好友 阅读权限 20
听众 最后登录 1970-1-1
本帖最后由 buddama 于 2017-4-24 14:54 编辑 破解 之旅。
[Asm] 纯文本查看 复制代码
004012D7 . /EB 04 jmp short 160-24-C.004012DD
004012D9 |54 push esp
004012DA |45 inc ebp
004012DB |58 pop eax ; kernel32.766DEF8C
004012DC |00AD 33D84975 add byte ptr ss:[ebp+0x7549D833],ch
004012E2 ? FA cli
004012E3 . 81FB FBCFFCAF cmp ebx,0xAFFCCFFB
004012E9 ^ 74 EE je short 160-24-C.004012D9 ; je short 004012D9->JNE
004012EB 68 59304000 push 160-24-C.00403059 ; /Your serial is not valid.
004012F0 . FF35 5C314000 push dword ptr ds:[0x40315C] ; |hWnd = NULL
004012F6 . E8 7D010000 call <jmp.&USER32.SetWindowTextA> ; \SetWindowTextA
004012FB . 33C0 xor eax,eax ; kernel32.BaseThreadInitThunk
004012FD . C9 leave
004012FE . C2 1000 retn 0x10
00401301 . 68 73 30 40 0>ascii "hs0@",0 ; YES! You found your serial!!
00401306 . FF35 5C314000 push dword ptr ds:[0x40315C] ; |hWnd = NULL
0040130C . E8 67010000 call <jmp.&USER32.SetWindowTextA> ; \SetWindowTextA
00401311 . 33C0 xor eax,eax ; kernel32.BaseThreadInitThunk
00401313 . C9 leave
00401314 . C2 1000 retn 0x10 [Asm] 纯文本查看 复制代码
00401255 > \3B05 58314000 cmp eax,dword ptr ds:[0x403158]
0040125B . 74 0C je short 160-24-C.00401269
0040125D . 3B05 54314000 cmp eax,dword ptr ds:[0x403154]
00401263 . 0F85 AE000000 jnz 160-24-C.00401317
00401269 C705 D9124000>mov dword ptr ds:[0x4012D9],0x584554 ; vengers
00401273 . 6A 00 push 0x0 ; /IsSigned = FALSE
00401275 . 8D45 FC lea eax,dword ptr ss:[ebp-0x4] ; |0
00401278 . 50 push eax ; |pSuccess = kernel32.BaseThreadInitThunk
00401279 . 6A 64 push 0x64 ; |ControlID = 64 (100.)
0040127B . FF35 50314000 push dword ptr ds:[0x403150] ; |hWnd = NULL
00401281 . E8 BC010000 call <jmp.&USER32.GetDlgItemInt> ; \GetDlgItemInt
00401286 . 837D FC 00 cmp dword ptr ss:[ebp-0x4],0x0
0040128A . 74 5F je short 160-24-C.004012EB
0040128C . 50 push eax ; kernel32.BaseThreadInitThunk
0040128D . 6A 14 push 0x14 ; /用户名最长不得超过(20.)
