OfficeMan-V2.1简单算法分析-菜鸟篇
【文章作者】: tzl
【作者邮箱】: 无
【软件名称】: OfficeMan-V2.1
【软件大小】: 1.57 MB
【下载地址】: http://down.downreg.com/Software/View-Software-6929.html
【加壳方式】: 无
【保护方式】: 注册码
【编写语言】: Borland Delphi 6.0 - 7.0
【使用工具】: OD PEID
【操作平台】: XP SP2
【软件介绍】:
1.导入方式非常灵活:
仅需在信息库管理中点击批量导入文档,就可以原汁原味的导入进一个或多个文档。
2.文档交流管理非常方便:
你可以使用Office小管家建立一个个xxk 的文件,导入的众多文档的所有属性内容就一起储存在这个文件中,你的同事朋友们也可以使用Office小管家打开这个文件,就可以浏览它里面的所有信息。当然,如果你收集的信息不想让别人看到,可以加上密码保护。
3.树状的分类目录整理:
那么多的文档导入到一个xxk 文件中,肯定需要分类整理。在Office小管家中,你可以建立一层层的目录,可以随意拖动目录或文档,随意进行排序。
很简单的算法,适合我这只小菜鸟,这里与大家分享,菜鸟共同进步。
一、查壳,无。
二、根据字符串相关信息,我们可以在这里下断开始分析,第一部分试练码:123456789;第二部分试练码:987654321
004E0B89 |. 55
push ebp
004E0B8A |. 68 7F0E4E00
push OfficeMa.004E0E7F
004E0B8F |. 64:FF30
push dword ptr fs:[
eax]
004E0B92 |. 64:8920
mov dword ptr fs:[
eax],
esp
004E0B95 |. 8D55 FC
lea edx,
dword ptr ss:[
ebp-4]
004E0B98 |. 8B83 14030000
mov eax,
dword ptr ds:[
ebx+314]
004E0B9E |. E8 39E6F6FF
call OfficeMa.0044F1DC
004E0BA3 |. 837D FC 00
cmp dword ptr ss:[
ebp-4],0
; 试练码第二部分不能为0
004E0BA7 |. 75 2C
jnz short OfficeMa.004E0BD5
004E0BA9 |. 6A 00
push 0
004E0BAB |. 68 900E4E00
push OfficeMa.004E0E90
; endo 提示
004E0BB0 |. 68 9C0E4E00
push OfficeMa.004E0E9C
; 请输入完整注册码信息!
004E0BB5 |. 8BC3
mov eax,
ebx
004E0BB7 |. E8 104EF7FF
call OfficeMa.004559CC
004E0BBC |. 50
push eax ; |hOwner
004E0BBD |. E8 6E73F2FF
call <jmp.&user32.MessageBoxA>
; \MessageBoxA
004E0BC2 |. 8B83 14030000
mov eax,
dword ptr ds:[
ebx+314]
004E0BC8 |. 8B10
mov edx,
dword ptr ds:[
eax]
004E0BCA |. FF92 C0000000
call dword ptr ds:[
edx+C0]
004E0BD0 |. E9 0C020000
jmp OfficeMa.004E0DE1
004E0BD5 |> 8D55 F4
lea edx,
dword ptr ss:[
ebp-C]
004E0BD8 |. 8B83 14030000
mov eax,
dword ptr ds:[
ebx+314]
004E0BDE |. E8 F9E5F6FF
call OfficeMa.0044F1DC
004E0BE3 |. 8B45 F4
mov eax,
dword ptr ss:[
ebp-C]
; 试练码第二部分987654321送eax
004E0BE6 |. 8D55 F8
lea edx,
dword ptr ss:[
ebp-8]
004E0BE9 |. E8 4E8AF2FF
call OfficeMa.0040963C
004E0BEE |. 8B45 F8
mov eax,
dword ptr ss:[
ebp-8]
004E0BF1 |. 50
push eax ; eax=987654321
004E0BF2 |. 8D55 EC
lea edx,
dword ptr ss:[
ebp-14]
004E0BF5 |. 8B83 0C030000
mov eax,
dword ptr ds:[
ebx+30C]
004E0BFB |. E8 DCE5F6FF
call OfficeMa.0044F1DC
004E0C00 |. 8B45 EC
mov eax,
dword ptr ss:[
ebp-14]
; 试练码第一部分123456789送eax
