0DFC170000                  lea        r9, qword [ds:cfstring_uh_] ; @"uh?"
0x0000000100001134 48897DF8                        mov        qword [ss:rbp-0x70+var_104], rdi
0x0000000100001138 488975F0                        mov        qword [ss:rbp-0x70+var_96], rsi
0x000000010000113c 488955E8                        mov        qword [ss:rbp-0x70+var_88], rdx
0x0000000100001140 4C89CF                          mov        rdi, r9
0x0000000100001143 488945B0                        mov        qword [ss:rbp-0x70+var_32], rax
0x0000000100001147 B000                            mov        al, 0x0
0x0000000100001149 4C8945A8                        mov        qword [ss:rbp-0x70+var_24], r8
0x000000010000114d 48894DA0                        mov        qword [ss:rbp-0x70+var_16], rcx
0x0000000100001151 E8C6030000                      call       imp___stubs__NSLog
0x0000000100001156 488B4DF8                        mov        rcx, qword [ss:rbp-0x70+var_104]
0x000000010000115a 488B152F190000                  mov        rdx, qword [ds:0x100002a90]
0x0000000100001161 488B0C11                        mov        rcx, qword [ds:rcx+rdx]
0x0000000100001165 488B350C160000                  mov        rsi, qword [ds:objc_sel_stringValue] ; @selector(stringValue)
0x000000010000116c 4889CF                          mov        rdi, rcx
0x000000010000116f E8B4030000                      call       imp___stubs__objc_msgSend
0x0000000100001174 488945E0                        mov        qword [ss:rbp-0x70+var_80], rax
0x0000000100001178 488B45E0                        mov        rax, qword [ss:rbp-0x70+var_80]
0x000000010000117c 4889C7                          mov        rdi, rax
0x000000010000117f 488B75A0                        mov        rsi, qword [ss:rbp-0x70+var_16]
0x0000000100001183 FF1557160000                    call       qword [ds:objc_msg_length]  ; @selector(length)
0x0000000100001189 488945D8                        mov        qword [ss:rbp-0x70+var_72], rax
0x000000010000118d 488B75D8                        mov        rsi, qword [ss:rbp-0x70+var_72]
0x0000000100001191 488B7DA8                        mov        rdi, qword [ss:rbp-0x70+var_24]
0x0000000100001195 B000                            mov        al, 0x0
0x0000000100001197 E880030000                      call       imp___stubs__NSLog
0x000000010000119c 488B4DF8                        mov        rcx, qword [ss:rbp-0x70+var_104]
0x00000001000011a0 488B15F1180000                  mov        rdx, qword [ds:0x100002a98]
0x00000001000011a7 488B0C11                        mov        rcx, qword [ds:rcx+rdx]
0x00000001000011ab 488B35C6150000                  mov        rsi, qword [ds:objc_sel_stringValue] ; @selector(stringValue)
0x00000001000011b2 4889CF                          mov        rdi, rcx
0x00000001000011b5 E86E030000                      call       imp___stubs__objc_msgSend
0x00000001000011ba 488945D0                        mov        qword [ss:rbp-0x70+var_64], rax
0x00000001000011be 488B45D0                        mov        rax, qword [ss:rbp-0x70+var_64]
0x00000001000011c2 4889C7                          mov        rdi, rax
0x00000001000011c5 488B75A0                        mov        rsi, qword [ss:rbp-0x70+var_16]
0x00000001000011c9 FF1511160000                    call       qword [ds:objc_msg_length]  ; @selector(length)
0x00000001000011cf 488945C8                        mov        qword [ss:rbp-0x70+var_56], rax
0x00000001000011d3 488B75C8                        mov        rsi, qword [ss:rbp-0x70+var_56]
0x00000001000011d7 488B7DB0                        mov        rdi, qword [ss:rbp-0x70+var_32]
0x00000001000011db B000                            mov        al, 0x0
0x00000001000011dd E83A030000                      call       imp___stubs__NSLog
0x00000001000011e2 48817DC80A000000                cmp        qword [ss:rbp-0x70+var_56], 0xa
0x00000001000011ea 0F86BF000000                    jbe        0x1000012af     //判斷密碼長度是否大于10
                                       ; Basic Block Input Regs: rbp -  Killed Regs: <nothing>
0x00000001000011f0 48817DC80F000000                cmp        qword [ss:rbp-0x70+var_56], 0xf
0x00000001000011f8 0F83B1000000                    jnc        0x1000012af //判斷密碼長度是否小于15
                                       ; Basic Block Input Regs: rbp -  Killed Regs: <nothing>
0x00000001000011fe 48817DD807000000                cmp        qword [ss:rbp-0x70+var_72], 0x7
0x0000000100001206 0F86A3000000                    jbe        0x1000012af   //判斷用戶名長度是否大于7
                                       ; Basic Block Input Regs: rbp -  Killed Regs: <nothing>
0x000000010000120c 48817DD80F000000                cmp        qword [ss:rbp-0x70+var_72], 0xf
