码迷,mamicode.com
首页 > 其他好文 > 详细

[反汇编练习] 160个CrackMe之030

时间:2014-07-10 15:32:59      阅读:334      评论:0      收藏:0      [点我收藏+]

标签:style   blog   http   color   使用   strong   

[反汇编练习] 160个CrackMe之030.

本系列文章的目的是从一个没有任何经验的新手的角度(其实就是我自己),一步步尝试将160个CrackMe全部破解,如果可以,通过任何方式写出一个类似于注册机的东西。

其中,文章中按照如下逻辑编排(解决如下问题):

1、使用什么环境和工具

2、程序分析

3、思路分析和破解流程

4、注册机的探索

----------------------------------

提醒各位看客: 如果文章中的逻辑看不明白,那你一定是没有亲手操刀!OD中的跳转提示很强大,只要你跟踪了,不用怎么看代码就理解了!

----------------------------------

1、工具和环境:

WinXP SP3 + 52Pojie六周年纪念版OD + PEID + 汇编金手指。

160个CrackMe的打包文件。

下载地址: http://pan.baidu.com/s/1xUWOY 密码: jbnq

注:

1、Win7系统对于模块和程序开启了随机初始地址的功能,会给分析带来很大的负担,所以不建议使用Win7进行分析。

2、以上工具都是在52PoJie论坛下的原版程序,NOD32不报毒,个人承诺绝对不会进行任何和木马病毒相关内容。

bubuko.com,布布扣

2、程序分析:

想要破解一个程序,必须先了解这个程序。所以,在破解过程中,对最初程序的分析很重要,他可以帮助我们理解作者的目的和意图,特别是对于注册码的处理细节,从而方便我们反向跟踪和推导。

和上一节一样,打开CHM,选择第30个cracking4all.1.exe,保存下来。运行程序,程序界面如下:

bubuko.com,布布扣

点击上面的OK按钮,弹出了信息框,很好。

注意的是,点击确定按钮后,程序直接退出了。

PEID:Microsoft Visual Basic 5.0 / 6.0

哎,又是一个郁闷的征程!

 

3、思路分析和破解流程

1、打开OD,将exe拖到OD窗口中,等程序暂停后,直接点击运行按钮(F9),不用理会。

2、点击About->Register,随意输入伪码:21312321。点击OK按钮,弹出信息框,不要关闭,回到OD。

3、Ctrl+K查看堆栈信息:

bubuko.com,布布扣

选中rtcMsgBox,右键->Show call。

4、向上浏览代码:

