新CrackMe160之151 - D4ph1%20 - %20Crackme#1
程序是汇编写的,所以直接看源码
00401000 >/$ 6A 00 push 0x0 ; /pModule = NULL
00401002 |. E8 C3020000 call <jmp.&kernel32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 44334000 mov dword ptr ds:[0x403344],eax
0040100C |. E8 B3020000 call <jmp.&kernel32.GetCommandLineA> ; [GetCommandLineA
00401011 |. A3 48334000 mov dword ptr ds:[0x403348],eax
00401016 |. 6A 00 push 0x0 ; /lParam = NULL
00401018 |. 68 52104000 push D4ph1_-_.00401052 ; |DlgProc = D4ph1_-_.00401052
0040101D |. 6A 00 push 0x0 ; |hOwner = NULL
0040101F |. 6A 66 push 0x66 ; |pTemplate = 0x66
00401021 |. FF35 44334000 push dword ptr ds:[0x403344] ; |hInst = NULL
00401027 |. E8 62020000 call <jmp.&user32.DialogBoxParamA> ; \DialogBoxParamA
0040102C |. 50 push eax ; /ExitCode = 0x19FFCC
0040102D \. E8 8C020000 call <jmp.&kernel32.ExitProcess> ; \ExitProcess
00401032 /$ BB 17000000 mov ebx,0x17
00401037 |. B8 2D000000 mov eax,0x2D
0040103C |. 83F0 0C xor eax,0xC
0040103F |. 83E8 17 sub eax,0x17
00401042 |> 2883 C6314000 /sub byte ptr ds:[ebx+0x4031C6],al
00401048 |. 4B |dec ebx
00401049 |.^ 75 F7 \jnz short D4ph1_-_.00401042
0040104B |. 2883 C6314000 sub byte ptr ds:[ebx+0x4031C6],al
00401051 \. C3 retn
00401052 /. 55 push ebp
00401053 |. 8BEC mov ebp,esp
00401055 |. 817D 0C 10010>cmp [arg.2],0x110
0040105C |. 75 42 jnz short D4ph1_-_.004010A0
0040105E |. 68 EA030000 push 0x3EA ; /ControlID = 3EA (1002.)
00401063 |. FF75 08 push [arg.1] ; |hWnd = 00213000
00401066 |. E8 29020000 call <jmp.&user32.GetDlgItem> ; \GetDlgItem
0040106B |. 68 EB030000 push 0x3EB ; /ControlID = 3EB (1003.)
00401070 |. FF75 08 push [arg.1] ; |hWnd = 00213000
00401073 |. E8 1C020000 call <jmp.&user32.GetDlgItem> ; \GetDlgItem
00401078 |. 6A 68 push 0x68 ; /RsrcName = 104.
0040107A |. FF35 44334000 push dword ptr ds:[0x403344] ; |hInst = NULL
00401080 |. E8 15020000 call <jmp.&user32.LoadIconA> ; \LoadIconA
00401085 |. 50 push eax ; /lParam = 0x19FFCC
00401086 |. 6A 00 push 0x0 ; |wParam = 0x0
00401088 |. 68 80000000 push 0x80 ; |Message = WM_SETICON
0040108D |. FF75 08 push [arg.1] ; |hWnd = 0x213000
00401090 |. E8 1D020000 call <jmp.&user32.SendMessageA> ; \SendMessageA
00401095 |. 50 push eax ; /hWnd = 0019FFCC
00401096 |. E8 1D020000 call <jmp.&user32.SetFocus> ; \SetFocus
0040109B |. E9 E4010000 jmp D4ph1_-_.00401284
004010A0 |> 837D 0C 10 cmp [arg.2],0x10
004010A4 |. 75 19 jnz short D4ph1_-_.004010BF
004010A6 |. 6A 00 push 0x0 ; /lParam = 0x0
004010A8 |. 68 EE030000 push 0x3EE ; |wParam = 0x3EE
004010AD |. 68 11010000 push 0x111 ; |Message = WM_COMMAND
004010B2 |. FF75 08 push [arg.1] ; |hWnd = 0x213000
004010B5 |. E8 F8010000 call <jmp.&user32.SendMessageA> ; \SendMessageA
004010BA |. E9 C5010000 jmp D4ph1_-_.00401284
004010BF |> 817D 0C 11010>cmp [arg.2],0x111
004010C6 |. 0F85 AF010000 jnz D4ph1_-_.0040127B
004010CC |. 8B45 10 mov eax,[arg.3]
004010CF |. 66:3D EE03 cmp ax,0x3EE
004010D3 |. 75 0C jnz short D4ph1_-_.004010E1
004010D5 |. 6A 00 push 0x0 ; /ExitCode = 0x0
004010D7 |. E8 CA010000 call <jmp.&user32.PostQuitMessage> ; \PostQuitMessage
004010DC |. E9 A3010000 jmp D4ph1_-_.00401284
004010E1 |> 66:3D EF03 cmp ax,0x3EF
004010E5 |. 75 18 jnz short D4ph1_-_.004010FF
004010E7 |. 6A 40 push 0x40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
004010E9 |. 68 00304000 push D4ph1_-_.00403000 ; |Title = "Crackme#1 By D4ph1"
004010EE |. 68 3F304000 push D4ph1_-_.0040303F ; |Text = "Patching is not allowed. Make a keygenerator,find the secret message and write a tutorial about how you did it!"
