-
-
[原创]修改RSATool2v17工具使之支持小写a~f输入&测试时支持16进制字符串
-
发表于: 2026-8-23 11:52
-
工具下载链接: ff1K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6@1L8$3!0D9i4K6u0W2K9$3q4F1P5s2g2W2i4K6u0W2j5$3!0E0i4K6u0r3K9h3&6V1k6i4S2Q4x3X3c8V1k6i4c8S2K9h3I4Q4x3X3b7I4x3e0k6Q4x3X3g2Z5N6r3@1`.
;;;--------------对于输入RSA的N,E,D字符串处理子程序----------------------------
004012D4 SUB ESP,00000BB8
004012DA CMP ECX,000005DB
004012E0 PUSH EBX
004012E1 PUSH EBP
004012E2 PUSH EDI
004012E3 JG 004014B6
004012E9 MOV EAX,[ESP+00000BD0]
004012F0 XOR EBX,EBX
004012F2 CMP EAX,EBX
004012F4 JZ 004014B6
004012FA MOV EBP,[ESP+00000BC8]
00401301 CMP EBP,EBX
00401303 JZ 004014B6
00401309 MOV EDX,[ESP+00000BCC]
00401310 PUSH ECX
00401311 LEA ECX,[ESP+10]
00401315 PUSH ECX
00401316 PUSH EAX
00401317 PUSH EDX
00401318 CALL [USER32!GetDlgItemTextA]
0040131E CMP EAX,EBX
00401320 JZ 004014B6
00401326 MOV ECX,[0041E240]
0040132C SUB ECX,EBX
0040132E JZ 0040136C ;输入为10进制串
00401330 DEC ECX
00401331 JZ 0040135A ;输入为16进制串
00401333 DEC ECX
00401334 JZ 00401348 ;输入为60进制串
00401336 MOV ECX,[0041E244]
0040133C MOV DWORD PTR [ECX+00000238],00000100
00401346 JMP 0040137C
00401348 MOV EDX,[0041E244]
0040134E MOV DWORD PTR [EDX+00000238],0000003C
00401358 JMP 0040137C
0040135A MOV ECX,[0041E244]
00401360 MOV DWORD PTR [ECX+00000238],00000010
0040136A JMP 0040137C
0040136C MOV EDX,[0041E244]
00401372 MOV DWORD PTR [EDX+00000238],0000000A
0040137C MOV EDI,[0041E240]
00401382 PUSH ESI
00401383 MOV ECX,EDI
00401385 SUB ECX,EBX
00401387 JZ 00401437 ;转输入的10进制串处理
0040138D DEC ECX
0040138E JZ 0040140B ;转输入的16进制串处理
00401390 DEC ECX
00401391 JZ 004013D5 ;转输入的60进制串处理
00401393 XOR EDX,EDX
00401395 XOR ESI,ESI
00401397 CMP EAX,EBX
00401399 JLE 00401457
0040139F MOV CL,[EDX+ESP+10]
004013A3 CMP CL,2F
004013A6 JAE 004013AD
004013A8 CMP CL,2B
004013AB JNZ 004013CB
004013AD CMP CL,39
004013B0 JBE 004013B7
004013B2 CMP CL,41
004013B5 JB 004013CB
004013B7 CMP CL,5A
004013BA JBE 004013C1
004013BC CMP CL,61
004013BF JB 004013CB
004013C1 CMP CL,7A
004013C4 JA 004013CB
004013C6 MOV [ESI+ESP+10],CL
004013CA INC ESI
004013CB INC EDX
004013CC CMP EDX,EAX
004013CE JL 0040139F
004013D0 JMP 00401457
004013D5 XOR EDX,EDX
004013D7 XOR ESI,ESI
004013D9 CMP EAX,EBX
004013DB JLE 00401457
004013DD MOV CL,[EDX+ESP+10]
004013E1 CMP CL,30
004013E4 JB 00401404
004013E6 CMP CL,5A
004013E9 JBE 004013F0
004013EB CMP CL,61
004013EE JB 00401404
004013F0 CMP CL,39
004013F3 JBE 004013FA
004013F5 CMP CL,41
004013F8 JB 00401404
004013FA CMP CL,78
004013FD JA 00401404
004013FF MOV [ESI+ESP+10],CL
00401403 INC ESI
00401404 INC EDX
00401405 CMP EDX,EAX
00401407 JL 004013DD
00401409 JMP 00401457
0040140B XOR EDX,EDX
