【文章标题】: czTrial's #3CrackMe的不完美破解
【文章作者】: bxm
【作者邮箱】: bxm78@163.com
【编写语言】: MASM32 / TASM32
【使用工具】: peid,od,计算器
【操作平台】: xinxp
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
常规检查就不细说了，输入
name:bxmwuc
serial:79082
00401388 |. E8 A3080000 call <jmp.&USER32.GetWindowTextA> ; \GetWindowTextA
0040138D |. 83F8 04 cmp eax, 4
00401390 |. 0F8E 9F000000 jle 00401435
00401396 |. 6A 40 push 40 ; /Count = 40 (64.)
00401398 |. 68 60334000 push 00403360 ; |Buffer = cztria~1.00403360
0040139D |. 68 B90B0000 push 0BB9 ; |ControlID = BB9 (3001.)
004013A2 |. FF75 08 push dword ptr [ebp+8] ; |hWnd
004013A5 |. E8 6E080000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
004013AA |. 83F8 04 cmp eax, 4
004013AD |. 0F8E 82000000 jle 00401435
004013B3 |. A3 62324000 mov [403262], eax
004013B8 |. FF35 66324000 push dword ptr [403266] ; /hWnd = 000A0188 (class='Edit',parent=000A01AC)
004013BE |. E8 AF080000 call <jmp.&USER32.SetFocus> ; \SetFocus
004013C3 |. BF 20334000 mov edi, 00403320 ; ASCII "bxmwuc"
004013C8 |. BE 20334000 mov esi, 00403320 ; ASCII "bxmwuc"
004013CD |> AC /lods byte ptr [esi]
004013CE |. 0C 00 |or al, 0
004013D0 |. 74 05 |je short 004013D7
004013D2 |. 0C 20 |or al, 20
004013D4 |. AA |stos byte ptr es:[edi]
004013D5 |.^ EB F6 \jmp short 004013CD
004013D7 |> BF A0324000 mov edi, 004032A0
004013DC |. BE 60334000 mov esi, 00403360 ; ASCII "79032"
004013E1 |. 8D1D 20334000 lea ebx, [403320]
004013E7 |. 33C9 xor ecx, ecx
004013E9 |> AC /lods byte ptr [esi] ; 假码的每个字符依次入AL
004013EA |. 0C 00 |or al, 0
004013EC |. 74 17 |je short 00401405 ; 读完了，跳
004013EE |. 8A13 |mov dl, [ebx] ; name的每个字符入DL
004013F0 |. 2AD0 |sub dl, al
004013F2 |. 80CA 00 |or dl, 0 ; name的相应字符与serial的相应字符不能相同
004013F5 |. 74 3E |je short 00401435 ; 相同则完蛋
004013F7 |. 8AC2 |mov al, dl
004013F9 |. 24 0F |and al, 0F ; AL的高4位清0
004013FB |. 0C 00 |or al, 0 ; name的相应字符-serial的相应字符结果的低4位不能为0
004013FD |. 74 36 |je short 00401435 ; 为0则完蛋
004013FF |. AA |stos byte ptr es:[edi] ; 把AL中的值放入[EDI]中
00401400 |. 02C8 |add cl, al
00401402 |. 43 |inc ebx
00401403 |.^ EB E4 \jmp short 004013E9
00401405 |> 890D 6A324000 mov [40326A], ecx ; 累加和放于[40326A]
0040140B |. E8 27020000 call 00401637 ; 部分算法call
00401410 |. BE A0324000 mov esi, 004032A0
00401415 |. 8B15 62324000 mov edx, [403262] ; serial长度入EDX
0040141B |. C1EA 02 shr edx, 2 ; EDX右移2位
0040141E |. 03F2 add esi, edx ; ESI+EDX
00401420 |. 8A06 mov al, [esi] ; [ESI]入AL
00401422 |. 33D2 xor edx, edx
00401424 |. 8B15 6E324000 mov edx, [40326E] ; 我的EDX为00000006H
0040142A |. 2BD0 sub edx, eax ; EDX-EAX
0040142C |. A1 6A324000 mov eax, [40326A] ; 累加和为2EH
00401431 |. 3BC2 cmp eax, edx ; eax=edx ?
