新CrackMe160之124 - Fishing%20With%20DiLA - v5

汇编写的程序直接OD看源码:

00401000 >/$  6A 00         push 0x0                                 ; /pModule = NULL
00401002  |.  E8 E3000000   call <jmp.&kernel32.GetModuleHandleA>    ; \GetModuleHandleA
00401007  |.  6A 00         push 0x0                                 ; /lParam = NULL
00401009  |.  68 22104000   push v5.00401022                         ; |DlgProc = v5.00401022
0040100E  |.  6A 00         push 0x0                                 ; |hOwner = NULL
00401010  |.  68 E9030000   push 0x3E9                               ; |pTemplate = 0x3E9
00401015  |.  50            push eax                                 ; |hInst = 0019FFCC
00401016  |.  E8 B7000000   call <jmp.&user32.DialogBoxParamA>       ; \DialogBoxParamA
0040101B  |.  6A 00         push 0x0                                 ; /ExitCode = 0x0
0040101D  \.  E8 C2000000   call <jmp.&kernel32.ExitProcess>         ; \ExitProcess
00401022  /.  55            push ebp
00401023  |.  8BEC          mov ebp,esp
00401025  |.  53            push ebx
00401026  |.  56            push esi                                 ;  v5.<ModuleEntryPoint>
00401027  |.  57            push edi                                 ;  v5.<ModuleEntryPoint>
00401028  |.  817D 0C 11010>cmp [arg.2],0x111
0040102F  |.  75 56         jnz short v5.00401087
00401031  |.  817D 10 EB030>cmp [arg.3],0x3EB
00401038  |.  75 4B         jnz short v5.00401085
0040103A  |.  6A 00         push 0x0                                 ; /IsSigned = FALSE
0040103C  |.  6A 00         push 0x0                                 ; |pSuccess = NULL
0040103E  |.  68 EA030000   push 0x3EA                               ; |ControlID = 3EA (1002.)
00401043  |.  FF75 08       push [arg.1]                             ; |hWnd = 0025C000
00401046  |.  E8 8D000000   call <jmp.&user32.GetDlgItemInt>         ; \GetDlgItemInt
0040104B  |.  50            push eax
0040104C  |.  68 BF104000   push v5.004010BF
00401051  |.  E8 48000000   call v5.0040109E                         ; 算法在这里
00401056  |.  83F8 01       cmp eax,0x1
00401059  |.  74 16         je short v5.00401071
0040105B  |.  6A 10         push 0x10                                ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
0040105D  |.  68 00304000   push v5.00403000                         ; |Title = "Fishing with DiLA v0.5"
00401062  |.  68 17304000   push v5.00403017                         ; |Text = "Sorry, wrong code!"
00401067  |.  FF75 08       push [arg.1]                             ; |hOwner = 0025C000
0040106A  |.  E8 6F000000   call <jmp.&user32.MessageBoxA>           ; \MessageBoxA
0040106F  |.  EB 14         jmp short v5.00401085
00401071  |>  6A 40         push 0x40                                ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
00401073  |.  68 00304000   push v5.00403000                         ; |Title = "Fishing with DiLA v0.5"
00401078  |.  68 2A304000   push v5.0040302A                         ; |Text = "Success! Thank you for playing ;)"
0040107D  |.  FF75 08       push [arg.1]                             ; |hOwner = 0025C000
00401080  |.  E8 59000000   call <jmp.&user32.MessageBoxA>           ; \MessageBoxA
00401085  |>  EB 0E         jmp short v5.00401095
00401087  |>  837D 0C 10    cmp [arg.2],0x10
0040108B  |.  75 08         jnz short v5.00401095
0040108D  |.  FF75 08       push [arg.1]                             ; /hWnd = 0025C000
00401090  |.  E8 37000000   call <jmp.&user32.DestroyWindow>         ; \DestroyWindow
00401095  |>  33C0          xor eax,eax
00401097  |.  5F            pop edi                                  ;  kernel32.7741FCC9
00401098  |.  5E            pop esi                                  ;  kernel32.7741FCC9
00401099  |.  5B            pop ebx                                  ;  kernel32.7741FCC9
0040109A  |.  C9            leave
0040109B  \.  C2 1000       retn 0x10
0040109E  /$  83C4 10       add esp,0x10                             ; 这是算法, OD调试发现这里要算两次, 第二次才是真正的算法
004010A1  |.  83EC 0C       sub esp,0xC
004010A4  |.  66:35 AFDE    xor ax,0xDEAF                            ; code = code ^ 0xDEAF
004010A8  |.  C1C0 10       rol eax,0x10                             ; code = code <<< 0x10
004010AB  |.  BB CFFFDA3A   mov ebx,0x3ADAFFCF                       ; code ?== 0x3ADAFFCF
004010B0  |.  3BC3          cmp eax,ebx
004010B2  |.  75 08         jnz short v5.004010BC
004010B4  |.  B8 01000000   mov eax,0x1
004010B9  |.  33DB          xor ebx,ebx
004010BB  |.  C3            retn
004010BC  |>  33DB          xor ebx,ebx
004010BE  \.  C3            retn
004010BF   .  58            pop eax                                  ;  kernel32.7741FCC9
004010C0   .  80C4 20       add ah,0x20                              ; 这里两行是关键
004010C3   .  F7D8          neg eax
004010C5   .  68 A1104000   push v5.004010A1
004010CA   .  C3            retn
004010CB      CC            int3
004010CC   $- FF25 18204000 jmp dword ptr ds:[<&user32.DestroyWindow>;  user32.DestroyWindow
004010D2   $- FF25 14204000 jmp dword ptr ds:[<&user32.DialogBoxPara>;  user32.DialogBoxParamA
004010D8   $- FF25 10204000 jmp dword ptr ds:[<&user32.GetDlgItemInt>;  user32.GetDlgItemInt
004010DE   $- FF25 0C204000 jmp dword ptr ds:[<&user32.MessageBoxA>] ;  user32.MessageBoxA
004010E4   .- FF25 04204000 jmp dword ptr ds:[<&kernel32.ExitProcess>;  kernel32.ExitProcess
004010EA   $- FF25 00204000 jmp dword ptr ds:[<&kernel32.GetModuleHa>;  kernel32.GetModuleHandleA
004010F0      00            db 00
004010F1      00            db 00

从上面算法可得:
code = (0x3ADAFFCF >>> 0x10) ^ 0xDEAF = 0xFFCF3ADA ^ 0xDEAF = 0xFFCFE475 = 4291814517
code = (0xFFCFE475 * -1) - 0x2000 = 0x30FB8B = 3210123

 
 
本节高手录制的视频,点击前往查看

 
 
 
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~