分析步骤
1.运行程序，随便输入序列号，提示错误
2.od载入, bp MessageBoxA
3.向上返到 004010f4处
004011F4 $ 55 push ebp
004011F5 . 8BEC mov ebp,esp
004011F7 . 83EC 1C sub esp,0x1C
004011FA . 8D45 E4 lea eax,dword ptr ss:[ebp-0x1C]
004011FD . 6A 15 push 0x15 ; /Count = 15 (21.)
004011FF . 50 push eax ; |Buffer = NULL
00401200 . 68 E9030000 push 0x3E9 ; |ControlID = 3E9 (1001.)
00401205 . FF35 28AA4000 push dword ptr ds:[0x40AA28] ; |hWnd = 007E18A8 (class='#32770',parent=00021B80)
0040120B . FF15 A8704000 call dword ptr ds:[<&USER32.GetDlgItemTe>; \GetDlgItemTextA
00401211 . 68 F4010000 push 0x1F4 ; /Timeout = 500. ms
00401216 . FF15 00704000 call dword ptr ds:[<&KERNEL32.Sleep>] ; \Sleep
0040121C . 8D45 E4 lea eax,dword ptr ss:[ebp-0x1C]
0040121F . 50 push eax
00401220 . E8 CB000000 call WannaLOL.004012F0 // 长度为 4
00401225 . 83F8 04 cmp eax,0x4
00401228 . 59 pop ecx ; WannaLOL.00401088
00401229 . 0F85 8C000000 jnz WannaLOL.004012BB
0040122F . 6A 30 push 0x30 //不能为0
00401231 . 59 pop ecx ; WannaLOL.00401088
00401232 . 384D E4 cmp byte ptr ss:[ebp-0x1C],cl
00401235 . 0F84 80000000 je WannaLOL.004012BB
0040123B . 384D E5 cmp byte ptr ss:[ebp-0x1B],cl
0040123E . 74 7B je short WannaLOL.004012BB
00401240 . 384D E6 cmp byte ptr ss:[ebp-0x1A],cl
00401243 . 74 76 je short WannaLOL.004012BB
00401245 . 384D E7 cmp byte ptr ss:[ebp-0x19],cl
00401248 . 74 71 je short WannaLOL.004012BB
0040124A . 74 03 je short WannaLOL.0040124F
0040124C . 75 01 jnz short WannaLOL.0040124F
0040124E E8 66B80800 call 0048CAB9
00401253 . 66:35 0700 xor ax,0x7
00401257 . 0FBE45 E6 movsx eax,byte ptr ss:[ebp-0x1A]
0040125B 2BC1 sub eax,ecx
0040125D 8945 FC mov dword ptr ss:[ebp-0x4],eax
00401260 0FBE45 E4 movsx eax,byte ptr ss:[ebp-0x1C]
00401264 . DB45 FC fild dword ptr ss:[ebp-0x4]
00401267 . 2BC1 sub eax,ecx
00401269 . 8945 FC mov dword ptr ss:[ebp-0x4],eax
0040126C . 0FBE45 E5 movsx eax,byte ptr ss:[ebp-0x1B]
00401270 . DB45 FC fild dword ptr ss:[ebp-0x4]
00401273 . 2BC1 sub eax,ecx
00401275 . 8945 FC mov dword ptr ss:[ebp-0x4],eax
00401278 . DA75 FC fidiv dword ptr ss:[ebp-0x4]
0040127B . 0FBE45 E7 movsx eax,byte ptr ss:[ebp-0x19]
0040127F . 2BC1 sub eax,ecx
00401281 . 8945 FC mov dword ptr ss:[ebp-0x4],eax
00401284 . DEE9 fsubp st(1),st
00401286 . DA4D FC fimul dword ptr ss:[ebp-0x4]
00401289 . D80D 1C714000 fmul dword ptr ds:[0x40711C]
0040128F . D95D FC fstp dword ptr ss:[ebp-0x4]
00401292 . 74 03 je short WannaLOL.00401297
00401294 . 75 01 jnz short WannaLOL.00401297
00401296 E8 66B80800 call 0048CB01
0040129B . 66:35 0700 xor ax,0x7
0040129F . D945 FC fld dword ptr ss:[ebp-0x4]
004012A2 . D81D 18714000 fcomp dword ptr ds:[0x407118]
004012A8 . 6A 00 push 0x0
004012AA . 68 64804000 push WannaLOL.00408064 ; ASCII "CrackMe 2017 CTF"
004012AF . DFE0 fstsw ax
004012B1 . 9E sahf
004012B2 . 75 0E jnz short WannaLOL.004012C2
004012B4 . 68 48804000 push WannaLOL.00408048 ; ASCII "Registration successful !"
004012B9 . EB 0C jmp short WannaLOL.004012C7
004012BB > 6A 00 push 0x0
004012BD . 68 64804000 push WannaLOL.00408064 ; ASCII "CrackMe 2017 CTF"
004012C2 > 68 40804000 push WannaLOL.00408040 ; ASCII "error !"
004012C7 > FF35 24AA4000 push dword ptr ds:[0x40AA24] ; |hOwner = 00021B80 ('PEDIY CTF 2017',class='myWindowClass')
004012CD . FF15 AC704000 call dword ptr ds:[<&USER32.MessageBoxA>>; \MessageBoxA
004012D3 . C9 leave
004012D4 . C3 retn
将0040124E 处和 00401296处，用nop填充，保存下。
IDA F5分析结果如下
int sub_4011F4()
{
double v0; // st7@6
double v1; // st6@6
double v2; // st6@6
const CHAR *v4; // [sp-Ch] [bp-28h]@7
const CHAR *v5; // [sp-8h] [bp-24h]@6
CHAR String; // [sp+0h] [bp-1Ch]@1
char v7; // [sp+1h] [bp-1Bh]@3
char v8; // [sp+2h] [bp-1Ah]@4
char v9; // [sp+3h] [bp-19h]@5
int v10; // [sp+18h] [bp-4h]@6
GetDlgItemTextA(hDlg, 1001, &String, 21);
Sleep(0x1F4u);
if ( strlen(&String) != 4 || String == 0x30 || v7 == 0x30 || v8 == 0x30 || v9 == 0x30 )
{
v5 = Caption;
goto LABEL_9;
}
v10 = v8 - 0x30;
v0 = (double)v10;
v10 = String - 0x30;
v1 = (double)v10;
v10 = v7 - 0x30;
v2 = v1 / (double)v10;
v10 = v9 - 0x30;
*(float *)&v10 = (v0 - v2) * (double)v10 * 16.0;
v5 = Caption;
if ( *(float *)&v10 != 384.0 )
{
LABEL_9:
v4 = Text;
return MessageBoxA(hWnd, v4, v5, 0);
}
v4 = aRegistrationSu;
return MessageBoxA(hWnd, v4, v5, 0);
}
直接笔算出来的。
v0 = b[2]
v1 = b[0]
v2 = b[0]/b[1]
(b[2] - b[0]/b[1])* b[3] = 24
(8- 8/2)*6
收工：8286
[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》，视频+靶场+题目！助力进入CTF世界
