新CrackMe160之084 - slayer_crackme1
汇编写的，依旧直接看源码
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 21030000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 37324000 mov dword ptr ds:[0x403237],eax
0040100C |. 6A 00 push 0x0 ; /lParam = NULL
0040100E |. 68 29104000 push KeyMe1.00401029 ; |DlgProc = KeyMe1.00401029
00401013 |. 6A 00 push 0x0 ; |hOwner = NULL
00401015 |. 6A 64 push 0x64 ; |pTemplate = 0x64
00401017 |. FF35 37324000 push dword ptr ds:[0x403237] ; |hInst = NULL
0040101D |. E8 2A030000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401022 |. 6A 00 push 0x0 ; /ExitCode = 0x0
00401024 \. E8 ED020000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
00401029 /. 55 push ebp
0040102A |. 8BEC mov ebp,esp
0040102C |. 817D 0C 10010>cmp [arg.2],0x110
00401033 |. 0F85 95000000 jnz KeyMe1.004010CE
00401039 |. 68 E8030000 push 0x3E8 ; /RsrcName = 1000.
0040103E |. FF35 37324000 push dword ptr ds:[0x403237] ; |hInst = NULL
00401044 |. E8 21030000 call <jmp.&USER32.LoadIconA> ; \LoadIconA
00401049 |. 50 push eax ; /lParam = 0x19FFCC
0040104A |. 6A 01 push 0x1 ; |wParam = 0x1
0040104C |. 68 80000000 push 0x80 ; |Message = WM_SETICON
00401051 |. FF75 08 push [arg.1] ; |hWnd = 0x285000
00401054 |. E8 23030000 call <jmp.&USER32.SendMessageA> ; \SendMessageA
00401059 |. 6A 67 push 0x67 ; /ControlID = 67 (103.)
0040105B |. FF75 08 push [arg.1] ; |hWnd = 00285000
0040105E |. E8 01030000 call <jmp.&USER32.GetDlgItem> ; \GetDlgItem
00401063 |. A3 56334000 mov dword ptr ds:[0x403356],eax
00401068 |. 6A 6A push 0x6A ; /ControlID = 6A (106.)
0040106A |. FF75 08 push [arg.1] ; |hWnd = 00285000
0040106D |. E8 F2020000 call <jmp.&USER32.GetDlgItem> ; \GetDlgItem
00401072 |. A3 5A334000 mov dword ptr ds:[0x40335A],eax
00401077 |. 50 push eax
00401078 |. 51 push ecx ; KeyMe1.<ModuleEntryPoint>
00401079 |. 8D05 3B324000 lea eax,dword ptr ds:[0x40323B]
0040107F |. 8D0D 3A334000 lea ecx,dword ptr ds:[0x40333A]
00401085 |. C701 FF000000 mov dword ptr ds:[ecx],0xFF
0040108B |. 51 push ecx ; /pBufferSize = KeyMe1.<ModuleEntryPoint>
0040108C |. 68 3B324000 push KeyMe1.0040323B ; |Buffer = KeyMe1.0040323B
00401091 |. E8 86020000 call <jmp.&KERNEL32.GetComputerNameA> ; \GetComputerNameA
00401096 |. 68 3B324000 push KeyMe1.0040323B ; /String = ""
0040109B |. E8 A0020000 call <jmp.&KERNEL32.lstrlenA> ; \lstrlenA
004010A0 |. A3 46334000 mov dword ptr ds:[0x403346],eax
004010A5 |. 59 pop ecx ; kernel32.7741FCC9
004010A6 |. 58 pop eax ; kernel32.7741FCC9
004010A7 |. 60 pushad
004010A8 |. 9C pushfd
004010A9 |. BE 3B324000 mov esi,KeyMe1.0040323B
004010AE |. C705 3E334000>mov dword ptr ds:[0x40333E],0x0
004010B8 |> AC /lods byte ptr ds:[esi]
004010B9 |. 0FB6C0 |movzx eax,al
004010BC |. 0105 3E334000 |add dword ptr ds:[0x40333E],eax
004010C2 |. 3C 00 |cmp al,0x0
004010C4 |.^ 75 F2 \jnz short KeyMe1.004010B8
004010C6 |. 9D popfd
