[原创][破]Christmas-KeygenMe#4.Guetta-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[原创][破]Christmas-KeygenMe#4.Guetta

发表于: 2007-1-27 23:28 5787

[原创][破]Christmas-KeygenMe#4.Guetta

hbqjxhw

2007-1-27 23:28

5787

【破文作者】 hbqjxhw[pyg]

【文章题目】 [破]Christmas-KeygenMe#4.Guetta

【软件名称】 Christmas-KeygenMe#4

【下载地址】 http://www.crackmes.de/users/guetta/christmas_keygenme/

----------------------------------------------------------------------------------------------
【破解工具】 OD,RSATool2v110,BigCalc,MD5,BASE64,MD5Crack V3.0

【破解平台】 WinXP SP2

----------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------
【破解过程】

1. PEiD查看，无壳，还找到了BASE64、RSA、MD5等加密算法；
2. OD载入；
3. 下BPX GetDlgItemTextA
00401EEA、00401F0C、00401F29、00401F4B保留这四个，F2去掉004029A0，为什么？自己试一试就知道了
然后一步一步去跟踪了：

00401ED5  /$  55          PUSH EBP                            ;  (Initial CPU selection)
00401ED6  |.  8BEC       MOV EBP,ESP
00401ED8  |.  53          PUSH EBX
00401ED9  |.  56          PUSH ESI
00401EDA  |.  57          PUSH EDI
00401EDB  |.  6A 40       PUSH 40                               ; /Count = 40 (64.)
00401EDD  |.  68 26814000 PUSH Christma.00408126                ; |Buffer = Christma.00408126
00401EE2  |.  68 94010000 PUSH 194                            ; |ControlID = 194 (404.)
00401EE7  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
00401EEA  |.  E8 450F0000 CALL <Christma.GetDlgItemTextA>       ; \GetDlgItemTextA
00401EEF  |.  83F8 02    CMP EAX,2                            ;  判断Name位数是否大于2
00401EF2  |.  0F82 15020000 JB Christma.0040210D
00401EF8  |.  A2 89834000 MOV BYTE PTR DS:[408389],AL
00401EFD  |.  6A 40       PUSH 40                               ; /Count = 40 (64.)
00401EFF  |.  68 E6814000 PUSH Christma.004081E6                ; |Invalid registration informations.
00401F04  |.  68 95010000 PUSH 195                            ; |ControlID = 195 (405.)
00401F09  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
00401F0C  |.  E8 230F0000 CALL <Christma.GetDlgItemTextA>       ; \GetDlgItemTextA
00401F11  |.  83F8 02    CMP EAX,2                            ;  判断Serial位数是否大于2
00401F14  |.  0F82 F3010000 JB Christma.0040210D
00401F1A  |.  6A 40       PUSH 40                               ; /Count = 40 (64.)
00401F1C  |.  68 66814000 PUSH Christma.00408166                ; |Buffer = Christma.00408166
00401F21  |.  68 99010000 PUSH 199                            ; |ControlID = 199 (409.)
00401F26  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
00401F29  |.  E8 060F0000 CALL <Christma.GetDlgItemTextA>       ; \GetDlgItemTextA
00401F2E  |.  83F8 02    CMP EAX,2                            ;  判断Group位数是否大于2
00401F31  |.  0F82 D6010000 JB Christma.0040210D
00401F37  |.  A2 8B834000 MOV BYTE PTR DS:[40838B],AL
00401F3C  |.  6A 40       PUSH 40                               ; /Count = 40 (64.)
00401F3E  |.  68 A6814000 PUSH Christma.004081A6                ; |Buffer = Christma.004081A6
00401F43  |.  68 9A010000 PUSH 19A                            ; |ControlID = 19A (410.)
00401F48  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
00401F4B  |.  E8 E40E0000 CALL <Christma.GetDlgItemTextA>       ; \GetDlgItemTextA
00401F50  |.  83F8 06    CMP EAX,6                            ;  判断E-Mail位数是否大于6
00401F53  |.  0F82 B4010000 JB Christma.0040210D
00401F59  |.  A2 8D834000 MOV BYTE PTR DS:[40838D],AL
00401F5E  |.  33DB       XOR EBX,EBX
00401F60  |.  BA A6814000 MOV EDX,Christma.004081A6
00401F65  |>  8A02       /MOV AL,BYTE PTR DS:[EDX]
00401F67  |.  83FB 03    |CMP EBX,3
00401F6A  |.  74 19       |JE SHORT Christma.00401F85
00401F6C  |.  3C 00       |CMP AL,0
00401F6E  |.  0F84 99010000 |JE Christma.0040210D
00401F74  |.  3C 40       |CMP AL,40
00401F76  |.  75 03       |JNZ SHORT Christma.00401F7B
00401F78  |.  83C3 01    |ADD EBX,1
00401F7B  |>  3C 2E       |CMP AL,2E
00401F7D  |.  75 03       |JNZ SHORT Christma.00401F82
00401F7F  |.  83C3 02    |ADD EBX,2
00401F82  |>  42          |INC EDX
00401F83  |.^ EB E0       \JMP SHORT Christma.00401F65
00401F85  |>  E8 48FBFFFF CALL Christma.00401AD2                ; \关键CALL，KeyFile文件的生成及内容算法
00401F8A  |.  3C 01       CMP AL,1
00401F8C  |.  74 06       JE SHORT Christma.00401F94
00401F8E  |.  0F85 79010000 JNZ Christma.0040210D
00401F94  |>  33C0       XOR EAX,EAX
Name标准的MD5计算并转换为大写取前15位
00401F96  |.  A0 89834000 MOV AL,BYTE PTR DS:[408389]
00401F9B  |.  68 A4894000 PUSH Christma.004089A4                ; /Arg3 = 004089A4
00401FA0  |.  50          PUSH EAX                            ; |Arg2
00401FA1  |.  68 26814000 PUSH Christma.00408126                ; |Arg1 = 00408126
00401FA6  |.  E8 55F0FFFF CALL Christma.00401000                ; \
00401FAB  |.  FF35 B0894000 PUSH DWORD PTR DS:[4089B0]          ; /<%.8x> = 71EB1925
00401FB1  |.  FF35 AC894000 PUSH DWORD PTR DS:[4089AC]          ; |<%.8x> = 352217E7
00401FB7  |.  FF35 A8894000 PUSH DWORD PTR DS:[4089A8]          ; |<%.8x> = 737A9385
00401FBD  |.  FF35 A4894000 PUSH DWORD PTR DS:[4089A4]          ; |<%.8x> = 84CC9A91
00401FC3  |.  68 53804000 PUSH Christma.00408053                ; |%.8x%.8x%.8x%.8x
00401FC8  |.  68 26834000 PUSH Christma.00408326                ; |s = Christma.00408326
00401FCD  |.  E8 1A0E0000 CALL <Christma.wsprintfA>             ; \wsprintfA
00401FD2  |.  83C4 18    ADD ESP,18
00401FD5  |.  68 26834000 PUSH Christma.00408326                ; /StringOrChar = "582C72D779E7F9B"
00401FDA  |.  E8 190E0000 CALL <Christma.CharUpperA>          ; \CharUpperA
00401FDF  |.  C605 35834000>MOV BYTE PTR DS:[408335],0
00401FE6  |.  33C0       XOR EAX,EAX
Group标准的MD5计算并转换为大写取前15位
00401FE8  |.  A0 8B834000 MOV AL,BYTE PTR DS:[40838B]
00401FED  |.  68 A4894000 PUSH Christma.004089A4                ; /Arg3 = 004089A4
00401FF2  |.  50          PUSH EAX                            ; |Arg2
00401FF3  |.  68 66814000 PUSH Christma.00408166                ; |Arg1 = 00408166
00401FF8  |.  E8 03F0FFFF CALL Christma.00401000                ; \
00401FFD  |.  FF35 B0894000 PUSH DWORD PTR DS:[4089B0]          ; /<%.8x> = 71EB1925
00402003  |.  FF35 AC894000 PUSH DWORD PTR DS:[4089AC]          ; |<%.8x> = 352217E7
00402009  |.  FF35 A8894000 PUSH DWORD PTR DS:[4089A8]          ; |<%.8x> = 737A9385
0040200F  |.  FF35 A4894000 PUSH DWORD PTR DS:[4089A4]          ; |<%.8x> = 84CC9A91
00402015  |.  68 53804000 PUSH Christma.00408053                ; |%.8x%.8x%.8x%.8x
0040201A  |.  68 47834000 PUSH Christma.00408347                ; |s = Christma.00408347
0040201F  |.  E8 C80D0000 CALL <Christma.wsprintfA>             ; \wsprintfA
00402024  |.  83C4 18    ADD ESP,18
00402027  |.  68 47834000 PUSH Christma.00408347                ; /StringOrChar = "81393C93EE1717E"
0040202C  |.  E8 C70D0000 CALL <Christma.CharUpperA>          ; \CharUpperA
00402031  |.  C605 56834000>MOV BYTE PTR DS:[408356],0
00402038  |.  33C0       XOR EAX,EAX
E-Mail标准的MD5计算并转换为大写取前15位
0040203A  |.  A0 8D834000 MOV AL,BYTE PTR DS:[40838D]
0040203F  |.  68 A4894000 PUSH Christma.004089A4                ; /Arg3 = 004089A4
00402044  |.  50          PUSH EAX                            ; |Arg2
00402045  |.  68 A6814000 PUSH Christma.004081A6                ; |Arg1 = 004081A6
0040204A  |.  E8 B1EFFFFF CALL Christma.00401000                ; \
0040204F  |.  FF35 B0894000 PUSH DWORD PTR DS:[4089B0]          ; /<%.8x> = 71EB1925
00402055  |.  FF35 AC894000 PUSH DWORD PTR DS:[4089AC]          ; |<%.8x> = 352217E7
0040205B  |.  FF35 A8894000 PUSH DWORD PTR DS:[4089A8]          ; |<%.8x> = 737A9385
00402061  |.  FF35 A4894000 PUSH DWORD PTR DS:[4089A4]          ; |<%.8x> = 84CC9A91
00402067  |.  68 53804000 PUSH Christma.00408053                ; |%.8x%.8x%.8x%.8x
0040206C  |.  68 68834000 PUSH Christma.00408368                ; |s = Christma.00408368
00402071  |.  E8 760D0000 CALL <Christma.wsprintfA>             ; \wsprintfA
00402076  |.  83C4 18    ADD ESP,18
00402079  |.  68 68834000 PUSH Christma.00408368                ; /StringOrChar = "84CC9A91737A938"
0040207E  |.  E8 750D0000 CALL <Christma.CharUpperA>          ; \CharUpperA
00402083  |.  C605 77834000>MOV BYTE PTR DS:[408377],0
0040208A  |.  33DB       XOR EBX,EBX
0040208C  |.  BA E6814000 MOV EDX,Christma.004081E6             ;  Serial赋给EDX
00402091  |>  8A02       /MOV AL,BYTE PTR DS:[EDX]             ;  Serial的格式检验
00402093  |.  83FB 04    |CMP EBX,4    ;  Serial的格式为SN1-SN2-SN3
00402096  |.  74 2E       |JE SHORT Christma.004020C6
00402098  |.  3C 00       |CMP AL,0
0040209A  |.  74 71       |JE SHORT Christma.0040210D
