[反彙編練習] 160個CrackMe之032.
本系列文章的目的是從一個沒有任何經驗的新手的角度(其實就是我自己),一步步嘗試將160個CrackMe全部破解,如果可以,通過任何方式寫出一個類似於註冊機的東西。
其中,文章中按照如下邏輯編排(解決如下問題):
1、使用什麼環境和工具
2、程序分析
3、思路分析和破解流程
4、註冊機的探索
----------------------------------
提醒各位看客: 如果文章中的邏輯看不明白,那你一定是沒有親手操刀!OD中的跳轉提示很強大,只要你跟蹤了,不用怎麼看代碼就理解了!
----------------------------------
1、工具和環境:
WinXP SP3 + 52Pojie六週年紀念版OD + PEID + 彙編金手指。
160個CrackMe的打包文件。
下載地址: http://pan.baidu.com/s/1xUWOY 密碼: jbnq
注:
1、Win7系統對於模塊和程序開啓了隨機初始地址的功能,會給分析帶來很大的負擔,所以不建議使用Win7進行分析。
2、以上工具都是在52PoJie論壇下的原版程序,NOD32不報毒,個人承諾絕對不會進行任何和木馬病毒相關內容。
2、程序分析:
想要破解一個程序,必須先了解這個程序。所以,在破解過程中,對最初程序的分析很重要,他可以幫助我們理解作者的目的和意圖,特別是對於註冊碼的處理細節,從而方便我們反向跟蹤和推導。
和上一節一樣,打開CHM,選擇第32個crackme.2.exe,保存下來。運行程序,程序界面如下:
xxxxxx
直接信息框提示沒有註冊文件!暈啊!
使用PEID看看:
還好,只是一個UPX的殼,直接使用【->】按鈕裏面的通用脫殼工具脫了!
得到 crackme.2.unpacked.exe,再用PEID看看:Borland Delphi 3.0
我去,又是Delphi的,坑人啊!
3、思路分析和破解流程
不用多想,直接上IDR吧:
窗口中的入口信息:
EntryPoint 004383DC push ebp 004383DD mov ebp,esp 004383DF add esp,0FFFFFFF4 004383E2 mov eax,4382E4 004383E7 call @InitExe 004383EC mov edx,438498; 'Reg.dat' 004383F1 mov eax,43A760 004383F6 call @Assign 004383FB mov edx,80 00438400 mov eax,43A760 00438405 call @ResetFile 0043840A call IOResult 0043840F test eax,eax >00438411 je 00438428 00438413 push 0 00438415 push 4384A0; 'Missing!' 0043841A push 4384AC; 'Hey, where is my little Reg.dat\rI love it so much that I can't\rlive without it. Return it back! Arrgh!' 0043841F push 0 00438421 call USER32.MessageBoxA >00438426 jmp 00438488 00438428 mov eax,[00439A90]; ^Application:TApplication 0043842D mov eax,dword ptr [eax] 0043842F call TApplication.Initialize 00438434 mov ecx,dword ptr ds:[439B0C]; ^gvar_0043A758:TForm1 0043843A mov eax,[00439A90]; ^Application:TApplication 0043843F mov eax,dword ptr [eax] 00438441 mov edx,dword ptr ds:[4380C8]; TForm1 00438447 call TApplication.CreateForm 0043844C mov ecx,dword ptr ds:[439B20]; ^gvar_0043A728:TForm2 00438452 mov eax,[00439A90]; ^Application:TApplication 00438457 mov eax,dword ptr [eax] 00438459 mov edx,dword ptr ds:[4379C0]; TForm2 0043845F call TApplication.CreateForm 00438464 mov ecx,dword ptr ds:[439A6C]; ^gvar_0043A750:TForm3 0043846A mov eax,[00439A90]; ^Application:TApplication 0043846F mov eax,dword ptr [eax] 00438471 mov edx,dword ptr ds:[437F38]; TForm3 00438477 call TApplication.CreateForm 0043847C mov eax,[00439A90]; ^Application:TApplication 00438481 mov eax,dword ptr [eax] 00438483 call TApplication.Run 00438488 call @Halt0
它用來判斷是否存在一個叫做Reg.dat的文件,不存在就彈窗,然後退出!好吧,我們在目錄下建一個Reg.dat的空文件!
