新CrackMe160之127 - skillas_keygenme4
汇编的程序直接使用OD查看源码
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 31020000 call <jmp.&kernel32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 0C314000 mov dword ptr ds:[0x40310C],eax
0040100C |. 6A 00 push 0x0 ; /lParam = NULL
0040100E |. 68 2B104000 push skilLa's.0040102B ; |DlgProc = skilLa's.0040102B
00401013 |. 6A 00 push 0x0 ; |hOwner = NULL
00401015 |. 68 E9030000 push 0x3E9 ; |pTemplate = 0x3E9
0040101A |. FF35 0C314000 push dword ptr ds:[0x40310C] ; |hInst = NULL
00401020 |. E8 EF010000 call <jmp.&user32.DialogBoxParamA> ; \DialogBoxParamA
00401025 |. 50 push eax ; /ExitCode = 0x19FFCC
00401026 \. E8 07020000 call <jmp.&kernel32.ExitProcess> ; \ExitProcess
0040102B . 55 push ebp
0040102C . 8BEC mov ebp,esp
0040102E . 817D 0C 11010>cmp dword ptr ss:[ebp+0xC],0x111
00401035 . 0F85 0A010000 jnz skilLa's.00401145
0040103B . 8B45 10 mov eax,dword ptr ss:[ebp+0x10]
0040103E . 3D EC030000 cmp eax,0x3EC
00401043 . 0F85 C8000000 jnz skilLa's.00401111
00401049 . 6A 14 push 0x14 ; /Count = 14 (20.)
0040104B . 68 89304000 push skilLa's.00403089 ; |Buffer = skilLa's.00403089
00401050 . 68 EA030000 push 0x3EA ; |ControlID = 3EA (1002.)
00401055 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 002EE000
00401058 . E8 C3010000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
0040105D . 85C0 test eax,eax
0040105F . 0F84 F0000000 je skilLa's.00401155
00401065 . 8D35 AC304000 lea esi,dword ptr ds:[0x4030AC]
0040106B . E8 EB000000 call skilLa's.0040115B ; 关键算法
00401070 . 6A 09 push 0x9 ; /Count = 0x9
00401072 . 68 8E304000 push skilLa's.0040308E ; |Buffer = skilLa's.0040308E
00401077 . 68 EB030000 push 0x3EB ; |ControlID = 3EB (1003.)
0040107C . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 002EE000
0040107F . E8 9C010000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
00401084 . 85C0 test eax,eax
00401086 . 0F84 C9000000 je skilLa's.00401155
0040108C . 33C9 xor ecx,ecx ; skilLa's.<ModuleEntryPoint>
0040108E . 8D35 97304000 lea esi,dword ptr ds:[0x403097]
00401094 . BB 10000000 mov ebx,0x10
00401099 > 0FBE81 8E3040>movsx eax,byte ptr ds:[ecx+0x40308E]
004010A0 . 3C 00 cmp al,0x0 ; Switch (cases 0..3F)
004010A2 . 74 28 je short skilLa's.004010CC
004010A4 . 3C 40 cmp al,0x40
004010A6 . 72 04 jb short skilLa's.004010AC
004010A8 . 2C 37 sub al,0x37
004010AA . EB 02 jmp short skilLa's.004010AE
004010AC > 2C 30 sub al,0x30 ; Cases 1,2,3,4,5,6,7,8,9,A,B,C,D,E,F,10,11,12,13,14,15,16,17,18,19,1A,1B,1C,1D,1E,1F,20,21,22,23,24,25,26,27,28,29,2A,2B,2C,2D,2E,2F,30,31,32,33,34,35,36,37,38,39,3A,3B,3C,3D,3E,3F of switch 004010A0
004010AE > F7E3 mul ebx ; Default case of switch 004010A0
004010B0 . 86E0 xchg al,ah
004010B2 . 8A81 8F304000 mov al,byte ptr ds:[ecx+0x40308F]
004010B8 . 3C 40 cmp al,0x40
004010BA . 72 04 jb short skilLa's.004010C0
004010BC . 2C 37 sub al,0x37
004010BE . EB 02 jmp short skilLa's.004010C2
004010C0 > 2C 30 sub al,0x30
004010C2 > 02C4 add al,ah
004010C4 . 8806 mov byte ptr ds:[esi],al
004010C6 . 46 inc esi ; skilLa's.<ModuleEntryPoint>
004010C7 . 83C1 02 add ecx,0x2
004010CA .^ EB CD jmp short skilLa's.00401099
004010CC > 8D35 DD304000 lea esi,dword ptr ds:[0x4030DD] ; Case 0 of switch 004010A0
004010D2 . E8 84000000 call skilLa's.0040115B ; 关键算法
004010D7 . A1 97304000 mov eax,dword ptr ds:[0x403097]
004010DC . 3D FB104000 cmp eax,skilLa's.004010FB ; 关键比较
004010E1 . 75 02 jnz short skilLa's.004010E5
004010E3 .- FFE0 jmp eax
004010E5 > 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
004010E7 . 68 81304000 push skilLa's.00403081 ; |Title = "Oh no!!"