0x0000000100001214 0F8395000000                    jnc        0x1000012af   // 判斷用戶名長度是否小于15
                                       ; Basic Block Input Regs: <nothing> -  Killed Regs: rax rcx rdx rbp rsi rdi
0x000000010000121a 488D05CF150000                  lea        rax, qword [ds:objc_msg_isEqualToString_] ; @selector(isEqualToString:)
0x0000000100001221 488D0D68170000                  lea        rcx, qword [ds:cfstring_]   ; @""
0x0000000100001228 488B15D9150000                  mov        rdx, qword [ds:bind__OBJC_CLASS_$_NSCharacterSet]
0x000000010000122f 488B354A150000                  mov        rsi, qword [ds:objc_sel_alphanumericCharacterSet] ; @selector(alphanumericCharacterSet)
0x0000000100001236 4889D7                          mov        rdi, rdx
0x0000000100001239 48894598                        mov        qword [ss:rbp-0x70+var_8], rax
0x000000010000123d 48894D90                        mov        qword [ss:rbp-0x70+var_0], rcx
0x0000000100001241 E8E2020000                      call       imp___stubs__objc_msgSend     //獲取字母和數(shù)字集合 NSCharacterSet *alphanumericSet = [ NSCharacterSetalphanumericCharacterSet ];
0x0000000100001246 488945C0                        mov        qword [ss:rbp-0x70+var_48], rax
0x000000010000124a 488B45D0                        mov        rax, qword [ss:rbp-0x70+var_64]
0x000000010000124e 488B55C0                        mov        rdx, qword [ss:rbp-0x70+var_48]
0x0000000100001252 488B352F150000                  mov        rsi, qword [ds:objc_sel_stringByTrimmingCharactersInSet_] ; @selector(stringByTrimmingCharactersInSet:)
0x0000000100001259 4889C7                          mov        rdi, rax
0x000000010000125c E8C7020000                      call       imp___stubs__objc_msgSend  //格式化密碼父叙，去除密碼中含alphanumericSet中的字符 NSString *trimmedString = [passwdString stringByTrimmingCharactersInSet:alphanumericSet];
0x0000000100001261 4889C7                          mov        rdi, rax
0x0000000100001264 488B7598                        mov        rsi, qword [ss:rbp-0x70+var_8]
0x0000000100001268 488B5590                        mov        rdx, qword [ss:rbp-0x70+var_0]
0x000000010000126c FF157E150000                    call       qword [ds:objc_msg_isEqualToString_] ; @selector(isEqualToString:)//判斷trimmedString是否和@“”空串相等
0x0000000100001272 8845BF                          mov        byte [ss:rbp-0x70+var_47], al
0x0000000100001275 807DBF00                        cmp        byte [ss:rbp-0x70+var_47], 0x0
0x0000000100001279 0F8418000000                    je         0x100001297   //不等則顯示錯誤
                                       ; Basic Block Input Regs: rbp -  Killed Regs: rax rsi rdi
0x000000010000127f 488B45F8                        mov        rax, qword [ss:rbp-0x70+var_104]
0x0000000100001283 488B3506150000                  mov        rsi, qword [ds:objc_sel_yes] ; @selector(yes)
0x000000010000128a 4889C7                          mov        rdi, rax
0x000000010000128d E896020000                      call       imp___stubs__objc_msgSend
0x0000000100001292 E913000000                      jmp        0x1000012aa
                                       ; Basic Block Input Regs: rbp -  Killed Regs: rax rsi rdi
0x0000000100001297 488B45F8                        mov        rax, qword [ss:rbp-0x70+var_104] ; XREF=0x100001279
0x000000010000129b 488B35F6140000                  mov        rsi, qword [ds:objc_sel_no] ; @selector(no)
0x00000001000012a2 4889C7                          mov        rdi, rax
0x00000001000012a5 E87E020000                      call       imp___stubs__objc_msgSend
                                       ; Basic Block Input Regs: <nothing> -  Killed Regs: <nothing>
0x00000001000012aa E913000000                      jmp        0x1000012c2                ; XREF=0x100001292
                                       ; Basic Block Input Regs: rbp -  Killed Regs: rax rsi rdi
0x00000001000012af 488B45F8                        mov        rax, qword [ss:rbp-0x70+var_104] ; XREF=0x1000011ea, 0x1000011f8, 0x100001206, 0x100001214
0x00000001000012b3 488B35DE140000                  mov        rsi, qword [ds:objc_sel_no] ; @selector(no)
0x00000001000012ba 4889C7                          mov        rdi, rax
0x00000001000012bd E866020000                      call       imp___stubs__objc_msgSend
                                       ; Basic Block Input Regs: <nothing> -  Killed Regs: rsp rbp
0x00000001000012c2 4883C470                        add        rsp, 0x70                  ; XREF=0x1000012aa
0x00000001000012c6 5D                              pop        rbp
0x00000001000012c7 C3                              ret

