MD5加密结果让人匪夷所思-密码应用-看雪-安全社区|安全招聘|kanxue.com

MD5加密结果让人匪夷所思

发表于: 2014-9-16 23:13 6128

MD5加密结果让人匪夷所思

starx

2014-9-16 23:13

6128

1、输入假序列号:11111-22222-33333-44444-55555

2、转成32进制，以五位二进制表示单个字母: 00001 00001 00001 00001 00001 00010 00010 00010 00010 00010 00011 00011 00011 00011 00011 111111 111111 111111 111111 111111 00100 00100 00100 00100
（中间有插值，未细究）
3、再转成16进制（每8位合成一字节，共15字节）：即：08421088421086318C7FFFFFFF9084
实际堆栈为：
0646F698 88104208
0646F69C 31861042
0646F6A0 FFFF7F8C
0646F6A4 008490FF

4、取前15组二进制加密，初步分析为MD5，程序代码附后：
实际堆栈为：
0646F698 88104208
0646F69C 31861042
0646F6A0 FFFF7F8C
0646F6A4 000000FF

5、结果为BB71D4B55FFF0425E66CBBFCE88A0137
实际堆栈为：
0636E5B8 B5D471BB
0636E5BC 2504FF5F
0636E5C0 FCBB6CE6
0636E5C4 37018AE8

6：将加密后的头两位即BB71(寄存器为71BB)与第3步转成的最后四位9084（寄存器为8490）进行比较，相同就OK
以上加密步骤中的第一步。

问题：从程序代码看，本加密有N多MD5特征，基本上被假设成了MD5，跟踪发现08421088421086318C7FFFFFFF加密后是BB71D4B55FFF0425E66CBBFCE88A0137，用MD5加密工具看无论如何也得不到这个值，直接晕菜！跟踪了2天输入输出非常确定，在此求助大老们看看何故：

--------------MD5主call：
0046A710 /$  83EC 58          sub esp,58
0046A713 |.  B8 30303030       mov eax,30303030
0046A718 |.  53                push ebx
0046A719 |.  56                push esi
0046A71A |.  8BF1             mov esi,ecx
0046A71C |.  57                push edi
0046A71D |.  B9 08000000       mov ecx,8
0046A722 |.  8D5E 04          lea ebx,dword ptr ds:[esi+4]
0046A725 |.  8BFB             mov edi,ebx
0046A727 |.  F3:AB             rep stos dword ptr es:[edi]
0046A729 |.  8B7C24 6C          mov edi,dword ptr ss:[esp+6C]
0046A72D |.  85FF             test edi,edi
0046A72F |.  7E 2B             jle short EduOffic.0046A75C
0046A731 |.  8D4424 0C          lea eax,dword ptr ss:[esp+C]
0046A735 |.  8BCE             mov ecx,esi
0046A737 |.  50                push eax
0046A738 |.  E8 33000000       call EduOffic.0046A770                      ;  载入MD5初始化数据
0046A73D |.  8B4C24 68          mov ecx,dword ptr ss:[esp+68]
0046A741 |.  57                push edi
0046A742 |.  8D5424 10          lea edx,dword ptr ss:[esp+10]
0046A746 |.  51                push ecx
0046A747 |.  52                push edx
0046A748 |.  8BCE             mov ecx,esi
0046A74A |.  E8 51000000       call EduOffic.0046A7A0                      ;  MD5-update
0046A74F |.  8D4424 0C          lea eax,dword ptr ss:[esp+C]
0046A753 |.  8BCE             mov ecx,esi
0046A755 |.  50                push eax                                     ; /Arg2
0046A756 |.  53                push ebx                                     ; |Arg1
0046A757 |.  E8 04010000       call EduOffic.0046A860                      ; \MD5-final
0046A75C |>  5F                pop edi
0046A75D |.  8BC3             mov eax,ebx
0046A75F |.  5E                pop esi
0046A760 |.  5B                pop ebx
0046A761 |.  83C4 58          add esp,58
0046A764 \.  C2 0800          retn 8