004010C7 |. 61 popad
004010C8 |. 33C0 xor eax,eax
004010CA |. C9 leave
004010CB |. C2 1000 retn 0x10
004010CE |> 837D 0C 10 cmp [arg.2],0x10
004010D2 |. 75 0A jnz short KeyMe1.004010DE
004010D4 |. 6A 00 push 0x0 ; /Result = 0x0
004010D6 |. FF75 08 push [arg.1] ; |hWnd = 00285000
004010D9 |. E8 7A020000 call <jmp.&USER32.EndDialog> ; \EndDialog
004010DE |> 817D 0C 11010>cmp [arg.2],0x111
004010E5 |. 0F85 19020000 jnz KeyMe1.00401304
004010EB |. 8B45 10 mov eax,[arg.3]
004010EE |. 66:83F8 68 cmp ax,0x68
004010F2 |. 75 0A jnz short KeyMe1.004010FE
004010F4 |. 6A 00 push 0x0 ; /Result = 0x0
004010F6 |. FF75 08 push [arg.1] ; |hWnd = 00285000
004010F9 |. E8 5A020000 call <jmp.&USER32.EndDialog> ; \EndDialog
004010FE |> 66:83F8 69 cmp ax,0x69
00401102 |. 75 13 jnz short KeyMe1.00401117
00401104 |. 6A 40 push 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
00401106 |. 68 00304000 push KeyMe1.00403000 ; |Title = "[ info ]"
0040110B |. 68 09304000 push KeyMe1.00403009 ; |Text = "[ KeyMe # 1 coded by Slayer ]
Rules : No patching at all. >> Keygen it <<
Solutions : slayeronthefly@yahoo.com
All accepted solutions will be awarded by source code :) "
00401110 |. 6A 00 push 0x0 ; |hOwner = NULL
00401112 |. E8 59020000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401117 |> 66:83F8 6A cmp ax,0x6A
0040111B |. 0F85 41010000 jnz KeyMe1.00401262
00401121 |. 6A 00 push 0x0 ; /hTemplateFile = NULL
00401123 |. 68 80000000 push 0x80 ; |Attributes = NORMAL
00401128 |. 6A 03 push 0x3 ; |Mode = OPEN_EXISTING
0040112A |. 6A 00 push 0x0 ; |pSecurity = NULL
0040112C |. 6A 01 push 0x1 ; |ShareMode = FILE_SHARE_READ
0040112E |. 68 00000080 push 0x80000000 ; |Access = GENERIC_READ
00401133 |. 68 26314000 push KeyMe1.00403126 ; |FileName = "reg.key"
00401138 |. E8 D3010000 call <jmp.&KERNEL32.CreateFileA> ; \CreateFileA
0040113D |. 83F8 FF cmp eax,-0x1
00401140 |. 75 05 jnz short KeyMe1.00401147
00401142 |. E9 E7000000 jmp KeyMe1.0040122E
00401147 |> A3 4A334000 mov dword ptr ds:[0x40334A],eax
0040114C |. 6A 00 push 0x0 ; /pFileSizeHigh = NULL
0040114E |. FF35 4A334000 push dword ptr ds:[0x40334A] ; |hFile = NULL
00401154 |. E8 C9010000 call <jmp.&KERNEL32.GetFileSize> ; \GetFileSize
00401159 |. 83F8 08 cmp eax,0x8
0040115C |. 73 10 jnb short KeyMe1.0040116E
0040115E |. FF35 4A334000 push dword ptr ds:[0x40334A] ; /hObject = NULL
00401164 |. E8 A1010000 call <jmp.&KERNEL32.CloseHandle> ; \CloseHandle
00401169 |. E9 C0000000 jmp KeyMe1.0040122E
0040116E |> A3 52334000 mov dword ptr ds:[0x403352],eax
00401173 |. FF35 52334000 push dword ptr ds:[0x403352] ; /MemSize = 0x0
00401179 |. 6A 40 push 0x40 ; |Flags = GPTR
0040117B |. E8 AE010000 call <jmp.&KERNEL32.GlobalAlloc> ; \GlobalAlloc
00401180 |. 0BC0 or eax,eax
00401182 |. 75 1F jnz short KeyMe1.004011A3
00401184 |. 68 0D314000 push KeyMe1.0040310D ; /Text = "Memory allocation error!"
