新160个crackme - 042-crackme

运行分析

• 提示需要key.dat文件
  
• 同目录下创建一个key.dat，提示key.dat内容不对

---

PE分析

• C++程序，32位，无壳

---

静态分析&动态调试

• ida搜索字符串，找到关键字符串双击进入关键函数

---

• 对关键函数进行分析，注释如上
• 当满足67行公式时，将会执行下面函数
• 发现89行有个VirtualProtect，即SMC
• SMC（Self-Modifying Code，自修改代码）是一种特殊的代码技术，通过在运行时修改自身代码，使得程序的实际行为与反汇编结果不符。可以通过动态调试绕过

---

• 一共有4个循环计算，其中第二个循环
• 第一个循环：key内容每一位与key长度亦或
• 第二个循环：决定key[3/4]
• 第三个循环：计算byte_405030
• 然后需满足byte_405030 * byte_405031 * byte_405032 != 2788340
• 第四个循环：key中需含有0x20

---

算法分析

byte_405030 = [0x1E, 0xBF, 0xA2, 0x1A, 0xF3, 0x0B, 0xB7, 0x34, 0x4E, 0x4B,
  0x34, 0xC5, 0x0E, 0x38, 0x88, 0x4B, 0x32, 0xC5, 0x06, 0x38,
  0x88, 0x0A, 0x35, 0x43, 0xC0, 0x61, 0x42, 0x8D, 0x76, 0x4C,
  0x45, 0xBF, 0x0B, 0x47, 0xF2, 0x0E, 0x48, 0x3A, 0xC5, 0x06,
  0x38, 0x88, 0x0A, 0x30, 0x52, 0xC0, 0x61, 0x42, 0x8D, 0x76,
  0x4B, 0x1F, 0xBF, 0x0B, 0x47, 0xF2, 0x0E, 0x4D, 0x0A, 0xC5,
  0x06, 0x38, 0x88, 0x0A, 0x33, 0x68, 0xC0, 0x61, 0x42, 0x8D,
  0x76, 0x46, 0x63, 0xBF, 0x0B, 0x47, 0xF2, 0x0E, 0x42, 0x17,
  0xC5, 0x06, 0x38, 0x88, 0x0A, 0x3E, 0x33, 0xC0, 0x61, 0x42,
  0x8D, 0x76, 0x45, 0x6B, 0xBF, 0x0B, 0x47, 0xF2, 0x0E, 0x47,
  0x33, 0xC5, 0x06, 0x38, 0x88, 0x0A, 0x39, 0x1D, 0xC0, 0x61,
  0x42, 0x8D, 0x76, 0x40, 0x6B, 0xBF, 0x0B, 0x47, 0xBE, 0x46,
  0xCB, 0xC5, 0x1A, 0xC0, 0x61, 0x42, 0xC3, 0x3E, 0xC5, 0x0E,
  0x38, 0xC4, 0x03, 0x35, 0xCE, 0xBA, 0x5C, 0xC5, 0x1E, 0x38,
  0xC6, 0x01, 0x35, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x36, 0xCE,
  0xBA, 0x5D, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x36, 0xC5, 0x0E,
  0x38, 0xC4, 0x03, 0x37, 0xCE, 0xBA, 0x53, 0xC5, 0x1E, 0x38,
  0xC6, 0x01, 0x37, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x30, 0xCE,
  0xBA, 0x5B, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x30, 0xC5, 0x0E,
  0x38, 0xC4, 0x03, 0x31, 0xCE, 0xBA, 0x14, 0xC5, 0x1E, 0x38,
  0xC6, 0x01, 0x31, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x32, 0xCE,
  0xBA, 0x6F, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x32, 0xC5, 0x0E,
  0x38, 0xC4, 0x03, 0x33, 0xCE, 0xBA, 0x60, 0xC5, 0x1E, 0x38,
  0xC6, 0x01, 0x33, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x3C, 0xCE,
  0xBA, 0x79, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x3C, 0xC5, 0x0E,
  0x38, 0xC4, 0x03, 0x3D, 0xCE, 0xBA, 0x73, 0xC5, 0x1E, 0x38,
  0xC6, 0x01, 0x3D, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x3E, 0xCE,
  0xBA, 0x69, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x3E, 0xC5, 0x0E,
  0x38, 0xC4, 0x03, 0x3F, 0xCE, 0xBA, 0x60, 0xC5, 0x1E, 0x38,
  0xC6, 0x01, 0x3F, 0xC5, 0x0E, 0x38, 0xC4, 0x03, 0x38, 0xCE,
  0xBA, 0x5C, 0xC5, 0x1E, 0x38, 0xC6, 0x01, 0x38, 0xC5, 0x0E,
  0x38, 0xC4, 0x03, 0x39, 0xCE, 0xBA, 0x5D, 0xC5, 0x1E, 0x38,
  0xC6, 0x01, 0x39, 0x89, 0x0E, 0xC8, 0x4E, 0x4B, 0x34, 0x4E,
  0xC0, 0x71, 0x42, 0x48, 0x71, 0xB2, 0xC0, 0x79, 0x46, 0x48,
  0x79, 0xB2, 0xC1, 0x25, 0xC6, 0x1B, 0x3B, 0xC5, 0x0E, 0xC8,
  0xCD, 0x8B, 0x35, 0xC7, 0x0E, 0xC8, 0xC5, 0x06, 0x3C, 0x4D,
  0x06, 0xC8, 0x41, 0xF5, 0x25, 0xCB, 0x99, 0x41, 0x97, 0xC0,
  0x71, 0x42, 0x48, 0x71, 0xB2, 0x8D, 0x74, 0x41, 0x4B, 0xBF,
  0xAB, 0x16, 0xF7, 0xFF]
v8 = [0] * len(byte_405030)

# 假设key为4位，其中最后一位为'0'
for key_0 in range(32,128):
    for key_1 in range(32,128):
        for key_2 in range(32,128):
            for length in range(4,5):
                key = [key_0,key_1,key_2]
                res = [key_0,key_1,key_2,0]

                # 第一个循环
                for i in range(0,3):
                    key[i] ^= length
                key[0] ^= 0x54
                key[1] ^= 0x4d
                key[2] ^= 0x47

                # 第三个循环
                for i in range(0,3):
                    v8[i] = byte_405030[i] ^ key[i]

                if v8[0] * v8[1] * v8[2] == 2788340:
                    res[3] = 0x20 ^ key[0] ^ length
                    print("".join([chr(i)for i in res]))

• 假设key为4位，进行算法爆破，得到2个结果
  
• 修改key.dat内容，双击程序运行，发现未弹出界面，是因为VirtualProtect导致的，后续分析难度过大，以后再分析