PEID加载后发现用的算法有rc6.心里有底了。断到这里，
004011F0 |. 83FB 03 CMP EBX,3
004011F3 |. 8BE8 MOV EBP,EAX
004011F5 |. 0F8C FE000000 JL CrackMe_.004012F9 ; 用户名长度不能小于3 TEAM长度不能小于2
004011FB |. 83FD 02 CMP EBP,2
004011FE |. 0F8C F5000000 JL CrackMe_.004012F9
00401204 |. 8D9424 480200>LEA EDX,DWORD PTR SS:[ESP+248]
0040120B |. 68 F5010000 PUSH 1F5 ; /Count = 1F5 (501.)
00401210 |. 52 PUSH EDX ; |Buffer
00401211 |. 68 EA030000 PUSH 3EA ; |ControlID = 3EA (1002.)
00401216 |. 56 PUSH ESI ; |hWnd
00401217 |. FFD7 CALL EDI ; \GetDlgItemTextA
00401219 |. 83F8 20 CMP EAX,20 ; 密码长度要等于32
0040121C |. 0F85 D7000000 JNZ CrackMe_.004012F9
00401222 |. 8D8424 3C0400>LEA EAX,DWORD PTR SS:[ESP+43C]
00401229 |. 8D8C24 480200>LEA ECX,DWORD PTR SS:[ESP+248]
00401230 |. 50 PUSH EAX
00401231 |. 6A 20 PUSH 20
00401233 |. 51 PUSH ECX
00401234 |. E8 27020000 CALL CrackMe_.00401460 ; 密码转成hex数
00401239 |. 8D9424 480400>LEA EDX,DWORD PTR SS:[ESP+448]
00401240 |. 6A 10 PUSH 10
00401242 |. 8D8424 580200>LEA EAX,DWORD PTR SS:[ESP+258]
00401249 |. 52 PUSH EDX
0040124A |. 50 PUSH EAX
0040124B |. E8 D0380000 CALL <CrackMe_._strncpy> ; copy假码的HEX串到esp+258
00401250 |. 8D4C24 4C LEA ECX,DWORD PTR SS:[ESP+4C]
00401254 |. 51 PUSH ECX ; HASH初始化
00401255 |. E8 16030000 CALL CrackMe_.00401570
0040125A |. 8D9424 4C0600>LEA EDX,DWORD PTR SS:[ESP+64C]
00401261 |. 53 PUSH EBX
00401262 |. 8D4424 54 LEA EAX,DWORD PTR SS:[ESP+54] ; hash(kyo327)
00401266 |. 52 PUSH EDX
00401267 |. 50 PUSH EAX
00401268 |. E8 43030000 CALL CrackMe_.004015B0
0040126D |. 8D4C24 5C LEA ECX,DWORD PTR SS:[ESP+5C]
00401271 |. 8D5424 38 LEA EDX,DWORD PTR SS:[ESP+38]
00401275 |. 51 PUSH ECX ; hash()final
00401276 |. 52 PUSH EDX
00401277 |. E8 04040000 CALL CrackMe_.00401680
0040127C |. 8D8424 840000>LEA EAX,DWORD PTR SS:[ESP+84]
00401283 |. 55 PUSH EBP ; team长度
00401284 |. 8D8C24 580800>LEA ECX,DWORD PTR SS:[ESP+858]
0040128B |. 50 PUSH EAX ; team
0040128C |. 51 PUSH ECX
0040128D |. E8 BE070000 CALL CrackMe_.00401A50
00401292 |. 8D9424 900000>LEA EDX,DWORD PTR SS:[ESP+90]
00401299 |. 8D4424 4C LEA EAX,DWORD PTR SS:[ESP+4C]
0040129D |. 52 PUSH EDX
0040129E |. 6A 10 PUSH 10
004012A0 |. 8D8C24 680800>LEA ECX,DWORD PTR SS:[ESP+868]
004012A7 |. 50 PUSH EAX
004012A8 |. 51 PUSH ECX