0040140D XOR ESI,ESI
0040140F CMP EAX,EBX
00401411 JLE 00401457
00401413 MOV CL,[EDX+ESP+10]
00401417 CMP CL,30 ;判断是不是
0040141A JB 00401430 ;"0"~~"9"
0040141C CMP CL,39 ;及大写的
0040141F JBE 00401426 ;"A"~~"F"
00401421 CMP CL,41 ;不是则
00401424 JB 00401430 ;去掉输入的
00401426 CMP CL,46 ;字符
00401429 JA 00401430 ;
0040142B MOV [ESI+ESP+10],CL ;是"0"~~"9"
0040142F INC ESI ;或"A"~~"F"保存
00401430 INC EDX
00401431 CMP EDX,EAX
00401433 JL 00401413
00401435 JMP 00401457
00401437 XOR EDX,EDX
00401439 XOR ESI,ESI
0040143B CMP EAX,EBX
0040143D JLE 00401457
0040143F MOV CL,[EDX+ESP+10]
00401443 CMP CL,30
00401446 JB 00401452
00401448 CMP CL,39
0040144B JA 00401452
0040144D MOV [ESI+ESP+10],CL
00401451 INC ESI
00401452 INC EDX
00401453 CMP EDX,EAX
00401455 JL 0040143F
00401457 MOV [ESI+ESP+10],BL
0040145B CMP ESI,EBX
0040145D POP ESI
0040145E JZ 004014B6
00401460 CMP EDI,03
00401463 JNZ 0040149E
00401465 LEA EAX,[ESP+000005E8]
0040146C LEA ECX,[ESP+0C]
00401470 PUSH EAX
00401471 PUSH ECX
00401472 CALL 00401030
00401477 MOV EDX,[0041E244]
0040147D MOV [EDX+00000248],EAX
00401483 LEA EAX,[ESP+000005F0]
0040148A PUSH EAX
0040148B PUSH EBP
0040148C CALL 004074F0
00401491 ADD ESP,10
00401494 POP EDI
00401495 POP EBP
00401496 POP EBX
00401497 ADD ESP,00000BB8
0040149D RET
0040149E LEA ECX,[ESP+0C]
004014A2 PUSH ECX
004014A3 PUSH EBP
004014A4 CALL 004074F0
004014A9 ADD ESP,08
004014AC POP EDI
004014AD POP EBP
004014AE POP EBX
004014AF ADD ESP,00000BB8
004014B5 RET
004014B6 POP EDI
004014B7 POP EBP
004014B8 XOR EAX,EAX
004014BA POP EBX
004014BB ADD ESP,00000BB8
004014C1 RET
;;;---------------------下面是测试加密的子程序代码---------------------------------
00405C80 MOV EAX,00001100
00405C85 CALL 0040E970
00405C8A PUSH EBX
00405C8B PUSH EBP
00405C8C PUSH ESI
00405C8D PUSH EDI
00405C8E MOV EDI,[ESP+00001114]
00405C95 LEA EAX,[ESP+10]
00405C99 PUSH 000000FF
00405C9E PUSH EAX
00405C9F PUSH 000003F3
00405CA4 PUSH EDI
00405CA5 CALL [USER32!GetDlgItemTextA] ;;;取测试输入要加密的字符串
00405CAB TEST EAX,EAX
00405CAD JNZ 00405CBA
00405CAF POP EDI
00405CB0 POP ESI
00405CB1 POP EBP
00405CB2 POP EBX
00405CB3 ADD ESP,00001100
00405CB9 RET
00405CBA MOV ECX,[0041E240]
00405CC0 PUSH 00
00405CC2 MOV [0041E248],ECX
00405CC8 MOV DWORD PTR [0041E240],00000001
00405CD2 CALL 00407A80
00405CD7 MOV EDX,[0041E470]
00405CDD PUSH 000004D2
00405CE2 MOV EBP,EAX
00405CE4 PUSH 00000404 ;;;公共密钥E的ID,(私钥D的ID=3F5)
00405CE9 PUSH EDX
00405CEA PUSH EBP
00405CEB CALL 004012D0
00405CF0 ADD ESP,14
00405CF3 TEST EAX,EAX
00405CF5 JNZ 00405D2A
00405CF7 PUSH 10
00405CF9 PUSH 00418FF4 ; "Error"
00405CFE PUSH 00418FDC ; "Parameter E is invalid"
00405D03 PUSH EDI
00405D04 CALL [USER32!MessageBoxA]