--------------载入MD5初始化数据
0046A770 /$  8B4424 04          mov eax,dword ptr ss:[esp+4]
0046A774 |.  33C9             xor ecx,ecx
0046A776 |.  8948 14          mov dword ptr ds:[eax+14],ecx
0046A779 |.  8948 10          mov dword ptr ds:[eax+10],ecx
0046A77C |.  C700 01234567    mov dword ptr ds:[eax],67452301
0046A782 |.  C740 04 89ABCDEF mov dword ptr ds:[eax+4],EFCDAB89
0046A789 |.  C740 08 FEDCBA98 mov dword ptr ds:[eax+8],98BADCFE
0046A790 |.  C740 0C 76543210 mov dword ptr ds:[eax+C],10325476
0046A797 \.  C2 0400          retn 4

---------------MD5 update CALL：

0046A7A0 /$  53                push ebx
0046A7A1 |.  55                push ebp
0046A7A2 |.  56                push esi
0046A7A3 |.  8B7424 10          mov esi,dword ptr ss:[esp+10]
0046A7A7 |.  8BE9             mov ebp,ecx
0046A7A9 |.  57                push edi
0046A7AA |.  8B4E 10          mov ecx,dword ptr ds:[esi+10]
0046A7AD |.  8B7C24 1C          mov edi,dword ptr ss:[esp+1C]
0046A7B1 |.  8BC1             mov eax,ecx
0046A7B3 |.  C1E8 03          shr eax,3
0046A7B6 |.  8D0CF9             lea ecx,dword ptr ds:[ecx+edi*8]
0046A7B9 |.  8D14FD 00000000    lea edx,dword ptr ds:[edi*8]
0046A7C0 |.  83E0 3F          and eax,3F
0046A7C3 |.  3BCA             cmp ecx,edx
0046A7C5 |.  894E 10          mov dword ptr ds:[esi+10],ecx
0046A7C8 |.  73 03             jnb short EduOffic.0046A7CD
0046A7CA |.  FF46 14          inc dword ptr ds:[esi+14]
0046A7CD |>  8B5E 14          mov ebx,dword ptr ds:[esi+14]
0046A7D0 |.  8BCF             mov ecx,edi
0046A7D2 |.  C1E9 1D          shr ecx,1D
0046A7D5 |.  03D9             add ebx,ecx
0046A7D7 |.  895E 14          mov dword ptr ds:[esi+14],ebx
0046A7DA |.  BB 40000000       mov ebx,40
0046A7DF |.  2BD8             sub ebx,eax
0046A7E1 |.  3BFB             cmp edi,ebx
0046A7E3 |.  72 50             jb short EduOffic.0046A835
0046A7E5 |.  8B5424 18          mov edx,dword ptr ss:[esp+18]
0046A7E9 |.  53                push ebx
0046A7EA |.  8D4430 18          lea eax,dword ptr ds:[eax+esi+18]
0046A7EE |.  52                push edx
0046A7EF |.  50                push eax
0046A7F0 |.  8BCD             mov ecx,ebp
0046A7F2 |.  E8 D90A0000       call EduOffic.0046B2D0
0046A7F7 |.  8D4E 18          lea ecx,dword ptr ds:[esi+18]
0046A7FA |.  51                push ecx                                     ; /Arg2
0046A7FB |.  56                push esi                                     ; |Arg1
0046A7FC |.  8BCD             mov ecx,ebp                                  ; |
0046A7FE |.  E8 DD000000       call EduOffic.0046A8E0                      ; \MD5-Transform
0046A803 |.  895C24 14          mov dword ptr ss:[esp+14],ebx
0046A807 |.  83C3 3F          add ebx,3F
0046A80A |.  3BDF             cmp ebx,edi
0046A80C |.  73 23             jnb short EduOffic.0046A831
0046A80E |>  8B5424 18          /mov edx,dword ptr ss:[esp+18]
0046A812 |.  8BCD             |mov ecx,ebp
0046A814 |.  8D441A C1          |lea eax,dword ptr ds:[edx+ebx-3F]
0046A818 |.  50                |push eax                                     ; /Arg2
0046A819 |.  56                |push esi                                     ; |Arg1
0046A81A |.  E8 C1000000       |call EduOffic.0046A8E0                      ; \MD5-Transform
0046A81F |.  8B5424 14          |mov edx,dword ptr ss:[esp+14]
0046A823 |.  83C3 40          |add ebx,40
0046A826 |.  83C2 40          |add edx,40
0046A829 |.  3BDF             |cmp ebx,edi
0046A82B |.  895424 14          |mov dword ptr ss:[esp+14],edx
0046A82F |.^ 72 DD             \jb short EduOffic.0046A80E
0046A831 |>  33C0             xor eax,eax
0046A833 |.  EB 08             jmp short EduOffic.0046A83D
0046A835 |>  C74424 14 00000000  mov dword ptr ss:[esp+14],0
0046A83D |>  8B4C24 14          mov ecx,dword ptr ss:[esp+14]
0046A841 |.  8B5424 18          mov edx,dword ptr ss:[esp+18]
0046A845 |.  2BF9             sub edi,ecx
0046A847 |.  03CA             add ecx,edx
0046A849 |.  57                push edi
0046A84A |.  8D4430 18          lea eax,dword ptr ds:[eax+esi+18]
0046A84E |.  51                push ecx
0046A84F |.  50                push eax
0046A850 |.  8BCD             mov ecx,ebp
0046A852 |.  E8 790A0000       call EduOffic.0046B2D0
0046A857 |.  5F                pop edi
0046A858 |.  5E                pop esi
0046A859 |.  5D                pop ebp
0046A85A |.  5B                pop ebx
0046A85B \.  C2 0C00          retn 0C