00401433 74 31 je short 00401466 ; 相等，则跳向成功
00401435 |> 68 00200000 push 2000 ; /Style = MB_OK|MB_TASKMODAL
0040143A |. 68 D1314000 push 004031D1 ; | error
0040143F |. 68 F9314000 push 004031F9 ; | sorry cracker, wrong.
00401444 |. FF75 08 push dword ptr [ebp+8] ; |hOwner
00401447 |. E8 02080000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
0040144C |. 6A 40 push 40 ; /Length = 40 (64.)
0040144E |. 68 E0324000 push 004032E0 ; |Destination = cztria~1.004032E0
00401453 |. E8 56080000 call <jmp.&KERNEL32.RtlZeroMemory> ; \RtlZeroMemory
00401458 |. 6A 40 push 40 ; /Length = 40 (64.)
0040145A |. 68 A0334000 push 004033A0 ; |Destination = cztria~1.004033A0
0040145F |. E8 4A080000 call <jmp.&KERNEL32.RtlZeroMemory> ; \RtlZeroMemory
00401464 |. EB 2F jmp short 00401495
00401466 |> 68 00200000 push 2000 ; /Style = MB_OK|MB_TASKMODAL
0040146B |. 68 E5314000 push 004031E5 ; | <registered>
00401470 |. 68 10324000 push 00403210 ; |Text = " You did it!"
00401475 |. FF75 08 push dword ptr [ebp+8] ; |hOwner
00401478 |. E8 D1070000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
=========================================================================================================
部分算法call
00401637 /$ BE A0324000 mov esi, 004032A0
0040163C |. 8B15 62324000 mov edx, [403262] ; serial长度入EDX
00401642 |. 52 push edx
00401643 |. 33C0 xor eax, eax ; EAX清0
00401645 |. 83EA 01 sub edx, 1 ; EDX-1
00401648 |. 03F2 add esi, edx
0040164A |. 8A06 mov al, [esi] ; name与serial运算后的最后一个值入AL
0040164C |. F7E0 mul eax ; EAX*EAX
0040164E |. 5A pop edx ; serial长度入EDX
0040164F |. 83EA 01 sub edx, 1 ; EDX-1
00401652 |. F7E2 mul edx ; EAX*EDX
00401654 |. B9 01000000 mov ecx, 1 ; ECX=1
00401659 |> 2BC1 /sub eax, ecx ; EAX-ECX
0040165B |. 83F8 00 |cmp eax, 0 ; EAX<0 ?
0040165E |. 7E 08 |jle short 00401668 ; 是，跳
00401660 |. 83C2 01 |add edx, 1
00401663 |. 83C1 02 |add ecx, 2
00401666 |.^ EB F1 \jmp short 00401659
00401668 |> 52 push edx ; EDX入栈，我的为5H
00401669 |. BE A0324000 mov esi, 004032A0
0040166E |. 8BFE mov edi, esi
00401670 |. 8B15 62324000 mov edx, [403262] ; serial长度入EDX
00401676 |. 33C0 xor eax, eax
00401678 |. 83EA 01 sub edx, 1
0040167B |. 03F2 add esi, edx
0040167D |. 8A06 mov al, [esi] ; name与serial运算后的最后一个值入AL
0040167F |. 83C0 01 add eax, 1 ; EAX+1
00401682 |. 5A pop edx ; 弹出值5H
00401683 |. 03C2 add eax, edx ; EAX+EDX
00401685 |. D1E8 shr eax, 1 ; EAX右移1位