004E0C03 |. 8D55 F0
lea edx,
dword ptr ss:[
ebp-10]
004E0C06 |. E8 318AF2FF
call OfficeMa.0040963C
004E0C0B |. 8B45 F0
mov eax,
dword ptr ss:[
ebp-10]
004E0C0E |. 50
push eax ; eax=123456789
004E0C0F |. 8D55 E4
lea edx,
dword ptr ss:[
ebp-1C]
004E0C12 |. 8B83 08030000
mov eax,
dword ptr ds:[
ebx+308]
004E0C18 |. E8 BFE5F6FF
call OfficeMa.0044F1DC
004E0C1D |. 8B45 E4
mov eax,
dword ptr ss:[
ebp-1C]
; 机器码"WD-WCAD19885326"出现,送eax
004E0C20 |. 8D55 E8
lea edx,
dword ptr ss:[
ebp-18]
; eax=WD-WCAD19885326
004E0C23 |. E8 148AF2FF
call OfficeMa.0040963C
004E0C28 |. 8B45 E8
mov eax,
dword ptr ss:[
ebp-18]
004E0C2B |. 5A
pop edx
004E0C2C |. 59
pop ecx
004E0C2D |. E8 02070000
call OfficeMa.004E1334
; 算法分析call
004E0C32 |. 3C 01
cmp al,1
004E0C34 |. 0F85 80010000
jnz OfficeMa.004E0DBA
; 标志位判断,不等则跳转到失败
004E0C3A |. 8D55 DC
lea edx,
dword ptr ss:[
ebp-24]
004E0C3D |. 8B83 0C030000
mov eax,
dword ptr ds:[
ebx+30C]
004E0C43 |. E8 94E5F6FF
call OfficeMa.0044F1DC
004E0C48 |. 8B45 DC
mov eax,
dword ptr ss:[
ebp-24]
004E0C4B |. 8D55 E0
lea edx,
dword ptr ss:[
ebp-20]
004E0C4E |. E8 E989F2FF
call OfficeMa.0040963C
004E0C53 |. 8B55 E0
mov edx,
dword ptr ss:[
ebp-20]
004E0C56 |. A1 A0865700
mov eax,
dword ptr ds:[5786A0]
004E0C5B |. 8B00
mov eax,
dword ptr ds:[
eax]
004E0C5D |. 83C0 0C
add eax,0C
004E0C60 |. E8 7F3FF2FF
call OfficeMa.00404BE4
004E0C65 |. 8D55 D4
lea edx,
dword ptr ss:[
ebp-2C]
004E0C68 |. 8B83 14030000
mov eax,
dword ptr ds:[
ebx+314]
004E0C6E |. E8 69E5F6FF
call OfficeMa.0044F1DC
004E0C73 |. 8B45 D4
mov eax,
dword ptr ss:[
ebp-2C]
004E0C76 |. 8D55 D8
lea edx,
dword ptr ss:[
ebp-28]
004E0C79 |. E8 BE89F2FF
call OfficeMa.0040963C
004E0C7E |. 8B55 D8
mov edx,
dword ptr ss:[
ebp-28]
004E0C81 |. A1 A0865700
mov eax,
dword ptr ds:[5786A0]
004E0C86 |. 8B00
mov eax,
dword ptr ds:[
eax]
004E0C88 |. 83C0 10
add eax,10
004E0C8B |. E8 543FF2FF
call OfficeMa.00404BE4
004E0C90 |. A1 A0865700
mov eax,
dword ptr ds:[5786A0]
004E0C95 |. 8B00
mov eax,
dword ptr ds:[
eax]
004E0C97 |. 33D2
xor edx,
edx
004E0C99 |. 8950 14
mov dword ptr ds:[
eax+14],
edx
004E0C9C |. 6A 00
push 0
004E0C9E |. 68 B40E4E00
push OfficeMa.004E0EB4
; 呵呵
004E0CA3 |. 68 BC0E4E00
push OfficeMa.004E0EBC
; 恭喜你!注册成功!\n\n本软件将自动重新运行!
