第一题：无限流[签到题] 签个到，怀念一下

前段时间在论坛要下个工具，关注了公众号，今天中午回到家就看到公众号的推送，回想起以前在论坛学习的日子，真的很怀念，那就来签个到吧。

把签到题下下来就愁了，除了VS好像其它工具都没有，那就VS吧，反正签到题都说了是无敌简单的。

1. 分析目标

目标叫goodluck.exe,看着都觉得心情不错。
一看图标就是熟悉的MFC写的,VS就直接使用dumpbin.exe吧

C:\Users\xxx\Desktop\goodluck>dumpbin goodluck.exe /IMPORTS
Microsoft (R) COFF/PE Dumper Version 14.16.27030.1
...
 
    MSVCRT.dll
                40318C Import Address Table
                4038C0 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference
 
                   48 _XcptFilter
                  249 exit
                   8F _acmdln
                   58 __getmainargs
                  10F _initterm
                   83 __setusermatherr
                   9D _adjust_fdiv
                   6A __p__commode
                   6F __p__fmode
                   81 __set_app_type
                   CA _except_handler3
                   B7 _controlfp
                  186 _onexit
                   55 __dllonexit
                  2BE strlen
                  2B8 strcmp
                   49 __CxxFrameHandler
                  1AA _setmbcp
                   D3 _exit
...

关于字符串相关的函数strlen,strcmp, 一看应该关键代码就和这相关了。

2. 调试

运行goodluck.exe ,VS 调试=>附加到进程，然后载入msvcrt.dll的符号信息，并设置断点：

随便输入123, 然后断在了strlen这里，返回到程序代码空间，就看到了关键代码:

040187A 83 C4 04             add         esp,4 
0040187D 85 C0                test        eax,eax  
0040187F 75 13                jne         00401894 
00401881 6A 00                push        0 
00401883 6A 00                push        0 
00401885 68 A8 35 40 00       push        4035A8h 
0040188A 8B 4D FC             mov         ecx,dword ptr [ebp-4]  
0040188D E8 20 06 00 00       call        00401EB2 
00401892 EB 7B                jmp         0040190F 
00401894 C7 45 F4 A0 35 40 00 mov         dword ptr [ebp-0Ch],4035A0h 
0040189B C7 45 F0 00 00 00 00 mov         dword ptr [ebp-10h],0 
004018A2 C7 45 F0 00 00 00 00 mov         dword ptr [ebp-10h],0 
004018A9 8B 55 F8             mov         edx,dword ptr [ebp-8]  
004018AC 03 55 F0             add         edx,dword ptr [ebp-10h]  
004018AF 0F BE 02             movsx       eax,byte ptr [edx]  
004018B2 85 C0                test        eax,eax  
004018B4 74 45                je          004018FB 
004018B6 8B 4D F8             mov         ecx,dword ptr [ebp-8]  
004018B9 03 4D F0             add         ecx,dword ptr [ebp-10h]  
004018BC 0F BE 11             movsx       edx,byte ptr [ecx]  
004018BF 83 FA 39             cmp         edx,39h 
004018C2 7F 27                jg          004018EB 
004018C4 8B 45 F8             mov         eax,dword ptr [ebp-8]  
004018C7 03 45 F0             add         eax,dword ptr [ebp-10h]  
004018CA 0F BE 08             movsx       ecx,byte ptr [eax]  
004018CD 83 F9 30             cmp         ecx,30h 
004018D0 7C 19                jl          004018EB 
004018D2 8B 55 F8             mov         edx,dword ptr [ebp-8]  
004018D5 03 55 F0             add         edx,dword ptr [ebp-10h]  
004018D8 0F BE 02             movsx       eax,byte ptr [edx]  
004018DB 8B 4D F0             mov         ecx,dword ptr [ebp-10h]  
004018DE 8B 55 F4             mov         edx,dword ptr [ebp-0Ch]  
004018E1 8A 44 02 D0          mov         al,byte ptr [edx+eax-30h]  
004018E5 88 44 0D E8          mov         byte ptr [ebp+ecx-18h],al  
004018E9 EB 05                jmp         004018F0 
004018EB E8 C0 FE FF FF       call        004017B0 
004018F0 8B 4D F0             mov         ecx,dword ptr [ebp-10h]  
004018F3 83 C1 01             add         ecx,1 
004018F6 89 4D F0             mov         dword ptr [ebp-10h],ecx  
004018F9 EB AE                jmp         004018A9 
004018FB 8B 55 F0             mov         edx,dword ptr [ebp-10h]  
004018FE C6 44 15 E8 00       mov         byte ptr [ebp+edx-18h],0 
00401903 8D 45 E8             lea         eax,[ebp-18h]  
00401906 50                   push        eax  
00401907 E8 E4 FE FF FF       call        004017F0 
0040190C 83 C4 04             add         esp,4 
0040190F 5F                   pop         edi  
00401910 5E                   pop         esi  
00401911 5B                   pop         ebx  
00401912 8B E5                mov         esp,ebp  
00401914 5D                   pop         ebp  
00401915 C3                   ret

大概算法就是计算'cuk!ogl'对应'0123456' 排序成'goluck!'后对应的数字：

/* 转成C代码算法大概这样,没运行过-_-! */
int encript(char *input, char *output, int output_len)
{
    const char* factor = "cuk!ogl";
    if (!input || !output) {
        return -1;
    }
    int input_len = strlen(input);
    int i = 0;
    for (i = 0; i < input_len && i < output_len; i++) {
        if (input[i] > '9' || input[i] < '0') {
            return -1;
        }
        output[i] = factor[i];
    }
    output[i] = '\0';
}