【文章标题】: LuTin NoiR's Small RSA分析
【文章作者】: HappyTown
【作者邮箱】: [email]wxr277@163.com[/email]
【作者主页】:
www.pediy.com
【软件名称】: keygenme
【下载地址】: 附件内
【加壳方式】: ASPack 2.1
【保护方式】: RSA190 + MD5
【编写语言】: VC6
【使用工具】: OD,BigCalc,DAMN_Hash
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
脱壳不用说
这个keygenme用的miracl库可能比较老，所以IDA分析不出什么有用的东西，需要手动定位。
还有一点就是，当不知道库函数时，要使用BigCalc来验证对函数的猜测。
name:happy
sn:7654321
00401000 /$>sub esp, 350
00401006 |.>lea eax, [esp+BC]
0040100D |.>push esi
0040100E |.>mov esi, [<&USER32.GetDlgItemTextA>] ; USER32.GetDlgItemTextA
00401014 |.>push edi
00401015 |.>mov edi, [esp+35C]
0040101C |.>push 46 ; /Count = 46 (70.)
0040101E |.>push eax ; |Buffer
0040101F |.>push 3E9 ; |ControlID = 3E9 (1001.)
00401024 |.>push edi ; |hWnd
00401025 |.>call esi ; \GetDlgItemTextA
00401027 |.>cmp eax, 5 ; name长度不小于5
0040102A |.>jb 004011A9
00401030 |.>lea ecx, [esp+290]
00401037 |.>push 46 ; /Count = 46 (70.)
00401039 |.>push ecx ; |Buffer
0040103A |.>push 3EA ; |ControlID = 3EA (1002.)
0040103F |.>push edi ; |hWnd
00401040 |.>call esi ; \GetDlgItemTextA
00401042 |.>cmp eax, 5 ; sn长度也不小于5
00401045 |.>jb 004011A9
0040104B |.>push ebx
0040104C |.>push ebp
0040104D |.>push 0
0040104F |.>push 64 ; 0x64
00401051 |.>call 00402190 ; mirsys
00401056 |.>push 0
00401058 |.>mov esi, eax
0040105A |.>call 00402130 ; mirvar
0040105F |.>push 0
00401061 |.>mov edi, eax
00401063 |.>call 00402130
00401068 |.>push 0
0040106A |.>mov ebx, eax
0040106C |.>call 00402130
00401071 |.>push 0
00401073 |.>mov ebp, eax
00401075 |.>call 00402130
0040107A |.>push 0040B0DC ; ASCII "65537"
0040107F |.>push eax ; e = 0x10001
00401080 |.>mov [esp+30], eax
00401084 |.>mov dword ptr [esi+228], 0A ; 10进制
0040108E |.>call 00402AF0 ; cinstr
00401093 |.>lea edx, [esp+2B8]
0040109A |.>mov dword ptr [esi+228], 10 ; 16进制
004010A4 |.>push edx ; sn :7654321
004010A5 |.>push ebx
004010A6 |.>call 00402AF0
004010AB |.>push 0040B0A8 ; ASCII "2F774486FD3B97FFA559687F7F9D5335CA3D16FBB60C0019"
004010B0 |.>push ebp ; n
004010B1 |.>call 00402AF0
004010B6 |.>mov eax, [esp+40]
004010BA |.>push edi ; c
004010BB |.>push ebp ; n
004010BC |.>push eax ; e
004010BD |.>push ebx ; sn
004010BE |.>call 00403280 ; c = sn^e (mod n) = 11ADE1A6505779E360A7D213E33D62787B7B30A09A772197 ，所以这个应该是powmod函数
004010C3 |.>add esp, 40
004010C6 |.>lea ecx, [esp+1D0]
004010CD |.>push ecx
004010CE |.>push edi
004010CF |.>call 00402D20
004010D4 |.>add esp, 8
004010D7 |.>lea edx, [esp+CC]
004010DE |.>push edx ; /name
004010DF |.>call [<&KERNEL32.lstrlen>] ; \lstrlenA
