MAC平台下的crackme两例分析

作者：creantan 小葡萄爸爸

工具列表：
Hopper disassembler（静态分析）
lldb （动态调试）

撸起：
先来个最简单的，直接用Hopper disassembler分析：
直接把第一个crackme拖到Hopper里面，看下左边窗口，看下这个crackme的Labels

很容易就找到这个methed实现methImpl_AppDelegate_checkifisok_
点击它看下汇编：

0x0000000100001110 55                              push       rbp
0x0000000100001111 4889E5                          mov        rbp, rsp
0x0000000100001114 4883EC70                        sub        rsp, 0x70
0x0000000100001118 488D0551180000                  lea        rax, qword [ds:cfstring_Length_of_the_serial_string_is___lx] ; @"Length of the serial string is: %lx"
0x000000010000111f 488D0DBA160000                  lea        rcx, qword [ds:objc_msg_length] ; @selector(length)
0x0000000100001126 4C8D0523180000                  lea        r8, qword [ds:cfstring_Length_of_the_name_string_is___lx] ; @"Length of the name string is: %lx"
0x000000010000112d 4C8D0DFC170000                  lea        r9, qword [ds:cfstring_uh_] ; @"uh?"
0x0000000100001134 48897DF8                        mov        qword [ss:rbp-0x70+var_104], rdi
0x0000000100001138 488975F0                        mov        qword [ss:rbp-0x70+var_96], rsi
0x000000010000113c 488955E8                        mov        qword [ss:rbp-0x70+var_88], rdx
0x0000000100001140 4C89CF                          mov        rdi, r9
0x0000000100001143 488945B0                        mov        qword [ss:rbp-0x70+var_32], rax
0x0000000100001147 B000                            mov        al, 0x0
0x0000000100001149 4C8945A8                        mov        qword [ss:rbp-0x70+var_24], r8
0x000000010000114d 48894DA0                        mov        qword [ss:rbp-0x70+var_16], rcx
0x0000000100001151 E8C6030000                      call       imp___stubs__NSLog
0x0000000100001156 488B4DF8                        mov        rcx, qword [ss:rbp-0x70+var_104]
0x000000010000115a 488B152F190000                  mov        rdx, qword [ds:0x100002a90]
0x0000000100001161 488B0C11                        mov        rcx, qword [ds:rcx+rdx]
0x0000000100001165 488B350C160000                  mov        rsi, qword [ds:objc_sel_stringValue] ; @selector(stringValue)
0x000000010000116c 4889CF                          mov        rdi, rcx
0x000000010000116f E8B4030000                      call       imp___stubs__objc_msgSend
0x0000000100001174 488945E0                        mov        qword [ss:rbp-0x70+var_80], rax
0x0000000100001178 488B45E0                        mov        rax, qword [ss:rbp-0x70+var_80]
0x000000010000117c 4889C7                          mov        rdi, rax
0x000000010000117f 488B75A0                        mov        rsi, qword [ss:rbp-0x70+var_16]
0x0000000100001183 FF1557160000                    call       qword [ds:objc_msg_length]  ; @selector(length)
0x0000000100001189 488945D8                        mov        qword [ss:rbp-0x70+var_72], rax
0x000000010000118d 488B75D8                        mov        rsi, qword [ss:rbp-0x70+var_72]
0x0000000100001191 488B7DA8                        mov        rdi, qword [ss:rbp-0x70+var_24]
0x0000000100001195 B000                            mov        al, 0x0
0x0000000100001197 E880030000                      call       imp___stubs__NSLog
0x000000010000119c 488B4DF8                        mov        rcx, qword [ss:rbp-0x70+var_104]
0x00000001000011a0 488B15F1180000                  mov        rdx, qword [ds:0x100002a98]
0x00000001000011a7 488B0C11                        mov        rcx, qword [ds:rcx+rdx]
0x00000001000011ab 488B35C6150000                  mov        rsi, qword [ds:objc_sel_stringValue] ; @selector(stringValue)
0x00000001000011b2 4889CF                          mov        rdi, rcx
0x00000001000011b5 E86E030000                      call       imp___stubs__objc_msgSend
0x00000001000011ba 488945D0                        mov        qword [ss:rbp-0x70+var_64], rax
0x00000001000011be 488B45D0                        mov        rax, qword [ss:rbp-0x70+var_64]
0x00000001000011c2 4889C7                          mov        rdi, rax
0x00000001000011c5 488B75A0                        mov        rsi, qword [ss:rbp-0x70+var_16]
0x00000001000011c9 FF1511160000                    call       qword [ds:objc_msg_length]  ; @selector(length)
0x00000001000011cf 488945C8                        mov        qword [ss:rbp-0x70+var_56], rax
0x00000001000011d3 488B75C8                        mov        rsi, qword [ss:rbp-0x70+var_56]
0x00000001000011d7 488B7DB0                        mov        rdi, qword [ss:rbp-0x70+var_32]
0x00000001000011db B000                            mov        al, 0x0
0x00000001000011dd E83A030000                      call       imp___stubs__NSLog
0x00000001000011e2 48817DC80A000000                cmp        qword [ss:rbp-0x70+var_56], 0xa
0x00000001000011ea 0F86BF000000                    jbe        0x1000012af     //判断密码长度是否大于10
                                       ; Basic Block Input Regs: rbp -  Killed Regs: <nothing>
0x00000001000011f0 48817DC80F000000                cmp        qword [ss:rbp-0x70+var_56], 0xf
0x00000001000011f8 0F83B1000000                    jnc        0x1000012af //判断密码长度是否小于15
