新CrackMe160之102 - haggar - keyme1
作者说只能XP下可用，我试下了，win10下多点几下也能运行起来, OD载入程序可看到一堆的花指令直接用插件去掉(菜单->插件->Dejunk,每个选项都执行一下可以去掉几百个花指令)
去掉花指令后，剩下的代码就不多了，看代码的编写习惯应该就是汇编写的，所有代码有如下：
00401000 > $ /E9 5D040000 jmp KeyMe1_?00401462
... //花指令
00401462 > \6A 00 push 0x0 ; /pModule = NULL
00401464 . E8 470A0000 call <jmp.&kernel32.GetModuleHandleA> ; \GetModuleHandleA
00401469 . A3 F8314000 mov dword ptr ds:[0x4031F8],eax
0040146E . C705 FC314000>mov dword ptr ds:[0x4031FC],0x72657375
00401478 . C705 00324000>mov dword ptr ds:[0x403200],0x642E3233
00401482 . C705 04324000>mov dword ptr ds:[0x403204],0x6C6C
0040148C . 68 FC314000 push KeyMe1_?004031FC ; /FileName = "user32.dll"
00401491 . E8 2C0A0000 call <jmp.&kernel32.LoadLibraryA> ; \LoadLibraryA
00401496 . C705 60324000>mov dword ptr ds:[0x403260],0x636F6C42
004014A0 . C705 64324000>mov dword ptr ds:[0x403264],0x706E496B
004014AA . C705 68324000>mov dword ptr ds:[0x403268],0x7475
004014B4 . 68 60324000 push KeyMe1_?00403260 ; /ProcNameOrOrdinal = "BlockInput"
004014B9 . 50 push eax ; |hModule = 00000031
004014BA . E8 F7090000 call <jmp.&kernel32.GetProcAddress> ; \GetProcAddress
004014BF . 6A 01 push 0x1
004014C1 . FFD0 call eax
004014C3 . 6A 00 push 0x0 ; /Title = NULL
004014C5 . 68 C4314000 push KeyMe1_?004031C4 ; |Class = "OLLYDBG"
004014CA . E8 C3090000 call <jmp.&user32.FindWindowA> ; \FindWindowA
004014CF . 83F8 00 cmp eax,0x0
004014D2 . 74 1A je short KeyMe1_?004014EE
004014D4 . 6A 30 push 0x30 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL
004014D6 . 68 7D314000 push KeyMe1_?0040317D ; |Title = "Got you!"
004014DB . 68 86314000 push KeyMe1_?00403186 ; |Text = "Buahaha ha ha ... Dude , what are you going to do now >:-> .."
004014E0 . 6A 00 push 0x0 ; |hOwner = NULL
004014E2 . E8 B7090000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004014E7 . 6A 00 push 0x0 ; /ExitCode = 0x0
004014E9 . E8 BC090000 call <jmp.&kernel32.ExitProcess> ; \ExitProcess
004014EE > C705 FC314000>mov dword ptr ds:[0x4031FC],0x72657375
004014F8 . C705 00324000>mov dword ptr ds:[0x403200],0x642E3233
00401502 . C705 04324000>mov dword ptr ds:[0x403204],0x6C6C
0040150C . 68 FC314000 push KeyMe1_?004031FC ; /FileName = "user32.dll"
00401511 . E8 AC090000 call <jmp.&kernel32.LoadLibraryA> ; \LoadLibraryA
00401516 . C705 60324000>mov dword ptr ds:[0x403260],0x636F6C42
00401520 . C705 64324000>mov dword ptr ds:[0x403264],0x706E496B
0040152A . C705 68324000>mov dword ptr ds:[0x403268],0x7475
00401534 . 68 60324000 push KeyMe1_?00403260 ; /ProcNameOrOrdinal = "BlockInput"
00401539 . 50 push eax ; |hModule = 00000031
0040153A . E8 77090000 call <jmp.&kernel32.GetProcAddress> ; \GetProcAddress