0040128F . 68 6C314000 push 160-24-C.0040316C ; |用户名
00401294 . FF35 54314000 push dword ptr ds:[0x403154] ; |hWnd = NULL
0040129A . E8 AF010000 call <jmp.&USER32.GetWindowTextA> ; \GetWindowTextA
0040129F . 85C0 test eax,eax ; 判断name不为空
004012A1 . 74 48 je short 160-24-C.004012EB
004012A3 . A1 0B304000 mov eax,dword ptr ds:[0x40300B] ; CTEX
004012A8 . BB 6C314000 mov ebx,160-24-C.0040316C ; 输入的name
004012AD > 0303 add eax,dword ptr ds:[ebx]
004012AF . 43 inc ebx
004012B0 . 81FB 7C314000 cmp ebx,160-24-C.0040317C
004012B6 .^ 75 F5 jnz short 160-24-C.004012AD ; 这是一轮累加，CTEX开始，依次取用户名四位加和，会溢出。eax中为后八位。 [Asm] 纯文本查看 复制代码
004012B8 . 5B pop ebx ; 取序列号来检测，随输随检，此时界面都还没显示；EBX=1
004012B9 . 03C3 add eax,ebx ; 160-24-C.0040317C
004012BB 3105 D9124000 xor dword ptr ds:[0x4012D9],eax ;
004012C1 . C1E8 10 shr eax,0x10
004012C4 66:2905 D9124>sub word ptr ds:[0x4012D9],ax ; [Perl] 纯文本查看 复制代码
#!/usr/bin/perl
$name="abcdefgh";
#程序对serial随输随检，这里只用serial的第一位；
$serial="1";
$len=length($name);
@rev =$name=~/\w{1}/g;
$rev= join "",reverse(@rev);
$sum=hex(58455443);#"CTEX";
for($i=1;$i<5;$i++){
$out=substr($rev,0,$i);
$out=hex(str2hex($out));
$sum += $out;
}
for($i=1;$i<$len-3;$i++){
$out=substr($rev,$i,4);
$out=hex(str2hex($out));
$sum += $out;
}
print hex($sum),"\n";#报错，这个数会溢出，因此只取后八位。
#取后八位；
$mod=&de_overflow_dec($sum);
$mod += hex($serial);
sub de_overflow_dec(){
$dec = shift;
# print "$dec will be de_overflowed...\n";
$dec %= 4294967296;#0x100000000;
return $dec;
}
sub str2hex{
my $s = shift;
my $str;
for (0..length($s)-1) {
$str .= sprintf "%0x", ord substr($s, $_, 1);
}
return $str;
}
sub dec2hex(){
$dec=shift;
$hex=sprintf "%0x",$dec;
return $hex;
} [Asm] 纯文本查看 复制代码
004012CB . BE EC114000 mov esi,160-24-C.004011EC ; 字串的位置，共62个dword
004012D0 . B9 3E000000 mov ecx,0x3E
004012D5 . 33DB xor ebx,ebx
004012D7 . EB 04 jmp short 160-24-C.004012DD
004012D9 14 07 adc al,0x7
004012DB 18F0 sbb al,dh
004012DD AD lods dword ptr ds:[esi]
004012DE 33D8 xor ebx,eax
004012E0 49 dec ecx
004012E1 ^ 75 FA jnz short 160-24-C.004012DD
004012E3 . 81FB FBCFFCAF cmp ebx,0xAFFCCFFB
004012E9 ^ 74 EE je short 160-24-C.004012D9 ; 疑似的关键跳转。 [Perl] 纯文本查看 复制代码
#!/usr/bin/perl
#下面这个字符串就是用来校验的；
$cons="558BEC83C4FC8B450C83F810750D6A00E86B02000033C0C9C2100083F80F750E8B4508E81801000033C0C9C2100083F801750633C0C9C210003D110100000F85E70000008B45143B0560314000751A6A00689630400068A7304000FF7508E81702000033C0C9C210003B0558314000740C3B05543140000F85AE000000C705D9124000544558006A008D45FC506A64FF3550314000E8BC010000837DFC00745F506A14686C314000FF3554314000E8AF01000085C07448A10B304000BB6C31400003034381FB7C31400075F55B03C33105D9124000C1E810662905D9124000BEEC114000B93E00000033DBEB049306F100AD33D84975FA81";
$seed="0x00000000";
for($i=1;$i<63;$i++){
$curstr=substr($cons,($i-1)*8,8);
@splitstr=split(//,$curstr);
$curstr=join('',$splitstr[6],$splitstr[7],$splitstr[4],$splitstr[5],$splitstr[2],$splitstr[3],$splitstr[0],$splitstr[1]);
$seed=hex($seed) ^ hex($curstr);
$seed=sprintf "%0x",$seed;
}
print $seed,"\n"; [Asm] 纯文本查看 复制代码
00401269 C705 D9124000 5>mov dword ptr ds:[0x4012D9],0x584554 ; vengers [Asm] 纯文本查看 复制代码
004012BB 3105 D9124000 xor dword ptr ds:[0x4012D9],eax ;
004012C4 66:2905 D912400>sub word ptr ds:[0x4012D9],ax ;
[Asm] 纯文本查看 复制代码
004012D7 . /EB 04 jmp short 160-24-C.004012DD
004012D9 |EB 26 jmp short 160-24-C.00401301 ;被复原的指令
004012DB |54 push esp
004012DC |58 pop eax
004012DD \AD lods dword ptr ds:[esi]
004012DE 33D8 xor ebx,eax
004012E0 49 dec ecx
004012E1 ^ 75 FA jnz short 160-24-C.004012DD
004012E3 . 81FB FBCFFCAF cmp ebx,0xAFFCCFFB
004012E9 ^ 74 EE je short 160-24-C.004012D9 ;
……
00401301 . 68 73 30 40 00 ascii "hs0@",0 ; YES! You found your serial!!
