[原创]AIMPR算法注册码分析-软件逆向-看雪-安全社区|安全招聘|kanxue.com

[原创]AIMPR算法注册码分析

发表于: 2008-5-24 00:12 7085

[原创]AIMPR算法注册码分析

arryang

2008-5-24 00:12

7085

AIMPR算法注册码分析
AIMPR简介:elcomsoft公司产品,用来恢复保存在本地的多种即时消息的密码，呵呵
说明:水平很差,共享出来只是想和大家交流,高手见笑了

背景: 软件以前有壳的,两年前脱的壳,好像用的什么工具,没有什么技术可谈,略去,附件中是脱过壳的

0041DF80  /$  51          push ecx
0041DF81  |.  53          push ebx
0041DF82  |.  55          push ebp
0041DF83  |.  56          push esi
0041DF84  |.  57          push edi
0041DF85  |.  68 02030000 push 302                                           ; /MemSize = 302 (770.)
0041DF8A  |.  6A 42       push 42                                              ; |Flags = GHND
0041DF8C  |.  FF15 1C914200 call dword ptr [<&kernel32.GlobalAlloc>]             ; \GlobalAlloc
0041DF92  |.  50          push eax                                           ; /hMem
0041DF93  |.  894424 14    mov    dword ptr [esp+14], eax                         ; |
0041DF97  |.  FF15 20914200 call dword ptr [<&kernel32.GlobalLock>]             ; \GlobalLock
0041DF9D  |.  8B7C24 1C    mov    edi, dword ptr [esp+1C]
0041DFA1  |.  8BD0       mov    edx, eax
0041DFA3  |.  83C9 FF    or    ecx, FFFFFFFF
0041DFA6  |.  33C0       xor    eax, eax
0041DFA8  |.  F2:AE       repne scas byte ptr es:[edi]
0041DFAA  |.  F7D1       not    ecx
0041DFAC  |.  2BF9       sub    edi, ecx
0041DFAE  |.  8D9A 00010000 lea    ebx, dword ptr [edx+100]
0041DFB4  |.  8BC1       mov    eax, ecx
0041DFB6  |.  8BF7       mov    esi, edi
0041DFB8  |.  8BFA       mov    edi, edx
0041DFBA  |.  52          push edx                                           ; /lParam
0041DFBB  |.  C1E9 02    shr    ecx, 2                                        ; |
0041DFBE  |.  F3:A5       rep    movs dword ptr es:[edi], dword ptr [esi]       ; |
0041DFC0  |.  8BC8       mov    ecx, eax                                        ; |
0041DFC2  |.  33C0       xor    eax, eax                                        ; |
0041DFC4  |.  83E1 03    and    ecx, 3                                        ; |
0041DFC7  |.  68 80DE4100 push 0041DE80                                        ; |DlgProc = _AIMPR.0041DE80
0041DFCC  |.  F3:A4       rep    movs byte ptr es:[edi], byte ptr [esi]          ; |
0041DFCE  |.  8B7C24 28    mov    edi, dword ptr [esp+28]                         ; |
0041DFD2  |.  83C9 FF    or    ecx, FFFFFFFF                                  ; |
0041DFD5  |.  F2:AE       repne scas byte ptr es:[edi]                         ; |
0041DFD7  |.  F7D1       not    ecx                                           ; |
0041DFD9  |.  2BF9       sub    edi, ecx                                        ; |
0041DFDB  |.  8BC1       mov    eax, ecx                                        ; |
0041DFDD  |.  8BF7       mov    esi, edi                                        ; |
0041DFDF  |.  8BFB       mov    edi, ebx                                        ; |
0041DFE1  |.  8D9A 00020000 lea    ebx, dword ptr [edx+200]                      ; |
0041DFE7  |.  C1E9 02    shr    ecx, 2                                        ; |
0041DFEA  |.  F3:A5       rep    movs dword ptr es:[edi], dword ptr [esi]       ; |
0041DFEC  |.  8BC8       mov    ecx, eax                                        ; |
0041DFEE  |.  33C0       xor    eax, eax                                        ; |
0041DFF0  |.  83E1 03    and    ecx, 3                                        ; |
0041DFF3  |.  F3:A4       rep    movs byte ptr es:[edi], byte ptr [esi]          ; |
0041DFF5  |.  8B7C24 2C    mov    edi, dword ptr [esp+2C]                         ; |
0041DFF9  |.  83C9 FF    or    ecx, FFFFFFFF                                  ; |
