-
-
[原创]我的CrackMe
-
发表于: 2006-12-15 11:27
-
|
|
|---|---|
|
|
哈哈，怎么样都要试试的。
shoooo老大。你很喜欢那个虫虫图标哦。专利啊。 您的壳应该更新了吧  要求计算的数太大了（循环左移和循环右移太麻烦了。我不会），水平有限 004010E8 83F8 08 cmp eax, 8 ; 输入的假码位数和8比较 004010EB 68 20124000 push 00401220 ; 小于8就结束 004010F0 B8 FD104000 mov eax, 004010FD 004010F5 0F450424 cmovne eax, dword ptr [esp] 004010F9 870424 xchg dword ptr [esp], eax 004010FC C3 retn 004010FD BE 30104000 mov esi, 00401030 ; ASCII "binbinbi" 00401102 BF 70104000 mov edi, 00401070 ; ASCII "12345678" 00401107 8066 08 00 and byte ptr [esi+8], 0 ; 这里看到只需要用户名的前8位 0040110B 66:AD lods word ptr [esi] 0040110D 0FB7D0 movzx edx, ax ; 取得第一第二位“6962”。放到edx 00401110 AD lods dword ptr [esi] ; 倒过来取得用户名第一个字的16进制Ascii。放在eax 00401111 0307 add eax, dword ptr [edi] ; 加。（倒过来的假码的第一个字的16进制ascii） 00401113 C1C0 05 rol eax, 5 ; 循环左移 00401116 35 ADDEADDE xor eax, DEADDEAD ; 异或 0040111B C1C8 08 ror eax, 8 ; 循环右移 0040111E 3D 025546B7 cmp eax, B7465502 ; 比较 |
|
|
|
|
|
算法很明了。。。都是大数运算
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 强,我投降了,竟然还有这种,第一次见到,学习学习.. 好多指令第一次见到. |
|
|
不甘心.我再试试.
|
|
|
shoooo太强了。 这代码就像闯关一样，我最多闯了2关。 中间的4字节数据通过变形可以通过第一关 DWORD GetfirstFourKey( char* fourname ) { //不得已用汇编..C++没循环移位.自己实现又太长. DWORD cont1 = 0xB7465502; DWORD cont2 = 0xDEADDEAD; DWORD dret; DWORD dfour = *(DWORD*)fourname; __asm { mov eax,cont1 rol eax,8 xor eax,cont2 ror eax,5 sub eax,dfour mov dret,eax } return dret; } 第二关就是效验头部和尾部，这个可以计算出来 DWORD MakeName()//生成头部和尾部 { DWORD cont = 0x8FA2040B ^ 0xFACC6A68; DWORD dret = HIWORD(cont); WORD n = LOWORD(cont); __asm { mov edx,dret bswap edx mov dret,edx } return dret; } 我就知道头部和尾步是可以计算出来的，前面是un,后面是cn，不过从截图上看貌似还有余地。 第三关就让人郁闷了，生成的KEY头4字节可以通过第一关，但是这里却不一样了 DWORD GetfirstFourKey2() { DWORD op1 = 0xC38A6955; __asm { mov eax,op1 rol eax,7 xor eax,0x74CA92E8 sub eax,0x4198D3A0 mov op1,eax } return op1; } 原形是pedi(还是idep?我搞忘了.昏)第一关和第三关的效验完全矛盾的嘛..我数学以前一直就是0分.所以搞不定. 后面的也就没心思研究了,这关搞定后面也就没几关了 这个矛盾我直接楞楞的看了4个小时,没看懂. 期待后面的高手ing... |
|
|
楼上3点还在做我的CM
 要多注意休息啊
|
|
|
所以
一但解开 敬请开源
|
|
|
最初由 fonge 发布 你这么个说法，说明你没看过这个CM 我的整个代码只有下面这些 //check call 00401090 55 push ebp 00401091 8BEC mov ebp,esp 00401093 53 push ebx 00401094 56 push esi 00401095 57 push edi 00401096 8B35 24104000 mov esi,dword ptr ds:[<&USER32.GetDlgItem>; USER32.GetDlgItem 0040109C 8B3D 14104000 mov edi,dword ptr ds:[<&USER32.SendMessag>; USER32.SendMessageA 004010A2 68 30104000 push cm.00401030 004010A7 6A 57 push 57 004010A9 6A 0D push 0D 004010AB 68 E8030000 push 3E8 004010B0 FF75 08 push dword ptr ss:[ebp+8] 004010B3 FFD6 call esi 004010B5 50 push