0040209C  |.  3C 2D       |CMP AL,2D
0040209E  |.  75 23       |JNZ SHORT Christma.004020C3
004020A0  |.  83C3 02    |ADD EBX,2                            ;  分支 (案例 2..2)
004020A3  |.  83FB 02    |CMP EBX,2
004020A6  |.  74 05       |JE SHORT Christma.004020AD
004020A8  |.  83FB 04    |CMP EBX,4
004020AB  |.  74 0B       |JE SHORT Christma.004020B8
004020AD  |>  8915 8F834000 |MOV DWORD PTR DS:[40838F],EDX       ;  分支 004020A0 默认案例
004020B3  |.  C602 00    |MOV BYTE PTR DS:[EDX],0
004020B6  |.  EB 0B       |JMP SHORT Christma.004020C3
004020B8  |>  8915 94834000 |MOV DWORD PTR DS:[408394],EDX       ;  案例 2 --> 分支 004020A0
004020BE  |.  C602 00    |MOV BYTE PTR DS:[EDX],0
004020C1  |.  EB 00       |JMP SHORT Christma.004020C3
004020C3  |>  42          |INC EDX
004020C4  |.^ EB CB       \JMP SHORT Christma.00402091
004020C6  |>  E8 7C010000 CALL Christma.00402247                ;  重要CALL,第1个SN1的RSA计算
004020CB  |.  E8 B5020000 CALL Christma.00402385                ;  重要CALL,第2个SN2的RSA计算
004020D0  |.  E8 F2030000 CALL Christma.004024C7                ;  重要CALL,第3个SN3的RSA计算
004020D5  |.  68 26834000 PUSH Christma.00408326                ; /String2 = "582C72D779E7F9B"
004020DA  |.  68 66824000 PUSH Christma.00408266                ; |String1 = "582C72D779E7F9B"
004020DF  |.  E8 EC0D0000 CALL <Christma.lstrcmpA>             ; \lstrcmpA
004020E4  |.  75 27       JNZ SHORT Christma.0040210D          ;  Name的MD5前15位是否等于第1个SN1的RSA计算的值
004020E6  |.  68 47834000 PUSH Christma.00408347                ; /String2 = "81393C93EE1717E"
004020EB  |.  68 A6824000 PUSH Christma.004082A6                ; |String1 = "81393C93EE1717E"
004020F0  |.  E8 DB0D0000 CALL <Christma.lstrcmpA>             ; \lstrcmpA
004020F5  |.  75 16       JNZ SHORT Christma.0040210D          ;  Group的MD5前15位是否等于第2个SN2的RSA计算的值
004020F7  |.  68 68834000 PUSH Christma.00408368                ; /String2 = "84CC9A91737A938"
004020FC  |.  68 E6824000 PUSH Christma.004082E6                ; |String1 = "CDC180E6C4ECD06"
00402101  |.  E8 CA0D0000 CALL <Christma.lstrcmpA>             ; \lstrcmpA
00402106  |.  75 05       JNZ SHORT Christma.0040210D          ;  E-Mail的MD5前15位是否等于第3个SN3的RSA计算的值
00402108  |.  E9 9B000000 JMP Christma.004021A8
0040210D  |>  68 3C854000 PUSH Christma.0040853C                ; /Invalid registration informations.
00402112  |.  68 95010000 PUSH 195                            ; |ControlID = 195 (405.)
00402117  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
0040211A  |.  E8 510D0000 CALL <Christma.SetDlgItemTextA>       ; \SetDlgItemTextA
0040211F  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
00402121  |.  68 26814000 PUSH Christma.00408126                ; |Destination = Christma.00408126
00402126  |.  E8 990D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
0040212B  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
0040212D  |.  68 66814000 PUSH Christma.00408166                ; |Destination = Christma.00408166
00402132  |.  E8 8D0D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
00402137  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
00402139  |.  68 A6814000 PUSH Christma.004081A6                ; |Destination = Christma.004081A6
0040213E  |.  E8 810D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
00402143  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
00402145  |.  68 66824000 PUSH Christma.00408266                ; |Destination = Christma.00408266
0040214A  |.  E8 750D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
0040214F  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
00402151  |.  68 A6824000 PUSH Christma.004082A6                ; |Destination = Christma.004082A6
00402156  |.  E8 690D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
0040215B  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
0040215D  |.  68 E6824000 PUSH Christma.004082E6                ; |Destination = Christma.004082E6
00402162  |.  E8 5D0D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
00402167  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
00402169  |.  68 26834000 PUSH Christma.00408326                ; |Destination = Christma.00408326
0040216E  |.  E8 510D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
00402173  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
00402175  |.  68 47834000 PUSH Christma.00408347                ; |Destination = Christma.00408347
0040217A  |.  E8 450D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
0040217F  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
00402181  |.  68 68834000 PUSH Christma.00408368                ; |Destination = Christma.00408368
00402186  |.  E8 390D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
0040218B  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
0040218D  |.  68 26824000 PUSH Christma.00408226                ; |Destination = Christma.00408226
00402192  |.  E8 2D0D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
00402197  |.  6A 27       PUSH 27                               ; /Length = 27 (39.)
00402199  |.  68 A4894000 PUSH Christma.004089A4                ; |Destination = Christma.004089A4
0040219E  |.  E8 210D0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
004021A3  |.  E9 98000000 JMP Christma.00402240
004021A8  |>  68 36804000 PUSH Christma.00408036                ; /Merry christmas my friend =)
004021AD  |.  68 95010000 PUSH 195                            ; |ControlID = 195 (405.)
004021B2  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
004021B5  |.  E8 B60C0000 CALL <Christma.SetDlgItemTextA>       ; \SetDlgItemTextA
004021BA  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
004021BC  |.  68 26814000 PUSH Christma.00408126                ; |Destination = Christma.00408126
004021C1  |.  E8 FE0C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
004021C6  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
004021C8  |.  68 66814000 PUSH Christma.00408166                ; |Destination = Christma.00408166
004021CD  |.  E8 F20C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
004021D2  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
004021D4  |.  68 A6814000 PUSH Christma.004081A6                ; |Destination = Christma.004081A6
004021D9  |.  E8 E60C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
004021DE  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
004021E0  |.  68 66824000 PUSH Christma.00408266                ; |Destination = Christma.00408266
004021E5  |.  E8 DA0C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
004021EA  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
004021EC  |.  68 A6824000 PUSH Christma.004082A6                ; |Destination = Christma.004082A6
004021F1  |.  E8 CE0C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
004021F6  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
004021F8  |.  68 E6824000 PUSH Christma.004082E6                ; |Destination = Christma.004082E6
004021FD  |.  E8 C20C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
00402202  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
00402204  |.  68 26834000 PUSH Christma.00408326                ; |Destination = Christma.00408326
00402209  |.  E8 B60C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
0040220E  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
00402210  |.  68 47834000 PUSH Christma.00408347                ; |Destination = Christma.00408347
00402215  |.  E8 AA0C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
0040221A  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
0040221C  |.  68 68834000 PUSH Christma.00408368                ; |Destination = Christma.00408368
00402221  |.  E8 9E0C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
00402226  |.  6A 40       PUSH 40                               ; /Length = 40 (64.)
00402228  |.  68 26824000 PUSH Christma.00408226                ; |Destination = Christma.00408226
0040222D  |.  E8 920C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
00402232  |.  6A 27       PUSH 27                               ; /Length = 27 (39.)
00402234  |.  68 A4894000 PUSH Christma.004089A4                ; |Destination = Christma.004089A4
00402239  |.  E8 860C0000 CALL <Christma.RtlZeroMemory>       ; \RtlZeroMemory
0040223E  |.  EB 00       JMP SHORT Christma.00402240
00402240  |>  5F          POP EDI
00402241  |.  5E          POP ESI
00402242  |.  5B          POP EBX
00402243  |.  C9          LEAVE
00402244  \.  C2 0400    RETN 4