00405D0A MOV EAX,[0041E248]
00405D0F PUSH EBP
00405D10 MOV [0041E240],EAX
00405D15 CALL 00408010
00405D1A ADD ESP,04
00405D1D XOR EAX,EAX
00405D1F POP EDI
00405D20 POP ESI
00405D21 POP EBP
00405D22 POP EBX
00405D23 ADD ESP,00001100
00405D29 RET
00405D2A MOV ECX,[0041E248]
00405D30 PUSH 00
00405D32 MOV [0041E240],ECX
00405D38 CALL 00407A80
00405D3D MOV EDX,[0041E244]
00405D43 MOV ESI,EAX
00405D45 LEA EAX,[ESP+14]
00405D49 MOV EBX,00000100
00405D4E PUSH EAX
00405D4F PUSH ESI
00405D50 MOV [EDX+00000238],EBX
00405D56 CALL 004074F0 ;;;转换输入的测试加密字符串
00405D5B MOV ECX,[0041E470]
00405D61 ADD ESP,0C
00405D64 PUSH 00
00405D66 PUSH 00
00405D68 PUSH 00000147
00405D6D PUSH 000003FA
00405D72 PUSH ECX
00405D73 CALL [USER32!SendDlgItemMessageA]
00405D79 MOV [0041E240],EAX
00405D7E SUB EAX,00
00405D81 JZ 00405DBA
00405D83 DEC EAX
00405D84 JZ 00405DA8
00405D86 DEC EAX
00405D87 JZ 00405D97
00405D89 MOV EDX,[0041E244]
00405D8F MOV [EDX+00000238],EBX
00405D95 JMP 00405DCA
00405D97 MOV EAX,[0041E244]
00405D9C MOV DWORD PTR [EAX+00000238],0000003C
00405DA6 JMP 00405DCA
00405DA8 MOV ECX,[0041E244]
00405DAE MOV DWORD PTR [ECX+00000238],00000010
00405DB8 JMP 00405DCA
00405DBA MOV EDX,[0041E244]
00405DC0 MOV DWORD PTR [EDX+00000238],0000000A
00405DCA PUSH 00
00405DCC CALL 00407A80
00405DD1 MOV EBX,EAX
00405DD3 MOV EAX,[0041E470]
00405DD8 PUSH 000004D3
00405DDD PUSH 000003F4
00405DE2 PUSH EAX
00405DE3 PUSH EBX
00405DE4 CALL 004012D0
00405DE9 ADD ESP,14
00405DEC TEST EAX,EAX
00405DEE JNZ 00405E1F
00405DF0 PUSH 10
00405DF2 PUSH 00418FF4 ; "Error"
00405DF7 PUSH 0041953C ; "Parameter N is invalid"
00405DFC PUSH EDI
00405DFD CALL [USER32!MessageBoxA]
00405E03 PUSH EBX
00405E04 CALL 00408010
00405E09 PUSH ESI
00405E0A CALL 00408010
00405E0F ADD ESP,08
00405E12 XOR EAX,EAX
00405E14 POP EDI
00405E15 POP ESI
00405E16 POP EBP
00405E17 POP EBX
00405E18 ADD ESP,00001100
00405E1E RET
00405E1F PUSH EBX
00405E20 PUSH ESI
00405E21 CALL 004086F0
00405E26 ADD ESP,08
00405E29 CMP EAX,-01
00405E2C JZ 00405E41
00405E2E PUSH 30
00405E30 PUSH 00418FD4 ; "Warning"
00405E35 PUSH 0041948C ; "Your message (M) is > N
00405E3A PUSH EDI
00405E3B CALL [USER32!MessageBoxA]
00405E41 PUSH 00
00405E43 CALL 00407A80
00405E48 MOV EDI,EAX
00405E4A PUSH EDI
00405E4B PUSH EBX
00405E4C PUSH EBP
00405E4D PUSH ESI
00405E4E CALL 0040CDC0
00405E53 MOV EAX,[0041E240]
00405E58 ADD ESP,14
00405E5B CMP EAX,03
00405E5E JNZ 00405E89
00405E60 LEA ECX,[ESP+00000910]
00405E67 PUSH ECX
00405E68 PUSH EDI
00405E69 CALL 004076C0
00405E6E PUSH EAX
00405E6F LEA EDX,[ESP+0000011C]
00405E76 LEA EAX,[ESP+0000091C]
00405E7D PUSH EDX
00405E7E PUSH EAX
00405E7F CALL 004010F0
00405E84 ADD ESP,14