0041DFFC  |.  F2:AE       repne scas byte ptr es:[edi]                         ; |
0041DFFE  |.  F7D1       not    ecx                                           ; |
0041E000  |.  2BF9       sub    edi, ecx                                        ; |
0041E002  |.  8BC1       mov    eax, ecx                                        ; |
0041E004  |.  8BF7       mov    esi, edi                                        ; |
0041E006  |.  8BFB       mov    edi, ebx                                        ; |
0041E008  |.  C1E9 02    shr    ecx, 2                                        ; |
0041E00B  |.  F3:A5       rep    movs dword ptr es:[edi], dword ptr [esi]       ; |
0041E00D  |.  8BC8       mov    ecx, eax                                        ; |
0041E00F  |.  83E1 03    and    ecx, 3                                        ; |
0041E012  |.  F3:A4       rep    movs byte ptr es:[edi], byte ptr [esi]          ; |
0041E014  |.  66:8B4C24 30  mov    cx, word ptr [esp+30]                         ; |
0041E019  |.  66:898A 00030>mov    word ptr [edx+300], cx                         ; |弹出密码框
0041E020  |.  8B5424 20    mov    edx, dword ptr [esp+20]                         ; |
0041E024  |.  52          push edx                                           ; |hOwner
0041E025  |.  68 30724300 push 00437230                                        ; |pTemplate = "INPUT"
0041E02A  |.  6A 00       push 0                                              ; |/pModule = NULL
0041E02C  |.  FF15 E8904200 call dword ptr [<&kernel32.GetModuleHandleA>]       ; |\GetModuleHandleA
0041E032  |.  50          push eax                                           ; |hInst
0041E033  |.  FF15 CC924200 call dword ptr [<&user32.DialogBoxParamA>]          ; \DialogBoxParamA
0041E039  |.  8BE8       mov    ebp, eax                                        ;  这里截获输入密码的对话框
0041E03B  |.  83FD 01    cmp    ebp, 1
0041E03E  |.  75 29       jnz    short 0041E069
0041E040  |.  8B5424 24    mov    edx, dword ptr [esp+24]
0041E044  |.  85D2       test edx, edx
0041E046  |.  74 2B       je    short 0041E073
0041E048  |.  8BFB       mov    edi, ebx                                        ;  ebx 获取密码
0041E04A  |.  83C9 FF    or    ecx, FFFFFFFF
0041E04D  |.  33C0       xor    eax, eax
0041E04F  |.  F2:AE       repne scas byte ptr es:[edi]
0041E051  |.  F7D1       not    ecx
0041E053  |.  2BF9       sub    edi, ecx
0041E055  |.  8BC1       mov    eax, ecx
0041E057  |.  8BF7       mov    esi, edi
0041E059  |.  8BFA       mov    edi, edx
0041E05B  |.  C1E9 02    shr    ecx, 2
0041E05E  |.  F3:A5       rep    movs dword ptr es:[edi], dword ptr [esi]
0041E060  |.  8BC8       mov    ecx, eax
0041E062  |.  83E1 03    and    ecx, 3
0041E065  |.  F3:A4       rep    movs byte ptr es:[edi], byte ptr [esi]
0041E067  |.  EB 0A       jmp    short 0041E073
0041E069  |>  83FD FF    cmp    ebp, -1
0041E06C  |.  75 05       jnz    short 0041E073
0041E06E  |.  BD 02000000 mov    ebp, 2
0041E073  |>  8B7424 10    mov    esi, dword ptr [esp+10]
0041E077  |.  56          push esi                                           ; /hMem
0041E078  |.  FF15 18914200 call dword ptr [<&kernel32.GlobalUnlock>]          ; \GlobalUnlock
0041E07E  |.  56          push esi                                           ; /hMem
0041E07F  |.  FF15 28914200 call dword ptr [<&kernel32.GlobalFree>]             ; \GlobalFree
0041E085  |.  5F          pop    edi
0041E086  |.  8BC5       mov    eax, ebp
0041E088  |.  5E          pop    esi
0041E089  |.  5D          pop    ebp
0041E08A  |.  5B          pop    ebx
0041E08B  |.  59          pop    ecx
0041E08C  \.  C3          retn

