西南石油大学第三届信息安全大赛-破解1-easy
打开：http://archer.swpuwllm.com/crkme/
下载crackme
文件下载地址：http://pan.baidu.com/share/link?shareid=109567&uk=1879521068
注意：要求以caidao为用户名caidao
查壳：TASM / MASM / FASM - assembler language
运行程序，看看大致的情况。
OD载入
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL 00401002 |. E8 B5030000 call <jmp.&kernel32.GetModuleHandleA> ; \GetModuleHandleA 00401007 |. A3 00304000 mov dword ptr [0x403000], eax 0040100C |. E8 A5030000 call <jmp.&kernel32.GetCommandLineA> ; [GetCommandLineA 00401011 |. A3 04304000 mov dword ptr [0x403004], eax 00401016 |. 6A 0A push 0xA 00401018 |. FF35 04304000 push dword ptr [0x403004] 0040101E |. 6A 00 push 0x0 00401020 |. FF35 00304000 push dword ptr [0x403000] 00401026 |. E8 F0000000 call 0040111B 0040102B |. 50 push eax ; /ExitCode 0040102C \. E8 7F030000 call <jmp.&kernel32.ExitProcess> ; \ExitProcess
往下找，可以看到
004011E1 /$ 55 push ebp 004011E2 |. 8BEC mov ebp, esp 004011E4 |. 81C4 F8FEFFFF add esp, -0x108 004011EA |. 60 pushad 004011EB |. A1 08304000 mov eax, dword ptr [0x403008] 004011F0 |. 8985 FCFEFFFF mov dword ptr [ebp-0x104], eax 004011F6 |. 68 F2030000 push 0x3F2 ; /ControlID = 3F2 (1010.) 004011FB |. FFB5 FCFEFFFF push dword ptr [ebp-0x104] ; |hWnd 00401201 |. E8 62010000 call <jmp.&user32.GetDlgItem> ; \GetDlgItem 00401206 |. 50 push eax ; /hWnd 00401207 |. E8 6E010000 call <jmp.&user32.GetWindowTextLengthA> ; \GetWindowTextLengthA 0040120C |. 83F8 0A cmp eax, 0xA 0040120F |. 0F87 AD000000 ja 004012C2 00401215 |. 68 F3030000 push 0x3F3 ; /ControlID = 3F3 (1011.) 0040121A |. FFB5 FCFEFFFF push dword ptr [ebp-0x104] ; |hWnd 00401220 |. E8 43010000 call <jmp.&user32.GetDlgItem> ; \GetDlgItem 00401225 |. 50 push eax ; /hWnd 00401226 |. E8 4F010000 call <jmp.&user32.GetWindowTextLengthA> ; \GetWindowTextLengthA 0040122B |. 83F8 0A cmp eax, 0xA 0040122E |. 77 77 ja short 004012A7 00401230 |. A1 08304000 mov eax, dword ptr [0x403008] 00401235 |. 8985 FCFEFFFF mov dword ptr [ebp-0x104], eax 0040123B |. 8D15 0C304000 lea edx, dword ptr [0x40300C] 00401241 |. 6A 0A push 0xA ; /Count = A (10.) 00401243 |. 52 push edx ; |Buffer => CrackMe.0040300C 00401244 |. 68 F2030000 push 0x3F2 ; |ControlID = 3F2 (1010.) 00401249 |. FFB5 FCFEFFFF push dword ptr [ebp-0x104] ; |hWnd 0040124F |. E8 1A010000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA 00401254 |. 8D05 0C304000 lea eax, dword ptr [0x40300C] 0040125A |. 50 push eax 0040125B |. E8 2DFEFFFF call 0040108D 00401260 |. 8D15 0C304000 lea edx, dword ptr [0x40300C] 00401266 |. 6A 0A push 0xA ; /Count = A (10.) 00401268 |. 52 push edx ; |Buffer => CrackMe.0040300C 00401269 |. 68 F3030000 push 0x3F3 ; |ControlID = 3F3 (1011.) 0040126E |. FFB5 FCFEFFFF push dword ptr [ebp-0x104] ; |hWnd 00401274 |. E8 F5000000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA 00401279 |. 68 20304000 push 00403020 ; /String2 = "" 0040127E |. 68 0C304000 push 0040300C ; |String1 = "" 00401283 |. E8 3A010000 call <jmp.&kernel32.lstrcmpA> ; \lstrcmpA 00401288 |. 85C0 test eax, eax 0040128A |. 75 1B jnz short 004012A7 0040128C |. 6A 40 push 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL 0040128E |. FF35 A1204000 push dword ptr [0x4020A1] ; |Title = "成?,A6,"" 00401294 |. FF35 A5204000 push dword ptr [0x4020A5] ; |Text = ""D7,"",A2,"",B2,"岢晒",A6,"?,A1,"" 0040129A |. FFB5 FCFEFFFF push dword ptr [ebp-0x104] ; |hOwner 004012A0 |. E8 E7000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA 004012A5 |. EB 36 jmp short 004012DD 004012A7 |> 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL 004012A9 |. FF35 99204000 push dword ptr [0x402099] ; |Title = "失",B0,"? 