----------------MD5 final call
0046A860 /$  83EC 08          sub esp,8
0046A863 |.  8D4424 00          lea eax,dword ptr ss:[esp]
0046A867 |.  53                push ebx
0046A868 |.  56                push esi
0046A869 |.  57                push edi
0046A86A |.  8B7C24 1C          mov edi,dword ptr ss:[esp+1C]
0046A86E |.  6A 08             push 8
0046A870 |.  8BF1             mov esi,ecx
0046A872 |.  8D5F 10          lea ebx,dword ptr ds:[edi+10]
0046A875 |.  53                push ebx
0046A876 |.  50                push eax
0046A877 |.  E8 B4090000       call EduOffic.0046B230
0046A87C |.  8B03             mov eax,dword ptr ds:[ebx]
0046A87E |.  B9 38000000       mov ecx,38
0046A883 |.  C1E8 03          shr eax,3
0046A886 |.  83E0 3F          and eax,3F
0046A889 |.  83F8 38          cmp eax,38
0046A88C |.  72 05             jb short EduOffic.0046A893
0046A88E |.  B9 78000000       mov ecx,78
0046A893 |>  2BC8             sub ecx,eax
0046A895 |.  51                push ecx
0046A896 |.  68 A4188B00       push EduOffic.008B18A4
0046A89B |.  57                push edi
0046A89C |.  8BCE             mov ecx,esi
0046A89E |.  E8 FDFEFFFF       call EduOffic.0046A7A0                      ;  MD5-update
0046A8A3 |.  8D4C24 0C          lea ecx,dword ptr ss:[esp+C]
0046A8A7 |.  6A 08             push 8
0046A8A9 |.  51                push ecx
0046A8AA |.  57                push edi
0046A8AB |.  8BCE             mov ecx,esi
0046A8AD |.  E8 EEFEFFFF       call EduOffic.0046A7A0                      ;  MD5-update
0046A8B2 |.  8B5424 18          mov edx,dword ptr ss:[esp+18]
0046A8B6 |.  6A 10             push 10
0046A8B8 |.  57                push edi
0046A8B9 |.  52                push edx
0046A8BA |.  8BCE             mov ecx,esi
0046A8BC |.  E8 6F090000       call EduOffic.0046B230                      ; MD5-Encode
0046A8C1 |.  6A 58             push 58
0046A8C3 |.  6A 00             push 0
0046A8C5 |.  57                push edi
0046A8C6 |.  8BCE             mov ecx,esi
0046A8C8 |.  E8 230A0000       call EduOffic.0046B2F0                      ;  MD5_memset
0046A8CD |.  5F                pop edi
0046A8CE |.  5E                pop esi
0046A8CF |.  5B                pop ebx
0046A8D0 |.  83C4 08          add esp,8
0046A8D3 \.  C2 0800          retn 8