運行:
在IDR中發現,Reg模塊纔是我們註冊的這個窗口:
由於OK按鈕被禁用了,所以他肯定是當文本發生變化時計算的,我們找到TForm2.EditxChange一共4個事件,進去看看吧:
Reg::TForm2.Edit1Change 00437E70 mov eax,1 00437E75 call 00437D1C 00437E7A ret Reg::TForm2.Edit1Change 00437E70 mov eax,1 00437E75 call 00437D1C 00437E7A ret
內部調用了Call 00437D1C,相當於是參數爲eax,函數爲00437D1C。看看這個Call的內容:
Reg::sub_00437D1C 00437D1C push ebp 00437D1D mov ebp,esp 00437D1F push 0 00437D21 push ebx 00437D22 mov ebx,eax 00437D24 xor eax,eax 00437D26 push ebp 00437D27 push 437DEE 00437D2C push dword ptr fs:[eax] 00437D2F mov dword ptr fs:[eax],esp 00437D32 mov eax,ebx 00437D34 dec eax >00437D35 je 00437D45 00437D37 dec eax >00437D38 je 00437D69 00437D3A dec eax >00437D3B je 00437D8D 00437D3D dec eax >00437D3E je 00437DB1 >00437D40 jmp 00437DD3 00437D45 lea edx,[ebp-4] 00437D48 mov eax,[0043A728]; 0x0 gvar_0043A728:TForm2 00437D4D mov eax,dword ptr [eax+1E8]; TForm2.Edit1:TEdit 00437D53 call TControl.GetText 00437D58 mov eax,dword ptr [ebp-4] 00437D5B call StrToInt 00437D60 mov dword ptr [ebx*4+43A738],eax; gvar_0043A738:Integer >00437D67 jmp 00437DD3 00437D69 lea edx,[ebp-4] 00437D6C mov eax,[0043A728]; 0x0 gvar_0043A728:TForm2 00437D71 mov eax,dword ptr [eax+1EC]; TForm2.Edit2:TEdit 00437D77 call TControl.GetText 00437D7C mov eax,dword ptr [ebp-4] 00437D7F call StrToInt 00437D84 mov dword ptr [ebx*4+43A738],eax; gvar_0043A738:Integer >00437D8B jmp 00437DD3 00437D8D lea edx,[ebp-4] 00437D90 mov eax,[0043A728]; 0x0 gvar_0043A728:TForm2 00437D95 mov eax,dword ptr [eax+1F0]; TForm2.Edit3:TEdit 00437D9B call TControl.GetText 00437DA0 mov eax,dword ptr [ebp-4] 00437DA3 call StrToInt 00437DA8 mov dword ptr [ebx*4+43A738],eax; gvar_0043A738:Integer >00437DAF jmp 00437DD3 00437DB1 lea edx,[ebp-4] 00437DB4 mov eax,[0043A728]; 0x0 gvar_0043A728:TForm2 00437DB9 mov eax,dword ptr [eax+1F4]; TForm2.Edit4:TEdit 00437DBF call TControl.GetText 00437DC4 mov eax,dword ptr [ebp-4] 00437DC7 call StrToInt 00437DCC mov dword ptr [ebx*4+43A738],eax; gvar_0043A738:Integer 00437DD3 call 00437BD8 00437DD8 xor eax,eax 00437DDA pop edx 00437DDB pop ecx 00437DDC pop ecx 00437DDD mov dword ptr fs:[eax],edx 00437DE0 push 437DF5 00437DE5 lea eax,[ebp-4] 00437DE8 call @LStrClr 00437DED ret <00437DEE jmp @HandleFinally <00437DF3 jmp 00437DE5 00437DF5 pop ebx 00437DF6 pop ecx 00437DF7 pop ebp 00437DF8 ret
在OD中,從開頭地址 00437D1C 跟蹤分析:
00437D1C 55 push ebp ; // Serial數字發生變化時調用 00437D1D 8BEC mov ebp,esp 00437D1F 6A 00 push 0x0 00437D21 53 push ebx 00437D22 8BD8 mov ebx,eax ; // eax 傳過來的參數,1-4 00437D24 33C0 xor eax,eax 00437D26 55 push ebp 00437D27 68 EE7D4300 push 00437DEE 00437D2C 64:FF30 push dword ptr fs:[eax] 00437D2F 64:8920 mov dword ptr fs:[eax],esp 00437D32 8BC3 mov eax,ebx 00437D34 48 dec eax 00437D35 74 0E je short 00437D45 ; 1 00437D37 48 dec eax 00437D38 74 2F je short 00437D69 ; 2 00437D3A 48 dec eax 00437D3B 74 50 je short 00437D8D ; 3 00437D3D 48 dec eax 00437D3E 74 71 je short 00437DB1 ; 4 00437D40 E9 8E000000 jmp 00437DD3 00437D45 8D55 FC lea edx,dword ptr ss:[ebp-0x4] ; // 1的處理 00437D48 A1 28A74300 mov eax,dword ptr ds:[0x43A728] ; 0x0 gvar_0043A728:TForm2 00437D4D 8B80 E8010000 mov eax,dword ptr ds:[eax+0x1E8] ; TForm2.Edit1:TEdit 00437D53 E8 6854FEFF call 0041D1C0 ; TControl.GetText 00437D58 8B45 FC mov eax,dword ptr ss:[ebp-0x4] 00437D5B E8 D0EBFCFF call 00406930 ; StrToInt 00437D60 89049D 38A74300 mov dword ptr ds:[ebx*4+0x43A738],eax ; gvar_0043A738:Integer 00437D67 EB 6A jmp short 00437DD3 00437D69 8D55 FC lea edx,dword ptr ss:[ebp-0x4] ; // 2的處理 00437D6C A1 28A74300 mov eax,dword ptr ds:[0x43A728] 00437D71 8B80 EC010000 mov eax,dword ptr ds:[eax+0x1EC] ; TForm2.Edit2:TEdit 00437D77 E8 4454FEFF call 0041D1C0 00437D7C 8B45 FC mov eax,dword ptr ss:[ebp-0x4] 00437D7F E8 ACEBFCFF call 00406930 00437D84 89049D 38A74300 mov dword ptr ds:[ebx*4+0x43A738],eax 00437D8B EB 46 jmp short 00437DD3 00437D8D 8D55 FC lea edx,dword ptr ss:[ebp-0x4] ; // 3的處理 00437D90 A1 28A74300 mov eax,dword ptr ds:[0x43A728] 00437D95 8B80 F0010000 mov eax,dword ptr ds:[eax+0x1F0] ; TForm2.Edit3:TEdit 00437D9B E8 2054FEFF call 0041D1C0 00437DA0 8B45 FC mov eax,dword ptr ss:[ebp-0x4] 00437DA3 E8 88EBFCFF call 00406930 00437DA8 89049D 38A74300 mov dword ptr ds:[ebx*4+0x43A738],eax 00437DAF EB 22 jmp short 00437DD3 00437DB1 8D55 FC lea edx,dword ptr ss:[ebp-0x4] ; // 4的處理 00437DB4 A1 28A74300 mov eax,dword ptr ds:[0x43A728] 00437DB9 8B80 F4010000 mov eax,dword ptr ds:[eax+0x1F4] ; TForm2.Edit4:TEdit 00437DBF E8 FC53FEFF call 0041D1C0 00437DC4 8B45 FC mov eax,dword ptr ss:[ebp-0x4] 00437DC7 E8 64EBFCFF call 00406930 00437DCC 89049D 38A74300 mov dword ptr ds:[ebx*4+0x43A738],eax 00437DD3 E8 00FEFFFF call 00437BD8 ; // 這裏是另外一個關鍵Call 00437DD8 33C0 xor eax,eax 00437DDA 5A pop edx 00437DDB 59 pop ecx 00437DDC 59 pop ecx 00437DDD 64:8910 mov dword ptr fs:[eax],edx 00437DE0 68 F57D4300 push 00437DF5 00437DE5 8D45 FC lea eax,dword ptr ss:[ebp-0x4] 00437DE8 E8 0FB9FCFF call 004036FC ; @LStrClr
這個Call沒有進行計算,主要功能就是獲取編輯框文本,然後轉化爲整數,存起來(存放的地址很特殊,如果不注意,後面註冊碼就悲劇了!)。
最後,這個Call又調用了另外一個Call:
IDR中查看:
Reg::sub_00437BD8 00437BD8 push ebp 00437BD9 mov ebp,esp 00437BDB push 0 00437BDD push 0 00437BDF push ebx 00437BE0 push esi 00437BE1 xor eax,eax 00437BE3 push ebp 00437BE4 push 437D0C 00437BE9 push dword ptr fs:[eax] 00437BEC mov dword ptr fs:[eax],esp 00437BEF lea edx,[ebp-4] 00437BF2 mov eax,[0043A728]; 0x0 gvar_0043A728:TForm2 00437BF7 mov eax,dword ptr [eax+20C]; TForm2.Edit5:TEdit 00437BFD call TControl.GetText 00437C02 mov eax,dword ptr [ebp-4] 00437C05 call @LStrLen 00437C0A cmp eax,5 >00437C0D jl 00437CC2 00437C13 mov eax,dword ptr [ebp-4] 00437C16 movzx eax,byte ptr [eax] 00437C19 mov ecx,0A 00437C1E cdq 00437C1F idiv eax,ecx 00437C21 mov [0043A72C],eax; gvar_0043A72C:Integer 00437C26 mov eax,dword ptr [ebp-4] 00437C29 movzx eax,byte ptr [eax+2] 00437C2D mov ecx,0A 00437C32 cdq 00437C33 idiv eax,ecx 00437C35 mov [0043A730],eax; gvar_0043A730:Integer 00437C3A mov eax,dword ptr [ebp-4] 00437C3D movzx eax,byte ptr [eax+3] 00437C41 mov ecx,0A 00437C46 cdq 00437C47 idiv eax,ecx 00437C49 mov [0043A734],eax; gvar_0043A734:Integer 00437C4E mov eax,dword ptr [ebp-4] 00437C51 movzx eax,byte ptr [eax+4] 00437C55 mov ecx,0A 00437C5A cdq 00437C5B idiv eax,ecx 00437C5D mov [0043A738],eax; gvar_0043A738:Integer 00437C62 mov esi,1 00437C67 mov ebx,43A72C; gvar_0043A72C:Integer 00437C6C lea edx,[ebp-8] 00437C6F mov eax,dword ptr [ebx] 00437C71 call IntToStr 00437C76 mov eax,dword ptr [ebp-8] 00437C79 call @LStrLen 00437C7E dec eax >00437C7F je 00437C8D 00437C81 mov eax,dword ptr [ebx] 00437C83 mov ecx,0A 00437C88 cdq 00437C89 idiv eax,ecx 00437C8B mov dword ptr [ebx],eax 00437C8D inc esi 00437C8E add ebx,4 00437C91 cmp esi,5 <00437C94 jne 00437C6C 00437C96 mov esi,1 00437C9B mov eax,43A72C; gvar_0043A72C:Integer 00437CA0 mov edx,43A73C 00437CA5 mov ecx,dword ptr [edx] 00437CA7 cmp ecx,dword ptr [eax] >00437CA9 je 00437CB2 00437CAB mov ecx,1 >00437CB0 jmp 00437CC7 00437CB2 xor ecx,ecx 00437CB4 inc esi 00437CB5 add edx,4 00437CB8 add eax,4 00437CBB cmp esi,5 <00437CBE jne 00437CA5 >00437CC0 jmp 00437CC7 00437CC2 mov ecx,1 00437CC7 test ecx,ecx >00437CC9 jne 00437CDF 00437CCB mov eax,[0043A728]; 0x0 gvar_0043A728:TForm2 00437CD0 mov eax,dword ptr [eax+1E0]; TForm2.Button1:TButton 00437CD6 mov dl,1 00437CD8 call TControl.SetEnabled >00437CDD jmp 00437CF1 00437CDF mov eax,[0043A728]; 0x0 gvar_0043A728:TForm2 00437CE4 mov eax,dword ptr [eax+1E0]; TForm2.Button1:TButton 00437CEA xor edx,edx 00437CEC call TControl.SetEnabled 00437CF1 xor eax,eax 00437CF3 pop edx 00437CF4 pop ecx 00437CF5 pop ecx 00437CF6 mov dword ptr fs:[eax],edx 00437CF9 push 437D13 00437CFE lea eax,[ebp-8] 00437D01 mov edx,2 00437D06 call @LStrArrayClr 00437D0B ret <00437D0C jmp @HandleFinally <00437D11 jmp 00437CFE 00437D13 pop esi 00437D14 pop ebx 00437D15 pop ecx 00437D16 pop ecx 00437D17 pop ebp 00437D18 ret