004E0CA8 |. 8BC3
mov eax,
ebx
004E0CAA |. E8 1D4DF7FF
call OfficeMa.004559CC
004E0CAF |. 50
push eax ; |hOwner
004E0CB0 |. E8 7B72F2FF
call <jmp.&user32.MessageBoxA>
; \MessageBoxA
004E0CB5 |. 8D55 CC
lea edx,
dword ptr ss:[
ebp-34]
004E0CB8 |. 8B83 08030000
mov eax,
dword ptr ds:[
ebx+308]
004E0CBE |. E8 19E5F6FF
call OfficeMa.0044F1DC
004E0CC3 |. 8B45 CC
mov eax,
dword ptr ss:[
ebp-34]
004E0CC6 |. 8D55 D0
lea edx,
dword ptr ss:[
ebp-30]
004E0CC9 |. E8 6E89F2FF
call OfficeMa.0040963C
004E0CCE |. 8B45 D0
mov eax,
dword ptr ss:[
ebp-30]
004E0CD1 |. 50
push eax
004E0CD2 |. A1 64875700
mov eax,
dword ptr ds:[578764]
004E0CD7 |. 8B00
mov eax,
dword ptr ds:[
eax]
004E0CD9 |. B9 EC0E4E00
mov ecx,OfficeMa.004E0EEC
; serialno
004E0CDE |. BA 000F4E00
mov edx,OfficeMa.004E0F00
; reg
004E0CE3 |. 8B30
mov esi,
dword ptr ds:[
eax]
004E0CE5 |. FF56 04
call dword ptr ds:[
esi+4]
004E0CE8 |. 8D55 C4
lea edx,
dword ptr ss:[
ebp-3C]
004E0CEB |. 8B83 0C030000
mov eax,
dword ptr ds:[
ebx+30C]
004E0CF1 |. E8 E6E4F6FF
call OfficeMa.0044F1DC
004E0CF6 |. 8B45 C4
mov eax,
dword ptr ss:[
ebp-3C]
004E0CF9 |. 8D55 C8
lea edx,
dword ptr ss:[
ebp-38]
004E0CFC |. E8 3B89F2FF
call OfficeMa.0040963C
004E0D01 |. 8B45 C8
mov eax,
dword ptr ss:[
ebp-38]
004E0D04 |. 50
push eax
004E0D05 |. A1 64875700
mov eax,
dword ptr ds:[578764]
004E0D0A |. 8B00
mov eax,
dword ptr ds:[
eax]
004E0D0C |. B9 0C0F4E00
mov ecx,OfficeMa.004E0F0C
; regnofir
004E0D11 |. BA 000F4E00
mov edx,OfficeMa.004E0F00
; reg
004E0D16 |. 8B30
mov esi,
dword ptr ds:[
eax]
004E0D18 |. FF56 04
call dword ptr ds:[
esi+4]
004E0D1B |. 8D55 BC
lea edx,
dword ptr ss:[
ebp-44]
004E0D1E |. 8B83 14030000
mov eax,
dword ptr ds:[
ebx+314]
004E0D24 |. E8 B3E4F6FF
call OfficeMa.0044F1DC
004E0D29 |. 8B45 BC
mov eax,
dword ptr ss:[
ebp-44]
004E0D2C |. 8D55 C0
lea edx,
dword ptr ss:[
ebp-40]
004E0D2F |. E8 0889F2FF
call OfficeMa.0040963C
004E0D34 |. 8B45 C0
mov eax,