00405E87 JMP 00405E9A
00405E89 LEA ECX,[ESP+00000110]
00405E90 PUSH ECX
00405E91 PUSH EDI
00405E92 CALL 004076C0
00405E97 ADD ESP,08
00405E9A MOV EAX,[ESP+00001114]
00405EA1 LEA EDX,[ESP+00000110]
00405EA8 PUSH EDX
00405EA9 PUSH 000003FD
00405EAE PUSH EAX
00405EAF CALL [USER32!SetDlgItemTextA]
00405EB5 MOV ECX,[ESP+00001114]
00405EBC PUSH 00419450 ; "Message encrypted: C=M^
00405EC1 PUSH 00
00405EC3 PUSH 0C
00405EC5 PUSH 00000400
00405ECA PUSH ECX
00405ECB CALL [USER32!SendDlgItemMessageA]
00405ED1 PUSH ESI
00405ED2 CALL 00408010
00405ED7 PUSH EBP
00405ED8 CALL 00408010
00405EDD PUSH EBX
00405EDE CALL 00408010
00405EE3 PUSH EDI
00405EE4 CALL 00408010
00405EE9 ADD ESP,10
00405EEC MOV EAX,00000001
00405EF1 POP EDI
00405EF2 POP ESI
00405EF3 POP EBP
00405EF4 POP EBX
00405EF5 ADD ESP,00001100
00405EFB RET
;;;---------------------测试解密的子程序代码如下---------------------------------
00405F00 SUB ESP,00000908
00405F06 LEA EAX,[ESP+00000108]
00405F0D PUSH EBX
00405F0E PUSH EBP
00405F0F PUSH ESI
00405F10 PUSH EDI
00405F11 MOV EDI,[ESP+0000091C]
00405F18 PUSH 000007FF
00405F1D PUSH EAX
00405F1E PUSH 000003FD
00405F23 PUSH EDI
00405F24 CALL [USER32!GetDlgItemTextA]
00405F2A TEST EAX,EAX
00405F2C JNZ 00405F39
00405F2E POP EDI
00405F2F POP ESI
00405F30 POP EBP
00405F31 POP EBX
00405F32 ADD ESP,00000908
00405F38 RET
00405F39 MOV ECX,[0041E470]
00405F3F PUSH 00
00405F41 PUSH 00
00405F43 PUSH 00000147
00405F48 PUSH 000003FA
00405F4D PUSH ECX
00405F4E CALL [USER32!SendDlgItemMessageA]
00405F54 MOV [0041E240],EAX
00405F59 SUB EAX,00
00405F5C JZ 00405F99
00405F5E DEC EAX
00405F5F JZ 00405F87
00405F61 DEC EAX
00405F62 JZ 00405F76
00405F64 MOV EDX,[0041E244]
00405F6A MOV DWORD PTR [EDX+00000238],00000100
00405F74 JMP 00405FA9
00405F76 MOV EAX,[0041E244] ; "@;>"
00405F7B MOV DWORD PTR [EAX+00000238],0000003C
00405F85 JMP 00405FA9
00405F87 MOV ECX,[0041E244]
00405F8D MOV DWORD PTR [ECX+00000238],00000010
00405F97 JMP 00405FA9
00405F99 MOV EDX,[0041E244]
00405F9F MOV DWORD PTR [EDX+00000238],0000000A
00405FA9 PUSH 00
00405FAB CALL 00407A80
00405FB0 PUSH 000004D3
00405FB5 MOV EBX,EAX
00405FB7 PUSH 000003FD
00405FBC PUSH EDI
00405FBD PUSH EBX
00405FBE CALL 004012D0
00405FC3 ADD ESP,14
00405FC6 TEST EAX,EAX
00405FC8 JNZ 00405FF3
00405FCA PUSH 10
00405FCC PUSH 00418FF4 ; "Error"
00405FD1 PUSH 004195C0 ; "Parameter C is invalid"
00405FD6 PUSH EDI
00405FD7 CALL [USER32!MessageBoxA]
00405FDD PUSH EBX
00405FDE CALL 00408010
00405FE3 ADD ESP,04
00405FE6 XOR EAX,EAX
00405FE8 POP EDI
00405FE9 POP ESI
00405FEA POP EBP
00405FEB POP EBX
00405FEC ADD ESP,00000908
00405FF2 RET
00405FF3 PUSH 00
00405FF5 CALL 00407A80
00405FFA MOV ESI,EAX
00405FFC MOV EAX,[0041E470]
