西南石油大学第三届信息安全大赛-破解1-easy

最新推荐文章于 2023-10-23 18:54:31 发布

tk86935367

最新推荐文章于 2023-10-23 18:54:31 发布

阅读量3k

点赞数

分类专栏：逆向分析网络攻防、信息安全比赛

本文链接：https://blog.csdn.net/tk86935367/article/details/8174698

版权

逆向分析同时被 2 个专栏收录

7 篇文章 0 订阅

订阅专栏

网络攻防、信息安全比赛

6 篇文章 0 订阅

订阅专栏

打开：http://archer.swpuwllm.com/crkme/

下载crackme

文件下载地址：http://pan.baidu.com/share/link?shareid=109567&uk=1879521068

注意：要求以caidao为用户名caidao

查壳：TASM / MASM / FASM - assembler language

运行程序，看看大致的情况。

OD载入

00401000 >/$  6A 00         push    0x0                                  ; /pModule = NULL
00401002  |.  E8 B5030000   call    <jmp.&kernel32.GetModuleHandleA>     ; \GetModuleHandleA
00401007  |.  A3 00304000   mov     dword ptr [0x403000], eax
0040100C  |.  E8 A5030000   call    <jmp.&kernel32.GetCommandLineA>      ; [GetCommandLineA
00401011  |.  A3 04304000   mov     dword ptr [0x403004], eax
00401016  |.  6A 0A         push    0xA
00401018  |.  FF35 04304000 push    dword ptr [0x403004]
0040101E  |.  6A 00         push    0x0
00401020  |.  FF35 00304000 push    dword ptr [0x403000]
00401026  |.  E8 F0000000   call    0040111B
0040102B  |.  50            push    eax                                  ; /ExitCode
0040102C  \.  E8 7F030000   call    <jmp.&kernel32.ExitProcess>          ; \ExitProcess