00401189 |. 6A 66 push 0x66 ; |ControlID = 66 (102.)
0040118B |. FF75 08 push [arg.1] ; |hWnd = 00285000
0040118E |. E8 EF010000 call <jmp.&USER32.SetDlgItemTextA> ; \SetDlgItemTextA
00401193 |. FF35 4A334000 push dword ptr ds:[0x40334A] ; /hObject = NULL
00401199 |. E8 6C010000 call <jmp.&KERNEL32.CloseHandle> ; \CloseHandle
0040119E |. E9 B4000000 jmp KeyMe1.00401257
004011A3 |> A3 4E334000 mov dword ptr ds:[0x40334E],eax
004011A8 |. 6A 00 push 0x0 ; /pOverlapped = NULL
004011AA |. 68 2E314000 push KeyMe1.0040312E ; |pBytesRead = KeyMe1.0040312E
004011AF |. FF35 52334000 push dword ptr ds:[0x403352] ; |BytesToRead = 0x0
004011B5 |. FF35 4E334000 push dword ptr ds:[0x40334E] ; |Buffer = NULL
004011BB |. FF35 4A334000 push dword ptr ds:[0x40334A] ; |hFile = NULL
004011C1 |. E8 74010000 call <jmp.&KERNEL32.ReadFile> ; \ReadFile
004011C6 |. 0BC0 or eax,eax
004011C8 |. 75 18 jnz short KeyMe1.004011E2
004011CA |. FF35 4A334000 push dword ptr ds:[0x40334A] ; /hObject = NULL
004011D0 |. E8 35010000 call <jmp.&KERNEL32.CloseHandle> ; \CloseHandle
004011D5 |. FF35 4E334000 push dword ptr ds:[0x40334E] ; /hMem = NULL
004011DB |. E8 54010000 call <jmp.&KERNEL32.GlobalFree> ; \GlobalFree
004011E0 |. EB 4C jmp short KeyMe1.0040122E
004011E2 |> FF35 4A334000 push dword ptr ds:[0x40334A] ; /hObject = NULL
004011E8 |. E8 1D010000 call <jmp.&KERNEL32.CloseHandle> ; \CloseHandle
004011ED |. 56 push esi ; KeyMe1.<ModuleEntryPoint>
004011EE |. 52 push edx ; KeyMe1.<ModuleEntryPoint>
004011EF |. 8B35 4E334000 mov esi,dword ptr ds:[0x40334E]
004011F5 |. 8B06 mov eax,dword ptr ds:[esi]
004011F7 |. 83C6 04 add esi,0x4
004011FA |. 8B16 mov edx,dword ptr ds:[esi]
004011FC |. 33C2 xor eax,edx ; KeyMe1.<ModuleEntryPoint>
004011FE |. 8B15 42334000 mov edx,dword ptr ds:[0x403342]
00401204 |. 03C2 add eax,edx ; KeyMe1.<ModuleEntryPoint>
00401206 |. 5A pop edx ; kernel32.7741FCC9
00401207 |. 5E pop esi ; kernel32.7741FCC9
00401208 |. 3B05 3E334000 cmp eax,dword ptr ds:[0x40333E]
0040120E |. 75 1E jnz short KeyMe1.0040122E
00401210 |. 68 D9304000 push KeyMe1.004030D9 ; /Text = "Good work. You have done it!"
00401215 |. 6A 66 push 0x66 ; |ControlID = 66 (102.)