00406001 PUSH 000004D3
00406006 PUSH 000003F5 ;;;私钥D的ID(公共密钥E的ID=404)
0040600B PUSH EAX
0040600C PUSH ESI
0040600D MOV [ESP+28],ESI
00406011 CALL 004012D0
00406016 ADD ESP,14
00406019 TEST EAX,EAX
0040601B JNZ 0040604C
0040601D PUSH 10
0040601F PUSH 00418FF4 ; "Error"
00406024 PUSH 004195A8 ; "Parameter D is invalid"
00406029 PUSH EDI
0040602A CALL [USER32!MessageBoxA]
00406030 PUSH ESI
00406031 CALL 00408010
00406036 PUSH EBX
00406037 CALL 00408010
0040603C ADD ESP,08
0040603F XOR EAX,EAX
00406041 POP EDI
00406042 POP ESI
00406043 POP EBP
00406044 POP EBX
00406045 ADD ESP,00000908
0040604B RET
0040604C PUSH 00
0040604E CALL 00407A80
00406053 MOV ECX,[0041E470]
00406059 PUSH 000004D3
0040605E MOV EBP,EAX
00406060 PUSH 000003F4
00406065 PUSH ECX
00406066 PUSH EBP
00406067 MOV [ESP+24],EBP
0040606B CALL 004012D0
00406070 ADD ESP,14
00406073 TEST EAX,EAX
00406075 JNZ 004060AC
00406077 PUSH 10
00406079 PUSH 00418FF4 ; "Error"
0040607E PUSH 0041953C ; "Parameter N is invalid"
00406083 PUSH EDI
00406084 CALL [USER32!MessageBoxA]
0040608A PUSH ESI
0040608B CALL 00408010
00406090 PUSH EBX
00406091 CALL 00408010
00406096 PUSH EBP
00406097 CALL 00408010
0040609C ADD ESP,0C
0040609F XOR EAX,EAX
004060A1 POP EDI
004060A2 POP ESI
004060A3 POP EBP
004060A4 POP EBX
004060A5 ADD ESP,00000908
004060AB RET
004060AC PUSH 00
004060AE CALL 00407A80
004060B3 MOV EDX,[ESP+14]
004060B7 MOV EBP,EAX
004060B9 PUSH EBP
004060BA PUSH EDX
004060BB PUSH ESI
004060BC PUSH EBX
004060BD CALL 0040CDC0
004060C2 MOV EAX,[0041E244] ; "@;>"
004060C7 LEA ECX,[ESP+2C]
004060CB PUSH ECX
004060CC PUSH EBP
004060CD MOV DWORD PTR [EAX+00000238],00000100
004060D7 CALL 004076C0
004060DC ADD ESP,1C
004060DF LEA EDX,[ESP+18]
004060E3 PUSH EDX
004060E4 PUSH 000003FD
004060E9 PUSH EDI
004060EA CALL [USER32!SetDlgItemTextA]
004060F0 LEA EAX,[ESP+00000118]
004060F7 PUSH 000000FF
004060FC PUSH EAX
004060FD PUSH 000003F3
00406102 PUSH EDI
00406103 CALL [USER32!GetDlgItemTextA]
00406109 LEA ESI,[ESP+00000118]
00406110 LEA EAX,[ESP+18]
00406114 MOV DL,[EAX]
00406116 MOV CL,DL
00406118 CMP DL,[ESI]
0040611A JNZ 00406138
0040611C TEST CL,CL
0040611E JZ 00406134
00406120 MOV DL,[EAX+01]
00406123 MOV CL,DL
00406125 CMP DL,[ESI+01]
00406128 JNZ 00406138
0040612A ADD EAX,02
0040612D ADD ESI,02
00406130 TEST CL,CL
00406132 JNZ 00406114
00406134 XOR EAX,EAX
00406136 JMP 0040613D
00406138 SBB EAX,EAX
0040613A SBB EAX,-01
0040613D TEST EAX,EAX
0040613F JNZ 00406148
00406141 PUSH 00419584 ; "Ciphertext decrypted: M
00406146 JMP 0040614D
00406148 PUSH 00419554 ; "Decryption M=C^D MOD N
0040614D PUSH 00
0040614F PUSH 0C
00406151 PUSH 00000400
00406156 PUSH EDI