004010EC . 68 7C304000 push skilLa's.0040307C ; |Text = "Oops"
004010F1 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hOwner = 002EE000
004010F4 . E8 2D010000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004010F9 . EB 5A jmp short skilLa's.00401155
004010FB . 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
004010FD . 68 75304000 push skilLa's.00403075 ; |Title = "Oh yes"
00401102 . 68 4E304000 push skilLa's.0040304E ; |Text = "Good you solved it write a tut please!"
00401107 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hOwner = 002EE000
0040110A . E8 17010000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
0040110F . EB 44 jmp short skilLa's.00401155
00401111 > 3D ED030000 cmp eax,0x3ED
00401116 . 75 16 jnz short skilLa's.0040112E
00401118 . 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
0040111A . 68 48304000 push skilLa's.00403048 ; |Title = "About"
0040111F . 68 00304000 push skilLa's.00403000 ; |Text = "Solve it without bruteforce,it contains a litle vm. Coded by skilLa^REM"
00401124 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hOwner = 002EE000
00401127 . E8 FA000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
0040112C . EB 27 jmp short skilLa's.00401155
0040112E > 3D EC030000 cmp eax,0x3EC
00401133 . 75 20 jnz short skilLa's.00401155
00401135 . 6A 00 push 0x0 ; /lParam = 0x0
00401137 . 6A 00 push 0x0 ; |wParam = 0x0
00401139 . 6A 10 push 0x10 ; |Message = WM_CLOSE
0040113B . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 0x2EE000
0040113E . E8 E9000000 call <jmp.&user32.SendMessageA> ; \SendMessageA
00401143 . EB 10 jmp short skilLa's.00401155
00401145 > 837D 0C 10 cmp dword ptr ss:[ebp+0xC],0x10
00401149 . 75 0A jnz short skilLa's.00401155
0040114B . 6A 00 push 0x0 ; /Result = 0x0
0040114D . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd = 002EE000
00401150 . E8 C5000000 call <jmp.&user32.EndDialog> ; \EndDialog
00401155 > 33C0 xor eax,eax
00401157 . C9 leave
00401158 . C2 1000 retn 0x10
0040115B /$ 8A1E /mov bl,byte ptr ds:[esi] ; 关键算法入口
0040115D |. 0FBEDB |movsx ebx,bl
00401160 |. 8BC3 |mov eax,ebx
00401162 |. 83F8 44 |cmp eax,0x44 ; Switch (cases 44..60)
00401165 |. 75 19 |jnz short skilLa's.00401180
00401167 |. 8B46 01 |mov eax,dword ptr ds:[esi+0x1] ; Case 44 ('D') of switch 00401162
0040116A |. 8B00 |mov eax,dword ptr ds:[eax]
0040116C |. 8B5E 05 |mov ebx,dword ptr ds:[esi+0x5]
0040116F |. 8B1B |mov ebx,dword ptr ds:[ebx]
00401171 |. 33C3 |xor eax,ebx
00401173 |. 8B5E 01 |mov ebx,dword ptr ds:[esi+0x1]
00401176 |. 8903 |mov dword ptr ds:[ebx],eax
00401178 |. 83C6 09 |add esi,0x9
0040117B |. E9 8E000000 |jmp skilLa's.0040120E
00401180 |> 83F8 45 |cmp eax,0x45
00401183 |. 75 16 |jnz short skilLa's.0040119B
00401185 |. 8B46 01 |mov eax,dword ptr ds:[esi+0x1] ; Case 45 ('E') of switch 00401162
00401188 |. 8B00 |mov eax,dword ptr ds:[eax]
0040118A |. 8B5E 05 |mov ebx,dword ptr ds:[esi+0x5]
0040118D |. 8B1B |mov ebx,dword ptr ds:[ebx]
0040118F |. 03C3 |add eax,ebx
00401191 |. 8B5E 01 |mov ebx,dword ptr ds:[esi+0x1]
00401194 |. 8903 |mov dword ptr ds:[ebx],eax
00401196 |. 83C6 09 |add esi,0x9
00401199 |. EB 73 |jmp short skilLa's.0040120E
0040119B |> 83F8 46 |cmp eax,0x46
0040119E |. 75 16 |jnz short skilLa's.004011B6
004011A0 |. 8B46 01 |mov eax,dword ptr ds:[esi+0x1] ; Case 46 ('F') of switch 00401162