00401217 |. FF75 08 push [arg.1] ; |hWnd = 00285000
0040121A |. E8 63010000 call <jmp.&USER32.SetDlgItemTextA> ; \SetDlgItemTextA
0040121F |. 6A 00 push 0x0 ; /Enable = FALSE
00401221 |. FF35 5A334000 push dword ptr ds:[0x40335A] ; |hWnd = NULL
00401227 |. E8 26010000 call <jmp.&USER32.EnableWindow> ; \EnableWindow
0040122C |. EB 29 jmp short KeyMe1.00401257
0040122E |> 68 F6304000 push KeyMe1.004030F6 ; /Text = "Registration failed!!!"
00401233 |. 6A 66 push 0x66 ; |ControlID = 66 (102.)
00401235 |. FF75 08 push [arg.1] ; |hWnd = 00285000
00401238 |. E8 45010000 call <jmp.&USER32.SetDlgItemTextA> ; \SetDlgItemTextA
0040123D |. 6A 00 push 0x0 ; /Enable = FALSE
0040123F |. FF35 5A334000 push dword ptr ds:[0x40335A] ; |hWnd = NULL
00401245 |. E8 08010000 call <jmp.&USER32.EnableWindow> ; \EnableWindow
0040124A |. 6A 01 push 0x1 ; /Enable = TRUE
0040124C |. FF35 56334000 push dword ptr ds:[0x403356] ; |hWnd = NULL
00401252 |. E8 FB000000 call <jmp.&USER32.EnableWindow> ; \EnableWindow
00401257 |> FF35 4E334000 push dword ptr ds:[0x40334E] ; /hMem = NULL
0040125D |. E8 D2000000 call <jmp.&KERNEL32.GlobalFree> ; \GlobalFree
00401262 |> 66:83F8 67 cmp ax,0x67
00401266 |. 0F85 98000000 jnz KeyMe1.00401304
0040126C |. 6A 00 push 0x0 ; /hWnd = NULL
0040126E |. E8 03010000 call <jmp.&USER32.OpenClipboard> ; \OpenClipboard
00401273 |. 6A 01 push 0x1 ; /Format = CF_TEXT
00401275 |. E8 E4000000 call <jmp.&USER32.GetClipboardData> ; \GetClipboardData
0040127A |. 0BC0 or eax,eax
0040127C |. 74 72 je short KeyMe1.004012F0
0040127E |. A3 33324000 mov dword ptr ds:[0x403233],eax
00401283 |. 60 pushad
00401284 |. 9C pushfd
00401285 |. BE 33324000 mov esi,KeyMe1.00403233
0040128A |. 8B36 mov esi,dword ptr ds:[esi]
0040128C |. FF35 3E334000 push dword ptr ds:[0x40333E]
00401292 |. 8F05 42334000 pop dword ptr ds:[0x403342] ; kernel32.7741FCC9
00401298 |. 8B0D 46334000 mov ecx,dword ptr ds:[0x403346]
0040129E |> 8A5431 FF /mov dl,byte ptr ds:[ecx+esi-0x1]
004012A2 |. 0FB6D2 |movzx edx,dl
004012A5 |. 2915 42334000 |sub dword ptr ds:[0x403342],edx ; KeyMe1.<ModuleEntryPoint>
004012AB |. 49 |dec ecx ; KeyMe1.<ModuleEntryPoint>
004012AC |.^ 75 F0 \jnz short KeyMe1.0040129E
004012AE |. 9D popfd
004012AF |. 61 popad
004012B0 |. A1 42334000 mov eax,dword ptr ds:[0x403342]
004012B5 |. 6BC0 FF imul eax,eax,-0x1
004012B8 |. 83C0 01 add eax,0x1
004012BB |. 6BC0 FF imul eax,eax,-0x1
004012BE |. 83C0 01 add eax,0x1
004012C1 |. 0BC0 or eax,eax
004012C3 |. 75 2B jnz short KeyMe1.004012F0
004012C5 |. 68 BB304000 push KeyMe1.004030BB ; /Text = "Step 1 ok -> now Register it!"
004012CA |. 6A 66 push 0x66 ; |ControlID = 66 (102.)