------------------------CALL Christma.00401AD2-------------------------
00401AD2  /$  55          PUSH EBP                      ;  KeyFile文件的生成及内容算法
00401AD3  |.  8BEC       MOV EBP,ESP
00401AD5  |.  83C4 FC    ADD ESP,-4
00401AD8  |.  53          PUSH EBX
00401AD9  |.  56          PUSH ESI
00401ADA  |.  57          PUSH EDI
00401ADB  |.  6A 00       PUSH 0                         ; /hTemplateFile = NULL
00401ADD  |.  6A 00       PUSH 0                         ; |Attributes = 0
00401ADF  |.  6A 03       PUSH 3                         ; |Mode = OPEN_EXISTING
00401AE1  |.  6A 00       PUSH 0                         ; |pSecurity = NULL
00401AE3  |.  6A 01       PUSH 1                         ; |ShareMode = FILE_SHARE_READ
00401AE5  |.  68 00000080 PUSH 80000000                ; |Access = GENERIC_READ
00401AEA  |.  68 73844000 PUSH Christma.00408473       ; |merryREchristmas
00401AEF  |.  E8 9A130000 CALL <Christma.CreateFileA>    ; \CreateFileA
00401AF4  |.  83F8 FF    CMP EAX,-1                   ;  创建名为merryREchristmas这样一个文件
00401AF7  |.  75 05       JNZ SHORT Christma.00401AFE
00401AF9  |.  E9 A4020000 JMP Christma.00401DA2
00401AFE  |>  6A 00       PUSH 0                         ; /pOverlapped = NULL
00401B00  |.  68 CB844000 PUSH Christma.004084CB       ; |pBytesRead = Christma.004084CB
00401B05  |.  6A 46       PUSH 46                      ; |BytesToRead = 46 (70.)
00401B07  |.  68 84844000 PUSH Christma.00408484       ; |Buffer = Christma.00408484
00401B0C  |.  50          PUSH EAX                      ; |hFile
00401B0D  |.  E8 AC130000 CALL <Christma.ReadFile>       ; \ReadFile
00401B12  |.  85C0       TEST EAX,EAX                   ;  读出文件内容
00401B14  |.  75 05       JNZ SHORT Christma.00401B1B
00401B16  |.  E9 87020000 JMP Christma.00401DA2
00401B1B  |>  A1 84844000 MOV EAX,DWORD PTR DS:[408484]
00401B20  |.  A3 F0844000 MOV DWORD PTR DS:[4084F0],EAX
00401B25  |.  C605 F3844000>MOV BYTE PTR DS:[4084F3],0
00401B2C  |.  B8 03000000 MOV EAX,3                      ;  这几行应该是想取前3个字符
00401B31  |.  68 A4894000 PUSH Christma.004089A4       ; /Arg3 = 004089A4
00401B36  |.  50          PUSH EAX                      ; |Arg2 => 00000003
00401B37  |.  68 F0844000 PUSH Christma.004084F0       ; |Arg1 = 004084F0
00401B3C  |.  E8 BFF4FFFF CALL Christma.00401000       ; \前3个字符标准的MD5计算
00401B41  |.  FF35 B0894000 PUSH DWORD PTR DS:[4089B0]    ; /<%.8x> = 71EB1925
00401B47  |.  FF35 AC894000 PUSH DWORD PTR DS:[4089AC]    ; |<%.8x> = 352217E7
00401B4D  |.  FF35 A8894000 PUSH DWORD PTR DS:[4089A8]    ; |<%.8x> = 737A9385
00401B53  |.  FF35 A4894000 PUSH DWORD PTR DS:[4089A4]    ; |<%.8x> = 84CC9A91
00401B59  |.  68 53804000 PUSH Christma.00408053       ; |%.8x%.8x%.8x%.8x
00401B5E  |.  68 26834000 PUSH Christma.00408326       ; |s = Christma.00408326
00401B63  |.  E8 84120000 CALL <Christma.wsprintfA>    ; \wsprintfA
00401B68  |.  83C4 18    ADD ESP,18
00401B6B  |.  68 CF844000 PUSH Christma.004084CF       ; /3c6e0b8a9c15224a8228b9a98ca1531d
00401B70  |.  68 26834000 PUSH Christma.00408326       ; |String1 = "582C72D779E7F9B"
00401B75  |.  E8 56130000 CALL <Christma.lstrcmpA>       ; \lstrcmpA
00401B7A  |.  74 05       JE SHORT Christma.00401B81    ;  前3个字符标准的MD5计算与3c6e0b8a9c15224a8228b9a98ca1531d是否相等
00401B7C  |.  E9 21020000 JMP Christma.00401DA2          ;  根据3c6e0b8a9c15224a8228b9a98ca1531d用MD5Crack V3.0很快计算出为key
00401B81  |>  803D 87844000>CMP BYTE PTR DS:[408487],0    ;  判断merryREchristmas文件的第4位HEX码是否为0
00401B88  |.  0F85 14020000 JNZ Christma.00401DA2
00401B8E  |.  803D 88844000>CMP BYTE PTR DS:[408488],0    ;  判断merryREchristmas文件的第5位HEX码是否为0
00401B95  |.  0F85 07020000 JNZ Christma.00401DA2
00401B9B  |.  803D 99844000>CMP BYTE PTR DS:[408499],0    ;  判断merryREchristmas文件的第22位HEX码是否为0
00401BA2  |.  0F85 FA010000 JNZ Christma.00401DA2
00401BA8  |.  803D 9A844000>CMP BYTE PTR DS:[40849A],0    ;  判断merryREchristmas文件的第23位HEX码是否为0
00401BAF  |.  0F85 ED010000 JNZ Christma.00401DA2
00401BB5  |.  803D AB844000>CMP BYTE PTR DS:[4084AB],0    ;  判断merryREchristmas文件的第40位HEX码是否为0
00401BBC  |.  0F85 E0010000 JNZ Christma.00401DA2
00401BC2  |.  803D AC844000>CMP BYTE PTR DS:[4084AC],0    ;  判断merryREchristmas文件的第41位HEX码是否为0
00401BC9  |.  0F85 D3010000 JNZ Christma.00401DA2
00401BCF  |.  803D BD844000>CMP BYTE PTR DS:[4084BD],0    ;  判断merryREchristmas文件的第58位HEX码是否为0
00401BD6  |.  0F85 C6010000 JNZ Christma.00401DA2
00401BDC  |.  803D BE844000>CMP BYTE PTR DS:[4084BE],0    ;  判断merryREchristmas文件的第59位HEX码是否为0
00401BE3  |.  0F85 B9010000 JNZ Christma.00401DA2
00401BE9  |.  68 89844000 PUSH Christma.00408489       ; /String = "C2D6D2FFA7BA10D9"
00401BEE  |.  E8 E3120000 CALL <Christma.lstrlenA>       ; \lstrlenA
00401BF3  |.  8945 FC    MOV DWORD PTR SS:[EBP-4],EAX
00401BF6  |.  BE 89844000 MOV ESI,Christma.00408489    ;  ASCII "C2D6D2FFA7BA10D9"
00401BFB  |.  BF E6804000 MOV EDI,Christma.004080E6    ;  ASCII "OTU2QTRBNkU5NzcyNTFEMQ=="
00401C00  |>  33C0       /XOR EAX,EAX
00401C02  |.  837D FC 01 |CMP DWORD PTR SS:[EBP-4],1
00401C06  |.  75 10       |JNZ SHORT Christma.00401C18
00401C08  |.  AC          |LODS BYTE PTR DS:[ESI]
00401C09  |.  B9 02000000 |MOV ECX,2
00401C0E  |.  BA 3D3D0000 |MOV EDX,3D3D
00401C13  |.  FF4D FC    |DEC DWORD PTR SS:[EBP-4]
00401C16  |.  EB 25       |JMP SHORT Christma.00401C3D
00401C18  |>  837D FC 02 |CMP DWORD PTR SS:[EBP-4],2
00401C1C  |.  75 12       |JNZ SHORT Christma.00401C30
00401C1E  |.  66:AD       |LODS WORD PTR DS:[ESI]
00401C20  |.  B9 03000000 |MOV ECX,3
00401C25  |.  BA 3D000000 |MOV EDX,3D
00401C2A  |.  836D FC 02 |SUB DWORD PTR SS:[EBP-4],2
00401C2E  |.  EB 0D       |JMP SHORT Christma.00401C3D
00401C30  |>  AD          |LODS DWORD PTR DS:[ESI]
00401C31  |.  B9 04000000 |MOV ECX,4
00401C36  |.  33D2       |XOR EDX,EDX
00401C38  |.  4E          |DEC ESI
00401C39  |.  836D FC 03 |SUB DWORD PTR SS:[EBP-4],3
00401C3D  |>  86C4       |XCHG AH,AL
00401C3F  |.  C1C0 10    |ROL EAX,10
00401C42  |.  86C4       |XCHG AH,AL
00401C44  |>  50          |/PUSH EAX
00401C45  |.  25 000000FC ||AND EAX,FC000000
00401C4A  |.  C1C0 06    ||ROL EAX,6
00401C4D  |.  8A80 64804000 ||MOV AL,BYTE PTR DS:[EAX+40806>
00401C53  |.  AA          ||STOS BYTE PTR ES:[EDI]