OD中跟蹤調試:
00437BD8 55 push ebp ; // 處理數據的Call 00437BD9 8BEC mov ebp,esp 00437BDB 6A 00 push 0x0 00437BDD 6A 00 push 0x0 00437BDF 53 push ebx 00437BE0 56 push esi 00437BE1 33C0 xor eax,eax 00437BE3 55 push ebp 00437BE4 68 0C7D4300 push 00437D0C 00437BE9 64:FF30 push dword ptr fs:[eax] 00437BEC 64:8920 mov dword ptr fs:[eax],esp 00437BEF 8D55 FC lea edx,dword ptr ss:[ebp-0x4] 00437BF2 A1 28A74300 mov eax,dword ptr ds:[0x43A728] ; 0x0 gvar_0043A728:TForm2 00437BF7 8B80 0C020000 mov eax,dword ptr ds:[eax+0x20C] ; TForm2.Edit5:TEdit 00437BFD E8 BE55FEFF call 0041D1C0 ; TControl.GetText 00437C02 8B45 FC mov eax,dword ptr ss:[ebp-0x4] 00437C05 E8 6EBDFCFF call 00403978 ; @LStrLen 00437C0A 83F8 05 cmp eax,0x5 ; // 與5做比較,不能小於5 00437C0D 0F8C AF000000 jl 00437CC2 ; // 小於5失敗 00437C13 8B45 FC mov eax,dword ptr ss:[ebp-0x4] 00437C16 0FB600 movzx eax,byte ptr ds:[eax] ; // "bbdxf" 00437C19 B9 0A000000 mov ecx,0xA 00437C1E 99 cdq ; // edx = 0 00437C1F F7F9 idiv ecx ; // 除法, eax/ecx, 餘數=ebx,結果=eax 00437C21 A3 2CA74300 mov dword ptr ds:[0x43A72C],eax ; gvar_0043A72C:Integer 00437C26 8B45 FC mov eax,dword ptr ss:[ebp-0x4] 00437C29 0FB640 02 movzx eax,byte ptr ds:[eax+0x2] ; // 序號爲2的字符 00437C2D B9 0A000000 mov ecx,0xA 00437C32 99 cdq 00437C33 F7F9 idiv ecx ; // 除法 00437C35 A3 30A74300 mov dword ptr ds:[0x43A730],eax ; gvar_0043A730:Integer 00437C3A 8B45 FC mov eax,dword ptr ss:[ebp-0x4] 00437C3D 0FB640 03 movzx eax,byte ptr ds:[eax+0x3] ; // 序號爲3的字符 00437C41 B9 0A000000 mov ecx,0xA 00437C46 99 cdq 00437C47 F7F9 idiv ecx ; // 除法 00437C49 A3 34A74300 mov dword ptr ds:[0x43A734],eax ; gvar_0043A734:Integer 00437C4E 8B45 FC mov eax,dword ptr ss:[ebp-0x4] 00437C51 0FB640 04 movzx eax,byte ptr ds:[eax+0x4] ; // 序號爲4的字符 00437C55 B9 0A000000 mov ecx,0xA 00437C5A 99 cdq 00437C5B F7F9 idiv ecx ; // 除法 00437C5D A3 38A74300 mov dword ptr ds:[0x43A738],eax ; gvar_0043A738:Integer 00437C62 BE 01000000 mov esi,0x1 00437C67 BB 2CA74300 mov ebx,0043A72C ; gvar_0043A72C:Integer 00437C6C 8D55 F8 lea edx,dword ptr ss:[ebp-0x8] 00437C6F 8B03 mov eax,dword ptr ds:[ebx] ; // ebx=第一個餘數的地址,遞增+4,去下一個整數 00437C71 E8 8AECFCFF call 00406900 ; IntToStr 00437C76 8B45 F8 mov eax,dword ptr ss:[ebp-0x8] ; "9" "10"... 