00403370   . /0F84 E8000000 je 0040345E
00403376   . |8B35 9C614000 mov esi,dword ptr ds:[<&MSVBVM50.__vbaVa>;  msvbvm50.__vbaVarDup
0040337C   . |BF 08000000   mov edi,0x8
00403381   . |8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]
00403387   . |8D4D 98       lea ecx,dword ptr ss:[ebp-0x68]
0040338A   . |C785 30FFFFFF>mov dword ptr ss:[ebp-0xD0],00402824     ;  UNICODE "Valid"
00403394   . |89BD 28FFFFFF mov dword ptr ss:[ebp-0xD8],edi
0040339A   . |FFD6          call esi                                 ;  <&MSVBVM50.__vbaVarDup>
0040339C   . |8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
004033A2   . |8D4D A8       lea ecx,dword ptr ss:[ebp-0x58]
004033A5   . |C785 40FFFFFF>mov dword ptr ss:[ebp-0xC0],004027E8     ;  UNICODE "Password correct, hehe, :-)"
004033AF   . |89BD 38FFFFFF mov dword ptr ss:[ebp-0xC8],edi
004033B5   . |FFD6          call esi
004033B7   . |8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]
004033BD   . |8D45 88       lea eax,dword ptr ss:[ebp-0x78]
004033C0   . |52            push edx
004033C1   . |8D4D 98       lea ecx,dword ptr ss:[ebp-0x68]
004033C4   . |50            push eax
004033C5   . |51            push ecx
004033C6   . |8D55 A8       lea edx,dword ptr ss:[ebp-0x58]
004033C9   . |6A 00         push 0x0
004033CB   . |52            push edx
004033CC   . |FF15 24614000 call dword ptr ds:[<&MSVBVM50.#595>]     ;  msvbvm50.rtcMsgBox
004033D2   . |8D85 78FFFFFF lea eax,dword ptr ss:[ebp-0x88]
004033D8   . |8D4D 88       lea ecx,dword ptr ss:[ebp-0x78]
004033DB   . |50            push eax
004033DC   . |8D55 98       lea edx,dword ptr ss:[ebp-0x68]
004033DF   . |51            push ecx
004033E0   . |8D45 A8       lea eax,dword ptr ss:[ebp-0x58]
004033E3   . |52            push edx
004033E4   . |50            push eax
004033E5   . |6A 04         push 0x4
004033E7   . |FF15 00614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeV>;  msvbvm50.__vbaFreeVarList
004033ED   . |A1 A4434000   mov eax,dword ptr ds:[0x4043A4]
004033F2   . |83C4 14       add esp,0x14
004033F5   . |85C0          test eax,eax
004033F7   . |75 10         jnz short 00403409
004033F9   . |68 A4434000   push 004043A4                            ; /Arg2 = 004043A4
004033FE   . |68 50284000   push 00402850                            ; |Arg1 = 00402850
00403403   . |FF15 80614000 call dword ptr ds:[<&MSVBVM50.__vbaNew2>>; \__vbaNew2
00403409   > |A1 38404000   mov eax,dword ptr ds:[0x404038]
0040340E   . |8B35 A4434000 mov esi,dword ptr ds:[0x4043A4]
00403414   . |85C0          test eax,eax
00403416   . |75 10         jnz short 00403428
00403418   . |68 38404000   push 00404038                            ; /Arg2 = 00404038
0040341D   . |68 6C204000   push 0040206C                            ; |Arg1 = 0040206C
00403422   . |FF15 80614000 call dword ptr ds:[<&MSVBVM50.__vbaNew2>>; \__vbaNew2
00403428   > |8B0D 38404000 mov ecx,dword ptr ds:[0x404038]
0040342E   . |8B3E          mov edi,dword ptr ds:[esi]
00403430   . |8D55 B8       lea edx,dword ptr ss:[ebp-0x48]
00403433   . |51            push ecx
00403434   . |52            push edx
00403435   . |FF15 2C614000 call dword ptr ds:[<&MSVBVM50.__vbaObjSe>;  msvbvm50.__vbaObjSetAddref
0040343B   . |50            push eax
0040343C   . |56            push esi
0040343D   . |FF57 10       call dword ptr ds:[edi+0x10]
00403440   . |85C0          test eax,eax
00403442   . |7D 0F         jge short 00403453
00403444   . |6A 10         push 0x10
00403446   . |68 40284000   push 00402840
0040344B   . |56            push esi
0040344C   . |50            push eax
0040344D   . |FF15 14614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>;  msvbvm50.__vbaHresultCheckObj
00403453   > |8D4D B8       lea ecx,dword ptr ss:[ebp-0x48]
00403456   . |FF15 B0614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  msvbvm50.__vbaFreeObj
0040345C   . |EB 7A         jmp short 004034D8
0040345E   > \8B35 9C614000 mov esi,dword ptr ds:[<&MSVBVM50.__vbaVa>;  msvbvm50.__vbaVarDup
00403464   .  BF 08000000   mov edi,0x8
00403469   .  8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]
0040346F   .  8D4D 98       lea ecx,dword ptr ss:[ebp-0x68]
00403472   .  C785 30FFFFFF>mov dword ptr ss:[ebp-0xD0],004028BC     ;  UNICODE "Invalid"
0040347C   .  89BD 28FFFFFF mov dword ptr ss:[ebp-0xD8],edi
00403482   .  FFD6          call esi                                 ;  <&MSVBVM50.__vbaVarDup>
00403484   .  8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
0040348A   .  8D4D A8       lea ecx,dword ptr ss:[ebp-0x58]
0040348D   .  C785 40FFFFFF>mov dword ptr ss:[ebp-0xC0],00402864     ;  UNICODE "Password incorrect, please try again ..."
00403497   .  89BD 38FFFFFF mov dword ptr ss:[ebp-0xC8],edi
0040349D   .  FFD6          call esi
0040349F   .  8D85 78FFFFFF lea eax,dword ptr ss:[ebp-0x88]
004034A5   .  8D4D 88       lea ecx,dword ptr ss:[ebp-0x78]
004034A8   .  50            push eax
004034A9   .  8D55 98       lea edx,dword ptr ss:[ebp-0x68]
004034AC   .  51            push ecx
004034AD   .  52            push edx
004034AE   .  8D45 A8       lea eax,dword ptr ss:[ebp-0x58]
004034B1   .  6A 00         push 0x0
004034B3   .  50            push eax
004034B4   .  FF15 24614000 call dword ptr ds:[<&MSVBVM50.#595>]     ;  msvbvm50.rtcMsgBox

