新手破解练习Crackme160之152 - The AntiXryst
151没有程序,只能跳过了
152这个程序IDR查看可知, 只有一个timer事件, 代码太长, 太难, 放弃了, 只能追码了, 关键位置如下:
00457BD2 8B45 A0 mov eax,dword ptr ss:[ebp-0x60]
00457BD5 2B45 A4 sub eax,dword ptr ss:[ebp-0x5C]
00457BD8 2B45 A8 sub eax,dword ptr ss:[ebp-0x58]
00457BDB 0345 AC add eax,dword ptr ss:[ebp-0x54]
00457BDE 8945 A0 mov dword ptr ss:[ebp-0x60],eax ; 存第一段值
00457BE1 8B45 90 mov eax,dword ptr ss:[ebp-0x70]
00457BE4 2B45 94 sub eax,dword ptr ss:[ebp-0x6C]
00457BE7 2B45 98 sub eax,dword ptr ss:[ebp-0x68]
00457BEA 0345 9C add eax,dword ptr ss:[ebp-0x64]
00457BED 8945 90 mov dword ptr ss:[ebp-0x70],eax ; 存第二段值
00457BF0 8D55 F0 lea edx,dword ptr ss:[ebp-0x10]
00457BF3 8D45 F4 lea eax,dword ptr ss:[ebp-0xC]
00457BF6 E8 B1F8FFFF call The_Anti.004574AC
上面是用户名计算后的两个值, 转为2进制即是左框中对应的选择与否
追码示例:
用户名: abc
注册码: F4BAD5F4-68990663
对应的二进制为:
F4: 11110100
BA: 10111010
D5: 11010101
F4: 11110100
68: 01101000
99: 10011001
06: 00000110
63: 01100011
附上solly大佬的注册机代码:
/*
keygen.cpp
*/
#include <stdio.h>
#include <stdlib.h>
#include "MD5.hpp"
int main(int argc, char** argv) {
unsigned char decrypt[16];
char temp[256];
char regname[80];
printf("Keygen for 152 - 'The AntiXryst' of 160 crackme.\n");
//// 输入用户名
printf("Enter your name: ");
gets(temp); //// 输入用户名
//// 用户名处理
int n = strlen(temp);
char * p = regname[1]; /// 从第2个字节开始保存连接的用户名
strncpy(p, temp, 64);
int m = n;
while(m<63) {
strcat(p+n, temp);
m += n;
}
regname[0] = '\0'; /// 第1个字节设为'\0'
regname[64] = '\0'; /// 字符串null结束符
//printf("Name: %s\n", p);
////MD5算法
int len = 0x40; /// 固定长度为64
MD5_CTX md5;
MD5Init(&md5);
MD5Update(&md5, (unsigned char *)regname, len);
MD5Final(&md5, decrypt);
//////
unsigned int sn[2];
sn[0] = md5.state2[0] - md5.state2[1] - md5.state2[2] + md5.state2[3];
sn[1] = md5.state[0] - md5.state[1] - md5.state[2] + md5.state[3];
////
printf("\n\nSN: %08X-%08X\n", sn[0], sn[1]);
printf("SN Matrix:\n");
for(int i=0; i<2; i++) {
unsigned int a = sn[i];
unsigned int b = 0x80000000;
for(int j=1; j<=32; j++) {
if(a & b) {
printf("1 ");
} else {
printf("0 ");
}
b >>=1;
if((j % 8) == 0) {
printf("\n");
}
}
}
system("pause");
return 0;
}
/*
Md5.cpp
*/
#include "Md5.hpp"
unsigned char PADDING[] = {
0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
void MD5Init(MD5_CTX *context){
context->count[0]=0;
context->count[1]=0;
context->state[0]=0x67452301;
context->state[1]=0xEFCDAB89;
context->state[2]=0x98BADCFE;
context->state[3]=0x10325476;
//// context->buffer[64];
}
void MD5Update(MD5_CTX *context, unsigned char *input, unsigned int inputlen){
unsigned int i=0,index=0,partlen=0;
index=(context->count[0]>>3)&0x3F;
partlen=64-index;
context->count[0]+=inputlen<<3;
if(context->count[0]<(inputlen<<3)) context->count[1]++;
context->count[1]+=inputlen>>29;
if(inputlen>=partlen){
memcpy(&context->buffer[index], input, partlen);
MD5Transform(context->state, context->buffer);
