[原创]注册机-2016腾讯游戏安全大赛-pc-第一轮-软件逆向-看雪安全社区

[原创]注册机-2016腾讯游戏安全大赛-pc-第一轮

发表于: 2025-12-1 23:54 283

[原创]注册机-2016腾讯游戏安全大赛-pc-第一轮

CreateSun

2025-12-1 23:54

283

MFC软件可以使用UI控件解析出其他按钮绑定的函数
例如这个软件
图片描述

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

#include <stdio.h>
#include <Windows.h>
 
//明确    数据      存储      循环计数        算法
 
 
 
// 自定义Base64字符集
const char* base64_chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@%";
 
// 函数：将二进制数组转换为Base64字符串
void binary_to_base64_string(const unsigned char* input, int input_len, char* output) {
    int i = 0, j = 0;
    unsigned char char_array_3[3];
    unsigned char char_array_4[4];
    int output_index = 0;
 
    while (input_len--) {
        char_array_3[i++] = *(input++);
 
        // 每积累3个字节，转换为4个Base64字符
        if (i == 3) {
            char_array_4[0] = (char_array_3[0] & 0xFC) >> 2;
            char_array_4[1] = ((char_array_3[0] & 0x03) << 4) + ((char_array_3[1] & 0xF0) >> 4);
            char_array_4[2] = ((char_array_3[1] & 0x0F) << 2) + ((char_array_3[2] & 0xC0) >> 6);
            char_array_4[3] = char_array_3[2] & 0x3F;
 
            for (i = 0; i < 4; i++) {
                output[output_index++] = base64_chars[char_array_4[i]];
            }
            i = 0;
        }
    }
 
    // 处理剩余的字节（如果不是3的倍数）
    if (i > 0) {
        // 用0填充剩余的字节
        for (j = i; j < 3; j++) {
            char_array_3[j] = '\0';
        }
 
        // 转换为Base64字符
        char_array_4[0] = (char_array_3[0] & 0xFC) >> 2;
        char_array_4[1] = ((char_array_3[0] & 0x03) << 4) + ((char_array_3[1] & 0xF0) >> 4);
        char_array_4[2] = ((char_array_3[1] & 0x0F) << 2) + ((char_array_3[2] & 0xC0) >> 6);
        char_array_4[3] = char_array_3[2] & 0x3F;
 
        // 添加Base64字符
        for (j = 0; j < i + 1; j++) {
            output[output_index++] = base64_chars[char_array_4[j]];
        }
 
        // 添加填充字符（可选，如果您需要标准Base64格式）
        // while (i++ < 3) {
        //     output[output_index++] = '=';
        // }
    }
 
    output[output_index] = '\0'; // 字符串结束符
}
 
int main() {
    char user[0x100] = { 0 };       // "123456"
    char pass[0x100] = { 0 };
    scanf_s("%s", user, sizeof(user));
    byte name_encrypt_1[0x100] = { 0 };
 
    UINT32 userLen = strlen(user);
    if (userLen < 6 || userLen>20) {
        printf("用户名长度不合法:6<=长度<=20");
        return 0;
    }
    int len = 0;
    //用户名算法1
    {
        //DWORD+DWORD  四字节   BYTE+BYTE  一字节
        unsigned char* userEncodePtr = 0;
        for (size_t i = 0; i < 0x10; i++)
        {
            len = i % userLen;  //字符串长度6   0x10 
            userEncodePtr = name_encrypt_1 + i;
            *(DWORD32*)userEncodePtr += user[len] * (0x1339E7E + i) * userLen;//0x1339E7E的十进制是2016 01 26 日期  char
        }
        printf("用户名算法1输出内存数据:");
        for (int j = 0; j < 0x14; j++) {
            printf("%02X", name_encrypt_1[j]);  //B4D8048CC50ACCBABDE340AAB7C9F03A585977
        }
        printf("\n");
    }
 
    //用户名算法2
    BYTE name_encrypt_2[20] = { NULL };
    {
        for (size_t i = 0; i < 0x14; i += 4)
        {
            /*
            0x66666667 = 1717986919 (十进制)
            2³⁴ ÷ 10 = 1717986918.4 ≈ 1717986919
            10=2³⁴/1717986919
            x/10=1717986919/2³⁴=1717986919>>34
            所以：
            ecx / 10 ≈ (ecx × 0x66666667) ÷ 2³⁴
                     = (ecx × 0x66666667) >> 34
 
            x*1717986919/2³⁴  == x/10
            */
            int tmp = *(int*)&name_encrypt_1[i] / 10;
            *(int*)&name_encrypt_2[i] = tmp;
        }
        printf("用户名算法2输出内存数据:");
        for (size_t i = 0; i < sizeof(name_encrypt_2); i++)
        {
            printf("%02X", name_encrypt_2[i]);      //79E266F47B6714F993E36CF7F8E0E40555EF0B00
        }
        printf("\n");
    }
 
 
    //通过N解密P数组
    DWORD32* N = (DWORD32*)name_encrypt_2;
    DWORD32 P[5] = { 0 };// 注意这里是 DWORD
 
    P[4] = N[0] + N[1];
    P[3] = N[2] + N[3];
    P[2] = 2 * N[0] + N[1];
    P[1] = 3 * N[2] - N[4];
    P[0] = 2 * N[2] + N[3];
 
    BYTE* pPassWord = (BYTE*)P;
    printf("计算所得二进制密码为:");
    for (int i = 0; i < 20; i++)
    {
        printf("%02X", pPassWord[i]);
    }
    printf("\n");
 
    char StringBuffer[0x100] = { 0 };
    binary_to_base64_string((const unsigned char*)P, sizeof(P), StringBuffer);
    printf("二进制数据转Base64编码密码为:");
    printf("%s", StringBuffer);
    printf("\n");
 
    return 0;
}