eax 004010B6 FFD7 call edi 004010B8 0BC0 or eax,eax 004010BA 68 20124000 push cm.00401220 004010BF B8 CC104000 mov eax,cm.004010CC 004010C4 0F440424 cmove eax,dword ptr ss:[esp] 004010C8 870424 xchg dword ptr ss:[esp],eax 004010CB C3 retn 004010CC 8B1D 20104000 mov ebx,dword ptr ds:[<&USER32.MessageBox>; USER32.MessageBoxA 004010D2 68 70104000 push cm.00401070 004010D7 6A 0A push 0A 004010D9 6A 0D push 0D 004010DB 68 E9030000 push 3E9 004010E0 FF75 08 push dword ptr ss:[ebp+8] 004010E3 FFD6 call esi 004010E5 50 push eax 004010E6 FFD7 call edi 004010E8 83F8 08 cmp eax,8 004010EB 68 20124000 push cm.00401220 004010F0 B8 FD104000 mov eax,cm.004010FD 004010F5 0F450424 cmovne eax,dword ptr ss:[esp] 004010F9 870424 xchg dword ptr ss:[esp],eax 004010FC C3 retn 004010FD BE 30104000 mov esi,cm.00401030 00401102 BF 70104000 mov edi,cm.00401070 00401107 8066 08 00 and byte ptr ds:[esi+8],0 0040110B 66:AD lods word ptr ds:[esi] 0040110D 0FB7D0 movzx edx,ax 00401110 AD lods dword ptr ds:[esi] 00401111 0307 add eax,dword ptr ds:[edi] 00401113 C1C0 05 rol eax,5 00401116 35 ADDEADDE xor eax,DEADDEAD 0040111B C1C8 08 ror eax,8 0040111E 3D 025546B7 cmp eax,B7465502 00401123 68 20124000 push cm.00401220 00401128 B8 35114000 mov eax,cm.00401135 0040112D 0F450424 cmovne eax,dword ptr ss:[esp] 00401131 870424 xchg dword ptr ss:[esp],eax 00401134 C3 retn 00401135 0FCA bswap edx 00401137 66:AD lods word ptr ds:[esi] 00401139 66:8BD0 mov dx,ax 0040113C 81F2 686ACCFA xor edx,FACC6A68 00401142 81FA 0B04A28F cmp edx,8FA2040B 00401148 68 20124000 push cm.00401220 0040114D B8 5A114000 mov eax,cm.0040115A 00401152 0F450424 cmovne eax,dword ptr ss:[esp] 00401156 870424 xchg dword ptr ss:[esp],eax 00401159 C3 retn 0040115A BE 80104000 mov esi,cm.00401080 0040115F BF 95114000 mov edi,cm.00401195 00401164 B9 8E114000 mov ecx,cm.0040118E 00401169 AD lods dword ptr ds:[esi] 0040116A 8BD0 mov edx,eax 0040116C AD lods dword ptr ds:[esi] 0040116D 66:85C0 test ax,ax 00401170 68 86114000 push cm.00401186 00401175 50 push eax 00401176 B8 95114000 mov eax,cm.00401195 0040117B 0F454424 04 cmovne eax,dword ptr ss:[esp+4] 00401180 874424 04 xchg dword ptr ss:[esp+4],eax 00401184 58 pop eax 00401185 C3 retn 00401186 8911 mov dword ptr ds:[ecx],edx 00401188 66:8941 04 mov word ptr ds:[ecx+4],ax 0040118C 33C0 xor eax,eax 0040118E B8 20124000 mov eax,cm.00401220 00401193 57 push edi 00401194 C3 retn 00401195 BE 70104000 mov esi,cm.00401070 0040119A AD lods dword ptr ds:[esi] 0040119B 0FC8 bswap eax 0040119D 05 A0D39841 add eax,4198D3A0 