00401C54  |.  58          ||POP EAX
00401C55  |.  C1E0 06    ||SHL EAX,6
00401C58  |.  49          ||DEC ECX
00401C59  |.^ 75 E9       |\JNZ SHORT Christma.00401C44
00401C5B  |.  837D FC 00 |CMP DWORD PTR SS:[EBP-4],0
00401C5F  |.^ 75 9F       \JNZ SHORT Christma.00401C00
00401C61  |.  8BC2       MOV EAX,EDX                   ;  取merryREchristmas文件的第6位到第21位字符串并计算出它的BASE64
00401C63  |.  AB          STOS DWORD PTR ES:[EDI]
00401C64  |.  68 28844000 PUSH Christma.00408428       ; /QzJENkQyRkZBN0JBMTBEOQ==
00401C69  |.  68 E6804000 PUSH Christma.004080E6       ; |String1 = "OTU2QTRBNkU5NzcyNTFEMQ=="
00401C6E  |.  E8 5D120000 CALL <Christma.lstrcmpA>       ; \lstrcmpA
00401C73  |.  74 05       JE SHORT Christma.00401C7A    ;  判断上面计算的值是否等于QzJENkQyRkZBN0JBMTBEOQ==
00401C75  |.  E9 28010000 JMP Christma.00401DA2
00401C7A  |>  68 9B844000 PUSH Christma.0040849B       ; /String = "DC8058C0540D1B89"
00401C7F  |.  E8 52120000 CALL <Christma.lstrlenA>       ; \lstrlenA
00401C84  |.  8945 FC    MOV DWORD PTR SS:[EBP-4],EAX
00401C87  |.  BE 9B844000 MOV ESI,Christma.0040849B    ;  ASCII "DC8058C0540D1B89"
00401C8C  |.  BF E6804000 MOV EDI,Christma.004080E6    ;  ASCII "OTU2QTRBNkU5NzcyNTFEMQ=="
00401C91  |>  33C0       /XOR EAX,EAX
00401C93  |.  837D FC 01 |CMP DWORD PTR SS:[EBP-4],1
00401C97  |.  75 10       |JNZ SHORT Christma.00401CA9
00401C99  |.  AC          |LODS BYTE PTR DS:[ESI]
00401C9A  |.  B9 02000000 |MOV ECX,2
00401C9F  |.  BA 3D3D0000 |MOV EDX,3D3D
00401CA4  |.  FF4D FC    |DEC DWORD PTR SS:[EBP-4]
00401CA7  |.  EB 25       |JMP SHORT Christma.00401CCE
00401CA9  |>  837D FC 02 |CMP DWORD PTR SS:[EBP-4],2
00401CAD  |.  75 12       |JNZ SHORT Christma.00401CC1
00401CAF  |.  66:AD       |LODS WORD PTR DS:[ESI]
00401CB1  |.  B9 03000000 |MOV ECX,3
00401CB6  |.  BA 3D000000 |MOV EDX,3D
00401CBB  |.  836D FC 02 |SUB DWORD PTR SS:[EBP-4],2
00401CBF  |.  EB 0D       |JMP SHORT Christma.00401CCE
00401CC1  |>  AD          |LODS DWORD PTR DS:[ESI]
00401CC2  |.  B9 04000000 |MOV ECX,4
00401CC7  |.  33D2       |XOR EDX,EDX
00401CC9  |.  4E          |DEC ESI
00401CCA  |.  836D FC 03 |SUB DWORD PTR SS:[EBP-4],3
00401CCE  |>  86C4       |XCHG AH,AL
00401CD0  |.  C1C0 10    |ROL EAX,10
00401CD3  |.  86C4       |XCHG AH,AL
00401CD5  |>  50          |/PUSH EAX
00401CD6  |.  25 000000FC ||AND EAX,FC000000
00401CDB  |.  C1C0 06    ||ROL EAX,6
00401CDE  |.  8A80 64804000 ||MOV AL,BYTE PTR DS:[EAX+40806>
00401CE4  |.  AA          ||STOS BYTE PTR ES:[EDI]
00401CE5  |.  58          ||POP EAX
00401CE6  |.  C1E0 06    ||SHL EAX,6
00401CE9  |.  49          ||DEC ECX
00401CEA  |.^ 75 E9       |\JNZ SHORT Christma.00401CD5
00401CEC  |.  837D FC 00 |CMP DWORD PTR SS:[EBP-4],0
00401CF0  |.^ 75 9F       \JNZ SHORT Christma.00401C91
00401CF2  |.  8BC2       MOV EAX,EDX                   ;  取merryREchristmas文件的第24位到第39位字符串并计算出它的BASE64
00401CF4  |.  AB          STOS DWORD PTR ES:[EDI]
00401CF5  |.  68 41844000 PUSH Christma.00408441       ; /REM4MDU4QzA1NDBEMUI4OQ==
00401CFA  |.  68 E6804000 PUSH Christma.004080E6       ; |String1 = "OTU2QTRBNkU5NzcyNTFEMQ=="
00401CFF  |.  E8 CC110000 CALL <Christma.lstrcmpA>       ; \lstrcmpA
00401D04  |.  74 05       JE SHORT Christma.00401D0B    ;  判断上面计算的值是否等于REM4MDU4QzA1NDBEMUI4OQ==
00401D06  |.  E9 97000000 JMP Christma.00401DA2
00401D0B  |>  68 AD844000 PUSH Christma.004084AD       ; /String = "956A4A6E977251D1"
00401D10  |.  E8 C1110000 CALL <Christma.lstrlenA>       ; \lstrlenA
00401D15  |.  8945 FC    MOV DWORD PTR SS:[EBP-4],EAX
00401D18  |.  BE AD844000 MOV ESI,Christma.004084AD    ;  ASCII "956A4A6E977251D1"
00401D1D  |.  BF E6804000 MOV EDI,Christma.004080E6    ;  ASCII "OTU2QTRBNkU5NzcyNTFEMQ=="
00401D22  |>  33C0       /XOR EAX,EAX
00401D24  |.  837D FC 01 |CMP DWORD PTR SS:[EBP-4],1
00401D28  |.  75 10       |JNZ SHORT Christma.00401D3A
00401D2A  |.  AC          |LODS BYTE PTR DS:[ESI]
00401D2B  |.  B9 02000000 |MOV ECX,2
00401D30  |.  BA 3D3D0000 |MOV EDX,3D3D
00401D35  |.  FF4D FC    |DEC DWORD PTR SS:[EBP-4]
00401D38  |.  EB 25       |JMP SHORT Christma.00401D5F
00401D3A  |>  837D FC 02 |CMP DWORD PTR SS:[EBP-4],2
00401D3E  |.  75 12       |JNZ SHORT Christma.00401D52
00401D40  |.  66:AD       |LODS WORD PTR DS:[ESI]
00401D42  |.  B9 03000000 |MOV ECX,3
00401D47  |.  BA 3D000000 |MOV EDX,3D
00401D4C  |.  836D FC 02 |SUB DWORD PTR SS:[EBP-4],2
00401D50  |.  EB 0D       |JMP SHORT Christma.00401D5F
00401D52  |>  AD          |LODS DWORD PTR DS:[ESI]
00401D53  |.  B9 04000000 |MOV ECX,4
00401D58  |.  33D2       |XOR EDX,EDX
00401D5A  |.  4E          |DEC ESI
00401D5B  |.  836D FC 03 |SUB DWORD PTR SS:[EBP-4],3
00401D5F  |>  86C4       |XCHG AH,AL
00401D61  |.  C1C0 10    |ROL EAX,10
00401D64  |.  86C4       |XCHG AH,AL
00401D66  |>  50          |/PUSH EAX
00401D67  |.  25 000000FC ||AND EAX,FC000000
00401D6C  |.  C1C0 06    ||ROL EAX,6
00401D6F  |.  8A80 64804000 ||MOV AL,BYTE PTR DS:[EAX+40806>
00401D75  |.  AA          ||STOS BYTE PTR ES:[EDI]
00401D76  |.  58          ||POP EAX
00401D77  |.  C1E0 06    ||SHL EAX,6
00401D7A  |.  49          ||DEC ECX
00401D7B  |.^ 75 E9       |\JNZ SHORT Christma.00401D66
00401D7D  |.  837D FC 00 |CMP DWORD PTR SS:[EBP-4],0
00401D81  |.^ 75 9F       \JNZ SHORT Christma.00401D22
00401D83  |.  8BC2       MOV EAX,EDX                   ;  取merryREchristmas文件的第42位到第57位字符串并计算出它的BASE64
00401D85  |.  AB          STOS DWORD PTR ES:[EDI]
00401D86  |.  68 5A844000 PUSH Christma.0040845A       ; /OTU2QTRBNkU5NzcyNTFEMQ==
00401D8B  |.  68 E6804000 PUSH Christma.004080E6       ; |String1 = "OTU2QTRBNkU5NzcyNTFEMQ=="
00401D90  |.  E8 3B110000 CALL <Christma.lstrcmpA>       ; \lstrcmpA
00401D95  |.  74 02       JE SHORT Christma.00401D99    ;  判断上面计算的值是否等于OTU2QTRBNkU5NzcyNTFEMQ==
00401D97  |.  EB 09       JMP SHORT Christma.00401DA2
00401D99  |>  B0 01       MOV AL,1
00401D9B  |.  5F          POP EDI
00401D9C  |.  5E          POP ESI
00401D9D  |.  5B          POP EBX
00401D9E  |.  C9          LEAVE
00401D9F  |.  C2 0400    RETN 4
00401DA2  |>  B0 00       MOV AL,0
00401DA4  |.  5F          POP EDI
00401DA5  |.  5E          POP ESI
00401DA6  |.  5B          POP EBX
00401DA7  |.  C9          LEAVE
00401DA8  \.  C2 0400    RETN 4