dword ptr ss:[
ebp-40]
004E0D37 |. 50
push eax
004E0D38 |. A1 64875700
mov eax,
dword ptr ds:[578764]
004E0D3D |. 8B00
mov eax,
dword ptr ds:[
eax]
004E0D3F |. B9 200F4E00
mov ecx,OfficeMa.004E0F20
; regnosec
004E0D44 |. BA 000F4E00
mov edx,OfficeMa.004E0F00
; reg
004E0D49 |. 8B30
mov esi,
dword ptr ds:[
eax]
004E0D4B |. FF56 04
call dword ptr ds:[
esi+4]
004E0D4E |. 6A 00
push 0
004E0D50 |. 8B15 F4885700
mov edx,
dword ptr ds:[5788F4]
; OfficeMa.0057B694
004E0D56 |. 8B12
mov edx,
dword ptr ds:[
edx]
004E0D58 |. 8D45 B8
lea eax,
dword ptr ss:[
ebp-48]
004E0D5B |. B9 340F4E00
mov ecx,OfficeMa.004E0F34
; 信息库文件\xxklist.edo
004E0D60 |. E8 2F41F2FF
call OfficeMa.00404E94
004E0D65 |. 8B55 B8
mov edx,
dword ptr ss:[
ebp-48]
004E0D68 |. A1 F08C5700
mov eax,
dword ptr ds:[578CF0]
004E0D6D |. 8B00
mov eax,
dword ptr ds:[
eax]
004E0D6F |. B9 10270000
mov ecx,2710
004E0D74 |. E8 FF9BFCFF
call OfficeMa.004AA978
004E0D79 |. A1 5C8D5700
mov eax,
dword ptr ds:[578D5C]
004E0D7E |. 8338 00
cmp dword ptr ds:[
eax],0
004E0D81 |. 74 0C
je short OfficeMa.004E0D8F
004E0D83 |. A1 5C8D5700
mov eax,
dword ptr ds:[578D5C]
004E0D88 |. 8B00
mov eax,
dword ptr ds:[
eax]
004E0D8A |. E8 B5BAF8FF
call OfficeMa.0046C844
004E0D8F |> A1 F88A5700
mov eax,
dword ptr ds:[578AF8]
004E0D94 |. 8B00
mov eax,
dword ptr ds:[
eax]
004E0D96 |. E8 41F2F8FF
call OfficeMa.0046FFDC
004E0D9B |. 6A 01
push 1
004E0D9D |. 6A 00
push 0
004E0D9F |. 6A 00
push 0
004E0DA1 |. 68 4C0F4E00
push OfficeMa.004E0F4C
; endo.exe
004E0DA6 |. 68 580F4E00
push OfficeMa.004E0F58
; open
004E0DAB |. 8BC3
mov eax,
ebx
004E0DAD |. E8 1A4CF7FF
call OfficeMa.004559CC
004E0DB2 |. 50
push eax ; |hWnd
004E0DB3 |. E8 A8BAF5FF
call <jmp.&shell32.ShellExecuteA>
; \ShellExecuteA
004E0DB8 |. EB 27
jmp short OfficeMa.004E0DE1
004E0DBA |> 6A 00
push 0
004E0DBC |. 68 600F4E00
push OfficeMa.004E0F60
; 警告
004E0DC1 |. 68 680F4E00
push OfficeMa.004E0F68
; 注册码错误!请重新输入!