004012A9 |. E8 42080000 CALL CrackMe_.00401AF0
004012AE |. 83C4 4C ADD ESP,4C
004012B1 |. 8D5424 20 LEA EDX,DWORD PTR SS:[ESP+20]
004012B5 |. 6A 10 PUSH 10
004012B7 |. 52 PUSH EDX ; 密钥
004012B8 |. E8 E3080000 CALL CrackMe_.00401BA0 ; rc5/rc6(初始化)
004012BD |. 8D8424 440400>LEA EAX,DWORD PTR SS:[ESP+444]
004012C4 |. 8D8C24 500200>LEA ECX,DWORD PTR SS:[ESP+250]
004012CB |. 50 PUSH EAX
004012CC |. 51 PUSH ECX
004012CD |. E8 CE090000 CALL CrackMe_.00401CA0 ; RC6解密算法
004012D2 |. 8D9424 4C0400>LEA EDX,DWORD PTR SS:[ESP+44C]
004012D9 |. 6A 10 PUSH 10
004012DB |. 8D4424 68 LEA EAX,DWORD PTR SS:[ESP+68]
004012DF |. 52 PUSH EDX
004012E0 |. 50 PUSH EAX
004012E1 |. E8 FA370000 CALL <CrackMe_._strncmp>
004012E6 |. 83C4 1C ADD ESP,1C
004012E9 |. F7D8 NEG EAX
004012EB |. 5F POP EDI
004012EC |. 5E POP ESI
004012ED |. 1BC0 SBB EAX,EAX
004012EF |. 5D POP EBP
004012F0 |. 40 INC EAX
004012F1 |. 5B POP EBX
004012F2 |. 81C4 14090000 ADD ESP,914
004012F8 |. C3 RETN
004012F9 |> 5F POP EDI
004012FA |. 5E POP ESI
004012FB |. 5D POP EBP
004012FC |. 33C0 XOR EAX,EAX
004012FE |. 5B POP EBX
004012FF |. 81C4 14090000 ADD ESP,914
先用用户名kyo327 team:lyz SN：1234567890ABCDEFFEDCBA0987654321测试
可以知道 CALL CrackMe_.00401680是个HASH算法
得到hash(kyo327)=BA D2 21 44 95 24 E5 D8 2E 78 65 CC 7D 6F 6C E9
接下来这个CALL是这样的
call 00401a50(len(team),team,esp+858)=X1
0013F98C 2B 03 62 D1 9C CD 3F 75 E4 C6 20 BE
0013F99C 6E 5E 40 56 87 8F B3 A3 B8 EC 7B 2A 90 22 9D 3D
0013F9AC 66 89 F3 7D 4F C5 78 08 6D 39 74 1B 9F 81 36 82
0013F9BC C2 91 F2 EE 19 A4 B4 16 88 37 AF 5D 93 92 10 05
0013F9CC 1F BB DA 32 44 12 D8 F8 8D 8C AC B9 F5 C7 95 5C
0013F9DC 96 E8 58 04 EA 68 DB 6C C0 DF 38 1C C1 0E 4D 11
0013F9EC A9 59 F9 57 AB 2D 0F 8E 14 A5 D2 49 34 13 F4 5F
0013F9FC 45 71 98 E7 5B 17 B2 99 AA BF F6 6F CB BD 47 52
0013FA0C DE 8B B6 E6 FB 21 AD 26 70 69 0A 33 9B 60 94 C8
0013FA1C FF CA A6 0C E1 FA 77 73 D9 65 83 29 C4 E2 D0 CF
0013FA2C 4E 09 A7 7C 31 E9 50 DD 18 CC A8 C9 24 D4 4B CE
0013FA3C 1E EF 7E E0 8A 4C E5 51 3C 9E 02 3E 6B 0B 79 53
0013FA4C D5 2F B1 D6 6A F0 F1 80 63 D7 AE FC 3B 43 01 35
0013FA5C 97 B0 B5 67 9A A2 7F C3 BA 84 76 FE E3 1A 5A 48
0013FA6C DC D3 46 55 1D 00 28 72 30 B7 2E EB 23 41 F7 85
0013FA7C 7A 06 4A 27 25 61 A1 FD ED 07 54 64 2C BC 86 0D