for(i=partlen;i+64<=inputlen;i+=64) MD5Transform(context->state,&input[i]);
index=0;
//// 相对标准MD5第1处改动, 在第1次基础上直接进行第2次MD5计算/////////////
context->state2[0] = context->state[0]; //// 保存第1次的MD5值
context->state2[1] = context->state[1]; //// 保存第1次的MD5值
context->state2[2] = context->state[2]; //// 保存第1次的MD5值
context->state2[3] = context->state[3]; //// 保存第1次的MD5值
MD5Transform(context->state, context->buffer);
for(i=partlen;i+64<=inputlen;i+=64) MD5Transform(context->state,&input[i]);
index=0;
//////////////////////////////////////////////////////////////////////////
}
else i=0;
memcpy(&context->buffer[index], &input[i], inputlen-i);
}
void MD5Final(MD5_CTX *context, unsigned char digest[16]){
unsigned int index=0,padlen=0;
unsigned char bits[8];
index=(context->count[0]>>3)&0x3F;
padlen=(index<56)?(56-index):(120-index);
////// 相对标准MD5第2处改动, 因为主注册名已经有64字节，并且由于其第1字节为'\0'，会padding掉全部内容，所以不进行Padding处理
// MD5Update(context,PADDING,padlen); //// no padding, comments by solly
//////////////////////////////////////////////////////////////////////////////////
MD5Update(context,bits,8);//index=0
/////
MD5Encode(digest,context->state,16);
}
void MD5Encode(unsigned char *output, unsigned int *input, unsigned int len){
unsigned int i = 0, j = 0;
while (j<len){
output[j]=input[i] & 0xFF;
output[j+1]=(input[i]>>8)&0xFF;
output[j+2]=(input[i]>>16)&0xFF;
output[j+3]=(input[i]>>24)&0xFF;
i++;
j += 4;
}
}
void MD5Decode(unsigned int *output, unsigned char *input, unsigned int len){
unsigned int i = 0, j = 0;
while (j < len){
output[i] = (input[j]) |
(input[j + 1] << 8) |
(input[j + 2] << 16) |
(input[j + 3] << 24);
i++;
j += 4;
}
}
void MD5Transform(unsigned int state[4], unsigned char block[64]){
unsigned int a = state[0];
unsigned int b = state[1];
unsigned int c = state[2];
unsigned int d = state[3];
unsigned int x[16];
MD5Decode(x, block, 64);
FF(a, b, c, d, x[0], 7, 0xd76aa478);
FF(d, a, b, c, x[1], 12, 0xe8c7b756);
FF(c, d, a, b, x[2], 17, 0x242070db);
FF(b, c, d, a, x[3], 22, 0xc1bdceee);
FF(a, b, c, d, x[4], 7, 0xf57c0faf);
FF(d, a, b, c, x[5], 12, 0x4787c62a);
FF(c, d, a, b, x[6], 17, 0xa8304613);
FF(b, c, d, a, x[7], 22, 0xfd469501);
FF(a, b, c, d, x[8], 7, 0x698098d8);
FF(d, a, b, c, x[9], 12, 0x8b44f7af);
FF(c, d, a, b, x[10], 17, 0xffff5bb1);
FF(b, c, d, a, x[11], 22, 0x895cd7be);
FF(a, b, c, d, x[12], 7, 0x6b901122);
FF(d, a, b, c, x[13], 12, 0xfd987193);
FF(c, d, a, b, x[14], 17, 0xa679438e);
FF(b, c, d, a, x[15], 22, 0x49b40821);
GG(a, b, c, d, x[1], 5, 0xf61e2562);
GG(d, a, b, c, x[6], 9, 0xc040b340);
GG(c, d, a, b, x[11], 14, 0x265e5a51);
GG(b, c, d, a, x[0], 20, 0xe9b6c7aa);
GG(a, b, c, d, x[5], 5, 0xd62f105d);
GG(d, a, b, c, x[10], 9, 0x2441453);
GG(c, d, a, b, x[15], 14, 0xd8a1e681);
GG(b, c, d, a, x[4], 20, 0xe7d3fbc8);
GG(a, b, c, d, x[9], 5, 0x21e1cde6);
GG(d, a, b, c, x[14], 9, 0xc33707d6);
GG(c, d, a, b, x[3], 14, 0xf4d50d87);