004011A2 35 E892CA74 xor eax,74CA92E8 004011A7 C1C8 07 ror eax,7 004011AA 2D 55698AC3 sub eax,C38A6955 004011AF 68 20124000 push cm.00401220 004011B4 B8 C1114000 mov eax,cm.004011C1 004011B9 0F450424 cmovne eax,dword ptr ss:[esp] 004011BD 870424 xchg dword ptr ss:[esp],eax 004011C0 C3 retn 004011C1 AD lods dword ptr ds:[esi] 004011C2 BA 78563412 mov edx,12345678 004011C7 0FC1D0 xadd eax,edx 004011CA 05 0F465C80 add eax,805C460F 004011CF 68 20124000 push cm.00401220 004011D4 B8 E1114000 mov eax,cm.004011E1 004011D9 0F450424 cmovne eax,dword ptr ss:[esp] 004011DD 870424 xchg dword ptr ss:[esp],eax 004011E0 C3 retn 004011E1 8BF3 mov esi,ebx 004011E3 AC lods byte ptr ds:[esi] 004011E4 2C CC sub al,0CC 004011E6 68 20124000 push cm.00401220 004011EB B8 F8114000 mov eax,cm.004011F8 004011F0 0F440424 cmove eax,dword ptr ss:[esp] 004011F4 870424 xchg dword ptr ss:[esp],eax 004011F7 C3 retn 004011F8 BE 80104000 mov esi,cm.00401080 004011FD AD lods dword ptr ds:[esi] 004011FE 3D CAA7B0DC cmp eax,DCB0A7CA 00401203 68 20124000 push cm.00401220 00401208 B8 15124000 mov eax,cm.00401215 0040120D 0F450424 cmovne eax,dword ptr ss:[esp] 00401211 870424 xchg dword ptr ss:[esp],eax 00401214 C3 retn 00401215 33C0 xor eax,eax 00401217 50 push eax 00401218 83EE 04 sub esi,4 0040121B 56 push esi 0040121C 56 push esi 0040121D 50 push eax 0040121E FFD3 call ebx 00401220 5F pop edi 00401221 5E pop esi 00401222 5B pop ebx 00401223 5D pop ebp 00401224 C3 retn // 消息循环 00401225 55 push ebp 00401226 8BEC mov ebp,esp 00401228 8B45 0C mov eax,dword ptr ss:[ebp+C] 0040122B 83E8 10 sub eax,10 0040122E 74 4C je short cm.0040127C 00401230 2D 00010000 sub eax,100 00401235 74 21 je short cm.00401258 00401237 48 dec eax 00401238 75 4A jnz short cm.00401284 0040123A 68 EA030000 push 3EA 0040123F FF75 08 push dword ptr ss:[ebp+8] 00401242 FF15 24104000 call dword ptr ds:[<&USER32.GetDlgItem>] ; USER32.GetDlgItem 00401248 3945 14 cmp dword ptr ss:[ebp+14],eax 0040124B 75 37 jnz short cm.00401284 0040124D FF75 08 push dword ptr ss:[ebp+8] 00401250 E8 3BFEFFFF call cm.00401090 00401255 59 pop ecx 00401256 EB 2C jmp short cm.00401284 00401258 6A 66 push 66 0040125A 6A 00 push 0 0040125C FF15 08104000 call dword ptr ds:[<&KERNEL32.GetModuleHa>; kernel32.GetModuleHandleA 00401262 50 push eax 00401263 FF15 18104000 call dword ptr ds:[<&USER32.LoadIconA>] ; USER32.LoadIconA 00401269 50 push eax 0040126A 6A 01 push 1 0040126C 68 80000000 push 80 00401271 FF75 08 push dword ptr ss:[ebp+8] 00401274 FF15 14104000 call dword ptr ds:[<&USER32.SendMessageA>>; USER32.SendMessageA 0040127A EB 08 jmp short cm.00401284 0040127C 6A 00 push 0 0040127E FF15 28104000 call dword ptr ds:[<&USER32.PostQuitMessa>; USER32.PostQuitMessage 00401284 33C0 xor eax,eax 00401286 5D pop ebp 00401287 C2 1000 retn 10 // entry point 0040128A c> 33C0 xor eax,eax 0040128C FF15 00104000 call dword ptr ds:[<&COMCTL32.