                                       ; Basic Block Input Regs: rbp -  Killed Regs: <nothing>
0x00000001000011fe 48817DD807000000                cmp        qword [ss:rbp-0x70+var_72], 0x7
0x0000000100001206 0F86A3000000                    jbe        0x1000012af   //判断用户名长度是否大于7
                                       ; Basic Block Input Regs: rbp -  Killed Regs: <nothing>
0x000000010000120c 48817DD80F000000                cmp        qword [ss:rbp-0x70+var_72], 0xf
0x0000000100001214 0F8395000000                    jnc        0x1000012af   // 判断用户名长度是否小于15
                                       ; Basic Block Input Regs: <nothing> -  Killed Regs: rax rcx rdx rbp rsi rdi
0x000000010000121a 488D05CF150000                  lea        rax, qword [ds:objc_msg_isEqualToString_] ; @selector(isEqualToString:)
0x0000000100001221 488D0D68170000                  lea        rcx, qword [ds:cfstring_]   ; @""
0x0000000100001228 488B15D9150000                  mov        rdx, qword [ds:bind__OBJC_CLASS_$_NSCharacterSet]
0x000000010000122f 488B354A150000                  mov        rsi, qword [ds:objc_sel_alphanumericCharacterSet] ; @selector(alphanumericCharacterSet)
0x0000000100001236 4889D7                          mov        rdi, rdx
0x0000000100001239 48894598                        mov        qword [ss:rbp-0x70+var_8], rax
0x000000010000123d 48894D90                        mov        qword [ss:rbp-0x70+var_0], rcx
0x0000000100001241 E8E2020000                      call       imp___stubs__objc_msgSend     //获取字母和数字集合 NSCharacterSet *alphanumericSet = [ NSCharacterSetalphanumericCharacterSet ];
0x0000000100001246 488945C0                        mov        qword [ss:rbp-0x70+var_48], rax
0x000000010000124a 488B45D0                        mov        rax, qword [ss:rbp-0x70+var_64]
0x000000010000124e 488B55C0                        mov        rdx, qword [ss:rbp-0x70+var_48]
0x0000000100001252 488B352F150000                  mov        rsi, qword [ds:objc_sel_stringByTrimmingCharactersInSet_] ; @selector(stringByTrimmingCharactersInSet:)
0x0000000100001259 4889C7                          mov        rdi, rax
0x000000010000125c E8C7020000                      call       imp___stubs__objc_msgSend  //格式化密码，去除密码中含alphanumericSet中的字符 NSString *trimmedString = [passwdString stringByTrimmingCharactersInSet:alphanumericSet];
0x0000000100001261 4889C7                          mov        rdi, rax
0x0000000100001264 488B7598                        mov        rsi, qword [ss:rbp-0x70+var_8]
0x0000000100001268 488B5590                        mov        rdx, qword [ss:rbp-0x70+var_0]
0x000000010000126c FF157E150000                    call       qword [ds:objc_msg_isEqualToString_] ; @selector(isEqualToString:)//判断trimmedString是否和@“”空串相等
0x0000000100001272 8845BF                          mov        byte [ss:rbp-0x70+var_47], al
0x0000000100001275 807DBF00                        cmp        byte [ss:rbp-0x70+var_47], 0x0
0x0000000100001279 0F8418000000                    je         0x100001297   //不等则显示错误
                                       ; Basic Block Input Regs: rbp -  Killed Regs: rax rsi rdi
0x000000010000127f 488B45F8                        mov        rax, qword [ss:rbp-0x70+var_104]
0x0000000100001283 488B3506150000                  mov        rsi, qword [ds:objc_sel_yes] ; @selector(yes)
0x000000010000128a 4889C7                          mov        rdi, rax
0x000000010000128d E896020000                      call       imp___stubs__objc_msgSend
0x0000000100001292 E913000000                      jmp        0x1000012aa
                                       ; Basic Block Input Regs: rbp -  Killed Regs: rax rsi rdi
0x0000000100001297 488B45F8                        mov        rax, qword [ss:rbp-0x70+var_104] ; XREF=0x100001279
0x000000010000129b 488B35F6140000                  mov        rsi, qword [ds:objc_sel_no] ; @selector(no)
0x00000001000012a2 4889C7                          mov        rdi, rax
0x00000001000012a5 E87E020000                      call       imp___stubs__objc_msgSend
                                       ; Basic Block Input Regs: <nothing> -  Killed Regs: <nothing>
0x00000001000012aa E913000000                      jmp        0x1000012c2                ; XREF=0x100001292
                                       ; Basic Block Input Regs: rbp -  Killed Regs: rax rsi rdi
0x00000001000012af 488B45F8                        mov        rax, qword [ss:rbp-0x70+var_104] ; XREF=0x1000011ea, 0x1000011f8, 0x100001206, 0x100001214
0x00000001000012b3 488B35DE140000                  mov        rsi, qword [ds:objc_sel_no] ; @selector(no)
0x00000001000012ba 4889C7                          mov        rdi, rax
0x00000001000012bd E866020000                      call       imp___stubs__objc_msgSend
                                       ; Basic Block Input Regs: <nothing> -  Killed Regs: rsp rbp
0x00000001000012c2 4883C470                        add        rsp, 0x70                  ; XREF=0x1000012aa
0x00000001000012c6 5D                              pop        rbp
0x00000001000012c7 C3                              ret