GG(b, c, d, a, x[8], 20, 0x455a14ed);
GG(a, b, c, d, x[13], 5, 0xa9e3e905);
GG(d, a, b, c, x[2], 9, 0xfcefa3f8);
GG(c, d, a, b, x[7], 14, 0x676f02d9);
GG(b, c, d, a, x[12], 20, 0x8d2a4c8a);
HH(a, b, c, d, x[5], 4, 0xfffa3942);
HH(d, a, b, c, x[8], 11, 0x8771f681);
HH(c, d, a, b, x[11], 16, 0x6d9d6122);
HH(b, c, d, a, x[14], 23, 0xfde5380c);
HH(a, b, c, d, x[1], 4, 0xa4beea44);
HH(d, a, b, c, x[4], 11, 0x4bdecfa9);
HH(c, d, a, b, x[7], 16, 0xf6bb4b60);
HH(b, c, d, a, x[10], 23, 0xbebfbc70);
HH(a, b, c, d, x[13], 4, 0x289b7ec6);
HH(d, a, b, c, x[0], 11, 0xeaa127fa);
HH(c, d, a, b, x[3], 16, 0xd4ef3085);
HH(b, c, d, a, x[6], 23, 0x4881d05);
HH(a, b, c, d, x[9], 4, 0xd9d4d039);
HH(d, a, b, c, x[12], 11, 0xe6db99e5);
HH(c, d, a, b, x[15], 16, 0x1fa27cf8);
HH(b, c, d, a, x[2], 23, 0xc4ac5665);
II(a, b, c, d, x[0], 6, 0xf4292244);
II(d, a, b, c, x[7], 10, 0x432aff97);
II(c, d, a, b, x[14], 15, 0xab9423a7);
II(b, c, d, a, x[5], 21, 0xfc93a039);
II(a, b, c, d, x[12], 6, 0x655b59c3);
II(d, a, b, c, x[3], 10, 0x8f0ccc92);
II(c, d, a, b, x[10], 15, 0xffeff47d);
II(b, c, d, a, x[1], 21, 0x85845dd1);
II(a, b, c, d, x[8], 6, 0x6fa87e4f);
II(d, a, b, c, x[15], 10, 0xfe2ce6e0);
II(c, d, a, b, x[6], 15, 0xa3014314);
II(b, c, d, a, x[13], 21, 0x4e0811a1);
II(a, b, c, d, x[4], 6, 0xf7537e82);
II(d, a, b, c, x[11], 10, 0xbd3af235);
II(c, d, a, b, x[2], 15, 0x2ad7d2bb);
II(b, c, d, a, x[9], 21, 0xeb86d391);
state[0] += a;
state[1] += b;
state[2] += c;
state[3] += d;
}
/*
MD5.hpp
*/
#include<cstdio>
#include<cstring>
#include<algorithm>
#include<cstdlib>
#include<iostream>
#include<cmath>
typedef struct{
unsigned int count[2];
unsigned int state[4];
unsigned char buffer[64];
unsigned int state2[4]; //// 这里是改动之三，不对算法产生影响，只是用来备份第1次MD5结果
} MD5_CTX;
#define F(x,y,z) ((x&y)|(~x&z))
#define G(x,y,z) ((x&z)|(y&~z))
#define H(x,y,z) (x^y^z)
#define I(x,y,z) (y^(x|~z))
#define ROTATE_LEFT(x,n) ((x<<n)|(x>>(32-n)))
#define FF(a,b,c,d,x,s,ac) { a+=F(b,c,d)+x+ac; a=ROTATE_LEFT(a,s); a+=b;}
#define GG(a,b,c,d,x,s,ac) { a+=G(b,c,d)+x+ac; a=ROTATE_LEFT(a,s); a+=b;}
#define HH(a,b,c,d,x,s,ac) { a+=H(b,c,d)+x+ac; a=ROTATE_LEFT(a,s); a+=b;}
#define II(a,b,c,d,x,s,ac) { a+=I(b,c,d)+x+ac; a=ROTATE_LEFT(a,s); a+=b;}
void MD5Init(MD5_CTX *context);
void MD5Update(MD5_CTX *context, unsigned char *input, unsigned int inputlen);
void MD5Final(MD5_CTX *context, unsigned char digest[16]);
void MD5Transform(unsigned int state[4], unsigned char block[64]);
void MD5Encode(unsigned char *output, unsigned int *input, unsigned int len);
void MD5Decode(unsigned int *output, unsigned char *input, unsigned int len);
上面代码在我电脑没有编译成功~ 先记录吧~
1~160每个破解过程,在吾爱破解论坛都有高手破解过了,也有整理好现成的, 我这边主要就是自己动手操作的过程,与他们的不太一样
附上高手们的连接: 点击前往查看
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
新人入门教程"玩玩破解，写给新人看" 点击前往查看
我就是从这里开始的,对我这样的小白感觉超级友好~
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号