004011A3 |. 8B00 |mov eax,dword ptr ds:[eax]
004011A5 |. 8B5E 05 |mov ebx,dword ptr ds:[esi+0x5]
004011A8 |. 8B1B |mov ebx,dword ptr ds:[ebx]
004011AA |. F7E3 |mul ebx
004011AC |. 8B5E 01 |mov ebx,dword ptr ds:[esi+0x1]
004011AF |. 8903 |mov dword ptr ds:[ebx],eax
004011B1 |. 83C6 09 |add esi,0x9
004011B4 |. EB 58 |jmp short skilLa's.0040120E
004011B6 |> 83F8 47 |cmp eax,0x47
004011B9 |. 75 16 |jnz short skilLa's.004011D1
004011BB |. 8B46 01 |mov eax,dword ptr ds:[esi+0x1] ; Case 47 ('G') of switch 00401162
004011BE |. 8B00 |mov eax,dword ptr ds:[eax]
004011C0 |. 8B5E 05 |mov ebx,dword ptr ds:[esi+0x5]
004011C3 |. 8A0B |mov cl,byte ptr ds:[ebx]
004011C5 |. D3E0 |shl eax,cl
004011C7 |. 8B5E 01 |mov ebx,dword ptr ds:[esi+0x1]
004011CA |. 8903 |mov dword ptr ds:[ebx],eax
004011CC |. 83C6 09 |add esi,0x9
004011CF |. EB 3D |jmp short skilLa's.0040120E
004011D1 |> 83F8 48 |cmp eax,0x48
004011D4 |. 75 16 |jnz short skilLa's.004011EC
004011D6 |. 8B46 01 |mov eax,dword ptr ds:[esi+0x1] ; Case 48 ('H') of switch 00401162
004011D9 |. 8B00 |mov eax,dword ptr ds:[eax]
004011DB |. 8B5E 05 |mov ebx,dword ptr ds:[esi+0x5]
004011DE |. 8A0B |mov cl,byte ptr ds:[ebx]
004011E0 |. D3E8 |shr eax,cl
004011E2 |. 8B5E 01 |mov ebx,dword ptr ds:[esi+0x1]
004011E5 |. 8903 |mov dword ptr ds:[ebx],eax
004011E7 |. 83C6 09 |add esi,0x9
004011EA |. EB 22 |jmp short skilLa's.0040120E
004011EC |> 83F8 49 |cmp eax,0x49
004011EF |. 75 16 |jnz short skilLa's.00401207
004011F1 |. 8B46 01 |mov eax,dword ptr ds:[esi+0x1] ; Case 49 ('I') of switch 00401162
004011F4 |. 8B00 |mov eax,dword ptr ds:[eax]
004011F6 |. 8B5E 05 |mov ebx,dword ptr ds:[esi+0x5]
004011F9 |. 8B1B |mov ebx,dword ptr ds:[ebx]
004011FB |. 2BC3 |sub eax,ebx
004011FD |. 8B5E 01 |mov ebx,dword ptr ds:[esi+0x1]
00401200 |. 8903 |mov dword ptr ds:[ebx],eax
00401202 |. 83C6 09 |add esi,0x9
00401205 |. EB 07 |jmp short skilLa's.0040120E
00401207 |> 83F8 60 |cmp eax,0x60
0040120A |. 75 02 |jnz short skilLa's.0040120E
0040120C |. EB 05 |jmp short skilLa's.00401213 ; Case 60 ('`') of switch 00401162
0040120E |>^ E9 48FFFFFF \jmp skilLa's.0040115B ; Default case of switch 00401162
00401213 \> C3 retn
00401214 $- FF25 1C204000 jmp dword ptr ds:[<&user32.DialogBoxPara>; user32.DialogBoxParamA
0040121A $- FF25 18204000 jmp dword ptr ds:[<&user32.EndDialog>] ; user32.EndDialog
00401220 $- FF25 14204000 jmp dword ptr ds:[<&user32.GetDlgItemTex>; user32.GetDlgItemTextA
00401226 $- FF25 10204000 jmp dword ptr ds:[<&user32.MessageBoxA>] ; user32.MessageBoxA
0040122C $- FF25 0C204000 jmp dword ptr ds:[<&user32.SendMessageA>>; user32.SendMessageA
00401232 .- FF25 04204000 jmp dword ptr ds:[<&kernel32.ExitProcess>; kernel32.ExitProcess
00401238 $- FF25 00204000 jmp dword ptr ds:[<&kernel32.GetModuleHa>; kernel32.GetModuleHandleA
0040123E 00 db 00
OD中单步跟踪算法完成后,还是没理解是什么算法, 但直接按步翻译后运行的注册机是成功的,如下:
#include <stdio.h>
#include <string.h>
int main() {
char user[5] = {0};
printf("用户名: ");
scanf("%s", user); getchar(); //消耗掉多输入的\n
unsigned int u = *(unsigned int*)&user;
u = u ^ 0x1337;
u = u + 0x2016;
u = u * 2;
u = u << 4;
u = u ^ (((0x004010FB + 0x1337) << 3) / 2 - 0xDEAD);
unsigned char *code = (unsigned char *)&u;
printf("注册码: %02X%02X%02X%02X", code[0],code[1],code[2],code[3]);
getchar(); return 0;
}
运行示例:
用户名: skilLa
注册码: 5BB9CC8D
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号