004010E5 |.>mov esi, eax
004010E7 |.>lea eax, [esp+74]
004010EB |.>push eax
004010EC |.>call <MD5_Init> =====>跟进去看看
//
004012B0 >/$>mov eax, [esp+4]
004012B4 |.>xor ecx, ecx
004012B6 |.>mov [eax+14], ecx
004012B9 |.>mov [eax+10], ecx
004012BC |.>mov dword ptr [eax], 67452301
004012C2 |.>mov dword ptr [eax+4], EFCDAB89
004012C9 |.>mov dword ptr [eax+8], 98BADCFE
004012D0 |.>mov dword ptr [eax+C], 10325476
\\ 004012D7 \.>retn
004010F1 |.>lea ecx, [esp+D0]
004010F8 |.>push esi ; nameLen:name的长度
004010F9 |.>lea edx, [esp+7C]
004010FD |.>push ecx ; name
004010FE |.>push edx
004010FF |.>call <MD5_Update>
00401104 |.>lea eax, [esp+84]
0040110B |.>lea ecx, [esp+24]
0040110F |.>push eax
00401110 |.>push ecx ; MD5(name)
00401111 |.>call <MD5_Final>
00401116 |.>add esp, 18
00401119 |.>xor edx, edx
0040111B |.>lea esi, [esp+14] ; MD5(name)
0040111F |>>/mov cl, [esi] ; //把MD5(name)值转换成字符串
00401121 |.>|mov al, cl
00401123 |.>|shr al, 4
00401126 |.>|add al, 30
00401128 |.>|cmp al, 39
0040112A |.>|mov [esp+edx+24], al
0040112E |.>|jbe short 00401136
00401130 |.>|add al, 7
00401132 |.>|mov [esp+edx+24], al
00401136 |>>|and cl, 0F
00401139 |.>|mov al, cl
0040113B |.>|add al, 30
0040113D |.>|cmp al, 39
0040113F |.>|mov [esp+edx+25], al
00401143 |.>|jbe short 0040114B
00401145 |.>|add al, 7
00401147 |.>|mov [esp+edx+25], al
0040114B |>>|add edx, 2
0040114E |.>|inc esi
0040114F |.>|cmp edx, 20
00401152 |.>\jb short 0040111F ; \\
00401154 |.>lea edx, [esp+1D0]
0040115B |.>lea eax, [esp+24]
0040115F |.>push edx ; /c
00401160 |.>push eax ; |MD5(name)
00401161 |.>mov byte ptr [esp+4C], 0 ; |
00401166 |.>call [<&KERNEL32.lstrcmp>] ; \lstrcmpA
0040116C |.>test eax, eax
0040116E |.>jnz short 00401188
00401170 |.>mov ecx, [esp+364]
00401177 |.>push 0040B070 ; /Text = "Well done you find a good serial, now keygen it :p !!!"
0040117C |.>push 3EA ; |ControlID = 3EA (1002.)
00401181 |.>push ecx ; |hWnd
00401182 |.>call [<&USER32.SetDlgItemTextA>] ; \SetDlgItemTextA
作者已经说了，这是一个RSA，验证方式很标准：
c = sn^e (mod n)
c ?= MD5(name)
因此，关键在于求出私钥d，用RSATool计算得：
d = 2312552808E487A2F561E2BBEF5FB7275C2BD350491DB9A1
注册机很好做，详见附件。
一组有效的注册码：
name:happytown
sn:24CCE5C0777E001DFC44A33DFE44222E09EE7BA50616BCB2
--------------------------------------------------------------------------------
【经验总结】
我觉得这个keygenme再适合不过RSA的初学者了，郑重推荐。
--------------------------------------------------------------------------------
【版权声明】: 本文原创于看雪技术论坛, 转载请注明作者并保持文章的完整, 谢谢!
2006年10月27日 10:46:29
[培训]科锐软件逆向50期预科班报名即将截止，速来！！！ 50期正式班报名火爆招生中！！！