很容易发现了一个提示成功和一个提示失败的信息框,并且在成功的信息框旁边就是一个关键跳转。(为什么它是关键跳转?你用OD选中地址00403370 处 je 0040345E,在OD中很清晰地提示了它的跳转流程。)

所以,爆破就很简单了,选中它,右键->Binary->Fill with NOPs。

bubuko.com,布布扣

 

4、注册机的探索

继续向上查看代码,发现代码不是很长,我们尝试从开头大概地梳理下流程:

004030F0   > \55            push ebp
004030F1   .  8BEC          mov ebp,esp
004030F3   .  83EC 0C       sub esp,0xC
004030F6   .  68 56104000   push <jmp.&MSVBVM50.__vbaExceptHandler>  ;  SE handler installation
004030FB   .  64:A1 0000000>mov eax,dword ptr fs:[0]
00403101   .  50            push eax
00403102   .  64:8925 00000>mov dword ptr fs:[0],esp
00403109   .  81EC 04010000 sub esp,0x104
0040310F   .  53            push ebx
00403110   .  56            push esi
00403111   .  57            push edi
00403112   .  8B7D 08       mov edi,dword ptr ss:[ebp+0x8]
00403115   .  8BC7          mov eax,edi
00403117   .  83E7 FE       and edi,0xFFFFFFFE
0040311A   .  8965 F4       mov dword ptr ss:[ebp-0xC],esp
0040311D   .  83E0 01       and eax,0x1
00403120   .  8B1F          mov ebx,dword ptr ds:[edi]
00403122   .  C745 F8 18104>mov dword ptr ss:[ebp-0x8],00401018
00403129   .  57            push edi
0040312A   .  8945 FC       mov dword ptr ss:[ebp-0x4],eax
0040312D   .  897D 08       mov dword ptr ss:[ebp+0x8],edi
00403130   .  FF53 04       call dword ptr ds:[ebx+0x4]
00403133   .  33F6          xor esi,esi
00403135   .  57            push edi
00403136   .  8975 D8       mov dword ptr ss:[ebp-0x28],esi
00403139   .  8975 C8       mov dword ptr ss:[ebp-0x38],esi
0040313C   .  8975 C0       mov dword ptr ss:[ebp-0x40],esi
0040313F   .  8975 BC       mov dword ptr ss:[ebp-0x44],esi
00403142   .  8975 B8       mov dword ptr ss:[ebp-0x48],esi
00403145   .  8975 A8       mov dword ptr ss:[ebp-0x58],esi
00403148   .  8975 98       mov dword ptr ss:[ebp-0x68],esi
0040314B   .  8975 88       mov dword ptr ss:[ebp-0x78],esi
0040314E   .  89B5 78FFFFFF mov dword ptr ss:[ebp-0x88],esi
00403154   .  89B5 68FFFFFF mov dword ptr ss:[ebp-0x98],esi
0040315A   .  89B5 58FFFFFF mov dword ptr ss:[ebp-0xA8],esi
00403160   .  89B5 48FFFFFF mov dword ptr ss:[ebp-0xB8],esi
00403166   .  89B5 38FFFFFF mov dword ptr ss:[ebp-0xC8],esi
0040316C   .  89B5 28FFFFFF mov dword ptr ss:[ebp-0xD8],esi
00403172   .  FF93 04030000 call dword ptr ds:[ebx+0x304]
00403178   .  8D4D B8       lea ecx,dword ptr ss:[ebp-0x48]
0040317B   .  50            push eax
0040317C   .  51            push ecx
0040317D   .  FF15 20614000 call dword ptr ds:[<&MSVBVM50.__vbaObjSe>;  msvbvm50.__vbaObjSet
00403183   .  8BF8          mov edi,eax
00403185   .  8D45 C0       lea eax,dword ptr ss:[ebp-0x40]
00403188   .  50            push eax
00403189   .  57            push edi
0040318A   .  8B17          mov edx,dword ptr ds:[edi]
0040318C   .  FF92 A0000000 call dword ptr ds:[edx+0xA0]
00403192   .  3BC6          cmp eax,esi
00403194   .  7D 12         jge short 004031A8
00403196   .  68 A0000000   push 0xA0
0040319B   .  68 B4274000   push 004027B4