往下找，可以看到

004011E1  /$  55            push    ebp
004011E2  |.  8BEC          mov     ebp, esp
004011E4  |.  81C4 F8FEFFFF add     esp, -0x108
004011EA  |.  60            pushad
004011EB  |.  A1 08304000   mov     eax, dword ptr [0x403008]
004011F0  |.  8985 FCFEFFFF mov     dword ptr [ebp-0x104], eax
004011F6  |.  68 F2030000   push    0x3F2                                ; /ControlID = 3F2 (1010.)
004011FB  |.  FFB5 FCFEFFFF push    dword ptr [ebp-0x104]                ; |hWnd
00401201  |.  E8 62010000   call    <jmp.&user32.GetDlgItem>             ; \GetDlgItem
00401206  |.  50            push    eax                                  ; /hWnd
00401207  |.  E8 6E010000   call    <jmp.&user32.GetWindowTextLengthA>   ; \GetWindowTextLengthA
0040120C  |.  83F8 0A       cmp     eax, 0xA
0040120F  |.  0F87 AD000000 ja      004012C2
00401215  |.  68 F3030000   push    0x3F3                                ; /ControlID = 3F3 (1011.)
0040121A  |.  FFB5 FCFEFFFF push    dword ptr [ebp-0x104]                ; |hWnd
00401220  |.  E8 43010000   call    <jmp.&user32.GetDlgItem>             ; \GetDlgItem
00401225  |.  50            push    eax                                  ; /hWnd
00401226  |.  E8 4F010000   call    <jmp.&user32.GetWindowTextLengthA>   ; \GetWindowTextLengthA
0040122B  |.  83F8 0A       cmp     eax, 0xA
0040122E  |.  77 77         ja      short 004012A7
00401230  |.  A1 08304000   mov     eax, dword ptr [0x403008]
00401235  |.  8985 FCFEFFFF mov     dword ptr [ebp-0x104], eax
0040123B  |.  8D15 0C304000 lea     edx, dword ptr [0x40300C]
00401241  |.  6A 0A         push    0xA                                  ; /Count = A (10.)
00401243  |.  52            push    edx                                  ; |Buffer => CrackMe.0040300C
00401244  |.  68 F2030000   push    0x3F2                                ; |ControlID = 3F2 (1010.)
00401249  |.  FFB5 FCFEFFFF push    dword ptr [ebp-0x104]                ; |hWnd
0040124F  |.  E8 1A010000   call    <jmp.&user32.GetDlgItemTextA>        ; \GetDlgItemTextA
00401254  |.  8D05 0C304000 lea     eax, dword ptr [0x40300C]
0040125A  |.  50            push    eax
0040125B  |.  E8 2DFEFFFF   call    0040108D
00401260  |.  8D15 0C304000 lea     edx, dword ptr [0x40300C]
00401266  |.  6A 0A         push    0xA                                  ; /Count = A (10.)
00401268  |.  52            push    edx                                  ; |Buffer => CrackMe.0040300C
00401269  |.  68 F3030000   push    0x3F3                                ; |ControlID = 3F3 (1011.)
0040126E  |.  FFB5 FCFEFFFF push    dword ptr [ebp-0x104]                ; |hWnd
00401274  |.  E8 F5000000   call    <jmp.&user32.GetDlgItemTextA>        ; \GetDlgItemTextA
00401279  |.  68 20304000   push    00403020                             ; /String2 = ""
0040127E  |.  68 0C304000   push    0040300C                             ; |String1 = ""
00401283  |.  E8 3A010000   call    <jmp.&kernel32.lstrcmpA>             ; \lstrcmpA
00401288  |.  85C0          test    eax, eax
0040128A  |.  75 1B         jnz     short 004012A7
0040128C  |.  6A 40         push    0x40                                 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0040128E  |.  FF35 A1204000 push    dword ptr [0x4020A1]                 ; |Title = "成?,A6,""
00401294  |.  FF35 A5204000 push    dword ptr [0x4020A5]                 ; |Text = ""D7,"",A2,"",B2,"岢晒",A6,"?,A1,""
0040129A  |.  FFB5 FCFEFFFF push    dword ptr [ebp-0x104]                ; |hOwner
004012A0  |.  E8 E7000000   call    <jmp.&user32.MessageBoxA>            ; \MessageBoxA
004012A5  |.  EB 36         jmp     short 004012DD
004012A7  |>  6A 10         push    0x10                                 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
004012A9  |.  FF35 99204000 push    dword ptr [0x402099]                 ; |Title = "失",B0,"?
004012AF  |.  FF35 9D204000 push    dword ptr [0x40209D]                 ; |Text = ""D7,"",A2,"",B2,"崾?,B0,"埽",A1,""
004012B5  |.  FFB5 FCFEFFFF push    dword ptr [ebp-0x104]                ; |hOwner
004012BB  |.  E8 CC000000   call    <jmp.&user32.MessageBoxA>            ; \MessageBoxA
004012C0  |.  EB 1B         jmp     short 004012DD
004012C2  |>  6A 10         push    0x10                                 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
004012C4  |.  FF35 99204000 push    dword ptr [0x402099]                 ; |Title = "失",B0,"?
004012CA  |.  FF35 A9204000 push    dword ptr [0x4020A9]                 ; |Text = "用",BB,"",AB,"?,A4,"?,A1,""
004012D0  |.  FFB5 FCFEFFFF push    dword ptr [ebp-0x104]                ; |hOwner
004012D6  |.  E8 B1000000   call    <jmp.&user32.MessageBoxA>            ; \MessageBoxA
004012DB  |.  EB 00         jmp     short 004012DD
004012DD  |>  61            popad
004012DE  |.  C9            leave
004012DF  \.  C3            retn