004010F3 |. 6A 00 push 0x0 ; |hOwner = NULL
004010F5 |. E8 A6010000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004010FA |. E9 85010000 jmp D4ph1_-_.00401284
004010FF |> 66:3D ED03 cmp ax,0x3ED
00401103 |. 0F85 7B010000 jnz D4ph1_-_.00401284
00401109 |. 68 4C334000 push D4ph1_-_.0040334C ; /lParam = 0x40334C
0040110E |. 6A 40 push 0x40 ; |wParam = 0x40
00401110 |. 6A 0D push 0xD ; |Message = WM_GETTEXT
00401112 |. 68 EA030000 push 0x3EA ; |ControlID = 3EA (1002.)
00401117 |. FF75 08 push [arg.1] ; |hWnd = 00213000
0040111A |. E8 8D010000 call <jmp.&user32.SendDlgItemMessageA> ; \SendDlgItemMessageA
0040111F |. A2 0D344000 mov byte ptr ds:[0x40340D],al
00401124 |. 3C 04 cmp al,0x4 ; Switch (cases 0..6)
00401126 |. 0F86 21010000 jbe D4ph1_-_.0040124D
0040112C |. 3C 06 cmp al,0x6
0040112E |. 75 07 jnz short D4ph1_-_.00401137
00401130 |. C605 0C344000>mov byte ptr ds:[0x40340C],0x1 ; Case 6 of switch 00401124
00401137 |> 8BD0 mov edx,eax ; Default case of switch 00401124
00401139 |. 33DB xor ebx,ebx
0040113B |. 33F6 xor esi,esi ; D4ph1_-_.<ModuleEntryPoint>
0040113D |> 8A86 4C334000 /mov al,byte ptr ds:[esi+0x40334C]
00401143 |. 3086 80324000 |xor byte ptr ds:[esi+0x403280],al
00401149 |. 33DB |xor ebx,ebx
0040114B |. 03D8 |add ebx,eax
0040114D |. 33DA |xor ebx,edx ; D4ph1_-_.<ModuleEntryPoint>
0040114F |. 899E 8C334000 |mov dword ptr ds:[esi+0x40338C],ebx
00401155 |. 46 |inc esi ; D4ph1_-_.<ModuleEntryPoint>
00401156 |. 4A |dec edx ; D4ph1_-_.<ModuleEntryPoint>
00401157 |.^ 75 E4 \jnz short D4ph1_-_.0040113D
00401159 |. C686 8C334000>mov byte ptr ds:[esi+0x40338C],0x2D
00401160 |. 68 CC334000 push D4ph1_-_.004033CC ; /lParam = 0x4033CC
00401165 |. 6A 41 push 0x41 ; |wParam = 0x41
00401167 |. 6A 0D push 0xD ; |Message = WM_GETTEXT
00401169 |. 68 EB030000 push 0x3EB ; |ControlID = 3EB (1003.)