004012CC |. FF75 08 push [arg.1] ; |hWnd = 00285000
004012CF |. E8 AE000000 call <jmp.&USER32.SetDlgItemTextA> ; \SetDlgItemTextA
004012D4 |. 6A 00 push 0x0 ; /Enable = FALSE
004012D6 |. FF35 56334000 push dword ptr ds:[0x403356] ; |hWnd = NULL
004012DC |. E8 71000000 call <jmp.&USER32.EnableWindow> ; \EnableWindow
004012E1 |. 6A 01 push 0x1 ; /Enable = TRUE
004012E3 |. FF35 5A334000 push dword ptr ds:[0x40335A] ; |hWnd = NULL
004012E9 |. E8 64000000 call <jmp.&USER32.EnableWindow> ; \EnableWindow
004012EE |. EB 0F jmp short KeyMe1.004012FF
004012F0 |> 68 F6304000 push KeyMe1.004030F6 ; /Text = "Registration failed!!!"
004012F5 |. 6A 66 push 0x66 ; |ControlID = 66 (102.)
004012F7 |. FF75 08 push [arg.1] ; |hWnd = 00285000
004012FA |. E8 83000000 call <jmp.&USER32.SetDlgItemTextA> ; \SetDlgItemTextA
004012FF |> E8 42000000 call <jmp.&USER32.CloseClipboard> ; [CloseClipboard
00401304 |> 33C0 xor eax,eax
00401306 |. C9 leave
00401307 \. C2 1000 retn 0x10
0040130A $- FF25 00204000 jmp dword ptr ds:[<&KERNEL32.CloseHandle>; kernel32.CloseHandle
00401310 $- FF25 04204000 jmp dword ptr ds:[<&KERNEL32.CreateFileA>; kernel32.CreateFileA
00401316 .- FF25 08204000 jmp dword ptr ds:[<&KERNEL32.ExitProcess>; kernel32.ExitProcess
0040131C $- FF25 0C204000 jmp dword ptr ds:[<&KERNEL32.GetComputer>; kernel32.GetComputerNameA
00401322 $- FF25 10204000 jmp dword ptr ds:[<&KERNEL32.GetFileSize>; kernel32.GetFileSize
00401328 $- FF25 14204000 jmp dword ptr ds:[<&KERNEL32.GetModuleHa>; kernel32.GetModuleHandleA
0040132E $- FF25 18204000 jmp dword ptr ds:[<&KERNEL32.GlobalAlloc>; kernel32.GlobalAlloc
00401334 $- FF25 1C204000 jmp dword ptr ds:[<&KERNEL32.GlobalFree>>; kernel32.GlobalFree
0040133A $- FF25 20204000 jmp dword ptr ds:[<&KERNEL32.ReadFile>] ; kernel32.ReadFile
00401340 $- FF25 24204000 jmp dword ptr ds:[<&KERNEL32.lstrlenA>] ; kernel32.lstrlenA
00401346 $- FF25 2C204000 jmp dword ptr ds:[<&USER32.CloseClipboar>; user32.CloseClipboard
0040134C $- FF25 30204000 jmp dword ptr ds:[<&USER32.DialogBoxPara>; user32.DialogBoxParamA
00401352 $- FF25 34204000 jmp dword ptr ds:[<&USER32.EnableWindow>>; user32.EnableWindow
00401358 $- FF25 38204000 jmp dword ptr ds:[<&USER32.EndDialog>] ; user32.EndDialog
0040135E $- FF25 3C204000 jmp dword ptr ds:[<&USER32.GetClipboardD>; user32.GetClipboardData
00401364 $- FF25 40204000 jmp dword ptr ds:[<&USER32.GetDlgItem>] ; user32.GetDlgItem
0040136A $- FF25 44204000 jmp dword ptr ds:[<&USER32.LoadIconA>] ; user32.LoadIconA
00401370 $- FF25 48204000 jmp dword ptr ds:[<&USER32.MessageBoxA>] ; user32.MessageBoxA