也就是说，我们可以用bp MessageBoxA下断，也可以用bp GetDlgItemTextA下断。

找到比较部分

key就找到了，输入即可。

算法部分：

0040108D  /$  55            push    ebp
0040108E  |.  8BEC          mov     ebp, esp
00401090  |.  83C4 F4       add     esp, -0xC
00401093  |.  8B45 08       mov     eax, dword ptr [ebp+0x8]
00401096  |.  50            push    eax                                  ; /String
00401097  |.  E8 2C030000   call    <jmp.&kernel32.lstrlenA>             ; \lstrlenA
0040109C  |.  48            dec     eax
0040109D  |.  8945 FC       mov     dword ptr [ebp-0x4], eax
004010A0  |.  8B75 08       mov     esi, dword ptr [ebp+0x8]
004010A3  |.  8D3D 20304000 lea     edi, dword ptr [0x403020]
004010A9  |.  33DB          xor     ebx, ebx
004010AB  |.  895D F8       mov     dword ptr [ebp-0x8], ebx
004010AE  |.  EB 4B         jmp     short 004010FB
004010B0  |>  33C0          /xor     eax, eax
004010B2  |.  8A0433        |mov     al, byte ptr [ebx+esi]
004010B5  |.  C1F8 04       |sar     eax, 0x4
004010B8  |.  8845 F7       |mov     byte ptr [ebp-0x9], al
004010BB  |.  33D2          |xor     edx, edx
004010BD  |.  8B45 F8       |mov     eax, dword ptr [ebp-0x8]
004010C0  |.  B9 02000000   |mov     ecx, 0x2
004010C5  |.  F7F1          |div     ecx
004010C7  |.  33C0          |xor     eax, eax
004010C9  |.  33C9          |xor     ecx, ecx
004010CB  |.  83FA 01       |cmp     edx, 0x1
004010CE  |.  74 0F         |je      short 004010DF
004010D0  |.  8A4433 01     |mov     al, byte ptr [ebx+esi+0x1]
004010D4  |.  C1E0 1C       |shl     eax, 0x1C
004010D7  |.  C1E8 1C       |shr     eax, 0x1C
004010DA  |.  83C0 41       |add     eax, 0x41
004010DD  |.  EB 0D         |jmp     short 004010EC
004010DF  |>  8A4433 FF     |mov     al, byte ptr [ebx+esi-0x1]
004010E3  |.  C1E0 1C       |shl     eax, 0x1C
004010E6  |.  C1E8 1C       |shr     eax, 0x1C
004010E9  |.  83C0 61       |add     eax, 0x61
004010EC  |>  8A4D F7       |mov     cl, byte ptr [ebp-0x9]
004010EF  |.  03C1          |add     eax, ecx
004010F1  |.  88043B        |mov     byte ptr [ebx+edi], al
004010F4  |.  8B5D F8       |mov     ebx, dword ptr [ebp-0x8]
004010F7  |.  43            |inc     ebx
004010F8  |.  895D F8       |mov     dword ptr [ebp-0x8], ebx
004010FB  |>  8B45 FC        mov     eax, dword ptr [ebp-0x4]
004010FE  |.  3BD8          |cmp     ebx, eax
00401100  |.^ 7C AE         \jl      short 004010B0
00401102  |.  8A0433        mov     al, byte ptr [ebx+esi]
00401105  |.  C1E0 1C       shl     eax, 0x1C
00401108  |.  C1F8 1C       sar     eax, 0x1C
0040110B  |.  83C0 31       add     eax, 0x31
0040110E  |.  88043B        mov     byte ptr [ebx+edi], al
00401111  |.  33C0          xor     eax, eax
00401113  |.  43            inc     ebx
00401114  |.  88043B        mov     byte ptr [ebx+edi], al
00401117  |.  C9            leave
00401118  \.  C2 0400       retn    0x4

有时间可以写一个注册机。

或者也可以用IDA的F5看下算法。

int __stdcall sub_40108D(LPCSTR lpString)
{
  int v1; // ebx@1
  char v2; // al@3
  int v3; // eax@6
  int result; // eax@7
  unsigned int i; // [sp+4h] [bp-8h]@1
  int v6; // [sp+8h] [bp-4h]@1

  v6 = lstrlenA(lpString) - 1;
  v1 = 0;
  for ( i = 0; ; ++i )
  {
    v3 = v6;
    if ( v1 >= v6 )
      break;
    if ( i % 2 == 1 )
      v2 = (lpString[v1 - 1] & 0xF) + 97;
    else
      v2 = (lpString[v1 + 1] & 0xF) + 65;
    String2[v1] = ((signed int)(unsigned __int8)lpString[v1] >> 4) + v2;
    v1 = i + 1;
  }
  LOBYTE(v3) = lpString[v1];
  String2[v1] = (v3 << 28 >> 28) + 49;
  result = 0;
  String2[v1 + 1] = 0;
  return result;
}

tk86935367

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
西南石油大学第三届信息安全大赛-破解1-easy

打开：http://archer.swpuwllm.com/crkme/下载crackme文件下载地址：http://pan.baidu.com/share/link?shareid=109567&uk=1879521068注意：要求以caidao为用户名caidao查壳：TASM / MASM / FASM - assembler language运行程序，看看大致的
复制链接

扫一扫

专栏目录