#17>] ; COMCTL32.InitCommonControls 00401292 68 25124000 push cm.00401225 00401297 50 push eax 00401298 6A 65 push 65 0040129A 50 push eax 0040129B FF15 08104000 call dword ptr ds:[<&KERNEL32.GetModuleHa>; kernel32.GetModuleHandleA 004012A1 50 push eax 004012A2 FF15 1C104000 call dword ptr ds:[<&USER32.DialogBoxPara>; USER32.DialogBoxParamA 004012A8 50 push eax 004012A9 FF15 0C104000 call dword ptr ds:[<&KERNEL32.ExitProcess>; kernel32.ExitProcess 004012AF CC int3 这和开源有分别么？ |
|
|
|
|
|
00401110 . AD LODS DWORD PTR DS:[ESI] ; 从name的第2字节读4字节到eax
00401111 . 0307 ADD EAX,DWORD PTR DS:[EDI] ; 通过后4字节计算key前4字节 00401113 . C1C0 05 ROL EAX,5 00401116 . 35 ADDEADDE XOR EAX,DEADDEAD 0040111B . C1C8 08 ROR EAX,8 0040111E . 3D 025546B7 CMP EAX,B7465502 ; 比较.正确那个retn就算过了 00401123 . 68 20124000 PUSH cm.00401220 00401128 . B8 35114000 MOV EAX,cm.00401135 0040112D . 0F450424 CMOVNE EAX,DWORD PTR SS:[ESP] 00401131 . 870424 XCHG DWORD PTR SS:[ESP],EAX 00401134 . C3 RETN 0040115A BE 80104000 MOV ESI,cm.00401080 ; 失败字符串 0040115F BF 95114000 MOV EDI,cm.00401195 00401164 B9 8E114000 MOV ECX,cm.0040118E 00401169 AD LODS DWORD PTR DS:[ESI] 0040116A 8BD0 MOV EDX,EAX 0040116C AD LODS DWORD PTR DS:[ESI] 0040116D 66:85C0 TEST AX,AX 00401170 68 86114000 PUSH cm.00401186 00401175 50 PUSH EAX 00401176 B8 95114000 MOV EAX,cm.00401195 0040117B 0F454424 04 CMOVNE EAX,DWORD PTR SS:[ESP+4] 00401180 874424 04 XCHG DWORD PTR SS:[ESP+4],EAX 00401184 58 POP EAX 00401185 C3 RETN ; 这里跳到了401195. 00401195 BE 70104000 MOV ESI,cm.00401070 ; 又对算出来的前4位KEY进行验证..这是个坎了... 0040119A AD LODS DWORD PTR DS:[ESI] 0040119B 0FC8 BSWAP EAX 0040119D 05 A0D39841 ADD EAX,4198D3A0 004011A2 35 E892CA74 XOR EAX,74CA92E8 004011A7 C1C8 07 ROR EAX,7 004011AA 2D 55698AC3 SUB EAX,C38A6955 004011AF 68 20124000 PUSH cm.00401220 004011B4 B8 C1114000 MOV EAX,cm.004011C1 004011B9 0F450424 CMOVNE EAX,DWORD PTR SS:[ESP] 004011BD 870424 XCHG DWORD PTR SS:[ESP],EAX 004011C0 C3 RETN  shoooo给个正确的KEY试试
|
|
|
|
|
|
这大冬天的，玩了好久没玩出来，手都冻的不行了，休息会再弄，
|
|
|
|
|
|
楼上正解
不过我原意是 edit1: unpackcn111111111111111111111111111111111111111111111111111111111111111111111111PVVPWS edit2: pediycom |
|
|
|
|
|
高手出手。
我等小辈看天书中～
|