004031A0   .  57            push edi
004031A1   .  50            push eax
004031A2   .  FF15 14614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>;  msvbvm50.__vbaHresultCheckObj
004031A8   >  8B45 C0       mov eax,dword ptr ss:[ebp-0x40]
004031AB   .  8D55 A8       lea edx,dword ptr ss:[ebp-0x58]
004031AE   .  8D4D D8       lea ecx,dword ptr ss:[ebp-0x28]
004031B1   .  8975 C0       mov dword ptr ss:[ebp-0x40],esi
004031B4   .  8945 B0       mov dword ptr ss:[ebp-0x50],eax
004031B7   .  C745 A8 08000>mov dword ptr ss:[ebp-0x58],0x8
004031BE   .  FF15 F8604000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>;  msvbvm50.__vbaVarMove
004031C4   .  8D4D B8       lea ecx,dword ptr ss:[ebp-0x48]
004031C7   .  FF15 B0614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>;  msvbvm50.__vbaFreeObj
004031CD   .  8D4D D8       lea ecx,dword ptr ss:[ebp-0x28]
004031D0   .  8D55 A8       lea edx,dword ptr ss:[ebp-0x58]
004031D3   .  51            push ecx                                 ; /Arg2 = "123123"
004031D4   .  52            push edx                                 ; |Arg1 = "123123"
004031D5   .  BE 01000000   mov esi,0x1                              ; |
004031DA   .  FF15 18614000 call dword ptr ds:[<&MSVBVM50.__vbaLenVa>; \__vbaLenVar
004031E0   .  50            push eax
004031E1   .  FF15 74614000 call dword ptr ds:[<&MSVBVM50.__vbaI2Var>;  msvbvm50.__vbaI2Var
004031E7   .  8985 F8FEFFFF mov dword ptr ss:[ebp-0x108],eax         ;  // eax = 6
004031ED   .  8BFE          mov edi,esi
004031EF   >  66:3BBD F8FEF>cmp di,word ptr ss:[ebp-0x108]           ;  // 循环与6比较
004031F6   .  8B1D 6C614000 mov ebx,dword ptr ds:[<&MSVBVM50.__vbaSt>;  msvbvm50.__vbaStrVarVal
004031FC   .  0F8F 2D010000 jg 0040332F
00403202   .  66:83FE 04    cmp si,0x4
00403206   .  7E 05         jle short 0040320D
00403208   .  BE 01000000   mov esi,0x1
0040320D   >  0FBFCF        movsx ecx,di
00403210   .  8D45 A8       lea eax,dword ptr ss:[ebp-0x58]
00403213   .  8D55 D8       lea edx,dword ptr ss:[ebp-0x28]
00403216   .  50            push eax                                 ;  1
00403217   .  51            push ecx
00403218   .  8D45 98       lea eax,dword ptr ss:[ebp-0x68]
0040321B   .  52            push edx                                 ;  "123123"
0040321C   .  50            push eax
0040321D   .  C745 B0 01000>mov dword ptr ss:[ebp-0x50],0x1
00403224   .  C745 A8 02000>mov dword ptr ss:[ebp-0x58],0x2
0040322B   .  FF15 38614000 call dword ptr ds:[<&MSVBVM50.#632>]     ;  msvbvm50.rtcMidCharVar
00403231   .  B8 02000000   mov eax,0x2
00403236   .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]          ;  "1" "2"...
0040323C   .  0FBFD6        movsx edx,si
0040323F   .  8985 78FFFFFF mov dword ptr ss:[ebp-0x88],eax
00403245   .  8945 88       mov dword ptr ss:[ebp-0x78],eax
00403248   .  51            push ecx
00403249   .  8D45 88       lea eax,dword ptr ss:[ebp-0x78]
0040324C   .  52            push edx