0040153F . 6A 00 push 0x0
00401541 . FFD0 call eax
00401543 . E9 BB050000 jmp KeyMe1_?00401B03
... //花指令
00401B03 > E8 B4030000 call <jmp.&kernel32.GetVersion>
00401B08 . 3C 05 cmp al,0x5
00401B0A . 75 7F jnz short KeyMe1_?00401B8B
00401B0C . C705 FC314000>mov dword ptr ds:[0x4031FC],0x6E72656B
00401B16 . C705 00324000>mov dword ptr ds:[0x403200],0x32336C65
00401B20 . C705 04324000>mov dword ptr ds:[0x403204],0x6C6C642E
00401B2A . C705 08324000>mov dword ptr ds:[0x403208],0x0
00401B34 . 68 FC314000 push KeyMe1_?004031FC ; /FileName = "user32.dll"
00401B39 . E8 84030000 call <jmp.&kernel32.LoadLibraryA> ; \LoadLibraryA
00401B3E . C705 60324000>mov dword ptr ds:[0x403260],0x65447349
00401B48 . C705 64324000>mov dword ptr ds:[0x403264],0x67677562
00401B52 . C705 68324000>mov dword ptr ds:[0x403268],0x72507265
00401B5C . C705 6C324000>mov dword ptr ds:[0x40326C],0x6E657365
00401B66 . C705 70324000>mov dword ptr ds:[0x403270],0x74
00401B70 . 68 60324000 push KeyMe1_?00403260 ; /ProcNameOrOrdinal = "BlockInput"
00401B75 . 50 push eax ; |hModule = 00000031
00401B76 . E8 3B030000 call <jmp.&kernel32.GetProcAddress> ; \GetProcAddress
00401B7B . FFD0 call eax
00401B7D . 83F8 00 cmp eax,0x0
00401B80 . 74 09 je short KeyMe1_?00401B8B
00401B82 . 6A 00 push 0x0 ; /Reserved = 0x0
00401B84 . 6A 00 push 0x0 ; |Options = EWX_LOGOFF
00401B86 . E8 01030000 call <jmp.&user32.ExitWindowsEx> ; \ExitWindowsEx
00401B8B > 6A 00 push 0x0 ; /lParam = NULL
00401B8D . 68 AA1B4000 push KeyMe1_?00401BAA ; |DlgProc = KeyMe1_?00401BAA
00401B92 . 6A 00 push 0x0 ; |hOwner = NULL
00401B94 . 68 E9030000 push 0x3E9 ; |pTemplate = 0x3E9
00401B99 . FF35 F8314000 push dword ptr ds:[0x4031F8] ; |hInst = 00400000
00401B9F . E8 DC020000 call <jmp.&user32.DialogBoxParamA> ; \DialogBoxParamA
00401BA4 . 50 push eax ; /ExitCode = 0x31
00401BA5 . E8 00030000 call <jmp.&kernel32.ExitProcess> ; \ExitProcess
00401BAA /. 55 push ebp
00401BAB |. 8BEC mov ebp,esp
00401BAD |. 817D 0C 11010>cmp [arg.2],0x111
00401BB4 |. 75 4A jnz short KeyMe1_?00401C00
00401BB6 |. 8B45 10 mov eax,[arg.3]
00401BB9 |. 3D EB030000 cmp eax,0x3EB ; Switch (cases 3EB..3ED)
00401BBE |. 75 07 jnz short KeyMe1_?00401BC7
00401BC0 |. E8 5C010000 call KeyMe1_?00401D21 ; Case 3EB of switch 00401BB9
00401BC5 |. EB 49 jmp short KeyMe1_?00401C10
00401BC7 |> 3D EC030000 cmp eax,0x3EC
00401BCC |. 75 1B jnz short KeyMe1_?00401BE9
00401BCE |. 6A 1E push 0x1E ; /Count = 1E (30.); Case 3EC of switch 00401BB9
00401BD0 |. 68 D0314000 push KeyMe1_?004031D0 ; |Buffer = KeyMe1_?004031D0
00401BD5 |. 68 EA030000 push 0x3EA ; |ControlID = 3EA (1002.)