----------------MD5 Transform CALL
0046A8E0 /$  83EC 44          sub esp,44                                  ;  MD5变换
0046A8E3 |.  53                push ebx
0046A8E4 |.  8B5424 50          mov edx,dword ptr ss:[esp+50]
0046A8E8 |.  55                push ebp
0046A8E9 |.  56                push esi
0046A8EA |.  8B7424 54          mov esi,dword ptr ss:[esp+54]
0046A8EE |.  57                push edi
0046A8EF |.  6A 40             push 40
0046A8F1 |.  52                push edx
0046A8F2 |.  8B06             mov eax,dword ptr ds:[esi]                   ;  第一组初始化数据
0046A8F4 |.  8B7E 04          mov edi,dword ptr ds:[esi+4]                ;  第二组初始化数据
0046A8F7 |.  8B5E 08          mov ebx,dword ptr ds:[esi+8]                ;  第三组初始化数据
0046A8FA |.  8B6E 0C          mov ebp,dword ptr ds:[esi+C]                ;  第四组初始化数据
0046A8FD |.  894424 60          mov dword ptr ss:[esp+60],eax
0046A901 |.  8D4424 1C          lea eax,dword ptr ss:[esp+1C]
0046A905 |.  50                push eax
0046A906 |.  894C24 1C          mov dword ptr ss:[esp+1C],ecx
0046A90A |.  E8 71090000       call EduOffic.0046B280
0046A90F |.  8B4424 14          mov eax,dword ptr ss:[esp+14]
0046A913 |.  8BCF             mov ecx,edi
0046A915 |.  F7D1             not ecx
0046A917 |.  8BD3             mov edx,ebx
0046A919 |.  23CD             and ecx,ebp
0046A91B |.  23D7             and edx,edi
0046A91D |.  0BCA             or ecx,edx
0046A91F |.  8BD7             mov edx,edi
0046A921 |.  03C8             add ecx,eax
0046A923 |.  8B4424 58          mov eax,dword ptr ss:[esp+58]
0046A927 |.  8D8C08 78A46AD7    lea ecx,dword ptr ds:[eax+ecx+D76AA478]
0046A92E |.  8BC1             mov eax,ecx
0046A930 |.  C1E8 19          shr eax,19
0046A933 |.  C1E1 07          shl ecx,7
0046A936 |.  0BC1             or eax,ecx
0046A938 |.  03C7             add eax,edi
0046A93A |.  8BC8             mov ecx,eax
0046A93C |.  23D0             and edx,eax
0046A93E |.  F7D1             not ecx
0046A940 |.  23CB             and ecx,ebx
0046A942 |.  0BCA             or ecx,edx
0046A944 |.  8B5424 18          mov edx,dword ptr ss:[esp+18]
0046A948 |.  03CA             add ecx,edx
0046A94A |.  8D9429 56B7C7E8    lea edx,dword ptr ds:[ecx+ebp+E8C7B756]
0046A951 |.  8BCA             mov ecx,edx
0046A953 |.  C1E9 14          shr ecx,14
0046A956 |.  C1E2 0C          shl edx,0C
0046A959 |.  0BCA             or ecx,edx
0046A95B |.  03C8             add ecx,eax
0046A95D |.  8BD1             mov edx,ecx
0046A95F |.  8BE9             mov ebp,ecx
0046A961 |.  F7D2             not edx
0046A963 |.  23D7             and edx,edi
0046A965 |.  23E8             and ebp,eax
0046A967 |.  0BD5             or edx,ebp
0046A969 |.  8B6C24 1C          mov ebp,dword ptr ss:[esp+1C]
0046A96D |.  03D5             add edx,ebp
0046A96F |.  8BE9             mov ebp,ecx
0046A971 |.  8D9C13 DB702024    lea ebx,dword ptr ds:[ebx+edx+242070DB]
0046A978 |.  8BD3             mov edx,ebx
0046A97A |.  C1EA 0F          shr edx,0F
0046A97D |.  C1E3 11          shl ebx,11
0046A980 |.  0BD3             or edx,ebx
0046A982 |.  03D1             add edx,ecx
0046A984 |.  8BDA             mov ebx,edx
0046A986 |.  23EA             and ebp,edx
0046A988 |.  F7D3             not ebx
0046A98A |.  23D8             and ebx,eax
0046A98C |.  0BDD             or ebx,ebp
0046A98E |.  8B6C24 20          mov ebp,dword ptr ss:[esp+20]
0046A992 |.  03DD             add ebx,ebp
0046A994 |.  8D9C1F EECEBDC1    lea ebx,dword ptr ds:[edi+ebx+C1BDCEEE]
0046A99B |.  8BFB             mov edi,ebx
0046A99D |.  C1E7 16          shl edi,16
0046A9A0 |.  C1EB 0A          shr ebx,0A
0046A9A3 |.  0BFB             or edi,ebx
0046A9A5 |.  8BDA             mov ebx,edx
0046A9A7 |.  03FA             add edi,edx
0046A9A9 |.  897C24 58          mov dword ptr ss:[esp+58],edi
0046A9AD |.  8B6C24 58          mov ebp,dword ptr ss:[esp+58]
0046A9B1 |.  F7D7             not edi
0046A9B3 |.  23F9             and edi,ecx
0046A9B5 |.  23DD             and ebx,ebp
0046A9B7 |.  0BFB             or edi,ebx
0046A9B9 |.  8B6C24 24          mov ebp,dword ptr ss:[esp+24]
0046A9BD |.  8B5C24 58          mov ebx,dword ptr ss:[esp+58]
0046A9C1 |.  03FD             add edi,ebp
0046A9C3 |.  8BEB             mov ebp,ebx
0046A9C5 |.  8D8438 AF0F7CF5    lea eax,dword ptr ds:[eax+edi+F57C0FAF]
0046A9CC |.  8BF8             mov edi,eax
0046A9CE |.  C1EF 19          shr edi,19
0046A9D1 |.  C1E0 07          shl eax,7
0046A9D4 |.  0BF8             or edi,eax
0046A9D6 |.  03FB             add edi,ebx
0046A9D8 |.  8BC7             mov eax,edi
0046A9DA |.  23EF             and ebp,edi
0046A9DC |.  F7D0             not eax
0046A9DE |.  23C2             and eax,edx
0046A9E0 |.  0BC5             or eax,ebp
0046A9E2 |.  8B6C24 28          mov ebp,dword ptr ss:[esp+28]
0046A9E6 |.  03C5             add eax,ebp
0046A9E8 |.  8D8C01 2AC68747    lea ecx,dword ptr ds:[ecx+eax+4787C62A]