0040324D   .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-0x98]
00403253   .  50            push eax                                 ;  eax = 000007D0 = 2000
00403254   .  51            push ecx
00403255   .  C745 80 01000>mov dword ptr ss:[ebp-0x80],0x1
0040325C   .  C745 90 D0070>mov dword ptr ss:[ebp-0x70],0x7D0
00403263   .  FF15 38614000 call dword ptr ds:[<&MSVBVM50.#632>]     ;  msvbvm50.rtcMidCharVar
00403269   .  8D55 98       lea edx,dword ptr ss:[ebp-0x68]
0040326C   .  8D45 C0       lea eax,dword ptr ss:[ebp-0x40]
0040326F   .  52            push edx
00403270   .  50            push eax
00403271   .  FFD3          call ebx                                 ;  msvbvm50.__vbaStrVarVal
00403273   .  50            push eax                                 ;  "1"
00403274   .  FF15 0C614000 call dword ptr ds:[<&MSVBVM50.#516>]     ;  msvbvm50.rtcAnsiValueBstr
0040327A   .  0FBFD0        movsx edx,ax
0040327D   .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-0x98]
00403283   .  8D45 BC       lea eax,dword ptr ss:[ebp-0x44]
00403286   .  51            push ecx                                 ;  "2" "0" "0" "0"
00403287   .  50            push eax
00403288   .  8995 E8FEFFFF mov dword ptr ss:[ebp-0x118],edx
0040328E   .  FFD3          call ebx                                 ;  msvbvm50.__vbaStrVarVal
00403290   .  50            push eax                                 ;  "2" "0" "0" "0"
00403291   .  FF15 0C614000 call dword ptr ds:[<&MSVBVM50.#516>]     ;  msvbvm50.rtcAnsiValueBstr
00403297   .  8B95 E8FEFFFF mov edx,dword ptr ss:[ebp-0x118]         ;  // edx = 0x31
0040329D   .  0FBFC8        movsx ecx,ax                             ;  // eax = 0x32
004032A0   .  33D1          xor edx,ecx                              ;  // 异或运算
004032A2   .  8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]
004032A8   .  52            push edx                                 ; /Arg2
004032A9   .  50            push eax                                 ; |Arg1
004032AA   .  FF15 64614000 call dword ptr ds:[<&MSVBVM50.#608>]     ; \rtcVarBstrFromAnsi
004032B0   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
004032B3   .  8D95 58FFFFFF lea edx,dword ptr ss:[ebp-0xA8]
004032B9   .  51            push ecx
004032BA   .  8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
004032C0   .  52            push edx
004032C1   .  50            push eax                                 ;  // "OK"
004032C2   .  FF15 70614000 call dword ptr ds:[<&MSVBVM50.__vbaVarCa>;  msvbvm50.__vbaVarCat
004032C8   .  8BD0          mov edx,eax
004032CA   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
004032CD   .  FF15 F8604000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>;  msvbvm50.__vbaVarMove
004032D3   .  8D4D BC       lea ecx,dword ptr ss:[ebp-0x44]
004032D6   .  8D55 C0       lea edx,dword ptr ss:[ebp-0x40]
004032D9   .  51            push ecx
004032DA   .  52            push edx
004032DB   .  6A 02         push 0x2