*************************************************************************************************
跟进算法
call OfficeMa.004E1334,来到这里
004E1334 /$ 55
push ebp
004E1335 |. 8BEC
mov ebp,
esp
004E1337 |. 81C4 1CFFFFFF
add esp,-0E4
004E133D |. 53
push ebx
004E133E |. 56
push esi
004E133F |. 33DB
xor ebx,
ebx
004E1341 |. 899D 1CFFFFFF
mov dword ptr ss:[
ebp-E4],
ebx
004E1347 |. 899D 20FFFFFF
mov dword ptr ss:[
ebp-E0],
ebx
004E134D |. 894D F4
mov dword ptr ss:[
ebp-C],
ecx ; ebp-C=987654321
004E1350 |. 8955 F8
mov dword ptr ss:[
ebp-8],
edx ; ebp-8=123456789
004E1353 |. 8945 FC
mov dword ptr ss:[
ebp-4],
eax ; ebp-4=机器码
004E1356 |. 8B45 FC
mov eax,
dword ptr ss:[
ebp-4]
004E1359 |. E8 D23CF2FF
call OfficeMa.00405030
004E135E |. 8B45 F8
mov eax,
dword ptr ss:[
ebp-8]
004E1361 |. E8 CA3CF2FF
call OfficeMa.00405030
004E1366 |. 8B45 F4
mov eax,
dword ptr ss:[
ebp-C]
004E1369 |. E8 C23CF2FF
call OfficeMa.00405030
; eax=987654321
004E136E |. 33C0
xor eax,
eax ; eax清零
004E1370 |. 55
push ebp
004E1371 |. 68 65144E00
push OfficeMa.004E1465
004E1376 |. 64:FF30
push dword ptr fs:[
eax]
004E1379 |. 64:8920
mov dword ptr fs:[
eax],
esp
004E137C |. C645 F3 00
mov byte ptr ss:[
ebp-D],0
004E1380 |. 33F6
xor esi,
esi
004E1382 |. 8B45 FC
mov eax,
dword ptr ss:[
ebp-4]
; 机器码送eax
004E1385 |. E8 BE3AF2FF
call OfficeMa.00404E48
004E138A |. 8BD0
mov edx,
eax
004E138C |. 85D2
test edx,
edx
004E138E |. 7E 2A
jle short OfficeMa.004E13BA
004E1390 |. B9 01000000
mov ecx,1
; ecx=987654321
004E1395 |. 8D85 24FFFFFF
lea eax,
dword ptr ss:[
ebp-DC]
004E139B |> 8B5D FC /
mov ebx,
dword ptr ss:[
ebp-4]
004E139E |. 0FB65C0B FF |
movzx ebx,
byte ptr ds:[
ebx+
ecx-1]
; 机器码的ascii码逐位送ebx
004E13A3 |. 8918 |
mov dword ptr ds:[
eax],
ebx ; ebx送ds:[eax]
004E13A5 |. 6918 39590500 |
imul ebx,
dword ptr ds:[
eax],55939
; ebx*55939
004E13AB |. 03F3 |
add esi,
ebx ; esi+ebx
004E13AD |. 81C6 16930600 |
add esi,69316
; esi+69316
004E13B3 |. 41 |
inc ecx ; ecx+1
004E13B4 |. 83C0 04 |
add eax,4
; eax+4
004E13B7 |. 4A |
dec edx ; edx-1
004E13B8 |.^ 75 E1 \
jnz short OfficeMa.004E139B
; 循环15次,即机器码位数
004E13BA |> 33C0
xor eax,
eax ; 最后循环计算出来的esi值为1375D293,转成十进制为326488723,即第一部分注册码
004E13BC |. 8945 EC
mov dword ptr ss:[
ebp-14],
eax
004E13BF |. 8B45 FC
mov eax,
dword ptr ss:[
ebp-4]
; 机器码送eax
004E13C2 |. E8 813AF2FF
call OfficeMa.00404E48
004E13C7 |. 8BD0
mov edx,
eax ; eax=机器码位数
004E13C9 |. 85D2
test edx,
edx
004E13CB |. 7E 2E
jle short OfficeMa.004E13FB
004E13CD |. B9 01000000
mov ecx,1
004E13D2 |. 8D85 24FFFFFF
lea eax,