复原代码如下：

/**
 *  用户名密码验证
 *  用户名密码长度验证，密码字母和数字验证，密码只能包含数字和字母
 *  @return 返回YES or NO
 */
-(BOOL)checkifisok{
    NSString* name = [nameTextField text];
    NSString* serial = [serialTextField text];
    int nameLength = [name length];
    int serialLength = [serial length];
    if(serialLength > 10 && serialLength < 15){
        if(nameLength > 7 && nameLength < 15){
            NSCharacterSet *alphanumericSet = [NSCharacterSet alphanumericCharacterSet];
            NSString *trimmedString = [serial stringByTrimmingCharactersInSet:alphanumericSet];
            if([trimmedString isEqualToString:@""]){
                returnYES;
            }
        }else{
            returnNO
        }
    }else{
        returnNO;
    }
}

第二个使用lldb动态调试：

lldb crackme2.app
r
ctl+c
br s -a 0x2a9e

0x00002a9e 55                              push      ebp
0x00002a9f 89E5                            mov       ebp,esp
0x00002aa1 57                              push      edi
0x00002aa2 56                              push      esi
0x00002aa3 53                              push      ebx
0x00002aa4 83EC3C                          sub       esp,0x3c
0x00002aa7 A140400000                      mov       eax, dword [ds:objc_msg_length]    ; @selector(length)
0x00002aac 89442404                        mov        dword [ss:esp+0x4],eax
0x00002ab0 8B4510                          mov       eax, dword [ss:ebp-0x48+arg_8]
0x00002ab3 890424                          mov        dword [ss:esp],eax
0x00002ab6 E8A3250000                      call       imp___jump_table__objc_msgSend
0x00002abb 83F808                          cmp        eax,0x8   //判断注册码长度是否为8位
0x00002abe 0F858A010000                    jne       0x2c4e  //不等跳往错误提示
                                       ; Basic Block Input Regs: ecx ebx ebp -  Killed Regs: eax ecx ebx esp ebp esi edi
0x00002ac4 A144400000                      mov       eax, dword [ds:objc_msg_lossyCString]; @selector(lossyCString)
0x00002ac9 BE04000000                      mov       esi,0x4   //esi初始化为4
0x00002ace 31DB                            xor       ebx,ebx
0x00002ad0 89442404                        mov        dword [ss:esp+0x4],eax
0x00002ad4 8B4514                          mov       eax, dword [ss:ebp-0x48+arg_C]
0x00002ad7 890424                          mov        dword [ss:esp],eax
0x00002ada E87F250000                      call       imp___jump_table__objc_msgSend
0x00002adf 890424                          mov        dword [ss:esp],eax
0x00002ae2 89C7                            mov       edi,eax
0x00002ae4 E87A250000                      call       imp___jump_table__strlen
0x00002ae9 31C9                            xor       ecx,ecx
0x00002aeb 8945D0                          mov        dword [ss:ebp-0x48+var_24],eax
0x00002aee EB37                            jmp       0x2b27
                                       ; Basic Block Input Regs: ebx esi edi -  Killed Regs: eax ecx edx ebx ebp esi
0x00002af0 0FBE041F                        movsx     eax, byte [ds:edi+ebx]             ; XREF=0x2b2a   //取用户名的一个字符
0x00002af4 43                              inc       ebx  //循环累加器
0x00002af5 0FAFC6                          imul      eax,esi  //取出来的字符与esi相乘
0x00002af8 83C604                          add       esi,0x4  //esi+4
0x00002afb 89C2                            mov       edx,eax
0x00002afd C1E204                          shl       edx,0x4  //edx << 0x4
0x00002b00 29C2                            sub       edx,eax
0x00002b02 B8AD8BDB68                      mov       eax,0x68db8bad
0x00002b07 8D8C0A9A020000                  lea       ecx, dword [ds:edx+ecx+0x29a]
0x00002b0e F7E9                            imul      ecx
0x00002b10 89C8                            mov       eax,ecx
0x00002b12 C1F81F                          sar       eax,0x1f
0x00002b15 C1FA0C                          sar       edx,0xc
0x00002b18 29C2                            sub       edx,eax
0x00002b1a 89C8                            mov       eax,ecx