復(fù)原代碼如下：

/**
 *  用戶名密碼驗證
 *  用戶名密碼長度驗證神郊，密碼字母和數(shù)字驗證，密碼只能包含數(shù)字和字母
 *  @return 返回YES or NO
 */
-(BOOL)checkifisok{
    NSString* name = [nameTextField text];
    NSString* serial = [serialTextField text];
    int nameLength = [name length];
    int serialLength = [serial length];
    if(serialLength > 10 && serialLength < 15){
        if(nameLength > 7 && nameLength < 15){
            NSCharacterSet *alphanumericSet = [NSCharacterSet alphanumericCharacterSet];
            NSString *trimmedString = [serial stringByTrimmingCharactersInSet:alphanumericSet];
            if([trimmedString isEqualToString:@""]){
                returnYES;
            }
        }else{
            returnNO
        }
    }else{
        returnNO;
    }
}

第二個使用lldb動態(tài)調(diào)試：

lldb crackme2.app
r
ctl+c
br s -a 0x2a9e

0x00002a9e 55                              push      ebp
0x00002a9f 89E5                            mov       ebp,esp
0x00002aa1 57                              push      edi
0x00002aa2 56                              push      esi
0x00002aa3 53                              push      ebx
0x00002aa4 83EC3C                          sub       esp,0x3c
0x00002aa7 A140400000                      mov       eax, dword [ds:objc_msg_length]    ; @selector(length)
0x00002aac 89442404                        mov        dword [ss:esp+0x4],eax
0x00002ab0 8B4510                          mov       eax, dword [ss:ebp-0x48+arg_8]
0x00002ab3 890424                          mov        dword [ss:esp],eax
0x00002ab6 E8A3250000                      call       imp___jump_table__objc_msgSend
0x00002abb 83F808                          cmp        eax,0x8   //判斷注冊碼長度是否為8位
0x00002abe 0F858A010000                    jne       0x2c4e  //不等跳往錯誤提示
                                       ; Basic Block Input Regs: ecx ebx ebp -  Killed Regs: eax ecx ebx esp ebp esi edi
0x00002ac4 A144400000                      mov       eax, dword [ds:objc_msg_lossyCString]; @selector(lossyCString)
0x00002ac9 BE04000000                      mov       esi,0x4   //esi初始化為4
0x00002ace 31DB                            xor       ebx,ebx
0x00002ad0 89442404                        mov        dword [ss:esp+0x4],eax
0x00002ad4 8B4514                          mov       eax, dword [ss:ebp-0x48+arg_C]
0x00002ad7 890424                          mov        dword [ss:esp],eax
0x00002ada E87F250000                      call       imp___jump_table__objc_msgSend
0x00002adf 890424                          mov        dword [ss:esp],eax
0x00002ae2 89C7                            mov       edi,eax
0x00002ae4 E87A250000                      call       imp___jump_table__strlen
0x00002ae9 31C9                            xor       ecx,ecx
0x00002aeb 8945D0                          mov        dword [ss:ebp-0x48+var_24],eax
0x00002aee EB37                            jmp       0x2b27
                                       ; Basic Block Input Regs: ebx esi edi -  Killed Regs: eax ecx edx ebx ebp esi
0x00002af0 0FBE041F                        movsx     eax, byte [ds:edi+ebx]             ; XREF=0x2b2a   //取用戶名的一個字符
0x00002af4 43                              inc       ebx  //循環(huán)累加器
0x00002af5 0FAFC6                          imul      eax,esi  //取出來的字符與esi相乘
0x00002af8 83C604                          add       esi,0x4  //esi+4
0x00002afb 89C2                            mov       edx,eax
0x00002afd C1E204                          shl       edx,0x4  //edx << 0x4
0x00002b00 29C2                            sub       edx,eax
0x00002b02 B8AD8BDB68                      mov       eax,0x68db8bad
0x00002b07 8D8C0A9A020000                  lea       ecx, dword [ds:edx+ecx+0x29a]
0x00002b0e F7E9                            imul      ecx
0x00002b10 89C8                            mov       eax,ecx
0x00002b12 C1F81F                          sar       eax,0x1f
0x00002b15 C1FA0C                          sar       edx,0xc
0x00002b18 29C2                            sub       edx,eax
0x00002b1a 89C8                            mov       eax,ecx
