新CrackMe160之101 - serialme - byToShimi

直接使用ESP定律张轻松脱壳，PEiD查看为汇编写的程序，直接看源码

...
00401251    6A 00           push 0x0
00401253    68 65314000     push serialme.00403165                   ; ASCII "Serialme"
00401258    68 6E314000     push serialme.0040316E                   ; ASCII "      ..::: toshimi :::..\nquebbek@hotmail.com"
0040125D    6A 00           push 0x0
0040125F    E8 76020000     call <jmp.&USER32.MessageBoxA>
00401264    EB 53           jmp short serialme.004012B9
00401266    66:3D E903      cmp ax,0x3E9
0040126A    75 38           jnz short serialme.004012A4
0040126C    6A 50           push 0x50
0040126E    68 00304000     push serialme.00403000
00401273    68 EA030000     push 0x3EA
00401278    FF75 08         push dword ptr ss:[ebp+0x8]
0040127B    E8 3C020000     call <jmp.&USER32.GetDlgItemTextA>
00401280    33FF            xor edi,edi                              ; serialme.<ModuleEntryPoint>
00401282    8D3D 44314000   lea edi,dword ptr ds:[0x403144]
00401288    C607 00         mov byte ptr ds:[edi],0x0
0040128B    E8 E3000000     call serialme.00401373                    ; 算法在这里
00401290    68 44314000     push serialme.00403144
00401295    68 EA030000     push 0x3EA
0040129A    FF75 08         push dword ptr ss:[ebp+0x8]
0040129D    E8 50020000     call <jmp.&USER32.SetDlgItemTextA>
004012A2    EB 15           jmp short serialme.004012B9
004012A4    66:3D ED03      cmp ax,0x3ED
004012A8    75 0F           jnz short serialme.004012B9
004012AA    6A 00           push 0x0
004012AC    68 EA030000     push 0x3EA
004012B1    FF75 08         push dword ptr ss:[ebp+0x8]
004012B4    E8 39020000     call <jmp.&USER32.SetDlgItemTextA>
...
00401373    50              push eax
00401374    33C0            xor eax,eax
00401376    33D2            xor edx,edx
00401378    8D35 00304000   lea esi,dword ptr ds:[0x403000]
0040137E    8A0432          mov al,byte ptr ds:[edx+esi]
00401381    84C0            test al,al
00401383    74 15           je short serialme.0040139A
00401385    B1 01           mov cl,0x1
00401387    42              inc edx
00401388    FEC1            inc cl
0040138A    F6F1            div cl
0040138C    80FC 00         cmp ah,0x0
0040138F    74 02           je short serialme.00401393
00401391  ^ EB EB           jmp short serialme.0040137E
00401393    FEC7            inc bh
00401395    80E9 02         sub cl,0x2
00401398  ^ EB E4           jmp short serialme.0040137E
0040139A    50              push eax
0040139B    C1C3 08         rol ebx,0x8
0040139E    52              push edx
0040139F    B4 00           mov ah,0x0
004013A1    B0 01           mov al,0x1
004013A3    B1 02           mov cl,0x2
004013A5    8A1C30          mov bl,byte ptr ds:[eax+esi]
004013A8    84DB            test bl,bl
004013AA    74 08           je short serialme.004013B4
004013AC    02D3            add dl,bl
004013AE    FEC1            inc cl
004013B0    02C1            add al,cl
004013B2  ^ EB F1           jmp short serialme.004013A5
004013B4    66:B8 FFFF      mov ax,0xFFFF
004013B8    80FA AB         cmp dl,0xAB
004013BB    75 0B           jnz short serialme.004013C8
004013BD    66:40           inc ax
004013BF    EB 0B           jmp short serialme.004013CC
004013C1    E8 13000000     call serialme.004013D9
004013C6    EB 0D           jmp short serialme.004013D5
004013C8    66:83C0 01      add ax,0x1
004013CC  ^ 72 F3           jb short serialme.004013C1
004013CE    E8 8A000000     call serialme.0040145D
004013D3  ^ EB EC           jmp short serialme.004013C1
004013D5    5A              pop edx                                  ; user32.76FA4275
004013D6    58              pop eax                                  ; user32.76FA4275
004013D7    58              pop eax                                  ; user32.76FA4275
004013D8    C3              retn
004013D9    8AF7            mov dh,bh
004013DB    8D3D 44314000   lea edi,dword ptr ds:[0x403144]
004013E1    33DB            xor ebx,ebx
004013E3    8AD0            mov dl,al
004013E5    83C4 04         add esp,0x4
004013E8    73 3C           jnb short serialme.00401426