0013FA8C A0 3A 15 42
这是对team也就是lyz做的一个运算
下面是这个CALL
call 00401af0 (X1,hash(kyo327),10,buffer)=
00 A7 7C D7 72 8A A3 BC 12 15 03 A6 97 55 43 49
把X1和HASH（kyo327）做为参数得到一个HASH串
下面CALL CrackMe_.00401BA0就是RC6的初始化
密钥是：BAC3BAC3D1A7CFB0CCECCCECCFF2C9CF----------好好学习天天向上 (hehe,多谢HAPPYTOWN的鼓励)
初始化完是一个DWORDkey[44]的子密钥
初始化密钥可以看到是0xb7e15163 0x9e3779b9
从这里的几个特征可以证实是RC6算法
CALL CrackMe_.00401CA0 是RC6的解密算法
参数就是输入的假码
而注册成功只要call 00401af0 (X1,hash(kyo327),10,buffer)的HASH串和DE_RC6(sn)相等即可
因此EN_RC6(00A77CD7728AA3BC121503A697554349)就可以得到注册码
即DA71C6FF5D525FAE5794ADD20FF6E85E
所以
用户名为kyo327
team:lyz
sn:DA71C6FF5D525FAE5794ADD20FF6E85E
其实CALL CrackMe_.00401CA0 我看好一会才明白是RC6解密算法 最开始一直认为是加密算法呢。
这是那个解密的代码
00401CA0 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]
00401CA4 |. 83EC 08 SUB ESP,8
00401CA7 |. 8B15 C8FE4000 MOV EDX,DWORD PTR DS:[40FEC8]
00401CAD |. 8B41 08 MOV EAX,DWORD PTR DS:[ECX+8] ; sn2
00401CB0 |. 53 PUSH EBX
00401CB1 |. 55 PUSH EBP
00401CB2 |. 8B69 04 MOV EBP,DWORD PTR DS:[ECX+4] ; sn1
00401CB5 |. 56 PUSH ESI
00401CB6 |. 8B35 CCFE4000 MOV ESI,DWORD PTR DS:[40FECC] ; CrackMe_.00400000
00401CBC |. 57 PUSH EDI
00401CBD |. 8B79 0C MOV EDI,DWORD PTR DS:[ECX+C]
00401CC0 |. 8B09 MOV ECX,DWORD PTR DS:[ECX] ; sn0
00401CC2 |. 2BC6 SUB EAX,ESI ; sn2=sn2-key[0]
00401CC4 |. 2BCA SUB ECX,EDX ; sn0=sn0-key[1]
00401CC6 |. BB C0FE4000 MOV EBX,CrackMe_.0040FEC0
00401CCB |. EB 08 JMP SHORT CrackMe_.00401CD5
00401CCD |> 8B6C24 1C /MOV EBP,DWORD PTR SS:[ESP+1C]
00401CD1 |. 8B4424 10 |MOV EAX,DWORD PTR SS:[ESP+10]
00401CD5 |> 897C24 14 MOV DWORD PTR SS:[ESP+14],EDI
00401CD9 |. 8BF8 |MOV EDI,EAX
00401CDB |. 894C24 1C |MOV DWORD PTR SS:[ESP+1C],ECX
00401CDF |. 83EB 08 |SUB EBX,8
00401CE2 |. 8D443F 01 |LEA EAX,DWORD PTR DS:[EDI+EDI+1]
00401CE6 |. 0FAFC7 |IMUL EAX,EDI ; D2=(sn2*2+1)*sn2
00401CE9 |. 8BD0 |MOV EDX,EAX
00401CEB |. C1EA 1B |SHR EDX,1B
00401CEE |. C1E0 05 |SHL EAX,5
00401CF1 |. 0BD0 |OR EDX,EAX ; 交换D1的前5位和后27位
00401CF3 |. 8D4409 01 |LEA EAX,DWORD PTR DS:[ECX+ECX+1]
00401CF7 |. 0FAFC1 |IMUL EAX,ECX ; D0=(sn0*2+1)*sn0
00401CFA |. 8BF0 |MOV ESI,EAX
00401CFC |. B9 20000000 |MOV ECX,20
00401D01 |. C1EE 1B |SHR ESI,1B
00401D04 |. C1E0 05 |SHL EAX,5
00401D07 |. 0BF0 |OR ESI,EAX ; D0=交换D0的前5位和后27位