00401376 $- FF25 4C204000 jmp dword ptr ds:[<&USER32.OpenClipboard>; user32.OpenClipboard
0040137C $- FF25 50204000 jmp dword ptr ds:[<&USER32.SendMessageA>>; user32.SendMessageA
00401382 $- FF25 54204000 jmp dword ptr ds:[<&USER32.SetDlgItemTex>; user32.SetDlgItemTextA
00401388 00 db 00
失败与成功关键词处都下好断点，点验证几次定位，最终定位到00401275 GetClipboardData 从粘贴板获取数据，下面是循环15次，说明与粘贴板15位内容有关
1). 将[0x403342]的内存值(0x423)循环减去粘贴板前15位值,结果为rlt
2). rlt = ((rlt * -1) + 1) * -1 + 1 = rlt (啥也不是)
3). 所以可知,粘贴板前15位值的和要等于0x423
0x423 / 0xF = 0x46 ... 9
所以可以分成6个F,9个G就行了,结果为: FFFFFFGGGGGGGGG, 复制这个,然后重新点验证, 0040127A处可以看到粘贴板的值了, 继续向上运行可见程序正常通过验证
这时验证按钮灰掉了,下面的注册按钮亮起了,说明第一步成功通过了
接着程序来到读文件处004011ED(需要先建好文件reg.key,内容长度为8位), 下面便是算法
004011EF |. 8B35 4E334000 mov esi,dword ptr ds:[0x40334E] ; 文件内容
004011F5 |. 8B06 mov eax,dword ptr ds:[esi] ; 取前4位
004011F7 |. 83C6 04 add esi,0x4
004011FA |. 8B16 mov edx,dword ptr ds:[esi] ; 取后4位
004011FC |. 33C2 xor eax,edx ; 前后4位异或得rlt
004011FE |. 8B15 42334000 mov edx,dword ptr ds:[0x403342]
00401204 |. 03C2 add eax,edx
00401206 |. 5A pop edx ; 0019F904
00401207 |. 5E pop esi ; 0019F904
00401208 |. 3B05 3E334000 cmp eax,dword ptr ds:[0x40333E] ; rlt 与 内存值(0x423)对比
上面代码分析可得文件内容可为(16进制): 23 04 00 00 00 00 00 00
到此两步都成功了, 细心的你应该发现一个问题, 这个[0x40333E]内存值是哪来的,
所以我们需要追踪一下
在OD代码区右键查找->所有常量, 输入0x40333E查找,可得结果:
地址 反汇编 注释
004010AE mov dword ptr ds:[0x40333E],0x0 ds:[0040333E]=00000423
004010BC add dword ptr ds:[0x40333E],eax
004011FC xor eax,edx (初始 CPU 选择)
00401208 cmp eax,dword ptr ds:[0x40333E] ds:[0040333E]=00000423
0040128C push dword ptr ds:[0x40333E] ds:[0040333E]=00000423
第一行是初始为0, 第二行是关键赋值, 选中第二行按回车直接定位到代码处004010BC, 向上可以看到GetComputerNameA 获取电脑名称的系统方法,然后循环累加
到此这个内存值也搞懂了, 下面是注册机
#include <stdio.h>
#include <string.h>
#include <windows.h>
int main() {
int cdLen = 0xF, rkLen = 8;
int i, sum=0, v0, v1;
char *cData = calloc(cdLen + 1, sizeof(char));
char computerName[256];
DWORD size = sizeof(computerName);
if (!GetComputerName(computerName, &size)) {
printf("Get Computer Name Error!\n");
return 0;
}
for(i=0; i<size; i++){
sum += computerName[i];
}
v0 = sum / cdLen;
v1 = sum % cdLen;
for(i=0; i<cdLen; i++){
cData[i] = v0 + (i < v1 ? 1 : 0);
}
printf("ComputerName: %s\n[0x40333E]: 0x%X\nClipboardData: %s\nreg.key(16): ", computerName, sum, cData);
char *regkey = (char *)malloc(rkLen);
regkey = (char *)∑
size = strlen(regkey);
for(i=0; i<rkLen; i++){
printf("%02X", i<size?regkey[i]:0);
}
free(regkey);
free(cData);
getchar();
return 0;
}
运行示例:
ComputerName: DESKTOP-FABLH2O
[0x40333E]: 0x423
ClipboardData: GGGGGGGGGFFFFFF
reg.key(16): 2304000000000000
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号