00401BDA |. FF75 08 push [arg.1] ; |hWnd = 000F432C ('KeyMe no.1 _..-~ˇˇ^^-:-..?????',class='#32770')
00401BDD |. E8 B6020000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
00401BE2 |. E8 2F000000 call KeyMe1_?00401C16
00401BE7 |. EB 27 jmp short KeyMe1_?00401C10
00401BE9 |> 3D ED030000 cmp eax,0x3ED
00401BEE |. 75 20 jnz short KeyMe1_?00401C10
00401BF0 |. 6A 00 push 0x0 ; /lParam = 0x0; Case 3ED of switch 00401BB9
00401BF2 |. 6A 00 push 0x0 ; |wParam = 0x0
00401BF4 |. 6A 10 push 0x10 ; |Message = WM_CLOSE
00401BF6 |. FF75 08 push [arg.1] ; |hWnd = 0xF432C
00401BF9 |. E8 A6020000 call <jmp.&user32.SendMessageA> ; \SendMessageA
00401BFE |. EB 10 jmp short KeyMe1_?00401C10
00401C00 |> 837D 0C 10 cmp [arg.2],0x10
00401C04 |. 75 0A jnz short KeyMe1_?00401C10
00401C06 |. 6A 00 push 0x0 ; /Result = 0x0
00401C08 |. FF75 08 push [arg.1] ; |hWnd = 000F432C ('KeyMe no.1 _..-~ˇˇ^^-:-..?????',class='#32770')
00401C0B |. E8 76020000 call <jmp.&user32.EndDialog> ; \EndDialog
00401C10 |> 33C0 xor eax,eax ; Default case of switch 00401BB9
00401C12 |. C9 leave
00401C13 \. C2 1000 retn 0x10
00401C16 $ 83F8 00 cmp eax,0x0
00401C19 . 75 0B jnz short KeyMe1_?00401C26
00401C1B . C3 retn
00401C1C . 44 75 6D 62 2>ascii "Dumb ape!",0
00401C26 > 83F8 1D cmp eax,0x1D
00401C29 . 74 13 je short KeyMe1_?00401C3E
00401C2B . C3 retn
00401C2C . 4E 6F 2C 20 6>ascii "No, no and no >:"
00401C3C . 28 00 ascii "(",0
00401C3E > 803D D5314000>cmp byte ptr ds:[0x4031D5],0x2D
00401C45 . 74 0C je short KeyMe1_?00401C53
00401C47 . C3 retn
00401C48 . 61 72 67 68 6>ascii "arghhhh...",0
00401C53 > 803D DB314000>cmp byte ptr ds:[0x4031DB],0x2D
00401C5A . 74 12 je short KeyMe1_?00401C6E
00401C5C . C3 retn
00401C5D . 6F 68 2C 20 6>ascii "oh, not again..."
00401C6D . 00 ascii 0
00401C6E > 803D E1314000>cmp byte ptr ds:[0x4031E1],0x2D
00401C75 . 74 0F je short KeyMe1_?00401C86
00401C77 . C3 retn
00401C78 . 74 73 2C 20 7>ascii "ts, ts, ts...",0
00401C86 > 803D E7314000>cmp byte ptr ds:[0x4031E7],0x2D
00401C8D . 74 10 je short KeyMe1_?00401C9F
00401C8F . C3 retn
00401C90 . 6E 6F 70 2C 2>ascii "nop, just nop.",0
00401C9F > 803D ED314000>cmp byte ptr ds:[0x4031ED],0x0
00401CA6 . 74 0A je short KeyMe1_?00401CB2
00401CA8 . C3 retn
00401CA9 . 68 6D 6D 6D 2>ascii "hmmm, OK",0
00401CB2 > EB 30 jmp short KeyMe1_?00401CE4
... //花指令
00401CE4 > E8 4C000000 call KeyMe1_?00401D35
00401CE9 . 83F8 00 cmp eax,0x0