dword ptr ss:[
ebp-DC]
004E13D8 |> 8B5D FC /
mov ebx,
dword ptr ss:[
ebp-4]
004E13DB |. 0FB65C0B FF |
movzx ebx,
byte ptr ds:[
ebx+
ecx-1]
; 机器码的ascii码逐位送ebx
004E13E0 |. 8918 |
mov dword ptr ds:[
eax],
ebx
004E13E2 |. 6918 49860C00 |
imul ebx,
dword ptr ds:[
eax],0C8649
; ebx*0C8649
004E13E8 |. 035D EC |
add ebx,
dword ptr ss:[
ebp-14]
; ebx+ss:[ebp-14]
004E13EB |. 81C3 16930600 |
add ebx,69316
; ebx+69316
004E13F1 |. 895D EC |
mov dword ptr ss:[
ebp-14],
ebx ; ebx送ss:[ebp-14]
004E13F4 |. 41 |
inc ecx ; ecx+1
004E13F5 |. 83C0 04 |
add eax,4
; eax+4
004E13F8 |. 4A |
dec edx ; edx-1
004E13F9 |.^ 75
DD \
jnz short OfficeMa.004E13D8
; 循环15次,即机器码位数
004E13FB |> 8D95 20FFFFFF
lea edx,
dword ptr ss:[
ebp-E0]
; 最后循环计算出来的ebx值为2D0D88A3,转成十进制为755861667,即第二部分注册码
004E1401 |. 8BC6
mov eax,
esi
004E1403 |. E8 7486F2FF
call OfficeMa.00409A7C
004E1408 |. 8B95 20FFFFFF
mov edx,
dword ptr ss:[
ebp-E0]
004E140E |. 8B45 F8
mov eax,
dword ptr ss:[
ebp-8]
004E1411 |. E8 763BF2FF
call OfficeMa.00404F8C
004E1416 |. 75 22
jnz short OfficeMa.004E143A
; 判断第一部分注册码是否正确,爆破点1
004E1418 |. 8D95 1CFFFFFF
lea edx,
dword ptr ss:[
ebp-E4]
004E141E |. 8B45 EC
mov eax,
dword ptr ss:[
ebp-14]
004E1421 |. E8 5686F2FF
call OfficeMa.00409A7C
004E1426 |. 8B95 1CFFFFFF
mov edx,
dword ptr ss:[
ebp-E4]
004E142C |. 8B45 F4
mov eax,
dword ptr ss:[
ebp-C]
004E142F |. E8 583BF2FF
call OfficeMa.00404F8C
004E1434 |. 75 04
jnz short OfficeMa.004E143A
; 判断第二部分注册码是否正确,爆破点2
004E1436 |. C645 F3 01
mov byte ptr ss:[
ebp-D],1
004E143A |> 33C0
xor eax,
eax
004E143C |. 5A
pop edx
004E143D |. 59
pop ecx
004E143E |. 59
pop ecx
004E143F |. 64:8910
mov dword ptr fs:[
eax],
edx
004E1442 |. 68 6C144E00
push OfficeMa.004E146C
004E1447 |> 8D85 1CFFFFFF
lea eax,
dword ptr ss:[
ebp-E4]
004E144D |. BA 02000000
mov edx,2
004E1452 |. E8 5D37F2FF
call OfficeMa.00404BB4
004E1457 |. 8D45 F4
lea eax,
dword ptr ss:[
ebp-C]
004E145A |. BA 03000000
mov edx,3
004E145F |. E8 5037F2FF
call OfficeMa.00404BB4
004E1464 \. C3
retn
*************************************************************************************************
算法总结:
软件算法很简单,注册码分两部分,主要思路如下:
1.根据机器码进行第一部分注册码运算,即逐位将机器码的ascii送
ebx;
ebx+
esi;
esi+69316,循环计算,直到取完机器码,最后计算的
esi值转成十进制即是第一部分注册码;
2.根据机器码进行第二部分注册码运算,即逐位将机器码的ascii送
ebx;
ebx*0C8649;
ebx+
ss:[
ebp-14];
ebx+69316;
ebx送
ss:[
ebp-14],循环计算,直到取完机器码,最后计算的
ebx值转成十进制即是第二部分注册码;
我这里的机器码为WD-WCAD19885326,注册码为326488723-755861667
特别说明: 本文仅是一些破解的心得和思路,完全是个人对程序的研究,无其他目的。
[培训]《安卓高级研修班(网课)》月薪三万计划,掌
握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法