00437C79 E8 FABCFCFF call 00403978 ; @LStrLen 00437C7E 48 dec eax 00437C7F 74 0C je short 00437C8D ; // 長度爲1則跳轉 00437C81 8B03 mov eax,dword ptr ds:[ebx] 00437C83 B9 0A000000 mov ecx,0xA 00437C88 99 cdq 00437C89 F7F9 idiv ecx ; // 除法 00437C8B 8903 mov dword ptr ds:[ebx],eax ; // 將餘數寫回去 00437C8D 46 inc esi 00437C8E 83C3 04 add ebx,0x4 00437C91 83FE 05 cmp esi,0x5 00437C94 ^ 75 D6 jnz short 00437C6C ; // 處理之後,所有的餘數都小於10 00437C96 BE 01000000 mov esi,0x1 00437C9B B8 2CA74300 mov eax,0043A72C ; gvar_0043A72C:Integer 00437CA0 BA 3CA74300 mov edx,0043A73C ; //---這個地址是Edit1-Edit4的整數值存放地址 00437CA5 8B0A mov ecx,dword ptr ds:[edx] ; // ecx = 1 00437CA7 3B08 cmp ecx,dword ptr ds:[eax] 00437CA9 74 07 je short 00437CB2 00437CAB B9 01000000 mov ecx,0x1 00437CB0 EB 15 jmp short 00437CC7 ; // 跳過去了 00437CB2 33C9 xor ecx,ecx 00437CB4 46 inc esi 00437CB5 83C2 04 add edx,0x4 00437CB8 83C0 04 add eax,0x4 00437CBB 83FE 05 cmp esi,0x5 00437CBE ^ 75 E5 jnz short 00437CA5 00437CC0 EB 05 jmp short 00437CC7 00437CC2 B9 01000000 mov ecx,0x1 00437CC7 85C9 test ecx,ecx ; // 測試ecx的值 00437CC9 75 14 jnz short 00437CDF ; // 關鍵跳轉 00437CCB A1 28A74300 mov eax,dword ptr ds:[0x43A728] ; 0x0 gvar_0043A728:TForm2 00437CD0 8B80 E0010000 mov eax,dword ptr ds:[eax+0x1E0] ; TForm2.Button1:TButton 00437CD6 B2 01 mov dl,0x1 00437CD8 E8 7B54FEFF call 0041D158 ; TControl.SetEnabled 00437CDD EB 12 jmp short 00437CF1 00437CDF A1 28A74300 mov eax,dword ptr ds:[0x43A728] 00437CE4 8B80 E0010000 mov eax,dword ptr ds:[eax+0x1E0] 00437CEA 33D2 xor edx,edx 00437CEC E8 6754FEFF call 0041D158 ; TControl.SetEnabled 00437CF1 33C0 xor eax,eax 00437CF3 5A pop edx 00437CF4 59 pop ecx 00437CF5 59 pop ecx 00437CF6 64:8910 mov dword ptr fs:[eax],edx 00437CF9 68 137D4300 push 00437D13 00437CFE 8D45 F8 lea eax,dword ptr ss:[ebp-0x8] 00437D01 BA 02000000 mov edx,0x2 00437D06 E8 15BAFCFF call 00403720 ; @LStrArrayClr 00437D0B C3 retn
首先,只有Name的第1、3、4、5這四個字符有用,Name長度不小於5就可以了。
然後,四個Edit裏面的數字是1、3、4、5字符對應的ANSII碼值除以10的整數商,如果商大於10,則繼續除以10。商的結果放在0043A72C開頭的四個int裏面。
最後,循環比較0043A72C和0043A73C爲開頭的4個int值,如果相等,則通過。
等等,地址 0043A73C 地址處的值是從哪裏來的呢?上下翻閱,也終究沒找到,但是查看他們的值發現,他就是4個編輯框的值,即四個編輯框的整數值存放在地址0043A73C開頭的4個int裏面。還記得前面分析編輯框事件嗎?看看那裏,就是修改這個地址的值啊!
好啦,都弄明白了,可以進行註冊機了!
// CrackMeDemo.cpp : 定義控制檯應用程序的入口點。 // #include "stdafx.h" #include <iostream> int _tmain(int argc, _TCHAR* argv[]) { char pName[] = "bbdxf"; char pNum[4] = {0}; pNum[0] = pName[0] / 0x0A; pNum[1] = pName[2] / 0x0A; pNum[2] = pName[3] / 0x0A; pNum[3] = pName[4] / 0x0A; for ( int i=0;i<4;i++) { if ( pNum[i]>=0x0A ) // 程序中是通過轉爲字符串,判斷字符串長度 { pNum[i] = pNum[i]/0x0A; } } printf("Num: %d - %d - %d - %d\r\n",pNum[0],pNum[1],pNum[2],pNum[3]); system("pause"); return 0; }
pName設置爲輸入的Name,計算後的四個數字則爲4個編輯框對應的內容!
BY 笨笨D幸福