00406157 CALL [USER32!SendDlgItemMessageA]
0040615D PUSH EBP
0040615E CALL 00408010
00406163 MOV EAX,[ESP+18]
00406167 PUSH EAX
00406168 CALL 00408010
0040616D MOV ECX,[ESP+18]
00406171 PUSH ECX
00406172 CALL 00408010
00406177 PUSH EBX
00406178 CALL 00408010
0040617D ADD ESP,10
00406180 MOV EAX,00000001
00406185 POP EDI
00406186 POP ESI
00406187 POP EBP
00406188 POP EBX
00406189 ADD ESP,00000908
0040618F RET
程序运行时可发现 4150F0 后面有大量空间可以填写补丁代码---填写后补丁代码如下:
;;;--------------加入判断小写'a'~~'f'补丁代码部分------------------------------------
004150F0 80F946 CMP CL,46 ;
004150F3 0F8632C3FEFF JBE 0040142B ;如果小于'F',继续执行原来代码
004150F9 80F961 CMP CL,61 ;
004150FC 0F822EC3FEFF JB 00401430 ;不是 'a'~~'f'
00415102 80F966 CMP CL,66 ;
00415105 0F8725C3FEFF JA 00401430 ;则跳过该字符
0041510B 80E920 SUB CL,20 ;是 'a'~~'f'则转换为大写的'A'~~'F'
0041510E E918C3FEFF JMP 0040142B ;
;;;--------------加入处理16进制字符串处理的补丁代码-----------------------------------
00415113 803848 CMP BYTE PTR [EAX],48 ;输入16进制字符串格式定义
00415116 7525 JNZ 0041513D ;第一个字符必须是大写'H'
00415118 60 PUSHAD ;否则则按原来方式处理
00415119 BA02000000 MOV EDX,00000002 ;第二个字符必须是'>'或者'<'
0041511E 8078013C CMP BYTE PTR [EAX+01],3C ;否则则按原来方式处理
00415122 7408 JZ 0041512C ;'>',输入串按大端模式处理
00415124 8078013E CMP BYTE PTR [EAX+01],3E ;'<',输入串按小端模式处理
00415128 7512 JNZ 0041513C ;后面跟的输入串长度必须是偶数
0041512A F7DA NEG EDX ;且范围必须是
0041512C 8BF8 MOV EDI,EAX ;'0'~~'9'
0041512E 8D5802 LEA EBX,[EAX+02] ;'A'~~'F'
00415131 33C0 XOR EAX,EAX ;'a'~~'f'
00415133 B900040000 MOV ECX,00000400 ;否则都走原来方式处理
00415138 F2AE REPNZ SCASB ;
0041513A 7406 JZ 00415142 ;
0041513C 61 POPAD ;
0041513D E9AE23FFFF JMP 004074F0 ;
00415142 F7C701000000 TEST EDI,00000001 ;
00415148 74F2 JZ 0041513C ;
0041514A 8D4FFF LEA ECX,[EDI-01]
0041514D 2BCB SUB ECX,EBX ;
0041514F E3EB JECXZ 0041513C ;
00415151 D1E9 SHR ECX,1 ;
00415153 8D4103 LEA EAX,[ECX+03] ;
00415156 C1E802 SHR EAX,02 ;
00415159 8906 MOV [ESI],EAX ;
0041515B 80FA02 CMP DL,02 ;
0041515E 7405 JZ 00415165
00415160 90 NOP
00415161 90 NOP
00415162 8D5FFD LEA EBX,[EDI-03]
00415165 8D7E04 LEA EDI,[ESI+04]
00415168 668B03 MOV AX,[EBX]
0041516B 3C30 CMP AL,30
0041516D 72CD JB 0041513C
0041516F 80FC30 CMP AH,30
00415172 72C8 JB 0041513C
00415174 3C66 CMP AL,66
00415176 77C4 JA 0041513C
00415178 80FC66 CMP AH,66
0041517B 77BF JA 0041513C
0041517D 3C39 CMP AL,39
0041517F 760E JBE 0041518F
00415181 3C41 CMP AL,41
00415183 72B7 JB 0041513C
00415185 3C46 CMP AL,46
00415187 7604 JBE 0041518D
00415189 3C61 CMP AL,61
0041518B 72AF JB 0041513C
0041518D 2C07 SUB AL,07
0041518F 80FC39 CMP AH,39
00415192 7612 JBE 004151A6
00415194 80FC41 CMP AH,41
00415197 72A3 JB 0041513C
00415199 80FC46 CMP AH,46
0041519C 7605 JBE 004151A3