.........
.........
.........
0046B181 |.  8DBC17 827E53F7    lea edi,dword ptr ds:[edi+edx+F7537E82]
0046B188 |.  8BD7             mov edx,edi
0046B18A |.  C1EA 1A          shr edx,1A
0046B18D |.  C1E7 06          shl edi,6
0046B190 |.  0BD7             or edx,edi
0046B192 |.  8BF9             mov edi,ecx
0046B194 |.  03D0             add edx,eax
0046B196 |.  F7D7             not edi
0046B198 |.  0BFA             or edi,edx
0046B19A |.  33F8             xor edi,eax
0046B19C |.  037C24 40          add edi,dword ptr ss:[esp+40]
0046B1A0 |.  8D9C3B 35F23ABD    lea ebx,dword ptr ds:[ebx+edi+BD3AF235]
0046B1A7 |.  8BFB             mov edi,ebx
0046B1A9 |.  C1EF 16          shr edi,16
0046B1AC |.  C1E3 0A          shl ebx,0A
0046B1AF |.  0BFB             or edi,ebx
0046B1B1 |.  03FA             add edi,edx
0046B1B3 |.  8BD8             mov ebx,eax
0046B1B5 |.  6A 40             push 40
0046B1B7 |.  F7D3             not ebx
0046B1B9 |.  0BDF             or ebx,edi
0046B1BB |.  6A 00             push 0
0046B1BD |.  33DA             xor ebx,edx
0046B1BF |.  035C24 24          add ebx,dword ptr ss:[esp+24]
0046B1C3 |.  8D8C19 BBD2D72A    lea ecx,dword ptr ds:[ecx+ebx+2AD7D2BB]
0046B1CA |.  8BD9             mov ebx,ecx
0046B1CC |.  C1EB 11          shr ebx,11
0046B1CF |.  C1E1 0F          shl ecx,0F
0046B1D2 |.  0BD9             or ebx,ecx
0046B1D4 |.  8BCA             mov ecx,edx
0046B1D6 |.  03DF             add ebx,edi
0046B1D8 |.  F7D1             not ecx
0046B1DA |.  0BCB             or ecx,ebx
0046B1DC |.  33CF             xor ecx,edi
0046B1DE |.  03CD             add ecx,ebp
0046B1E0 |.  8B6E 08          mov ebp,dword ptr ds:[esi+8]
0046B1E3 |.  03EB             add ebp,ebx
0046B1E5 |.  8D8408 91D386EB    lea eax,dword ptr ds:[eax+ecx+EB86D391]
0046B1EC |.  8B0E             mov ecx,dword ptr ds:[esi]
0046B1EE |.  03CA             add ecx,edx
0046B1F0 |.  8BD0             mov edx,eax
0046B1F2 |.  C1E2 15          shl edx,15
0046B1F5 |.  C1E8 0B          shr eax,0B
0046B1F8 |.  0BD0             or edx,eax
0046B1FA |.  8B46 04          mov eax,dword ptr ds:[esi+4]
0046B1FD |.  03D3             add edx,ebx
0046B1FF |.  8B5E 0C          mov ebx,dword ptr ds:[esi+C]
0046B202 |.  03C2             add eax,edx
0046B204 |.  890E             mov dword ptr ds:[esi],ecx
0046B206 |.  8B4C24 18          mov ecx,dword ptr ss:[esp+18]                ;  存储MD5后的16进制值，四组
0046B20A |.  8946 04          mov dword ptr ds:[esi+4],eax
0046B20D |.  8D4424 1C          lea eax,dword ptr ss:[esp+1C]
0046B211 |.  03DF             add ebx,edi
0046B213 |.  50                push eax
0046B214 |.  896E 08          mov dword ptr ds:[esi+8],ebp
0046B217 |.  895E 0C          mov dword ptr ds:[esi+C],ebx
0046B21A |.  E8 D1000000       call EduOffic.0046B2F0
0046B21F |.  5F                pop edi
0046B220 |.  5E                pop esi
0046B221 |.  5D                pop ebp
0046B222 |.  5B                pop ebx
0046B223 |.  83C4 44          add esp,44
0046B226 \.  C2 0800          retn 8