0x00002b1c 69D210270000                    imul      edx,edx,0x2710
0x00002b22 29D0                            sub       eax,edx
0x00002b24 8945E0                          mov        dword [ss:ebp-0x48+var_40],eax
                                       ; Basic Block Input Regs: ebx ebp -  Killed Regs: <nothing>
0x00002b27 395DD0                          cmp        dword [ss:ebp-0x48+var_24],ebx   ; XREF=0x2aee
0x00002b2a 77C4                            jnbe      0x2af0
                                       ; Basic Block Input Regs: ecx ebx ebp edi -  Killed Regs: eax ecx ebx esp ebp esi
0x00002b2c 8B45E0                          mov       eax, dword [ss:ebp-0x48+var_40]
0x00002b2f BE04000000                      mov       esi,0x4
0x00002b34 31DB                            xor       ebx,ebx
0x00002b36 C744240878300000                mov        dword [ss:esp+0x8],0x3078         ; @"%i"
0x00002b3e 8944240C                        mov        dword [ss:esp+0xc],eax
0x00002b42 A128400000                      mov       eax, dword [ds:objc_msg_stringWithFormat_]; @selector(stringWithFormat:)
0x00002b47 89442404                        mov        dword [ss:esp+0x4],eax
0x00002b4b A154400000                      mov       eax, dword [ds:cls_NSString]
0x00002b50 890424                          mov        dword [ss:esp],eax
0x00002b53 E806250000                      call       imp___jump_table__objc_msgSend   //將結(jié)果格式化為NSString
0x00002b58 893C24                          mov        dword [ss:esp],edi
0x00002b5b 8945D8                          mov        dword [ss:ebp-0x48+var_32],eax
0x00002b5e E800250000                      call       imp___jump_table__strlen
0x00002b63 31C9                            xor       ecx,ecx
0x00002b65 8945D4                          mov        dword [ss:ebp-0x48+var_28],eax
0x00002b68 EB32                            jmp       0x2b9c
                                       ; Basic Block Input Regs: ebx esi edi -  Killed Regs: eax ecx edx ebx ebp esi
0x00002b6a 0FBE041F                        movsx     eax, byte [ds:edi+ebx]             ; XREF=0x2b9f
0x00002b6e 43                              inc       ebx
0x00002b6f 0FAFC6                          imul      eax,esi
0x00002b72 83C608                          add       esi,0x8
0x00002b75 8D1480                          lea       edx, dword [ds:eax+eax*4]
0x00002b78 8D54502D                        lea       edx, dword [ds:eax+edx*2+0x2d]
0x00002b7c B8AD8BDB68                      mov       eax,0x68db8bad
0x00002b81 01D1                            add       ecx,edx
0x00002b83 F7E9                            imul      ecx
0x00002b85 89C8                            mov       eax,ecx
0x00002b87 C1F81F                          sar       eax,0x1f
0x00002b8a C1FA0C                          sar       edx,0xc
0x00002b8d 29C2                            sub       edx,eax
0x00002b8f 89C8                            mov       eax,ecx
0x00002b91 69D210270000                    imul      edx,edx,0x2710
0x00002b97 29D0                            sub       eax,edx
0x00002b99 8945E4                          mov        dword [ss:ebp-0x48+var_44],eax
                                       ; Basic Block Input Regs: ebx ebp -  Killed Regs: <nothing>
0x00002b9c 3B5DD4                          cmp       ebx, dword [ss:ebp-0x48+var_28]    ; XREF=0x2b68
0x00002b9f 72C9                            jc        0x2b6a
                                       ; Basic Block Input Regs: ebx ebp -  Killed Regs: eax ebx esp ebp esi edi
0x00002ba1 8B45E4                          mov       eax, dword [ss:ebp-0x48+var_44]
0x00002ba4 BE04000000                      mov       esi,0x4
0x00002ba9 31DB                            xor       ebx,ebx
0x00002bab C744240878300000                mov        dword [ss:esp+0x8],0x3078         ; @"%i"
0x00002bb3 BF04000000                      mov       edi,0x4
0x00002bb8 8944240C                        mov        dword [ss:esp+0xc],eax