0041519E 80FC61 CMP AH,61
004151A1 7299 JB 0041513C
004151A3 80EC07 SUB AH,07
004151A6 80E40F AND AH,0F
004151A9 C0E004 SHL AL,04
004151AC 0AC4 OR AL,AH
004151AE AA STOSB
004151AF 01D3 ADD EBX,EDX
004151B1 E2B5 LOOP 00415168
004151B3 61 POPAD
004151B4 C3 RET
;;;-------------为了执行补丁需要再原来两处代码位置加入跳转指令-----
00405D56 E8B8F30000 CALL 00415113 ;;;修改该处代码转入16进制串补丁部分
00401426 E9C53C0100 JMP 004150F0 ;;;修改该处代码转入'a'~~'f'补丁部分
;;;---------原来程序使用UPX压缩,可以等执行完解压后把补丁代码搬到指定位置----------
00425940 61 POPAD
00425941 BE00804100 MOV ESI,00418000
00425946 8DBE0090FEFF LEA EDI,[ESI+FFFE9000]
0042594C 57 PUSH EDI
0042594D 83CDFF OR EBP,-01
00425950 EB10 JMP 00425962
00425952 EB00 JMP 00425954
00425954 EBEA JMP 00425940
00425956 EBE8 JMP 00425940
00425958 8A06 MOV AL,[ESI]
0042595A 46 INC ESI
0042595B 8807 MOV [EDI],AL
0042595D 47 INC EDI
0042595E 01DB ADD EBX,EBX
00425960 7507 JNZ 00425969
00425962 8B1E MOV EBX,[ESI]
00425964 83EEFC SUB ESI,-04
00425967 11DB ADC EBX,EBX
00425969 72ED JB 00425958
0042596B B801000000 MOV EAX,00000001
00425970 01DB ADD EBX,EBX
00425972 7507 JNZ 0042597B
00425974 8B1E MOV EBX,[ESI]
00425976 83EEFC SUB ESI,-04
00425979 11DB ADC EBX,EBX
0042597B 11C0 ADC EAX,EAX
0042597D 01DB ADD EBX,EBX
0042597F 73EF JAE 00425970
00425981 7509 JNZ 0042598C
00425983 8B1E MOV EBX,[ESI]
00425985 83EEFC SUB ESI,-04
00425988 11DB ADC EBX,EBX
0042598A 73E4 JAE 00425970
0042598C 31C9 XOR ECX,ECX
0042598E 83E803 SUB EAX,03
00425991 720D JB 004259A0
00425993 C1E008 SHL EAX,08
00425996 8A06 MOV AL,[ESI]
00425998 46 INC ESI
00425999 83F0FF XOR EAX,-01
0042599C 7474 JZ 00425A12
0042599E 89C5 MOV EBP,EAX
004259A0 01DB ADD EBX,EBX
004259A2 7507 JNZ 004259AB
004259A4 8B1E MOV EBX,[ESI]
004259A6 83EEFC SUB ESI,-04
004259A9 11DB ADC EBX,EBX
004259AB 11C9 ADC ECX,ECX
004259AD 01DB ADD EBX,EBX
004259AF 7507 JNZ 004259B8
004259B1 8B1E MOV EBX,[ESI]
004259B3 83EEFC SUB ESI,-04
004259B6 11DB ADC EBX,EBX
004259B8 11C9 ADC ECX,ECX
004259BA 7520 JNZ 004259DC
004259BC 41 INC ECX
004259BD 01DB ADD EBX,EBX
004259BF 7507 JNZ 004259C8
004259C1 8B1E MOV EBX,[ESI]
004259C3 83EEFC SUB ESI,-04
004259C6 11DB ADC EBX,EBX
004259C8 11C9 ADC ECX,ECX
004259CA 01DB ADD EBX,EBX
004259CC 73EF JAE 004259BD
004259CE 7509 JNZ 004259D9
004259D0 8B1E MOV EBX,[ESI]
004259D2 83EEFC SUB ESI,-04
004259D5 11DB ADC EBX,EBX
004259D7 73E4 JAE 004259BD
004259D9 83C102 ADD ECX,02
004259DC 81FD00F3FFFF CMP EBP,FFFFF300
004259E2 83D101 ADC ECX,01
004259E5 8D142F LEA EDX,[EBP+EDI]
004259E8 83FDFC CMP EBP,-04
004259EB 760F JBE 004259FC
004259ED 8A02 MOV AL,[EDX]
004259EF 42 INC EDX
004259F0 8807 MOV [EDI],AL
004259F2 47 INC EDI
004259F3 49 DEC ECX
004259F4 75F7 JNZ 004259ED