进入CALL Christma.00401000之后很快就会找到，MD5的四个标准常数
00401054  |.  C706 01234567 MOV DWORD PTR DS:[ESI],67452301
0040105A  |.  C746 04 89ABC>MOV DWORD PTR DS:[ESI+4],EFCDAB89
00401061  |.  C746 08 FEDCB>MOV DWORD PTR DS:[ESI+8],98BADCFE
00401068  |.  C746 0C 76543>MOV DWORD PTR DS:[ESI+C],10325476
----------------------------------------------------------------------------------------------

第1个SN1的RSA计算
------------------CALL Christma.00402247------------------
00402247  /$  55          PUSH EBP
00402248  |.  8BEC       MOV EBP,ESP
0040224A  |.  83C4 F0    ADD ESP,-10
0040224D  |.  60          PUSHAD
0040224E  |.  6A 00       PUSH 0
00402250  |.  E8 DB0C0000 CALL <Christma.__BigCreate@4>
00402255  |.  8945 F0    MOV DWORD PTR SS:[EBP-10],EAX
00402258  |.  6A 00       PUSH 0
0040225A  |.  E8 D10C0000 CALL <Christma.__BigCreate@4>
0040225F  |.  8945 FC    MOV DWORD PTR SS:[EBP-4],EAX
00402262  |.  6A 00       PUSH 0
00402264  |.  E8 C70C0000 CALL <Christma.__BigCreate@4>
00402269  |.  8945 F8    MOV DWORD PTR SS:[EBP-8],EAX
0040226C  |.  6A 00       PUSH 0
0040226E  |.  E8 BD0C0000 CALL <Christma.__BigCreate@4>
00402273  |.  8945 F4    MOV DWORD PTR SS:[EBP-C],EAX
00402276  |.  FF75 F0    PUSH DWORD PTR SS:[EBP-10]          ; /Arg3
00402279  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
0040227B  |.  68 E6814000 PUSH Christma.004081E6                ; |Invalid registration informations.
00402280  |.  E8 4E0E0000 CALL <Christma.__BigIn@12>          ; \Christma.004030D3
00402285  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]             ; /Arg3
00402288  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
0040228A  |.  68 89844000 PUSH Christma.00408489                ; |Arg1 = 00408489 N="C2D6D2FFA7BA10D9"
0040228F  |.  E8 3F0E0000 CALL <Christma.__BigIn@12>          ; \Christma.004030D3
00402294  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]             ; /Arg3
00402297  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
00402299  |.  68 DE834000 PUSH Christma.004083DE                ; |E="10001"
0040229E  |.  E8 300E0000 CALL <Christma.__BigIn@12>          ; \Christma.004030D3
004022A3  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]
004022A6  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]
004022A9  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]
004022AC  |.  FF75 F0    PUSH DWORD PTR SS:[EBP-10]
004022AF  |.  E8 301C0000 CALL <Christma.__BigPowMod@16>
004022B4  |.  68 66824000 PUSH Christma.00408266                ; /Arg3 = 00408266 ASCII "582C72D779E7F9B"
004022B9  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
004022BB  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]             ; |Arg1
004022BE  |.  E8 F2100000 CALL <Christma.__BigOut@12>          ; \Christma.004033B5
004022C3  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]
004022C6  |.  E8 920C0000 CALL <Christma.__BigDestroy@4>
004022CB  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]
004022CE  |.  E8 8A0C0000 CALL <Christma.__BigDestroy@4>
004022D3  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]
004022D6  |.  E8 820C0000 CALL <Christma.__BigDestroy@4>
004022DB  |.  FF75 F0    PUSH DWORD PTR SS:[EBP-10]
004022DE  |.  E8 7A0C0000 CALL <Christma.__BigDestroy@4>
004022E3  |.  61          POPAD
004022E4  |.  C9          LEAVE
004022E5  \.  C3          RETN
P=E3A6B0C3
Q=DB1A1E33
N=C2D6D2FFA7BA10D9
D=E1FE2B5D380D65D
E=10001