00401CEC . 74 01 je short KeyMe1_?00401CEF
00401CEE . C3 retn
00401CEF > E8 7E000000 call KeyMe1_?00401D72
00401CF4 . 83F8 00 cmp eax,0x0
00401CF7 . 74 01 je short KeyMe1_?00401CFA
00401CF9 . C3 retn
00401CFA > E8 B0000000 call KeyMe1_?00401DAF
00401CFF . 83F8 00 cmp eax,0x0
00401D02 . 74 01 je short KeyMe1_?00401D05
00401D04 . C3 retn
00401D05 > E8 E2000000 call KeyMe1_?00401DEC
00401D0A . 83F8 00 cmp eax,0x0
00401D0D . 74 01 je short KeyMe1_?00401D10
00401D0F . C3 retn
00401D10 > E8 14010000 call KeyMe1_?00401E29
00401D15 . 83F8 00 cmp eax,0x0
00401D18 . 74 01 je short KeyMe1_?00401D1B
00401D1A . C3 retn
00401D1B > E8 4B010000 call KeyMe1_?00401E6B
00401D20 . C3 retn
00401D21 /$ 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
00401D23 |. 68 1F304000 push KeyMe1_?0040301F ; |Title = "About"
00401D28 |. 68 25304000 push KeyMe1_?00403025 ; |Text = "Your task is to find valid serial for this crackme and then write a good
tutorial. Beware of small anti-Olly tricks :)
Greets goes to everybody on CRACKMES.DE , BIW reversing , SnD ,
FHCF and ARTEAM.
haggar ~ 08.04.2006"
00401D2D |. 6A 00 push 0x0 ; |hOwner = NULL
00401D2F |. E8 6A010000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00401D34 \. C3 retn
00401D35 /$ 33C0 xor eax,eax
00401D37 |. 33DB xor ebx,ebx
00401D39 |. 0FB605 D03140>movzx eax,byte ptr ds:[0x4031D0]
00401D40 |. 0FB61D D13140>movzx ebx,byte ptr ds:[0x4031D1]
00401D47 |. 03C3 add eax,ebx
00401D49 |. F7E3 mul ebx
00401D4B |. 0FB61D D23140>movzx ebx,byte ptr ds:[0x4031D2]
00401D52 |. 03C3 add eax,ebx
00401D54 |. F7E3 mul ebx
00401D56 |. 0FB61D D33140>movzx ebx,byte ptr ds:[0x4031D3]
00401D5D |. 03C3 add eax,ebx
00401D5F |. F7E3 mul ebx
00401D61 |. 0FB61D D43140>movzx ebx,byte ptr ds:[0x4031D4]
00401D68 |. 03C3 add eax,ebx
00401D6A |. F7E3 mul ebx
00401D6C |. 35 A915CF31 xor eax,0x31CF15A9
00401D71 \. C3 retn
00401D72 /$ 33C0 xor eax,eax
00401D74 |. 33DB xor ebx,ebx
00401D76 |. 0FB605 D63140>movzx eax,byte ptr ds:[0x4031D6]
00401D7D |. 0FB61D D73140>movzx ebx,byte ptr ds:[0x4031D7]
00401D84 |. 03C3 add eax,ebx
00401D86 |. F7E3 mul ebx
00401D88 |. 0FB61D D83140>movzx ebx,byte ptr ds:[0x4031D8]
00401D8F |. 03C3 add eax,ebx
00401D91 |. F7E3 mul ebx
00401D93 |. 0FB61D D93140>movzx ebx,byte ptr ds:[0x4031D9]
00401D9A |. 03C3 add eax,ebx
00401D9C |. F7E3 mul ebx
00401D9E |. 0FB61D DA3140>movzx ebx,byte ptr ds:[0x4031DA]
