-
-
[原创]两个cm的详细分析
-
发表于: 2011-11-5 09:57
-
原cm见http://bbs.pediy.com/showthread.php?t=141100，此处不再传了
这是cm区某校比赛的两个小程序，都没有壳，也没有猥琐的反调试，没有复杂antidebug，而又有简单的算法，很适合拿来练手
先来看第一个
这程序非常简洁，winmain里只有一个DialogBoxParamA，顺藤摸瓜找到dialogproc，dialogproc只处理了三个消息
0x16 0x110 0x111查阅头文件得知这三个消息分别为WM_CLOSE WM_INITDIALOG WM_COMMAND
程序结构有多简单就可想而知了，对话框过程还原伪代码如下
int __stdcall DialogFunc(HWND hDlg, int uMsg, unsigned __int16 wParam, int lParam)
{
if ( uMsg == WM_CLOSE )
{
rEndDialog(hDlg);
}
else
{
if ( uMsg == WM_INITDIALOG )
return sub_4011E0(hDlg);
if ( uMsg == WM_SYSCOMMAND )
{
sub_401230(hDlg, wParam);
return 0;
}
}
return 0;
}
.text:004010B0 ; DWORD __stdcall StartAddress(LPVOID) .text:004010B0 StartAddress proc near ; DATA XREF: sub_4011E0+27o .text:004010B0 push ebx .text:004010B1 mov ebx, ds:Sleep .text:004010B7 push ebp .text:004010B8 mov ebp, ds:ExitProcess .text:004010BE push esi .text:004010BF push edi .text:004010C0 mov edi, ds:GetModuleHandleA .text:004010C6 .text:004010C6 loc_4010C6: ; CODE XREF: StartAddress+49j .text:004010C6 ; .text:004010FFj .text:004010C6 push 0 ; lpModuleName .text:004010C8 call edi ; GetModuleHandleA .text:004010CA mov ecx, [eax+3Ch] .text:004010CD xor edx, edx .text:004010CF add ecx, eax ; ecx = .text:004010CF ; imagebase + e_lfanew = .text:004010CF ; pe_header .text:004010D1 mov dx, [ecx+14h] ; dx = SizeOfOptionalHeader .text:004010D5 mov esi, [ecx-4] ; esi = pe头前面的一个dword .text:004010D8 lea edx, [edx+ecx+18h] ; edx = .text:004010D8 ; SizeOfOptionalHeader + pe_header + 0x18 = .text:004010D8 ; sectionheader ;此时正好指向第一个section text段 .text:004010DC mov ecx, [edx+8] ; ecx = text.VirtualSize .text:004010DF mov edx, [edx+0Ch] ; edx = VirtualAddress .text:004010E2 add edx, eax ; edx = .text:004010E2 ; ImageBase + text.VirtualAddress = .text:004010E2 ; text.rva .text:004010E4 push ecx ; text.VirtualSize .text:004010E5 push edx ; text.rva .text:004010E6 call crc32 .text:004010EB add esp, 8 .text:004010EE cmp esi, eax ; 判断crc32返回值是否等于预先存储的0x99397da .text:004010F0 jnz short loc_4010FB .text:004010F2 push 5000 ; dwMilliseconds .text:004010F7 call ebx ; Sleep .text:004010F9 jmp short loc_4010C6 .text:004010FB ; --------------------------------------------------------------------------- .text:004010FB .text:004010FB loc_4010FB: ; CODE XREF: StartAddress+40j .text:004010FB push 1 ; uExitCode .text:004010FD call ebp ; ExitProcess
BOOL __cdecl sub_401230(int a1, BOOL a2)
{
BOOL result; // eax@1
int v3; // esi@2
CHAR String; // [sp+4h] [bp-100h]@1
char v5; // [sp+5h] [bp-FFh]@1
__int16 v6; // [sp+101h] [bp-3h]@1
char v7; // [sp+103h] [bp-1h]@1
String = 0;
memset(&v5, 0, 0xFCu);
v6 = 0;
v7 = 0;
result = a2;
if ( a2 == 1000 )
{
GetWindowTextA(hWnd, &String, 10);
v3 = sub_401110("Iceberg");
result = sub_401140(&String);
if ( v3 == result )
result = EnableWindow(hButtonSucess, 1);
}
return result;
}
Appcall(0x401110, "int func(char *);" , "Iceberg")
text:0040114C movsx ecx, cl .text:0040114F lea eax, [eax+eax*4] .text:00401152 inc edx .text:00401153 lea eax, [ecx+eax*2-30h] .text:00401157 mov cl, [edx] .text:00401159 test cl, cl .text:0040115B jnz short loc_40114C
if ( uMsg == 1000 )
{
GetDlgItemTextA(hDlg, 1004, &pwd, 256);
sub_401140(&pwd, &b64pwd);
v3 = sub_4012D0(&b64pwd, &v4);
result = sub_401360(v3, v4);
}
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
|
|
|---|---|
|
|
不 错 能不能把那2个cm给我发一份吧 我攒钱转正呢
 谢了哈 lhwqqq@gmail.com
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
是不错。
|
|
|
|
|
|
|