00401306 . FF35 5C314000 push dword ptr ds:[0x40315C] ; |hWnd = 0037095E ('Your serial is not valid.',class='Edit',parent=00430852)
0040130C . E8 67010000 call <jmp.&USER32.SetWindowTextA> ; \SetWindowTextA
[Perl] 纯文本查看 复制代码
#!/usr/bin/perl
#name和serial需满足的条件：
#（1）以二者为参数进行运算，对内存代码进行修改，使0x004012D8-0x004012DF段成为正确的代码（04EB265458AD33D8);
#（2）为满足1，要求window-sum（name）应小于推算出来的（window-sum（name)+serial);或者说serial必须为正整数；因此name不是随意定的。
print "-" x 50,"\n";
$name=$ARGV[0];
$len=length($name);
@rev =$name=~/\w{1}/g;
$rev= join "",reverse(@rev);
$sum=hex(58455443);#"CTEX";
print "Window-sum(name) starts......\n";
for($i=1;$i<5;$i++){
$out=substr($rev,0,$i);
$out=hex(str2hex($out));
$sum += $out;
}
for($i=1;$i<$len-3;$i++){
$out=substr($rev,$i,4);
$out=hex(str2hex($out));
$sum += $out;
}
$sum_str=&de_overflow_hex($sum);
print "Window-sum(name) is: $sum_str\n";
print "Window-sum(name) done.\n";
print "-" x 50,"\n";
print "Serial computing starts......\n";
$m_low_digits_str=join("",(split(//,$sum_str))[6,7,4,5]);
$m_high_digits_str=join("",(split(//,$sum_str))[2,3,0,1]);
$low_digits_str=join("",(split(//,$sum_str))[4,5,6,7]);
$high_digits_str=join("",(split(//,$sum_str))[0,1,2,3]);
print "Low_digits,high_digits are in memory: $m_low_digits_str $m_high_digits_str.\n";
print "Actually low and high values are $low_digits_str,$high_digits_str.\n";
$tail=hex("5854")^hex("0058");
print "The high digits are 5854 xor 0058 = ",dec2hex($tail),"\n";
$head=((hex("26eb")+$tail))^hex("4554");
print "The low digits are (26eb+",dec2hex($tail),") xor 4554 = ",dec2hex($head),"\n";
print "Window-sum(name)+serial should be: ",join("",dec2hex($tail),dec2hex($head)),"\n";
$serial=hex(join("",dec2hex($tail),dec2hex($head)))-hex($sum_str);
$serial_hex_str=dec2hex($serial);
print "The serial should be: ",$serial," or in hex: ",$serial_hex_str,"\n";
print "Serial computing done......\n";
print "-" x 50,"\n";
if($serial < 0){
print "Illegal name! Please try a new name with short length (<8 letters)and low ASCII value, i. e. 7654321;abcde;\n";
}
else{
print "Your serial is: $serial.\n";
}
print "-" x 50,"\n";
sub de_overflow_hex(){
$dec = shift;
# print "$dec will be de_overflowed...\n";
$dec %= 4294967296;#0x100000000;
$d2h = sprintf("%0x",$dec);
return $d2h;
}
sub de_overflow_dec(){
$dec = shift;
# print "$dec will be de_overflowed...\n";
$dec %= 4294967296;#0x100000000;
return $dec;
}
sub str2hex{
my $s = shift;
my $str;
for (0..length($s)-1) {
$str .= sprintf "%0x", ord substr($s, $_, 1);
}
return $str;
}
sub dec2hex(){
$dec=shift;
$hex=sprintf "%0x",$dec;
return $hex;
}
http://www.52pojie.cn/thread-599913-1-1.html 。欢迎大牛们指点。
查看全部评分
· 杂七杂八 | 主题: 1080, 订阅: 322
· 优秀逆向文 | 主题: 238, 订阅: 94
[复制链接]
发表于 2017-4-20 21:29
|
发表于 2017-4-23 20:38
发表于 2017-4-21 16:48
