0x00 业务逻辑与模型抽象
样例主体框架比较主观，main函数获取长度位16字节的输入key，
存放于全局变量00450B80 Hi_key db 10h dup(?) 处。然后通过
函数Hi_check_if_aK2iK_19xyzm_Ke_eq_Kr校验。校验函数步骤如下：
(1)将输入Hi_key映射为字符集Hi_szMapAI索引，构成初始K0
0040DA68 Hi_szMapAI db 'abcdefghijklmnopqrstuvwxyz+-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
(2)我们这里抽象一种有限域三维模型，
函数通过局部定义的"坐标选择向量"loc_A_dw64_b100h[16][16],经空间有限域Hi_xyzm将K0迭代变换19次得到Ke。
Hi_xyzm定义为全局变量，位于 0040FEF0 处。这里抽象为 char Hi_xyzm[x][y][z],其中x,y,z限定取值范围皆为0~63.
xyzm大小为64*64*64;
(3)最后将得到Ke与全局静态变量Kr(0040FEE0 Hi_Kr)比较，若匹配则映射出成功提示"yourserialisgood".
代码业务逻辑如下
int __cdecl main(int argc,const char**argv,const char**envp)
{
printf("Only 'a'-'z','A'-'Z','0'-'9' accepted.\n");
printf("Only 16 chars accepted.\n");
printf("Serial:");
scanf_s("%s",Hi_key,17);
Hi_check_if_aK2iK_19xyzm_Ke_eq_Kr();
system("PAUSE");
return 0;
}
int Hi_check_if_aK2iK_19xyzm_Ke_eq_Kr()
{
signed int loc_j;// ebx
signed int loc_kidx;// esi
signed int i;// eax
int loc_nKsize;// eax
char*loc_pKn_startPosRef;// ecx
signed int loc_A_WWIdx;// edi
char*loc_axes;// eax
int loc_PosN2;// esi
int v8;// ecx
int v9;// ecx
int v10;// ecx
signed int loc_i;// eax
_BYTE*loc_pKn_x;// [esp+Ch] [ebp-258h]
int loc_WWCntOfKNeed2Test_also_K0_N10h;// [esp+10h] [ebp-254h]
int loc_2N_nKsize;// [esp+14h] [ebp-250h]
char loc_xyz[3];// [esp+18h] [ebp-24Ch]
int loc_nKsize_ai;// [esp+1Ch] [ebp-248h]
KS loc_k0[20];// [esp+20h] [ebp-244h]
int loc_A_dw64_b100h[64];// [esp+160h] [ebp-104h]
loc_j=0;
loc_A_dw64_b100h[0]=65793;
loc_A_dw64_b100h[1]=0;
loc_A_dw64_b100h[2]=0;
loc_A_dw64_b100h[3]=0;
loc_A_dw64_b100h[4]=16777217;
loc_A_dw64_b100h[5]=1;
loc_A_dw64_b100h[6]=0;
loc_A_dw64_b100h[7]=0;
loc_A_dw64_b100h[8]=1;
loc_A_dw64_b100h[9]=65792;
loc_A_dw64_b100h[10]=0;
loc_A_dw64_b100h[11]=0;
loc_A_dw64_b100h[12]=256;
loc_A_dw64_b100h[13]=16777472;
loc_A_dw64_b100h[14]=0;
loc_A_dw64_b100h[15]=0;
loc_A_dw64_b100h[16]=256;
loc_A_dw64_b100h[17]=65537;
loc_A_dw64_b100h[18]=0;
loc_A_dw64_b100h[19]=0;
loc_A_dw64_b100h[20]=16842752;
loc_A_dw64_b100h[21]=0;
loc_A_dw64_b100h[22]=1;
loc_A_dw64_b100h[23]=0;
loc_A_dw64_b100h[24]=0x10000;
loc_A_dw64_b100h[25]=1;
loc_A_dw64_b100h[26]=256;
loc_A_dw64_b100h[27]=0;
loc_A_dw64_b100h[28]=0x1000000;
loc_A_dw64_b100h[29]=0x1000000;
loc_A_dw64_b100h[30]=0x10000;
loc_A_dw64_b100h[31]=0;
loc_A_dw64_b100h[32]=0;
loc_A_dw64_b100h[33]=256;
loc_A_dw64_b100h[34]=1;
loc_A_dw64_b100h[35]=1;
loc_A_dw64_b100h[36]=0;
loc_A_dw64_b100h[37]=0x10000;
loc_A_dw64_b100h[38]=0x1000000;
loc_A_dw64_b100h[39]=256;
loc_A_dw64_b100h[40]=0;
loc_A_dw64_b100h[41]=0x1000000;
loc_A_dw64_b100h[42]=0;
loc_A_dw64_b100h[43]=257;
loc_A_dw64_b100h[44]=0;
loc_A_dw64_b100h[45]=0;
loc_A_dw64_b100h[46]=16777472;
loc_A_dw64_b100h[47]=0x10000;
loc_A_dw64_b100h[48]=0;