0040116E |. FF75 08 push [arg.1] ; |hWnd = 00213000
00401171 |. E8 36010000 call <jmp.&user32.SendDlgItemMessageA> ; \SendDlgItemMessageA
00401176 |. 33D2 xor edx,edx ; D4ph1_-_.<ModuleEntryPoint>
00401178 |> 0FBEBA CC3340>/movsx edi,byte ptr ds:[edx+0x4033CC]
0040117F |. 0FBE9A 8C3340>|movsx ebx,byte ptr ds:[edx+0x40338C]
00401186 |. 42 |inc edx ; D4ph1_-_.<ModuleEntryPoint>
00401187 |. 3BFB |cmp edi,ebx
00401189 |.^ 74 ED \je short D4ph1_-_.00401178
0040118B |. 4A dec edx ; D4ph1_-_.<ModuleEntryPoint>
0040118C |. 83F2 45 xor edx,0x45
0040118F |. 83F6 45 xor esi,0x45
00401192 |. 2BD6 sub edx,esi ; D4ph1_-_.<ModuleEntryPoint>
00401194 |. 75 6A jnz short D4ph1_-_.00401200
00401196 |. E8 97FEFFFF call D4ph1_-_.00401032
0040119B |. 803D 0C344000>cmp byte ptr ds:[0x40340C],0x1
004011A2 |. 75 47 jnz short D4ph1_-_.004011EB
004011A4 |. BB 47000000 mov ebx,0x47
004011A9 |> 0FBEBA CC3340>/movsx edi,byte ptr ds:[edx+0x4033CC]
004011B0 |. 0FBEB2 3B3340>|movsx esi,byte ptr ds:[edx+0x40333B]
004011B7 |. 03DE |add ebx,esi ; D4ph1_-_.<ModuleEntryPoint>
004011B9 |. 3BFB |cmp edi,ebx
004011BB |. 75 2E |jnz short D4ph1_-_.004011EB
004011BD |. 42 |inc edx ; D4ph1_-_.<ModuleEntryPoint>
004011BE |. 83FA 05 |cmp edx,0x5
004011C1 |.^ 76 E6 \jbe short D4ph1_-_.004011A9
004011C3 |. 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
004011C5 |. 68 00304000 push D4ph1_-_.00403000 ; |Title = "Crackme#1 By D4ph1"
004011CA |. 68 80324000 push D4ph1_-_.00403280 ; |Text = "Q,F"
004011CF |. 6A 00 push 0x0 ; |hOwner = NULL
004011D1 |. E8 CA000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004011D6 |. 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
004011D8 |. 68 00304000 push D4ph1_-_.00403000 ; |Title = "Crackme#1 By D4ph1"
004011DD |. 68 13304000 push D4ph1_-_.00403013 ; |Text = "Great work mate!You passed all the tests!:)"
004011E2 |. 6A 00 push 0x0 ; |hOwner = NULL
004011E4 |. E8 B7000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004011E9 |. EB 2A jmp short D4ph1_-_.00401215
004011EB |> 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
004011ED |. 68 00304000 push D4ph1_-_.00403000 ; |Title = "Crackme#1 By D4ph1"
004011F2 |. 68 C8324000 push D4ph1_-_.004032C8 ; |Text = "You did it!But the secret message remains secret!"
004011F7 |. 6A 00 push 0x0 ; |hOwner = NULL
004011F9 |. E8 A2000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004011FE |. EB 15 jmp short D4ph1_-_.00401215
00401200 |> 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
00401202 |. 68 00304000 push D4ph1_-_.00403000 ; |Title = "Crackme#1 By D4ph1"
00401207 |. 68 20324000 push D4ph1_-_.00403220 ; |Text = "The Serial is not correct...:("
0040120C |. 6A 00 push 0x0 ; |hOwner = NULL
0040120E |. E8 8D000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00401213 |. EB 00 jmp short D4ph1_-_.00401215
00401215 |> 33F6 xor esi,esi ; D4ph1_-_.<ModuleEntryPoint>
00401217 |> 8A86 4C334000 /mov al,byte ptr ds:[esi+0x40334C]
0040121D |. 3086 80324000 |xor byte ptr ds:[esi+0x403280],al
00401223 |. 46 |inc esi ; D4ph1_-_.<ModuleEntryPoint>
00401224 |. 3B35 0D344000 |cmp esi,dword ptr ds:[0x40340D]
0040122A |.^ 75 EB \jnz short D4ph1_-_.00401217
0040122C |. BB 17000000 mov ebx,0x17
00401231 |. B8 2D000000 mov eax,0x2D
00401236 |. 83F0 0C xor eax,0xC
00401239 |. 83E8 17 sub eax,0x17
0040123C |> 0083 C6314000 /add byte ptr ds:[ebx+0x4031C6],al
00401242 |. 4B |dec ebx
00401243 |.^ 75 F7 \jnz short D4ph1_-_.0040123C
00401245 |. 0083 C6314000 add byte ptr ds:[ebx+0x4031C6],al
0040124B |. EB 2C jmp short D4ph1_-_.00401279
0040124D |> 0AC0 or al,al
0040124F |. 75 15 jnz short D4ph1_-_.00401266
00401251 |. 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL; Case 0 of switch 00401124
00401253 |. 68 00304000 push D4ph1_-_.00403000 ; |Title = "Crackme#1 By D4ph1"
00401258 |. 68 D4304000 push D4ph1_-_.004030D4 ; |Text = "You must enter a Name I think..."