004012AF |. FF35 9D204000 push dword ptr [0x40209D] ; |Text = ""D7,"",A2,"",B2,"崾?,B0,"埽",A1,"" 004012B5 |. FFB5 FCFEFFFF push dword ptr [ebp-0x104] ; |hOwner 004012BB |. E8 CC000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA 004012C0 |. EB 1B jmp short 004012DD 004012C2 |> 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL 004012C4 |. FF35 99204000 push dword ptr [0x402099] ; |Title = "失",B0,"? 004012CA |. FF35 A9204000 push dword ptr [0x4020A9] ; |Text = "用",BB,"",AB,"?,A4,"?,A1,"" 004012D0 |. FFB5 FCFEFFFF push dword ptr [ebp-0x104] ; |hOwner 004012D6 |. E8 B1000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA 004012DB |. EB 00 jmp short 004012DD 004012DD |> 61 popad 004012DE |. C9 leave 004012DF \. C3 retn
也就是说，我们可以用bp MessageBoxA下断，也可以用bp GetDlgItemTextA下断。
找到比较部分
key就找到了，输入即可。
算法部分：
0040108D /$ 55 push ebp 0040108E |. 8BEC mov ebp, esp 00401090 |. 83C4 F4 add esp, -0xC 00401093 |. 8B45 08 mov eax, dword ptr [ebp+0x8] 00401096 |. 50 push eax ; /String 00401097 |. E8 2C030000 call <jmp.&kernel32.lstrlenA> ; \lstrlenA 0040109C |. 48 dec eax 0040109D |. 8945 FC mov dword ptr [ebp-0x4], eax 004010A0 |. 8B75 08 mov esi, dword ptr [ebp+0x8] 004010A3 |. 8D3D 20304000 lea edi, dword ptr [0x403020] 004010A9 |. 33DB xor ebx, ebx 004010AB |. 895D F8 mov dword ptr [ebp-0x8], ebx 004010AE |. EB 4B jmp short 004010FB 004010B0 |> 33C0 /xor eax, eax 004010B2 |. 8A0433 |mov al, byte ptr [ebx+esi] 004010B5 |. C1F8 04 |sar eax, 0x4 004010B8 |. 8845 F7 |mov byte ptr [ebp-0x9], al 004010BB |. 33D2 |xor edx, edx 004010BD |. 8B45 F8 |mov eax, dword ptr [ebp-0x8] 004010C0 |. B9 02000000 |mov ecx, 0x2 004010C5 |. F7F1 |div ecx 004010C7 |. 33C0 |xor eax, eax 004010C9 |. 33C9 |xor ecx, ecx 004010CB |. 83FA 01 |cmp edx, 0x1 004010CE |. 74 0F |je short 004010DF 004010D0 |. 8A4433 01 |mov al, byte ptr [ebx+esi+0x1] 004010D4 |. C1E0 1C |shl eax, 0x1C 004010D7 |. C1E8 1C |shr eax, 0x1C 004010DA |. 83C0 41 |add eax, 0x41 004010DD |. EB 0D |jmp short 004010EC 004010DF |> 8A4433 FF |mov al, byte ptr [ebx+esi-0x1] 004010E3 |. C1E0 1C |shl eax, 0x1C 004010E6 |. C1E8 1C |shr eax, 0x1C 004010E9 |. 83C0 61 |add eax, 0x61 004010EC |> 8A4D F7 |mov cl, byte ptr [ebp-0x9] 004010EF |. 03C1 |add eax, ecx 004010F1 |. 88043B |mov byte ptr [ebx+edi], al 004010F4 |. 8B5D F8 |mov ebx, dword ptr [ebp-0x8] 004010F7 |. 43 |inc ebx 004010F8 |. 895D F8 |mov dword ptr [ebp-0x8], ebx 004010FB |> 8B45 FC mov eax, dword ptr [ebp-0x4] 004010FE |. 3BD8 |cmp ebx, eax 00401100 |.^ 7C AE \jl short 004010B0 00401102 |. 8A0433 mov al, byte ptr [ebx+esi] 00401105 |. C1E0 1C shl eax, 0x1C 00401108 |. C1F8 1C sar eax, 0x1C 0040110B |. 83C0 31 add eax, 0x31 0040110E |. 88043B mov byte ptr [ebx+edi], al 00401111 |. 33C0 xor eax, eax 00401113 |. 43 inc ebx 00401114 |. 88043B mov byte ptr [ebx+edi], al 00401117 |. C9 leave 00401118 \. C2 0400 retn 0x4
有时间可以写一个注册机。
或者也可以用IDA的F5看下算法。
int __stdcall sub_40108D(LPCSTR lpString)
{
int v1; // ebx@1
char v2; // al@3
int v3; // eax@6
int result; // eax@7
unsigned int i; // [sp+4h] [bp-8h]@1
int v6; // [sp+8h] [bp-4h]@1
v6 = lstrlenA(lpString) - 1;
v1 = 0;
for ( i = 0; ; ++i )
{
v3 = v6;
if ( v1 >= v6 )
break;
if ( i % 2 == 1 )
v2 = (lpString[v1 - 1] & 0xF) + 97;
else
v2 = (lpString[v1 + 1] & 0xF) + 65;
String2[v1] = ((signed int)(unsigned __int8)lpString[v1] >> 4) + v2;
v1 = i + 1;
}
LOBYTE(v3) = lpString[v1];
String2[v1] = (v3 << 28 >> 28) + 49;
result = 0;
String2[v1 + 1] = 0;
return result;
}