loc_A_dw64_b100h[49]=0;
loc_A_dw64_b100h[50]=65537;
loc_A_dw64_b100h[51]=0x10000;
loc_A_dw64_b100h[52]=0;
loc_A_dw64_b100h[53]=0;
loc_A_dw64_b100h[54]=65792;
loc_A_dw64_b100h[55]=0x1000000;
loc_A_dw64_b100h[56]=0;
loc_A_dw64_b100h[57]=0;
loc_A_dw64_b100h[58]=0x1000000;
loc_A_dw64_b100h[59]=16777217;
loc_A_dw64_b100h[60]=0;
loc_A_dw64_b100h[61]=0;
loc_A_dw64_b100h[62]=0;
loc_A_dw64_b100h[63]=16843008;
loc_kidx=0;
do
{
for(i=0;;++i)
{
if(i>=64)
{
printf("input error\n");
system("PAUSE");
exit(-1);
}
if(Hi_szMapAI[i]==(unsigned __int8)Hi_key[loc_kidx])
break;
}
loc_k0[0].kx[loc_kidx++]=i;
}
while(loc_kidx<16);
printf("\n");
loc_nKsize=16;
loc_nKsize_ai=16;
loc_2N_nKsize=2-(_DWORD)&loc_k0[1];
do
{
loc_pKn_startPosRef=(char*)loc_k0+loc_nKsize;
loc_pKn_x=(char*)loc_k0+loc_nKsize;
loc_A_WWIdx=0;
do
{
loc_axes=loc_xyz;
loc_PosN2=(int)&loc_pKn_startPosRef[loc_2N_nKsize];
loc_WWCntOfKNeed2Test_also_K0_N10h=4;
do
{
v8=(loc_PosN2-2)%16;
if(*((_BYTE*)&loc_A_dw64_b100h[loc_A_WWIdx]+v8))
*loc_axes++=*((_BYTE*)&loc_WWCntOfKNeed2Test_also_K0_N10h+v8+loc_nKsize_ai);
v9=(loc_PosN2-1)%16;
if(*((_BYTE*)&loc_A_dw64_b100h[loc_A_WWIdx]+v9))
*loc_axes++=*((_BYTE*)&loc_WWCntOfKNeed2Test_also_K0_N10h+v9+loc_nKsize_ai);
if(*((_BYTE*)&loc_A_dw64_b100h[loc_A_WWIdx]+loc_PosN2%16))
*loc_axes++=*((_BYTE*)&loc_WWCntOfKNeed2Test_also_K0_N10h+loc_PosN2%16+loc_nKsize_ai);
v10=(loc_PosN2+1)%16;
if(*((_BYTE*)&loc_A_dw64_b100h[loc_A_WWIdx]+v10))
*loc_axes++=*((_BYTE*)&loc_WWCntOfKNeed2Test_also_K0_N10h+v10+loc_nKsize_ai);
loc_PosN2+=4;
--loc_WWCntOfKNeed2Test_also_K0_N10h;
}
while(loc_WWCntOfKNeed2Test_also_K0_N10h);
*loc_pKn_x=Hi_xyzm[64*((unsigned __int8)loc_xyz[1]+((unsigned __int8)loc_xyz[0]<<6))
+(unsigned __int8)loc_xyz[2]];
loc_A_WWIdx+=4;
loc_pKn_startPosRef=loc_pKn_x+++1;
}
while(loc_A_WWIdx<64);
loc_2N_nKsize-=16;
loc_nKsize=loc_nKsize_ai+16;
loc_nKsize_ai=loc_nKsize;
}
while(loc_nKsize<0x140);
loc_i=0;
do
{
if((unsigned __int8)loc_k0[19].kx[loc_i]!=Hi_Kr[loc_i])
return printf("serial error\n");
++loc_i;
}
while(loc_i<16);
do
printf("%c",(unsigned __int8)Hi_szMapAI[(unsigned int)(unsigned __int8)loc_k0[9].kx[loc_j++]>>1]);
while(loc_j<16);
return printf("\n");
}
0x01 提取数据并抽象模型
IDA+WINDBG,在校验函数下面完成局部定义的"坐标选择向量"loc_A_dw64_b100h[16][16]初始化处断下,
00401212 xor esi, esi
在断点处执行下属IDAPython脚本，得到"坐标选择向量"loc_A_dw64_b100h[16][16],我们定义为A
#------- ------- ------- ------- ------- ------- -------
A_addr = get_reg_value('ebp')-0x104
for i in xrange(0,0x100):#16*16
print "0x{:02X}, ".format(Byte(A_addr+i)),
if (i+1)%16 == 0:
print ""
print " ",
#------- ------- ------- ------- ------- ------- -------
A = [
0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00,
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