0x00002b1c 69D210270000                    imul      edx,edx,0x2710
0x00002b22 29D0                            sub       eax,edx
0x00002b24 8945E0                          mov        dword [ss:ebp-0x48+var_40],eax
                                       ; Basic Block Input Regs: ebx ebp -  Killed Regs: <nothing>
0x00002b27 395DD0                          cmp        dword [ss:ebp-0x48+var_24],ebx   ; XREF=0x2aee
0x00002b2a 77C4                            jnbe      0x2af0
                                       ; Basic Block Input Regs: ecx ebx ebp edi -  Killed Regs: eax ecx ebx esp ebp esi
0x00002b2c 8B45E0                          mov       eax, dword [ss:ebp-0x48+var_40]
0x00002b2f BE04000000                      mov       esi,0x4
0x00002b34 31DB                            xor       ebx,ebx
0x00002b36 C744240878300000                mov        dword [ss:esp+0x8],0x3078         ; @"%i"
0x00002b3e 8944240C                        mov        dword [ss:esp+0xc],eax
0x00002b42 A128400000                      mov       eax, dword [ds:objc_msg_stringWithFormat_]; @selector(stringWithFormat:)
0x00002b47 89442404                        mov        dword [ss:esp+0x4],eax
0x00002b4b A154400000                      mov       eax, dword [ds:cls_NSString]
0x00002b50 890424                          mov        dword [ss:esp],eax
0x00002b53 E806250000                      call       imp___jump_table__objc_msgSend   //将结果格式化为NSString
0x00002b58 893C24                          mov        dword [ss:esp],edi
0x00002b5b 8945D8                          mov        dword [ss:ebp-0x48+var_32],eax
0x00002b5e E800250000                      call       imp___jump_table__strlen
0x00002b63 31C9                            xor       ecx,ecx
0x00002b65 8945D4                          mov        dword [ss:ebp-0x48+var_28],eax
0x00002b68 EB32                            jmp       0x2b9c
                                       ; Basic Block Input Regs: ebx esi edi -  Killed Regs: eax ecx edx ebx ebp esi
0x00002b6a 0FBE041F                        movsx     eax, byte [ds:edi+ebx]             ; XREF=0x2b9f
0x00002b6e 43                              inc       ebx
0x00002b6f 0FAFC6                          imul      eax,esi
0x00002b72 83C608                          add       esi,0x8
0x00002b75 8D1480                          lea       edx, dword [ds:eax+eax*4]
0x00002b78 8D54502D                        lea       edx, dword [ds:eax+edx*2+0x2d]
0x00002b7c B8AD8BDB68                      mov       eax,0x68db8bad
0x00002b81 01D1                            add       ecx,edx
0x00002b83 F7E9                            imul      ecx
0x00002b85 89C8                            mov       eax,ecx
0x00002b87 C1F81F                          sar       eax,0x1f
0x00002b8a C1FA0C                          sar       edx,0xc
0x00002b8d 29C2                            sub       edx,eax
0x00002b8f 89C8                            mov       eax,ecx
0x00002b91 69D210270000                    imul      edx,edx,0x2710
0x00002b97 29D0                            sub       eax,edx
0x00002b99 8945E4                          mov        dword [ss:ebp-0x48+var_44],eax
                                       ; Basic Block Input Regs: ebx ebp -  Killed Regs: <nothing>
0x00002b9c 3B5DD4                          cmp       ebx, dword [ss:ebp-0x48+var_28]    ; XREF=0x2b68
0x00002b9f 72C9                            jc        0x2b6a
                                       ; Basic Block Input Regs: ebx ebp -  Killed Regs: eax ebx esp ebp esi edi
0x00002ba1 8B45E4                          mov       eax, dword [ss:ebp-0x48+var_44]
0x00002ba4 BE04000000                      mov       esi,0x4
0x00002ba9 31DB                            xor       ebx,ebx
0x00002bab C744240878300000                mov        dword [ss:esp+0x8],0x3078         ; @"%i"
0x00002bb3 BF04000000                      mov       edi,0x4
0x00002bb8 8944240C                        mov        dword [ss:esp+0xc],eax