00401D09 |. 8BC5 |MOV EAX,EBP
00401D0B |. 8B6B 0C |MOV EBP,DWORD PTR DS:[EBX+C]
00401D0E |. 2BC5 |SUB EAX,EBP ; sn1=sn1-key[2]
00401D10 |. 8BEE |MOV EBP,ESI
00401D12 |. 83E5 1F |AND EBP,1F ; D0的后5位
00401D15 |. 896C24 10 |MOV DWORD PTR SS:[ESP+10],EBP
00401D19 |. 2BCD |SUB ECX,EBP
00401D1B |. 8BE8 |MOV EBP,EAX
00401D1D |. D3E5 |SHL EBP,CL
00401D1F |. 8B4C24 10 |MOV ECX,DWORD PTR SS:[ESP+10]
00401D23 |. D3E8 |SHR EAX,CL
00401D25 |. B9 20000000 |MOV ECX,20
00401D2A |. 0BE8 |OR EBP,EAX
00401D2C |. 8B4424 14 |MOV EAX,DWORD PTR SS:[ESP+14]
00401D30 |. 33EA |XOR EBP,EDX
00401D32 |. 83E2 1F |AND EDX,1F
00401D35 |. 896C24 10 |MOV DWORD PTR SS:[ESP+10],EBP
00401D39 |. 8B6B 08 |MOV EBP,DWORD PTR DS:[EBX+8]
00401D3C |. 2BC5 |SUB EAX,EBP ; sn3-key[3]
00401D3E |. 2BCA |SUB ECX,EDX
00401D40 |. 8BE8 |MOV EBP,EAX
00401D42 |. D3E5 |SHL EBP,CL
00401D44 |. 8BCA |MOV ECX,EDX
00401D46 |. D3E8 |SHR EAX,CL
00401D48 |. 0BE8 |OR EBP,EAX
00401D4A |. 33EE |XOR EBP,ESI
00401D4C |. 81FB 28FE4000 |CMP EBX,CrackMe_.0040FE28
00401D52 |. 8BCD |MOV ECX,EBP
00401D54 |.^ 0F8D 73FFFFFF \JGE CrackMe_.00401CCD
00401D5A |. 8B15 24FE4000 MOV EDX,DWORD PTR DS:[40FE24]
00401D60 |. A1 20FE4000 MOV EAX,DWORD PTR DS:[40FE20]
00401D65 |. 2BFA SUB EDI,EDX
00401D67 |. 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+1C]
00401D6B |. 2BD0 SUB EDX,EAX
00401D6D |. 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+20]
00401D71 |. 8978 0C MOV DWORD PTR DS:[EAX+C],EDI
00401D74 |. 8908 MOV DWORD PTR DS:[EAX],ECX
00401D76 |. 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]
00401D7A |. 5F POP EDI
00401D7B |. 5E POP ESI
00401D7C |. 5D POP EBP
00401D7D |. 8950 04 MOV DWORD PTR DS:[EAX+4],EDX
00401D80 |. 8948 08 MOV DWORD PTR DS:[EAX+8],ECX
00401D83 |. 5B POP EBX
00401D84 |. 83C4 08 ADD ESP,8
00401D87 \. C3 RETN
和加密不同的是
00401CC0 |. 8B09 MOV ECX,DWORD PTR DS:[ECX] ; sn0
00401CC2 |. 2BC6 SUB EAX,ESI ; sn2=sn2-key[0]
00401CC4 |. 2BCA SUB ECX,EDX ; sn0=sn0-key[1]
这两句是个特点
加密的话应该是sn1和sn3的运算 并且SUB要换成ADD。
好了 前面那些HASH算法是不可逆的 要想写注册机就提取里面的汇编代码吧
RC6的加密解密算法 应该GOOGLE可以找到吧
就麻烦哪位大虾来写吧
我可能比较懒 就不写了 。或者说 我根本也写不出来 呵呵
再给出一组注册码吧
用户名：pediy
team:CCG
sn:90F24ECB4E8CF6741C963FCCE7D62E83
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