004013EA    88143B          mov byte ptr ds:[ebx+edi],dl
004013ED    43              inc ebx
004013EE    80FA 6F         cmp dl,0x6F
004013F1    74 14           je short serialme.00401407
004013F3    80FA 72         cmp dl,0x72
004013F6    74 14           je short serialme.0040140C
004013F8    80FA 49         cmp dl,0x49
004013FB    74 58           je short serialme.00401455
004013FD    80FA 6E         cmp dl,0x6E
00401400    74 44           je short serialme.00401446
00401402    80C2 2C         add dl,0x2C
00401405  ^ EB E3           jmp short serialme.004013EA
00401407    80C2 03         add dl,0x3
0040140A  ^ EB DE           jmp short serialme.004013EA
0040140C    C6043B 72       mov byte ptr ds:[ebx+edi],0x72
00401410    43              inc ebx
00401411    C6043B 65       mov byte ptr ds:[ebx+edi],0x65
00401415    43              inc ebx
00401416    C6043B 63       mov byte ptr ds:[ebx+edi],0x63
0040141A    43              inc ebx
0040141B    C6043B 74       mov byte ptr ds:[ebx+edi],0x74
0040141F    43              inc ebx
00401420    C6043B 21       mov byte ptr ds:[ebx+edi],0x21
00401424    EB 33           jmp short serialme.00401459
00401426    58              pop eax                                  ; user32.76FA4275
00401427    83F0 0B         xor eax,0xB
0040142A    83F8 07         cmp eax,0x7
0040142D    75 1B           jnz short serialme.0040144A
0040142F    83F9 00         cmp ecx,0x0
00401432    75 16           jnz short serialme.0040144A
00401434    80F6 0C         xor dh,0xC
00401437    80FE 48         cmp dh,0x48
0040143A    75 0E           jnz short serialme.0040144A
0040143C    C64438 01 00    mov byte ptr ds:[eax+edi+0x1],0x0
00401441    C64438 02 00    mov byte ptr ds:[eax+edi+0x2],0x0
00401446    B2 43           mov dl,0x43
00401448  ^ EB A0           jmp short serialme.004013EA
0040144A    33DB            xor ebx,ebx
0040144C    B2 49           mov dl,0x49
0040144E    B8 07000000     mov eax,0x7
00401453  ^ EB 95           jmp short serialme.004013EA
00401455    B2 6E           mov dl,0x6E
00401457  ^ EB 91           jmp short serialme.004013EA
00401459    83EC 08         sub esp,0x8
0040145C    C3              retn
0040145D    53              push ebx
0040145E    807E 05 33      cmp byte ptr ds:[esi+0x5],0x33
00401462    75 32           jnz short serialme.00401496
00401464    807E 02 2D      cmp byte ptr ds:[esi+0x2],0x2D
00401468    75 2C           jnz short serialme.00401496
0040146A    807E 0A 30      cmp byte ptr ds:[esi+0xA],0x30
0040146E    76 26           jbe short serialme.00401496
00401470    807E 0B 31      cmp byte ptr ds:[esi+0xB],0x31
00401474    75 20           jnz short serialme.00401496
00401476    807E 03 31      cmp byte ptr ds:[esi+0x3],0x31
0040147A    75 1A           jnz short serialme.00401496
0040147C    807E 09 30      cmp byte ptr ds:[esi+0x9],0x30
00401480    75 14           jnz short serialme.00401496
00401482    807E 06 39      cmp byte ptr ds:[esi+0x6],0x39
00401486    75 0E           jnz short serialme.00401496
00401488    807E 0A 39      cmp byte ptr ds:[esi+0xA],0x39
0040148C    77 08           ja short serialme.00401496
0040148E    807E 07 33      cmp byte ptr ds:[esi+0x7],0x33
00401492    75 02           jnz short serialme.00401496
00401494    33C9            xor ecx,ecx                                         ; serialme.<ModuleEntryPoint>
00401496    5B              pop ebx                                             ; kernel32.7741FCC9
00401497    C3              retn
...

看一遍上面的代码可知算法在这行0040128B，
由0040145D这个方法可得：
code[2] = 0x2D (-)
code[5] = 0x33 (3)
code[6] = 0x39 (9)
code[7] = 0x33 (3)
code[9] = 0x30 (0)
code[A] = (0,9]
code[B] = 0x31 (1)

由004013A5 ~ 004013B2可得
code[1] + code[4] + code[8] = 0xAB - 12 = 0x35 * 3 (固定3个5即可，也可随机生成三个和为9F的数)

这样就可得:
code = ?5-1539350?1
第11个数是1~9
第1个数为任意字符
示例：
15-153935051
C3-163936091

经多遍测试，可确定
00401434 80F6 0C xor dh,0xC
00401437 80FE 48 cmp dh,0x48
0040143A 75 0E jnz short serialme.0040144A ; 永远都是失败，无法成功
这行条件无法达成，所以将0040143A改为 nop

 
 
本节高手录制的视频,点击前往查看

 
 
 
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~