0x00002bbc A128400000                      mov       eax, dword [ds:objc_msg_stringWithFormat_]; @selector(stringWithFormat:)
0x00002bc1 89442404                        mov        dword [ss:esp+0x4],eax
0x00002bc5 A154400000                      mov       eax, dword [ds:cls_NSString]
0x00002bca 890424                          mov        dword [ss:esp],eax
0x00002bcd E88C240000                      call       imp___jump_table__objc_msgSend //将结果格式化为NSString
0x00002bd2 895C2408                        mov        dword [ss:esp+0x8],ebx
0x00002bd6 8974240C                        mov        dword [ss:esp+0xc],esi
0x00002bda 8945DC                          mov        dword [ss:ebp-0x48+var_36],eax
0x00002bdd A148400000                      mov       eax, dword [ds:objc_msg_substringWithRange_]; @selector(substringWithRange:)
0x00002be2 89442404                        mov        dword [ss:esp+0x4],eax
0x00002be6 8B4510                          mov       eax, dword [ss:ebp-0x48+arg_8]
0x00002be9 890424                          mov        dword [ss:esp],eax
0x00002bec E86D240000                      call       imp___jump_table__objc_msgSend //截取密码前4位验证
0x00002bf1 89742408                        mov        dword [ss:esp+0x8],esi
0x00002bf5 897C240C                        mov        dword [ss:esp+0xc],edi
0x00002bf9 89C3                            mov       ebx,eax
0x00002bfb A148400000                      mov       eax, dword [ds:objc_msg_substringWithRange_]; @selector(substringWithRange:)
0x00002c00 89442404                        mov        dword [ss:esp+0x4],eax
0x00002c04 8B4510                          mov       eax, dword [ss:ebp-0x48+arg_8]
0x00002c07 890424                          mov        dword [ss:esp],eax
0x00002c0a E84F240000                      call       imp___jump_table__objc_msgSend//截取密码后4位验证
0x00002c0f 891C24                          mov        dword [ss:esp],ebx
0x00002c12 89C6                            mov       esi,eax
0x00002c14 8B45D8                          mov       eax, dword [ss:ebp-0x48+var_32]
0x00002c17 89442408                        mov        dword [ss:esp+0x8],eax
0x00002c1b A108400000                      mov       eax, dword [ds:objc_msg_isEqual_]  ; @selector(isEqual:)
0x00002c20 89442404                        mov        dword [ss:esp+0x4],eax
0x00002c24 E835240000                      call       imp___jump_table__objc_msgSend //判断是否相等
0x00002c29 84C0                            test      al,al
0x00002c2b 7421                            je        0x2c4e
                                       ; Basic Block Input Regs: ebp esi -  Killed Regs: eax edx esp
0x00002c2d 8B45DC                          mov       eax, dword [ss:ebp-0x48+var_36]
0x00002c30 893424                          mov        dword [ss:esp],esi
0x00002c33 89442408                        mov        dword [ss:esp+0x8],eax
0x00002c37 A108400000                      mov       eax, dword [ds:objc_msg_isEqual_]  ; @selector(isEqual:)
0x00002c3c 89442404                        mov        dword [ss:esp+0x4],eax
0x00002c40 E819240000                      call       imp___jump_table__objc_msgSend//判断是否相等
0x00002c45 BA01000000                      mov       edx,0x1
0x00002c4a 84C0                            test      al,al
0x00002c4c 7502                            jne       0x2c50
                                       ; Basic Block Input Regs: edx -  Killed Regs: edx
0x00002c4e 31D2                            xor       edx,edx                           ; XREF=0x2abe, 0x2c2b
                                       ; Basic Block Input Regs: edx -  Killed Regs: eax ebx esp esi edi
0x00002c50 83C43C                          add       esp,0x3c                         ; XREF=0x2c4c
0x00002c53 89D0                            mov       eax,edx
0x00002c55 5B                              pop       ebx
0x00002c56 5E                              pop       esi
0x00002c57 5F                              pop       edi
0x00002c58 C9                              leave     
0x00002c59 C3                              ret