0040125D |. 6A 00 push 0x0 ; |hOwner = NULL
0040125F |. E8 3C000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00401264 |. EB 13 jmp short D4ph1_-_.00401279
00401266 |> 6A 10 push 0x10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL; Cases 1,2,3,4 of switch 00401124
00401268 |. 68 00304000 push D4ph1_-_.00403000 ; |Title = "Crackme#1 By D4ph1"
0040126D |. 68 AF304000 push D4ph1_-_.004030AF ; |Text = "The Name you entered is not valid..."
00401272 |. 6A 00 push 0x0 ; |hOwner = NULL
00401274 |. E8 27000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00401279 |> EB 09 jmp short D4ph1_-_.00401284
0040127B |> B8 00000000 mov eax,0x0
00401280 |. C9 leave
00401281 |. C2 1000 retn 0x10
00401284 |> B8 01000000 mov eax,0x1
00401289 |. C9 leave
0040128A \. C2 1000 retn 0x10
0040128D CC int3
0040128E $- FF25 28204000 jmp dword ptr ds:[<&user32.DialogBoxPara>; user32.DialogBoxParamA
00401294 $- FF25 24204000 jmp dword ptr ds:[<&user32.GetDlgItem>] ; user32.GetDlgItem
0040129A $- FF25 18204000 jmp dword ptr ds:[<&user32.LoadIconA>] ; user32.LoadIconA
004012A0 $- FF25 10204000 jmp dword ptr ds:[<&user32.MessageBoxA>] ; user32.MessageBoxA
004012A6 $- FF25 14204000 jmp dword ptr ds:[<&user32.PostQuitMessa>; user32.PostQuitMessage
004012AC $- FF25 2C204000 jmp dword ptr ds:[<&user32.SendDlgItemMe>; user32.SendDlgItemMessageA
004012B2 $- FF25 1C204000 jmp dword ptr ds:[<&user32.SendMessageA>>; user32.SendMessageA
004012B8 $- FF25 20204000 jmp dword ptr ds:[<&user32.SetFocus>] ; user32.SetFocus
004012BE .- FF25 04204000 jmp dword ptr ds:[<&kernel32.ExitProcess>; kernel32.ExitProcess
004012C4 $- FF25 00204000 jmp dword ptr ds:[<&kernel32.GetCommandL>; kernel32.GetCommandLineA
004012CA $- FF25 08204000 jmp dword ptr ds:[<&kernel32.GetModuleHa>; kernel32.GetModuleHandleA
004012D0 00 db 00
004012D1 00 db 00
关键算法在0040113D ~ 00401157 code[i] = user[i] ^ (len-i),
如用户名: abcdef 那系列号则为: gggggg, 输入验证提示"You did it!But the secret message remains secret!", 作者说还有别的秘密
跟踪可知上面的输入运行到004011B9处就跳转到提示框了,此处还是一个循环对比,说明还需要继续比较,对比前6位,所以这里可看出前6位应该是固定的
code[0] = 0x47 + 0x00 = 0x47 = G
code[1] = 0x47 + 0x22 = 0x69 = i
code[2] = 0x69 + 0xFD = 0x66 = f
code[3] = 0x66 + 0x00 = 0x66 = f
code[4] = 0x66 + 0x0A = 0x70 = p
code[5] = 0x70 + 0x05 = 0x75 = u
如果用户名就是6位, 那也是固定的 Albert
最终为:
用户名: Albert
系列号: Giffpu
(感觉是名字呢, 阿博特.吉普)
使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载
下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~
浙公网安备 33010602011771号