00401DA5 |. 03C3 add eax,ebx
00401DA7 |. F7E3 mul ebx
00401DA9 |. 2D 60F69028 sub eax,0x2890F660
00401DAE \. C3 retn
00401DAF /$ 33C0 xor eax,eax
00401DB1 |. 33DB xor ebx,ebx
00401DB3 |. 0FB605 DC3140>movzx eax,byte ptr ds:[0x4031DC]
00401DBA |. 0FB61D DD3140>movzx ebx,byte ptr ds:[0x4031DD]
00401DC1 |. 03C3 add eax,ebx
00401DC3 |. F7E3 mul ebx
00401DC5 |. 0FB61D DE3140>movzx ebx,byte ptr ds:[0x4031DE]
00401DCC |. 03C3 add eax,ebx
00401DCE |. F7E3 mul ebx
00401DD0 |. 0FB61D DF3140>movzx ebx,byte ptr ds:[0x4031DF]
00401DD7 |. 03C3 add eax,ebx
00401DD9 |. F7E3 mul ebx
00401DDB |. 0FB61D E03140>movzx ebx,byte ptr ds:[0x4031E0]
00401DE2 |. 03C3 add eax,ebx
00401DE4 |. F7E3 mul ebx
00401DE6 |. 05 300AC0D3 add eax,0xD3C00A30
00401DEB \. C3 retn
00401DEC /$ 33C0 xor eax,eax
00401DEE |. 33DB xor ebx,ebx
00401DF0 |. 0FB605 E23140>movzx eax,byte ptr ds:[0x4031E2]
00401DF7 |. 0FB61D E33140>movzx ebx,byte ptr ds:[0x4031E3]
00401DFE |. 03C3 add eax,ebx
00401E00 |. F7E3 mul ebx
00401E02 |. 0FB61D E43140>movzx ebx,byte ptr ds:[0x4031E4]
00401E09 |. 03C3 add eax,ebx
00401E0B |. F7E3 mul ebx
00401E0D |. 0FB61D E53140>movzx ebx,byte ptr ds:[0x4031E5]
00401E14 |. 03C3 add eax,ebx
00401E16 |. F7E3 mul ebx
00401E18 |. 0FB61D E63140>movzx ebx,byte ptr ds:[0x4031E6]
00401E1F |. 03C3 add eax,ebx
00401E21 |. F7E3 mul ebx
00401E23 |. 1D 11589C2F sbb eax,0x2F9C5811
00401E28 \. C3 retn
00401E29 /$ 33C0 xor eax,eax
00401E2B |. 33DB xor ebx,ebx
00401E2D |. 0FB605 E83140>movzx eax,byte ptr ds:[0x4031E8]
00401E34 |. 0FB61D E93140>movzx ebx,byte ptr ds:[0x4031E9]
00401E3B |. 03C3 add eax,ebx
00401E3D |. F7E3 mul ebx
00401E3F |. 0FB61D EA3140>movzx ebx,byte ptr ds:[0x4031EA]
00401E46 |. 03C3 add eax,ebx
00401E48 |. F7E3 mul ebx
00401E4A |. 0FB61D EB3140>movzx ebx,byte ptr ds:[0x4031EB]
00401E51 |. 03C3 add eax,ebx
00401E53 |. F7E3 mul ebx
00401E55 |. 0FB61D EC3140>movzx ebx,byte ptr ds:[0x4031EC]
00401E5C |. 03C3 add eax,ebx
00401E5E |. F7E3 mul ebx
00401E60 |. BB D48A412D mov ebx,0x2D418AD4
00401E65 |. F7F3 div ebx
00401E67 |. 83E8 01 sub eax,0x1
00401E6A \. C3 retn
00401E6B /$ 6A 40 push 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
00401E6D |. 68 08314000 push KeyMe1_?00403108 ; |Title = "Well done :)"
00401E72 |. 68 15314000 push KeyMe1_?00403115 ; |Text = "Thumbs up, young cracker! You have done a good job :)
Now wrote small tutorial that will help others."