0x00002bbc A128400000                      mov       eax, dword [ds:objc_msg_stringWithFormat_]; @selector(stringWithFormat:)
0x00002bc1 89442404                        mov        dword [ss:esp+0x4],eax
0x00002bc5 A154400000                      mov       eax, dword [ds:cls_NSString]
0x00002bca 890424                          mov        dword [ss:esp],eax
0x00002bcd E88C240000                      call       imp___jump_table__objc_msgSend //將結(jié)果格式化為NSString
0x00002bd2 895C2408                        mov        dword [ss:esp+0x8],ebx
0x00002bd6 8974240C                        mov        dword [ss:esp+0xc],esi
0x00002bda 8945DC                          mov        dword [ss:ebp-0x48+var_36],eax
0x00002bdd A148400000                      mov       eax, dword [ds:objc_msg_substringWithRange_]; @selector(substringWithRange:)
0x00002be2 89442404                        mov        dword [ss:esp+0x4],eax
0x00002be6 8B4510                          mov       eax, dword [ss:ebp-0x48+arg_8]
0x00002be9 890424                          mov        dword [ss:esp],eax
0x00002bec E86D240000                      call       imp___jump_table__objc_msgSend //截取密碼前4位驗證
0x00002bf1 89742408                        mov        dword [ss:esp+0x8],esi
0x00002bf5 897C240C                        mov        dword [ss:esp+0xc],edi
0x00002bf9 89C3                            mov       ebx,eax
0x00002bfb A148400000                      mov       eax, dword [ds:objc_msg_substringWithRange_]; @selector(substringWithRange:)
0x00002c00 89442404                        mov        dword [ss:esp+0x4],eax
0x00002c04 8B4510                          mov       eax, dword [ss:ebp-0x48+arg_8]
0x00002c07 890424                          mov        dword [ss:esp],eax
0x00002c0a E84F240000                      call       imp___jump_table__objc_msgSend//截取密碼后4位驗證
0x00002c0f 891C24                          mov        dword [ss:esp],ebx
0x00002c12 89C6                            mov       esi,eax
0x00002c14 8B45D8                          mov       eax, dword [ss:ebp-0x48+var_32]
0x00002c17 89442408                        mov        dword [ss:esp+0x8],eax
0x00002c1b A108400000                      mov       eax, dword [ds:objc_msg_isEqual_]  ; @selector(isEqual:)
0x00002c20 89442404                        mov        dword [ss:esp+0x4],eax
0x00002c24 E835240000                      call       imp___jump_table__objc_msgSend //判斷是否相等
0x00002c29 84C0                            test      al,al
0x00002c2b 7421                            je        0x2c4e
                                       ; Basic Block Input Regs: ebp esi -  Killed Regs: eax edx esp
0x00002c2d 8B45DC                          mov       eax, dword [ss:ebp-0x48+var_36]
0x00002c30 893424                          mov        dword [ss:esp],esi
0x00002c33 89442408                        mov        dword [ss:esp+0x8],eax
0x00002c37 A108400000                      mov       eax, dword [ds:objc_msg_isEqual_]  ; @selector(isEqual:)
0x00002c3c 89442404                        mov        dword [ss:esp+0x4],eax
0x00002c40 E819240000                      call       imp___jump_table__objc_msgSend//判斷是否相等
0x00002c45 BA01000000                      mov       edx,0x1
0x00002c4a 84C0                            test      al,al
0x00002c4c 7502                            jne       0x2c50
                                       ; Basic Block Input Regs: edx -  Killed Regs: edx
0x00002c4e 31D2                            xor       edx,edx                           ; XREF=0x2abe, 0x2c2b
                                       ; Basic Block Input Regs: edx -  Killed Regs: eax ebx esp esi edi
0x00002c50 83C43C                          add       esp,0x3c                         ; XREF=0x2c4c
0x00002c53 89D0                            mov       eax,edx
0x00002c55 5B                              pop       ebx
0x00002c56 5E                              pop       esi
0x00002c57 5F                              pop       edi
0x00002c58 C9                              leave     
0x00002c59 C3                              ret