00401687 |. 8B15 62324000 mov edx, [403262] ; serial长度入EDX
0040168D |. 03FA add edi, edx
0040168F |. AA stos byte ptr es:[edi] ; AX的值存入name与serial运算后存放地点的后一个单元
00401690 |. F7E0 mul eax ; EAX*EAX
00401692 |. 8B15 62324000 mov edx, [403262] ; serial长度入EDX
00401698 |. 83EA 01 sub edx, 1 ; EDX-1
0040169B |. F7E2 mul edx ; EAX*EDX
0040169D |. B9 01000000 mov ecx, 1 ; ECX=1
004016A2 |> 2BC1 /sub eax, ecx
004016A4 |. 83F8 00 |cmp eax, 0
004016A7 |. 7E 08 |jle short 004016B1
004016A9 |. 83C2 01 |add edx, 1
004016AC |. 83C1 02 |add ecx, 2
004016AF |.^ EB F1 \jmp short 004016A2
004016B1 |> 52 push edx ; EDX入栈，我的为7H
004016B2 |. BE A0324000 mov esi, 004032A0
004016B7 |. 8B15 62324000 mov edx, [403262] ; serial长度入EDX
004016BD |. 33C0 xor eax, eax
004016BF |. 03F2 add esi, edx
004016C1 |. 8A06 mov al, [esi] ; 把[004018F]语句存入的值取出
004016C3 |. 83C0 01 add eax, 1 ; EAX+1
004016C6 |. 5A pop edx ; 弹出值7H
004016C7 |. 03C2 add eax, edx ; EAX+EDX
004016C9 |. D1E8 shr eax, 1 ; EAX右移1位
004016CB |. A3 6E324000 mov [40326E], eax ; EAX放入[40326E]备用，我的为6H
004016D0 \. C3 retn
算法小结：
1、name长度与serial长度必须都大于等于5,name必须是字母。
2、name超出serial长度部分不参加运算。
3、name与serial同时参与运算，它们之间的关系不太清楚，好像是多对多的情形，即一个name可能对应多个serial,一个serial也可能对应多个name，我是根据汇编分析用穷举法做注册机的，能找到一个serial就不再继续找了。
具体源码如下：
#include<iostream.h>
void main()
{
char name[50];
char serial[]="00000";
char nameoper[6],temp;
int i;
long unsigned temp2;
int sum,eax,ecx,edx,callend;
cout<<"Please input name(>4):\n";
cin>>name;
do
{
temp2=(serial[0]-0x30)*10000+(serial[1]-0x30)*1000+(serial[2]-0x30)*100+(serial[3]-0x30)*10+(serial[4]-0x30)+1;
i=4;
do
{
serial[i]=temp2%10+0x30;
temp2/=10;
i--;
}
while(temp2);
sum=0;
for(i=0;i<5;i++)
{
temp=(name[i]-serial[i])&0x0F;
if(temp==0) serial[i]++;
nameoper[i]=(name[i]-serial[i])&0x0F;
sum+=nameoper[i];
}
eax=int(nameoper[4])*int(nameoper[4])*4;
ecx=1;
edx=0;
do
{
eax-=ecx;
if(eax<=0) break;
else
{
edx++;
ecx+=2;
}
}
while(1);
eax=(nameoper[4]+1+edx)>>1;
nameoper[5]=(char)eax; //存入下一单元
eax=eax*eax*4;
ecx=1;
edx=0;
do
{
eax-=ecx;
if(eax<=0) break;
edx++;
ecx+=2;
}
while(1);
eax=(nameoper[5]+1+edx)>>1; //call最终运算结果
callend=eax;
eax=callend-(int)nameoper[1]-sum;
}
while(eax);
cout<<endl<<"Code is "<<serial<<endl;
}
可用的一组信息：
name:bxmwuc
serial:03866
如用更好算法，还请各位大侠不吝赐教！
--------------------------------------------------------------------------------
【版权声明】: 本文原创于看雪技术论坛, 转载请注明作者并保持文章的完整, 谢谢!
2006年08月03日 下午 11:15:02
[招生]系统0day安全班，企业级设备固件漏洞挖掘，Linux平台漏洞挖掘！