00401E77 |. 6A 00 push 0x0 ; |hOwner = NULL
00401E79 |. E8 20000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00401E7E \. C3 retn
00401E7F CC int3
00401E80 $- FF25 28204000 jmp dword ptr ds:[<&user32.DialogBoxParamA>] ; user32.DialogBoxParamA
00401E86 $- FF25 24204000 jmp dword ptr ds:[<&user32.EndDialog>] ; user32.EndDialog
00401E8C $- FF25 20204000 jmp dword ptr ds:[<&user32.ExitWindowsEx>] ; user32.ExitWindowsEx
00401E92 $- FF25 1C204000 jmp dword ptr ds:[<&user32.FindWindowA>] ; user32.FindWindowA
00401E98 $- FF25 18204000 jmp dword ptr ds:[<&user32.GetDlgItemTextA>] ; user32.GetDlgItemTextA
00401E9E $- FF25 30204000 jmp dword ptr ds:[<&user32.MessageBoxA>] ; user32.MessageBoxA
00401EA4 $- FF25 2C204000 jmp dword ptr ds:[<&user32.SendMessageA>] ; user32.SendMessageA
00401EAA .- FF25 0C204000 jmp dword ptr ds:[<&kernel32.ExitProcess>] ; kernel32.ExitProcess
00401EB0 $- FF25 08204000 jmp dword ptr ds:[<&kernel32.GetModuleHandleA>] ; kernel32.GetModuleHandleA
00401EB6 $- FF25 04204000 jmp dword ptr ds:[<&kernel32.GetProcAddress>] ; kernel32.GetProcAddress
00401EBC $- FF25 00204000 jmp dword ptr ds:[<&kernel32.GetVersion>] ; kernel32.GetVersion
00401EC2 $- FF25 10204000 jmp dword ptr ds:[<&kernel32.LoadLibraryA>] ; kernel32.LoadLibraryA
... //空数据
所以总的代码就这200多行，
00401BDD |. E8 B6020000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
00401BE2 |. E8 2F000000 call KeyMe1_?00401C16
第一行是获取文本框内容，那下面这行call就是关键算法处了，下好断点就可以分析算法了
00401C16 ~ 00401C9F 可得密钥长度得是29位,第6,12,18,24位为'-'号,将整个密钥分为5段
00401CE4 ~ 00401D10 分别是5段中第一段的算法
1). ((((code[0] + code[1]) * code[1] + code[2]) * code[2] + code[3]) * code[3] + code[4]) * code[4] = 0x31CF15A9
2). ((((code[6] + code[7]) * code[7] + code[8]) * code[8] + code[9]) * code[9] + code[10]) * code[10] = 0x2890F660
3). ((((code[12] + code[13]) * code[13] + code[14]) * code[14] + code[15]) * code[15] + code[16]) * code[16] = -0xD3C00A30 = 0x2C3FF5D0
4). ((((code[18] + code[19]) * code[19] + code[20]) * code[20] + code[21]) * code[21] + code[22]) * code[22] = 0x2F9C5811
5). ((((code[24] + code[25]) * code[25] + code[26]) * code[26] + code[27]) * code[27] + code[28]) * code[28] = 0x2D418AD4
五段的算法都一样,都是连乘的算法,所以我们只需要因式分解大数就可以了
0x31CF15A9 = 53(53+15767024) = 53(53+52(52+303160)) = 53(53+52(52+55(55+5778))) = 53(53+52(52+55(55+51(51+56))))
第1段为: 83745
0x2890F660 = 52(52+13088196) = 52(52+54(54+242320)) = 52(52+54(54+52(52+4608))) = 52(52+54(54+52(52+48(48+48))))
第2段为: 00464
0x2C3FF5D0 = 49(49+15150751) = 49(49+49(49+309150)) = 49(49+49(49+54(54+5671))) = 49(49+49(49+54(54+53(53+54))))
第3段为: 65611
0x2F9C5811 = 49(49+16301488) = 49(49+56(56+291042)) = 49(49+56(56+57(57+5049))) = 49(49+56(56+57(57+51(51+48))))
第4段为: 03981
0x2D418AD4 = 50(50+15185352) = 50(50+51(51+297701)) = 50(50+51(51+53(53+5564))) = 50(50+51(51+53(53+52(52+55))))
第5段为: 74532
最终注册码为: 83745-00464-65611-03981-74532
因式分解结果不一定是唯一的,这是其中一个结果，经后期测试注册码只有两个，后4段都唯一，只有第一段有两种
83745-00464-65611-03981-74532
56445-00464-65611-03981-74532
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号