keygen代碼如下：

int main(int argc, constchar * argv[]) {
    @autoreleasepool {
       
        unsignedlong nameLength = strlen(argv[1]);
        constchar* index = argv[1];
        unsignedint eax = 0;
        int ecx=0,edx=0,esi = 4;
        int serial_1=0;
        long constValue =  0x68db8bad;
        for (int i = 0; i<nameLength; i++) {
            eax = (int)(*index);
            eax = eax * esi;
            esi+=4;
            edx = (eax << 0x4) - eax;
            ecx = edx + ecx+0x29a;
            edx = constValue*ecx >> 32;
            serial_1 = ecx - ((edx >> 0xc)-(ecx >> 0x1f)) * 0x2710;
            index++;
           
        }
        int serial_2=0;
        index = argv[1];
        eax = 0,ecx=0,edx=0,esi = 4;
       
        for (int i = 0; i<nameLength; i++) {
            eax = (int)(*index);
            eax = eax * esi;
            esi+=8;
            edx = eax+(eax+eax*4)*2+0x2d;
            ecx += edx;
            edx = constValue*ecx >> 32;
            serial_2 = ecx - ((edx >> 0xc) - (ecx >> 0x1f)) * 0x2710;
            index++;
        }
        NSLog(@"\nname:%s\nserial:%d%d",argv[1],serial_1,serial_2);
    }
    return0;
}

