设置name(4个name中随机选1个),
按换行符分隔转换成16进制
name_part1记为Y, name_part2记为G
.text:004040D0 x_set_rnd_name
.text:00403F0C push offset aDS ; "%d\n%s"
.text:00403F11 push ecx ; char *
.text:00403F12 call _sscanf
Y: 67
G: 1DB49DFF25CFF1A955529516A2B1D92728988B150F53514B6ABB26A8EC6F4FE3
Y: 66
G: 54D8FFDD81B50AC27A20DBD697C9A530841471595B691B7F4336FF5313867ABC
Y: 65
G: 6F7570369DA6669C5F2E620CCB6F2379BF5E790929BC7989B5AE5E088D510782
Y: 64
G: 14681B5AB4AA11E0CE7AF892923160F7C975EE6688141717927C2A0904B38767
sn以XXXX分隔, 前半部分记为v1(256进制), 后半部分记为v2(10进制)
.text:004040D0 x_set_rnd_name
.text:00403F0C push offset aDS ; "%d\n%s"
.text:00403F11 push ecx ; char *
.text:00403F12 call _sscanf
Y: 67
G: 1DB49DFF25CFF1A955529516A2B1D92728988B150F53514B6ABB26A8EC6F4FE3
Y: 66
G: 54D8FFDD81B50AC27A20DBD697C9A530841471595B691B7F4336FF5313867ABC
Y: 65
G: 6F7570369DA6669C5F2E620CCB6F2379BF5E790929BC7989B5AE5E088D510782
Y: 64
G: 14681B5AB4AA11E0CE7AF892923160F7C975EE6688141717927C2A0904B38767
sn以XXXX分隔, 前半部分记为v1(256进制), 后半部分记为v2(10进制)
.text:004040D0 x_set_rnd_name
.text:00403F0C push offset aDS ; "%d\n%s"
.text:00403F11 push ecx ; char *
.text:00403F12 call _sscanf
Y: 67
G: 1DB49DFF25CFF1A955529516A2B1D92728988B150F53514B6ABB26A8EC6F4FE3
Y: 66
G: 54D8FFDD81B50AC27A20DBD697C9A530841471595B691B7F4336FF5313867ABC
Y: 65
G: 6F7570369DA6669C5F2E620CCB6F2379BF5E790929BC7989B5AE5E088D510782
Y: 64
G: 14681B5AB4AA11E0CE7AF892923160F7C975EE6688141717927C2A0904B38767
sn以XXXX分隔, 前半部分记为v1(256进制), 后半部分记为v2(10进制)
.text:00403FA1 call x_extract_XXXX
.text:00403FA1 call x_extract_XXXX
验证sn, 返回结果必须为0
.text:00404004 call x_404270
.text:00404004 call x_404270
素数p=2^255-19=7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED
phi(p)=p-1=7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEC
.text:00403E94 mov [esp+8CCh+prime_arg], 2
.text:00403E9C mov [esp+8CCh+prime_arg+4], 0FFh
.text:00403EA4 mov [esp+8CCh+prime_arg+8], 0FFFFFFEDh
.text:0040445E call big__set_int
.text:0040446F call big__pow_int
.text:00404480 call big__add_int
.text:00404492 call big__sub_int
.text:004044A2 call big__set_int
.text:00403E94 mov [esp+8CCh+prime_arg], 2
.text:00403E9C mov [esp+8CCh+prime_arg+4], 0FFh
.text:00403EA4 mov [esp+8CCh+prime_arg+8], 0FFFFFFEDh
.text:0040445E call big__set_int
.text:0040446F call big__pow_int
.text:00404480 call big__add_int
.text:00404492 call big__sub_int
.text:004044A2 call big__set_int
4*v2 < p
.text:00404587 call big__add
.text:004045A1 call big__add
.text:004045B1 call big__compare
.text:00404587 call big__add
.text:004045A1 call big__add
.text:004045B1 call big__compare
x=v2-v1
验证 64x^4+x^2+3 mod p == v1
.text:00404607 call big__sub
.text:0040462A call big__powmod_int
.text:0040464A call big__ax_plus_b_mod_p
.text:00404683 call big__sub
.text:0040468F call big__get_int
.text:00404607 call big__sub
.text:0040462A call big__powmod_int
.text:0040464A call big__ax_plus_b_mod_p
.text:00404683 call big__sub
.text:0040468F call big__get_int
v1的最后1个字符+10, 判断是否为25进制(ABCDEFGHKJILMNOPQRSTUVWYZ)
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