keygen代码如下：

int main(int argc, constchar * argv[]) {
    @autoreleasepool {
       
        unsignedlong nameLength = strlen(argv[1]);
        constchar* index = argv[1];
        unsignedint eax = 0;
        int ecx=0,edx=0,esi = 4;
        int serial_1=0;
        long constValue =  0x68db8bad;
        for (int i = 0; i<nameLength; i++) {
            eax = (int)(*index);
            eax = eax * esi;
            esi+=4;
            edx = (eax << 0x4) - eax;
            ecx = edx + ecx+0x29a;
            edx = constValue*ecx >> 32;
            serial_1 = ecx - ((edx >> 0xc)-(ecx >> 0x1f)) * 0x2710;
            index++;
           
        }
        int serial_2=0;
        index = argv[1];
        eax = 0,ecx=0,edx=0,esi = 4;
       
        for (int i = 0; i<nameLength; i++) {
            eax = (int)(*index);
            eax = eax * esi;
            esi+=8;
            edx = eax+(eax+eax*4)*2+0x2d;
            ecx += edx;
            edx = constValue*ecx >> 32;
            serial_2 = ecx - ((edx >> 0xc) - (ecx >> 0x1f)) * 0x2710;
            index++;
        }
        NSLog(@"\nname:%s\nserial:%d%d",argv[1],serial_1,serial_2);
    }
    return0;
}
最后编辑于 ：
©著作权归作者所有,转载或内容合作请联系作者
  • 人面猴
    序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
    沈念sama阅读 202,980评论 5赞 476
  • 死咒
    序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
    沈念sama阅读 85,178评论 2赞 380
  • 救了他两次的神仙让他今天三更去死
    文/潘晓璐 我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
    开封第一讲书人阅读 149,868评论 0赞 336
  • 道士缉凶录：失踪的卖姜人
    文/不坏的土叔 我叫张陵，是天一观的道长。 经常有香客问我，道长，这世上最难降的妖魔是什么？ 我笑而不...
    开封第一讲书人阅读 54,498评论 1赞 273
  • 港岛之恋（遗憾婚礼）
    正文 为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
    茶点故事阅读 63,492评论 5赞 364
  • 恶毒庶女顶嫁案：这布局不是一般人想出来的
    文/花漫 我一把揭开白布。 她就那样静静地躺着，像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上，一...
    开封第一讲书人阅读 48,521评论 1赞 281
  • 城市分裂传说
    那天，我揣着相机与录音，去河边找鬼。 笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。 我是一名探鬼主播，决...
    沈念sama阅读 37,910评论 3赞 395
  • 双鸳鸯连环套：你想象不到人心有多黑
    文/苍兰香墨 我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
    开封第一讲书人阅读 36,569评论 0赞 256
  • 万荣杀人案实录
    序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
    沈念sama阅读 40,793评论 1赞 296
  • 护林员之死
    正文 独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 35,559评论 2赞 319
  • 白月光启示录
    正文 我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 37,639评论 1赞 329
  • 活死人
    序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
    沈念sama阅读 33,342评论 4赞 318
  • 日本核电站爆炸内幕
    正文 年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
    茶点故事阅读 38,931评论 3赞 307
  • 男人毒药：我在死后第九天来索命
    文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 29,904评论 0赞 19
  • 一桩弑父案，背后竟有这般阴谋
    文/苍兰香墨 我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 31,144评论 1赞 259
  • 情欲美人皮
    我被黑心中介骗来泰国打工， 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。 一个月前我还...
    沈念sama阅读 42,833评论 2赞 349
  • 代替公主和亲
    正文 我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
    茶点故事阅读 42,350评论 2赞 342

推荐阅读更多精彩内容