最后編輯于：2017.11.27 02:23:33

?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者

人面猴
序言：七十年代末，一起剝皮案震驚了整個濱河市，隨后出現(xiàn)的幾起案子蓬抄，更是在濱河造成了極大的恐慌埋心，老刑警劉巖，帶你破解...
沈念sama閱讀 206,311評論 6贊 481
死咒
序言：濱河連續(xù)發(fā)生了三起死亡事件抄课，死亡現(xiàn)場離奇詭異，居然都是意外死亡峭沦，警方通過查閱死者的電腦和手機蒸辆，發(fā)現(xiàn)死者居然都...
沈念sama閱讀 88,339評論 2贊 382
救了他兩次的神仙讓他今天三更去死
文/潘曉璐我一進(jìn)店門征炼，熙熙樓的掌柜王于貴愁眉苦臉地迎上來，“玉大人躬贡，你說我怎么就攤上這事谆奥。” “怎么了拂玻？”我有些...
開封第一講書人閱讀 152,671評論 0贊 342
道士緝兇錄：失蹤的賣姜人
文/不壞的土叔我叫張陵酸些，是天一觀的道長。經(jīng)常有香客問我檐蚜，道長魄懂，這世上最難降的妖魔是什么？我笑而不...
開封第一講書人閱讀 55,252評論 1贊 279
?港島之戀（遺憾婚禮）
正文為了忘掉前任闯第，我火速辦了婚禮市栗，結(jié)果婚禮上，老公的妹妹穿的比我還像新娘乡括。我一直安慰自己肃廓，他們只是感情好，可當(dāng)我...
茶點故事閱讀 64,253評論 5贊 371
惡毒庶女頂嫁案：這布局不是一般人想出來的
文/花漫我一把揭開白布诲泌。她就那樣靜靜地躺著盲赊，像睡著了一般。火紅的嫁衣襯著肌膚如雪敷扫。梳的紋絲不亂的頭發(fā)上哀蘑，一...
開封第一講書人閱讀 49,031評論 1贊 285
城市分裂傳說
那天，我揣著相機與錄音葵第，去河邊找鬼绘迁。笑死，一個胖子當(dāng)著我的面吹牛卒密，可吹牛的內(nèi)容都是我干的缀台。我是一名探鬼主播，決...
沈念sama閱讀 38,340評論 3贊 399
雙鴛鴦連環(huán)套：你想象不到人心有多黑
文/蒼蘭香墨我猛地睜開眼哮奇，長吁一口氣：“原來是場噩夢啊……” “哼膛腐！你這毒婦竟也來了？” 一聲冷哼從身側(cè)響起鼎俘，我...
開封第一講書人閱讀 36,973評論 0贊 259
萬榮殺人案實錄
序言：老撾萬榮一對情侶失蹤哲身，失蹤者是張志新（化名）和其女友劉穎，沒想到半個月后贸伐，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體勘天，經(jīng)...
沈念sama閱讀 43,466評論 1贊 300
?護(hù)林員之死
正文獨居荒郊野嶺守林人離奇死亡，尸身上長有42處帶血的膿包…… 初始之章·張勛以下內(nèi)容為張勛視角年9月15日...
茶點故事閱讀 35,937評論 2贊 323
?白月光啟示錄
正文我和宋清朗相戀三年，在試婚紗的時候發(fā)現(xiàn)自己被綠了脯丝。大學(xué)時的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片商膊。...
茶點故事閱讀 38,039評論 1贊 333
活死人
序言：一個原本活蹦亂跳的男人離奇死亡，死狀恐怖巾钉，靈堂內(nèi)的尸體忽然破棺而出翘狱，到底是詐尸還是另有隱情，我是刑警寧澤砰苍，帶...
沈念sama閱讀 33,701評論 4贊 323
?日本核電站爆炸內(nèi)幕
正文年R本政府宣布潦匈，位于F島的核電站，受9級特大地震影響赚导，放射性物質(zhì)發(fā)生泄漏茬缩。R本人自食惡果不足惜，卻給世界環(huán)境...
茶點故事閱讀 39,254評論 3贊 307
男人毒藥：我在死后第九天來索命
文/蒙蒙一吼旧、第九天我趴在偏房一處隱蔽的房頂上張望凰锡。院中可真熱鬧，春花似錦圈暗、人聲如沸掂为。這莊子的主人今日做“春日...
開封第一講書人閱讀 30,259評論 0贊 19
一樁弒父案员串，背后竟有這般陰謀
文/蒼蘭香墨我抬頭看了看天上的太陽勇哗。三九已至，卻和暖如春寸齐，著一層夾襖步出監(jiān)牢的瞬間欲诺，已是汗流浹背。一陣腳步聲響...
開封第一講書人閱讀 31,485評論 1贊 262
情欲美人皮
我被黑心中介騙來泰國打工渺鹦，沒想到剛下飛機就差點兒被人妖公主榨干…… 1. 我叫王不留扰法，地道東北人。一個月前我還...
沈念sama閱讀 45,497評論 2贊 354
代替公主和親
正文我出身青樓毅厚，卻偏偏與公主長得像塞颁，于是被迫代替她去往敵國和親。傳聞我的和親對象是個殘疾皇子吸耿，可洞房花燭夜當(dāng)晚...
茶點故事閱讀 42,786評論 2贊 345

MAC平臺下的crackme兩例分析

推薦閱讀更多精彩內(nèi)容