前言
每篇文章前都是吐槽自己懒,哈哈哈,真懒
正文
脱壳
这个软件开始有了壳,不过脱壳不难,直接ESP定律可以找到入口点。
接着上LoadPE,找到相应进程,右键,修正镜像大小,再右键,完整转存
再用ImportREC进行修复,找到相应进程,修改OEP地址,点击自动搜索,点击获取输入表,,得到输入表的有关信息,
再点击修复转存文件,找到我们刚才用LoadPE转存的文件。
至此,脱壳完成
暴力破解
先用DelphiDecompiler分析一下,可以找到按钮事件地址
再用OD打开,直接定位到按钮事件处,省去大把找事件的时间,
经过调试,找到关键跳转,(源程序是jne,我改成了je,我蒙一个数蒙对的几率还是很小的,nop掉也可以,反正不能让他跳转就对了),这样可以看到,显示出了奖杯
分析算法
0044A323 |. 52 push edx
0044A324 |. 50 push eax
0044A325 |. 8BC6 mov eax,esi
0044A327 |. 99 cdq
0044A328 |. 030424 add eax,dword ptr ss:[esp] ; 输入字符串自加(以十进制形式)
0044A32B |. 135424 04 adc edx,dword ptr ss:[esp+0x4]
0044A32F |. 83C4 08 add esp,0x8
0044A332 |. 52 push edx
0044A333 |. 50 push eax
0044A334 |. 8BC6 mov eax,esi
0044A336 |. 99 cdq
0044A337 |. 030424 add eax,dword ptr ss:[esp] ; 上面计算结果再加输入字符串,至此一共加了三次
0044A33A |. 135424 04 adc edx,dword ptr ss:[esp+0x4]
0044A33E |. 83C4 08 add esp,0x8
0044A341 |. 52 push edx
0044A342 |. 50 push eax
0044A343 |. 8D55 F8 lea edx,[local.2]
0044A346 |. B8 06000000 mov eax,0x6
0044A34B |. E8 78D6FBFF call dumped_.004079C8
0044A350 |. 8B55 F8 mov edx,[local.2] ; 将上面计算结果转化为16进制字符串
0044A353 |. 8B83 CC020000 mov eax,dword ptr ds:[ebx+0x2CC]
0044A359 |. E8 DEA0FDFF call dumped_.0042443C
0044A35E |. 8D55 F4 lea edx,[local.3]
0044A361 |. 8B83 CC020000 mov eax,dword ptr ds:[ebx+0x2CC]
0044A367 |. E8 A0A0FDFF call dumped_.0042440C
0044A36C |. 8B45 F4 mov eax,[local.3]
0044A36F |. 50 push eax
0044A370 |. 8D55 F0 lea edx,[local.4]
0044A373 |. 8B83 F0020000 mov eax,dword ptr ds:[ebx+0x2F0]
0044A379 |. E8 8EA0FDFF call dumped_.0042440C
0044A37E |. 8B55 F0 mov edx,[local.4] ; edx储存有待比较数字
0044A381 |. 58 pop eax ; dumped_.004409A8
0044A382 |. E8 6198FBFF call dumped_.00403BE8
0044A387 74 0F je short dumped_.0044A398 ; 关键跳转
0044A389 |. B2 01 mov dl,0x1
0044A38B |. 8B83 FC020000 mov eax,dword ptr ds:[ebx+0x2FC]
0044A391 |. E8 669FFDFF call dumped_.004242FC
0044A396 |. EB 11 jmp short dumped_.0044A3A9
0044A398 |> 8B83 D4020000 mov eax,dword ptr ds:[ebx+0x2D4]
0044A39E |. 8B50 34 mov edx,dword ptr ds:[eax+0x34]
0044A3A1 |. 83EA 0A sub edx,0xA
0044A3A4 |. E8 4398FDFF call dumped_.00423BEC
0044A3A9 |> 8B83 D4020000 mov eax,dword ptr ds:[ebx+0x2D4]
0044A3AF |. 8378 34 32 cmp dword ptr ds:[eax+0x34],0x32
0044A3B3 |. 7D 07 jge short dumped_.0044A3BC
0044A3B5 |. 8BC3 mov eax,ebx
0044A3B7 |. E8 302EFFFF call dumped_.0043D1EC
0044A3BC |> 33C0 xor eax,eax
0044A3BE |. 5A pop edx ; dumped_.004409A8
0044A3BF |. 59 pop ecx ; dumped_.004409A8
0044A3C0 |. 59 pop ecx ; dumped_.004409A8
0044A3C1 |. 64:8910 mov dword ptr fs:[eax],edx
0044A3C4 |. 68 EBA34400 push dumped_.0044A3EB
0044A3C9 |> 8D45 F0 lea eax,[local.4]
0044A3CC |. BA 02000000 mov edx,0x2
0044A3D1 |. E8 AA94FBFF call dumped_.00403880
0044A3D6 |. 8D45 F8 lea eax,[local.2]
0044A3D9 |. BA 02000000 mov edx,0x2
0044A3DE |. E8 9D94FBFF call dumped_.00403880
0044A3E3 \. C3 retn
简单的逻辑,将输入的10进制字符串转化成10进制数,再乘以3,再转化为16进制字符串,与给出的字符串相比较,相等即出奖杯。
所以我们将‘3E74984B’转化成10进制,再除以3即可。
成功!