[招生]系统0day安全班，企业级设备固件漏洞挖掘，Linux平台漏洞挖掘！

收藏・1

免费・0

支持

最新回复 (2)
NutCracker 雪币： 39 活跃值： (2971) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 194 粉丝 8 关注私信	NutCracker 2 楼 MD5源代码没几行，自己对照着看一下，是否为MD5的变形算法。 2014-9-17 01:44 0
starx 雪币： 221 活跃值： (10) 能力值： ( LV3，RANK：20 ) 在线值：发帖 7 回帖 14 粉丝 0 关注私信	starx 3 楼第一关MD5已通过，开始第二关！发帖前犯了低级错误，MD5工具输入的是字符是ASCLL码，程序内部是16进制，两者当然不会得到同样结果。感谢关注并解答。 2014-9-18 23:25 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

starx

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (2)
NutCracker 雪币： 39 活跃值： (2971) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 194 粉丝 8 关注私信	NutCracker 2 楼 MD5源代码没几行，自己对照着看一下，是否为MD5的变形算法。 2014-9-17 01:44 0
starx 雪币： 221 活跃值： (10) 能力值： ( LV3，RANK：20 ) 在线值：发帖 7 回帖 14 粉丝 0 关注私信	starx 3 楼第一关MD5已通过，开始第二关！发帖前犯了低级错误，MD5工具输入的是字符是ASCLL码，程序内部是16进制，两者当然不会得到同样结果。感谢关注并解答。 2014-9-18 23:25 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复