004032DD   .  FF15 8C614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>;  msvbvm50.__vbaFreeStrList
004032E3   .  83C4 0C       add esp,0xC
004032E6   .  8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]
004032EC   .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-0x98]
004032F2   .  8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]
004032F8   .  50            push eax
004032F9   .  51            push ecx
004032FA   .  8D45 88       lea eax,dword ptr ss:[ebp-0x78]
004032FD   .  52            push edx
004032FE   .  8D4D 98       lea ecx,dword ptr ss:[ebp-0x68]
00403301   .  50            push eax
00403302   .  8D55 A8       lea edx,dword ptr ss:[ebp-0x58]
00403305   .  51            push ecx
00403306   .  52            push edx
00403307   .  6A 06         push 0x6
00403309   .  FF15 00614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeV>;  msvbvm50.__vbaFreeVarList
0040330F   .  83C4 1C       add esp,0x1C
00403312   .  66:46         inc si
00403314   .  B8 01000000   mov eax,0x1
00403319   .  66:03C7       add ax,di
0040331C   .  0F80 44020000 jo 00403566
00403322   .  0F80 3E020000 jo 00403566
00403328   .  8BF8          mov edi,eax
0040332A   .^ E9 C0FEFFFF   jmp 004031EF
0040332F   >  8D45 C8       lea eax,dword ptr ss:[ebp-0x38]
00403332   .  8D8D 38FFFFFF lea ecx,dword ptr ss:[ebp-0xC8]
00403338   .  50            push eax
00403339   .  51            push ecx
0040333A   .  C785 40FFFFFF>mov dword ptr ss:[ebp-0xC0],004027C8     ;  UNICODE "qBQSYdXUe_B\V"
00403344   .  C785 38FFFFFF>mov dword ptr ss:[ebp-0xC8],0x8008
0040334E   .  FF15 44614000 call dword ptr ds:[<&MSVBVM50.__vbaVarTs>;  msvbvm50.__vbaVarTstEq
00403354   .  66:85C0       test ax,ax
00403357   .  B9 04000280   mov ecx,0x80020004
0040335C   .  B8 0A000000   mov eax,0xA
00403361   .  894D 80       mov dword ptr ss:[ebp-0x80],ecx
00403364   .  8985 78FFFFFF mov dword ptr ss:[ebp-0x88],eax
0040336A   .  894D 90       mov dword ptr ss:[ebp-0x70],ecx
0040336D   .  8945 88       mov dword ptr ss:[ebp-0x78],eax
00403370      0F84 E8000000 je 0040345E                              ;  // 关键跳转
00403376   .  8B35 9C614000 mov esi,dword ptr ds:[<&MSVBVM50.__vbaVa>;  msvbvm50.__vbaVarDup
0040337C   .  BF 08000000   mov edi,0x8
00403381   .  8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]
00403387   .  8D4D 98       lea ecx,dword ptr ss:[ebp-0x68]
0040338A   .  C785 30FFFFFF>mov dword ptr ss:[ebp-0xD0],00402824     ;  UNICODE "Valid"
00403394   .  89BD 28FFFFFF mov dword ptr ss:[ebp-0xD8],edi
0040339A   .  FFD6          call esi                                 ;  <&MSVBVM50.__vbaVarDup>
0040339C   .  8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
004033A2   .  8D4D A8       lea ecx,dword ptr ss:[ebp-0x58]
004033A5   .  C785 40FFFFFF>mov dword ptr ss:[ebp-0xC0],004027E8     ;  UNICODE "Password correct, hehe, :-)"
004033AF   .  89BD 38FFFFFF mov dword ptr ss:[ebp-0xC8],edi
004033B5   .  FFD6          call esi