第2个RSA计算
------------------CALL Christma.00402385------------------
00402385  /$  55          PUSH EBP
00402386  |.  8BEC       MOV EBP,ESP
00402388  |.  83C4 F0    ADD ESP,-10
0040238B  |.  60          PUSHAD
0040238C  |.  6A 00       PUSH 0
0040238E  |.  E8 9D0B0000 CALL <Christma.__BigCreate@4>
00402393  |.  8945 F0    MOV DWORD PTR SS:[EBP-10],EAX
00402396  |.  6A 00       PUSH 0
00402398  |.  E8 930B0000 CALL <Christma.__BigCreate@4>
0040239D  |.  8945 FC    MOV DWORD PTR SS:[EBP-4],EAX
004023A0  |.  6A 00       PUSH 0
004023A2  |.  E8 890B0000 CALL <Christma.__BigCreate@4>
004023A7  |.  8945 F8    MOV DWORD PTR SS:[EBP-8],EAX
004023AA  |.  6A 00       PUSH 0
004023AC  |.  E8 7F0B0000 CALL <Christma.__BigCreate@4>
004023B1  |.  8945 F4    MOV DWORD PTR SS:[EBP-C],EAX
004023B4  |.  A1 8F834000 MOV EAX,DWORD PTR DS:[40838F]
004023B9  |.  83C0 01    ADD EAX,1
004023BC  |.  FF75 F0    PUSH DWORD PTR SS:[EBP-10]          ; /Arg3
004023BF  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
004023C1  |.  50          PUSH EAX                            ; |Arg1
004023C2  |.  E8 0C0D0000 CALL <Christma.__BigIn@12>          ; \Christma.004030D3
004023C7  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]             ; /Arg3
004023CA  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
004023CC  |.  68 9B844000 PUSH Christma.0040849B                ; |Arg1 = 0040849B N="DC8058C0540D1B89"
004023D1  |.  E8 FD0C0000 CALL <Christma.__BigIn@12>          ; \Christma.004030D3
004023D6  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]             ; /Arg3
004023D9  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
004023DB  |.  68 DE834000 PUSH Christma.004083DE                ; |E="10001"
004023E0  |.  E8 EE0C0000 CALL <Christma.__BigIn@12>          ; \Christma.004030D3
004023E5  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]
004023E8  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]
004023EB  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]
004023EE  |.  FF75 F0    PUSH DWORD PTR SS:[EBP-10]
004023F1  |.  E8 EE1A0000 CALL <Christma.__BigPowMod@16>
004023F6  |.  68 A6824000 PUSH Christma.004082A6                ; /Arg3 = 004082A6 ASCII "81393C93EE1717E"
004023FB  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
004023FD  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]             ; |Arg1
00402400  |.  E8 B00F0000 CALL <Christma.__BigOut@12>          ; \Christma.004033B5
00402405  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]
00402408  |.  E8 500B0000 CALL <Christma.__BigDestroy@4>
0040240D  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]
00402410  |.  E8 480B0000 CALL <Christma.__BigDestroy@4>
00402415  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]
00402418  |.  E8 400B0000 CALL <Christma.__BigDestroy@4>
0040241D  |.  FF75 F0    PUSH DWORD PTR SS:[EBP-10]
00402420  |.  E8 380B0000 CALL <Christma.__BigDestroy@4>
00402425  |.  61          POPAD
00402426  |.  C9          LEAVE
00402427  \.  C3          RETN
P=E96E7F93
Q=F1D1D1F3
N=DC8058C0540D1B89
D=9678D396AFB2F8CD
E=10001