004259F6 E963FFFFFF JMP 0042595E
004259FB 90 NOP
004259FC 8B02 MOV EAX,[EDX]
004259FE 83C204 ADD EDX,04
00425A01 8907 MOV [EDI],EAX
00425A03 83C704 ADD EDI,04
00425A06 83E904 SUB ECX,04
00425A09 77F1 JA 004259FC
00425A0B 01CF ADD EDI,ECX
00425A0D E94CFFFFFF JMP 0042595E
00425A12 5E POP ESI
00425A13 89F7 MOV EDI,ESI
00425A15 B97B070000 MOV ECX,0000077B
00425A1A 8A07 MOV AL,[EDI]
00425A1C 47 INC EDI
00425A1D 2CE8 SUB AL,E8
00425A1F 3C01 CMP AL,01
00425A21 77F7 JA 00425A1A
00425A23 803F06 CMP BYTE PTR [EDI],06
00425A26 75F2 JNZ 00425A1A
00425A28 8B07 MOV EAX,[EDI]
00425A2A 8A5F04 MOV BL,[EDI+04]
00425A2D 66C1E808 SHR AX,08
00425A31 C1C010 ROL EAX,10
00425A34 86C4 XCHG AL,AH
00425A36 29F8 SUB EAX,EDI
00425A38 80EBE8 SUB BL,E8
00425A3B 01F0 ADD EAX,ESI
00425A3D 8907 MOV [EDI],EAX
00425A3F 83C705 ADD EDI,05
00425A42 89D8 MOV EAX,EBX
00425A44 E2D9 LOOP 00425A1F
00425A46 8DBE00300200 LEA EDI,[ESI+00023000]
00425A4C 8B07 MOV EAX,[EDI]
00425A4E 09C0 OR EAX,EAX
00425A50 7445 JZ 00425A97
00425A52 8B5F04 MOV EBX,[EDI+04]
00425A55 8D8430545A0200 LEA EAX,[ESI+EAX+00025A54]
00425A5C 01F3 ADD EBX,ESI
00425A5E 50 PUSH EAX
00425A5F 83C708 ADD EDI,08
00425A62 FF96B85A0200 CALL [ESI+00025AB8]
00425A68 95 XCHG EAX,EBP
00425A69 8A07 MOV AL,[EDI]
00425A6B 47 INC EDI
00425A6C 08C0 OR AL,AL
00425A6E 74DC JZ 00425A4C
00425A70 89F9 MOV ECX,EDI
00425A72 7907 JNS 00425A7B
00425A74 0FB707 MOVZX EAX,WORD PTR [EDI]
00425A77 47 INC EDI
00425A78 50 PUSH EAX
00425A79 47 INC EDI
00425A7A B95748F2AE MOV ECX,AEF24857
00425A7F 55 PUSH EBP
00425A80 FF96BC5A0200 CALL [ESI+00025ABC]
00425A86 09C0 OR EAX,EAX
00425A88 7407 JZ 00425A91
00425A8A 8903 MOV [EBX],EAX
00425A8C 83C304 ADD EBX,04
00425A8F EBD8 JMP 00425A69
00425A91 FF96C05A0200 CALL [ESI+00025AC0]
00425A97 60 PUSHAD
00425A98 E97A90FEFF JMP 0040EB17
;;;------------------程序解压完成后修改程序中代码加入补丁----------
00425A97 60 PUSHAD
00425A98 E800000000 CALL 00425A9D ;
00425A9D 5B POP EBX ;
00425A9E 8D7363 LEA ESI,[EBX+63] ;代码补丁数据
00425AA1 8DBB53F6FEFF LEA EDI,[EBX+FFFEF653] ;需要搬运的位置
00425AA7 B932000000 MOV ECX,00000032 ;
00425AAC F3A5 REPZ MOVSD ;搬运补丁代码
00425AAE 8DBBBA02FEFF LEA EDI,[EBX+FFFE02BA] ;支持输入16进制串
00425AB4 A5 MOVSD ;
00425AB5 8DBB89B9FDFF LEA EDI,[EBX+FFFDB989] ;支持小写'a'~~'f'输入
00425ABB A5 MOVSD ;
00425ABC A4 MOVSB ;
00425ABD 8DBB6A05FEFF LEA EDI,[EBX+FFFE056A] ;测试时用私钥加密
00425AC3 66A5 MOVSW ;
00425AC5 8DBB4802FEFF LEA EDI,[EBX+FFFE0248] ;测试时用共要解密
00425ACB 66A5 MOVSW ;
00425ACD 61 POPAD
00425ACE 60 PUSHAD
00425ACF E94390FEFF JMP 0040EB17
附件是改后程序其中
RSATool2v17HD.exe 是测试时用私钥加密，用公钥解密
RSATool2v17HN.exe 是测试时用公钥加密，用私钥解密(原程序是这个)
冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。
|
|
|---|---|