这个整个流程大概就是取文本的中间字符,然后转化为ANSII,然后与另外一个字符异或运算,最终得到一个文本,然后与"qBQSYdXUe_B\V"比较,相等则成功!

具体细节为……好吧,我承认,我跟踪了好几遍也没有弄清楚与输入序列异或的那个字符是怎么来的!

使用VB 反编译工具试试:

Private Sub Command1_Click() ‘4030F0
  Dim var_48 As TextBox
  loc_00403122: var_8 = &H401018
  loc_0040317D: Set var_48 = Me
  loc_0040318C: var_40 = Text1.Text
  loc_004031B4: var_50 = var_40
  loc_004031B7: var_58 = 8
  loc_004031BE: var_28 = var_40
  loc_004031DA: var_58 = Len(var_28)
  loc_004031E7: var_108 = CInt(var_40)
                If 00000001h > 0 Then GoTo loc_0040332F
  loc_0040321D: var_50 = 1
  loc_00403224: var_58 = 2
  loc_0040323F: var_88 = 2
  loc_00403245: var_78 = 2
  loc_00403255: var_80 = 1
  loc_0040325C: var_70 = &H7D0
  loc_00403271: var_40 = CStr(Mid$(var_28, 1, 1))
  loc_00403288: var_118 = Asc(var_40)
  loc_0040328E: var_44 = CStr(Mid$(2000, 1, 1))
  loc_004032AA: var_A8 = Chr(Asc(var_40) xor ecx)
  loc_00403312: si = 00000001h + 1
  loc_00403319: 00000001h = 00000001h + 00000001h
  loc_0040332A: GoTo loc_004031EF
  loc_0040332F: 
  loc_0040333A: var_C0 = "qBQSYdXUe_B\V"
  loc_00403344: var_C8 = &H8008
  loc_0040334E: Var_Ret_1 = (var_38 & &H7D0 = "qBQSYdXUe_B\V")
  loc_00403361: var_80 = 80020004h
  loc_00403364: var_88 = 10
  loc_0040336A: var_70 = 80020004h
  loc_0040336D: var_78 = 10
                If Var_Ret_1 = 0 Then GoTo loc_0040345E
  loc_0040338A: var_D0 = "Valid"
  loc_00403394: var_D8 = 8
  loc_004033A5: var_C0 = "Password correct, hehe, :-)"
  loc_004033AF: var_C8 = 8
  loc_004033CC: MsgBox "Password correct, hehe, :-)", 0, "Valid"
  loc_00403435: Set var_48 = 4210744
  loc_0040343D: call password.GetTypeInfo(var_48, var_88, var_48, 004027B4h, var_78, var_88, var_48, 004027B4h)
  loc_0040345E: 
  loc_00403472: var_D0 = "Invalid"
  loc_0040347C: var_D8 = 8
  loc_0040348D: var_C0 = "Password incorrect, please try again ..."
  loc_00403497: var_C8 = 8
  loc_004034B4: MsgBox "Password incorrect, please try again ...", 0, "Invalid"
  loc_004034D8: var_4 = 0
  loc_004034E4: GoTo loc_00403536
  loc_00403535: Exit Sub
  loc_00403536: 
  loc_00403544: GoTo loc_00esi
  loc_00403546: Exit Sub
End Sub

似乎与2000有些关系,但是VB代码中的流程太坑了,看的很迷糊!

SmartCheck:

bubuko.com,布布扣

哈哈,SmartCheck的流程加上OD中分析到的异或操作,我明白了!原来异或的文本就是2000,按照序号对4取余作为索引获得的ANSII。

大概就是这样:

pKey[i] = pName[i] ^ "2000"[i%4];
pKey == "qBQSYdXUe_B\V"

但是,我们的目的是获得原始文本,所以只好把算法的计算流程反过来还原,CPP如下:

// CrackMeDemo.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <iostream>
/*
pKey[i] = pName[i] ^ "2000"[i%4];
pKey == "qBQSYdXUe_B\V"
*/
int _tmain(int argc, _TCHAR* argv[])
{
	char pkey[] = "qBQSYdXUe_B\\V"; // \会被转义,所以需要这么做
	char pName[15] = {0};
	int nLen = strlen(pkey);
	for (int i=0;i<nLen;i++)
	{
		pName[i] = pkey[i] ^ "2000"[i%4];
	}
	printf("the input is: %s\r\n",pName);
	system("pause");
	return 0;
}

bubuko.com,布布扣

 

 

BY  笨笨D幸福

[反汇编练习] 160个CrackMe之030,布布扣,bubuko.com

[反汇编练习] 160个CrackMe之030

标签:style   blog   http   color   使用   strong   

原文地址:http://www.cnblogs.com/bbdxf/p/3835044.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!