第3个RSA计算
------------------CALL Christma.004024C7------------------
004024C7  /$  55          PUSH EBP
004024C8  |.  8BEC       MOV EBP,ESP
004024CA  |.  83C4 F0    ADD ESP,-10
004024CD  |.  60          PUSHAD
004024CE  |.  6A 00       PUSH 0
004024D0  |.  E8 5B0A0000 CALL <Christma.__BigCreate@4>
004024D5  |.  8945 F0    MOV DWORD PTR SS:[EBP-10],EAX
004024D8  |.  6A 00       PUSH 0
004024DA  |.  E8 510A0000 CALL <Christma.__BigCreate@4>
004024DF  |.  8945 FC    MOV DWORD PTR SS:[EBP-4],EAX
004024E2  |.  6A 00       PUSH 0
004024E4  |.  E8 470A0000 CALL <Christma.__BigCreate@4>
004024E9  |.  8945 F8    MOV DWORD PTR SS:[EBP-8],EAX
004024EC  |.  6A 00       PUSH 0
004024EE  |.  E8 3D0A0000 CALL <Christma.__BigCreate@4>
004024F3  |.  8945 F4    MOV DWORD PTR SS:[EBP-C],EAX
004024F6  |.  A1 94834000 MOV EAX,DWORD PTR DS:[408394]
004024FB  |.  83C0 01    ADD EAX,1
004024FE  |.  FF75 F0    PUSH DWORD PTR SS:[EBP-10]          ; /Arg3
00402501  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
00402503  |.  50          PUSH EAX                            ; |Arg1
00402504  |.  E8 CA0B0000 CALL <Christma.__BigIn@12>          ; \Christma.004030D3
00402509  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]             ; /Arg3
0040250C  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
0040250E  |.  68 AD844000 PUSH Christma.004084AD                ; |Arg1 = 004084AD N="956A4A6E977251D1"
00402513  |.  E8 BB0B0000 CALL <Christma.__BigIn@12>          ; \Christma.004030D3
00402518  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]             ; /Arg3
0040251B  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
0040251D  |.  68 DE834000 PUSH Christma.004083DE                ; |E="10001"
00402522  |.  E8 AC0B0000 CALL <Christma.__BigIn@12>          ; \Christma.004030D3
00402527  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]
0040252A  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]
0040252D  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]
00402530  |.  FF75 F0    PUSH DWORD PTR SS:[EBP-10]
00402533  |.  E8 AC190000 CALL <Christma.__BigPowMod@16>
00402538  |.  68 E6824000 PUSH Christma.004082E6                ; /Arg3 = 004082E6 ASCII "CDC180E6C4ECD06"
0040253D  |.  6A 10       PUSH 10                               ; |Arg2 = 00000010
0040253F  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]             ; |Arg1
00402542  |.  E8 6E0E0000 CALL <Christma.__BigOut@12>          ; \Christma.004033B5
00402547  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]
0040254A  |.  E8 0E0A0000 CALL <Christma.__BigDestroy@4>
0040254F  |.  FF75 F8    PUSH DWORD PTR SS:[EBP-8]
00402552  |.  E8 060A0000 CALL <Christma.__BigDestroy@4>
00402557  |.  FF75 F4    PUSH DWORD PTR SS:[EBP-C]
0040255A  |.  E8 FE090000 CALL <Christma.__BigDestroy@4>
0040255F  |.  FF75 F0    PUSH DWORD PTR SS:[EBP-10]
00402562  |.  E8 F6090000 CALL <Christma.__BigDestroy@4>
00402567  |.  61          POPAD
00402568  |.  C9          LEAVE
00402569  \.  C3          RETN
P=A3074563
Q=EA9F9C3B
N=956A4A6E977251D1
D=6C668806A1B389FD
E=10001

RSA用到的三个N，就是merryREchristmas内的三个数也就是：
QzJENkQyRkZBN0JBMTBEOQ== 这个解密之后为 C2D6D2FFA7BA10D9
REM4MDU4QzA1NDBEMUI4OQ== 这个解密之后为 DC8058C0540D1B89
OTU2QTRBNkU5NzcyNTFEMQ== 这个解密之后为 956A4A6E977251D1
----------------------------------------------------------------------------------------------
【破解总结】
1、建立merryREchristmas文件及内容。
2、第1个RSA(MD5(Name)并转换为大写取前15位)=SN1
3、第2个RSA(MD5(Group)并转换为大写取前15位)=SN2
4、第3个RSA(MD5(E-Mail)并转换为大写取前15位)=SN3
5、组合为：SN1-SN2-SN3

----------------------------------------------------------------------------------------------
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享:)

【版权声明】本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
----------------------------------------------------------------------------------------------
                                                                              文章写于2007-1-27 23:20:12

登录后可查看完整内容

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

上传的附件：

merryrechristmas.rar （0.13kb，8次下载）

收藏・0

免费・7

支持

最新回复 (9)
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 2 楼好长，厉害 2007-1-27 23:38 0
紫色缘雪币： 253 活跃值： (25) 能力值： ( LV9，RANK：290 ) 在线值：发帖 12 回帖 384 粉丝 0 关注私信	紫色缘 7 3 楼牛人一个支持 2007-1-28 00:21 0
坚持到底雪币： 538 活跃值： (460) 能力值： ( LV9，RANK：290 ) 在线值：发帖 12 回帖 245 粉丝 2 关注私信	坚持到底 7 4 楼支持，太强了！ 2007-1-28 14:36 0
windtrace 雪币： 4441 活跃值： (805) 能力值： ( LV3，RANK：30 ) 在线值：发帖 15 回帖 266 粉丝 0 关注私信	windtrace 5 楼支持一下,菜鸟眩晕中 2007-1-31 14:44 0
happytown 雪币： 721 活跃值： (350) 能力值： ( LV9，RANK：1250 ) 在线值：发帖 132 回帖 1022 粉丝 1 关注私信	happytown 31 6 楼请上传原crackme文件 2007-1-31 15:41 0
hbqjxhw 雪币： 313 活跃值： (250) 能力值： ( LV9，RANK：650 ) 在线值：发帖 44 回帖 311 粉丝 0 关注私信	hbqjxhw 16 7 楼最初由 happytown* 发布* 请上传原crackme文件上传的附件： christmas-keygenme.zip （299.07kb，3次下载） 2007-2-2 00:17 0
mingren 雪币： 309 活跃值： (99) 能力值： ( LV4，RANK：50 ) 在线值：发帖 27 回帖 125 粉丝 1 关注私信	mingren 1 8 楼 00401EF2 \|. 0F82 15020000 JB Christma.0040210D 到了这跳指令就跳掉了．Ｆ４想跳过也不行不知道怎么才能到关键ＣＡＬＬ　这里 00401F85 \|> E8 48FBFFFF CALL Christma.00401AD2 ; \关键CALL 2007-2-2 13:26 0
hbqjxhw 雪币： 313 活跃值： (250) 能力值： ( LV9，RANK：650 ) 在线值：发帖 44 回帖 311 粉丝 0 关注私信	hbqjxhw 16 9 楼最初由 mingren* 发布* 00401EF2 \|. 0F82 15020000 JB Christma.0040210D 到了这跳指令就跳掉了．Ｆ４想跳过也不行不知道怎么才能到关键ＣＡＬＬ　这里 00401F85 \|> E8 48FBFFFF CALL Christma.00401AD2 ; \关键CALL 判断Name位数是否大于2 判断Serial位数是否大于2 判断Group位数是否大于2 判断E-Mail位数是否大于6 上面几个判断首先要通过，才能到重要CALL 2007-2-2 13:37 0
mingren 雪币： 309 活跃值： (99) 能力值： ( LV4，RANK：50 ) 在线值：发帖 27 回帖 125 粉丝 1 关注私信	mingren 1 10 楼哦,知道了,原来这样...谢谢 2007-2-3 11:19 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

hbqjxhw

发帖

311

回帖

650

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (9)
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 2 楼好长，厉害 2007-1-27 23:38 0
紫色缘雪币： 253 活跃值： (25) 能力值： ( LV9，RANK：290 ) 在线值：发帖 12 回帖 384 粉丝 0 关注私信	紫色缘 7 3 楼牛人一个支持 2007-1-28 00:21 0
坚持到底雪币： 538 活跃值： (460) 能力值： ( LV9，RANK：290 ) 在线值：发帖 12 回帖 245 粉丝 2 关注私信	坚持到底 7 4 楼支持，太强了！ 2007-1-28 14:36 0
windtrace 雪币： 4441 活跃值： (805) 能力值： ( LV3，RANK：30 ) 在线值：发帖 15 回帖 266 粉丝 0 关注私信	windtrace 5 楼支持一下,菜鸟眩晕中 2007-1-31 14:44 0
happytown 雪币： 721 活跃值： (350) 能力值： ( LV9，RANK：1250 ) 在线值：发帖 132 回帖 1022 粉丝 1 关注私信	happytown 31 6 楼请上传原crackme文件 2007-1-31 15:41 0
hbqjxhw 雪币： 313 活跃值： (250) 能力值： ( LV9，RANK：650 ) 在线值：发帖 44 回帖 311 粉丝 0 关注私信	hbqjxhw 16 7 楼最初由 happytown* 发布* 请上传原crackme文件上传的附件： christmas-keygenme.zip （299.07kb，3次下载） 2007-2-2 00:17 0
mingren 雪币： 309 活跃值： (99) 能力值： ( LV4，RANK：50 ) 在线值：发帖 27 回帖 125 粉丝 1 关注私信	mingren 1 8 楼 00401EF2 \|. 0F82 15020000 JB Christma.0040210D 到了这跳指令就跳掉了．Ｆ４想跳过也不行不知道怎么才能到关键ＣＡＬＬ　这里 00401F85 \|> E8 48FBFFFF CALL Christma.00401AD2 ; \关键CALL 2007-2-2 13:26 0
hbqjxhw 雪币： 313 活跃值： (250) 能力值： ( LV9，RANK：650 ) 在线值：发帖 44 回帖 311 粉丝 0 关注私信	hbqjxhw 16 9 楼最初由 mingren* 发布* 00401EF2 \|. 0F82 15020000 JB Christma.0040210D 到了这跳指令就跳掉了．Ｆ４想跳过也不行不知道怎么才能到关键ＣＡＬＬ　这里 00401F85 \|> E8 48FBFFFF CALL Christma.00401AD2 ; \关键CALL 判断Name位数是否大于2 判断Serial位数是否大于2 判断Group位数是否大于2 判断E-Mail位数是否大于6 上面几个判断首先要通过，才能到重要CALL 2007-2-2 13:37 0
mingren 雪币： 309 活跃值： (99) 能力值： ( LV4，RANK：50 ) 在线值：发帖 27 回帖 125 粉丝 1 关注私信	mingren 1 10 楼哦,知道了,原来这样...谢谢 2007-2-3 11:19 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复