0041DBF0  /$  83EC 6C    sub    esp, 6C
0041DBF3  |.  83C9 FF    or    ecx, FFFFFFFF
0041DBF6  |.  33C0       xor    eax, eax
0041DBF8  |.  53          push ebx
0041DBF9  |.  55          push ebp
0041DBFA  |.  8B6C24 78    mov    ebp, dword ptr [esp+78]
0041DBFE  |.  57          push edi
0041DBFF  |.  8BFD       mov    edi, ebp
0041DC01  |.  F2:AE       repne scas byte ptr es:[edi]
0041DC03  |.  F7D1       not    ecx
0041DC05  |.  49          dec    ecx
0041DC06  |.  83F9 06    cmp    ecx, 6                                        ;  注册码长度和6比较小于则错
0041DC09  |.  7D 07       jge    short 0041DC12
0041DC0B  |.  5F          pop    edi
0041DC0C  |.  5D          pop    ebp
0041DC0D  |.  5B          pop    ebx
0041DC0E  |.  83C4 6C    add    esp, 6C
0041DC11  |.  C3          retn
0041DC12  |>  81E1 01000080 and    ecx, 80000001                                  ;  注册码位数为奇数则错
0041DC18  |.  79 05       jns    short 0041DC1F
0041DC1A  |.  49          dec    ecx
0041DC1B  |.  83C9 FE    or    ecx, FFFFFFFE
0041DC1E  |.  41          inc    ecx
0041DC1F  |>  74 09       je    short 0041DC2A
0041DC21  |.  5F          pop    edi
0041DC22  |.  5D          pop    ebp
0041DC23  |.  33C0       xor    eax, eax
0041DC25  |.  5B          pop    ebx
0041DC26  |.  83C4 6C    add    esp, 6C
0041DC29  |.  C3          retn
0041DC2A  |>  8BFD       mov    edi, ebp
0041DC2C  |.  83C9 FF    or    ecx, FFFFFFFF
0041DC2F  |.  33C0       xor    eax, eax
0041DC31  |.  56          push esi
0041DC32  |.  F2:AE       repne scas byte ptr es:[edi]
0041DC34  |.  F7D1       not    ecx
0041DC36  |.  49          dec    ecx
0041DC37  |.  8D4424 20    lea    eax, dword ptr [esp+20]
0041DC3B  |.  8BD9       mov    ebx, ecx
0041DC3D  |.  50          push eax
0041DC3E  |.  83C3 04    add    ebx, 4                                        ;  注册码长度加4
0041DC41  |.  D1EB       shr    ebx, 1                                        ;  注册码长度除以2
0041DC43  |.  E8 08ECFFFF call 0041C850                                        ;  md5 初始化
0041DC48  |.  53          push ebx
0041DC49  |.  8D4C24 28    lea    ecx, dword ptr [esp+28]
0041DC4D  |.  55          push ebp
0041DC4E  |.  51          push ecx
0041DC4F  |.  E8 2CECFFFF call 0041C880
0041DC54  |.  8D5424 30    lea    edx, dword ptr [esp+30]
0041DC58  |.  8D4424 20    lea    eax, dword ptr [esp+20]
0041DC5C  |.  52          push edx
0041DC5D  |.  50          push eax
0041DC5E  |.  E8 ADFCFFFF call 0041D910                                        ;  计算 (strlen("helloworld")+4)/2 的md5值
0041DC63  |.  83C4 18    add    esp, 18
0041DC66  |.  B9 04000000 mov    ecx, 4
0041DC6B  |.  BF 68714300 mov    edi, 00437168
0041DC70  |.  8D7424 10    lea    esi, dword ptr [esp+10]
0041DC74  |.  33D2       xor    edx, edx
0041DC76  |.  F3:A7       repe cmps dword ptr es:[edi], dword ptr [esi]       ;  同 437168处的4位值值比较,相等则注册码正确
0041DC78  |.  5E          pop    esi
0041DC79  |.  74 09       je    short 0041DC84
0041DC7B  |.  5F          pop    edi
0041DC7C  |.  5D          pop    ebp
0041DC7D  |.  33C0       xor    eax, eax
0041DC7F  |.  5B          pop    ebx
0041DC80  |.  83C4 6C    add    esp, 6C
0041DC83  |.  C3          retn
0041DC84  |> \8D4424 1C    lea    eax, dword ptr [esp+1C]
0041DC88  |.  50          push eax
0041DC89  |.  E8 C2EBFFFF call 0041C850                ;  奶奶的，又来了，md5_init
0041DC8E  |.  8BFD       mov    edi, ebp
0041DC90  |.  83C9 FF    or    ecx, FFFFFFFF
0041DC93  |.  33C0       xor    eax, eax
0041DC95  |.  F2:AE       repne scas byte ptr es:[edi]
0041DC97  |.  F7D1       not    ecx
0041DC99  |.  49          dec    ecx
0041DC9A  |.  51          push ecx
0041DC9B  |.  8D4C24 24    lea    ecx, dword ptr [esp+24]
0041DC9F  |.  55          push ebp
0041DCA0  |.  51          push ecx
0041DCA1  |.  E8 DAEBFFFF call 0041C880                ;  md5_update，注意，这次是整个注册码
0041DCA6  |.  8D5424 2C    lea    edx, dword ptr [esp+2C]
0041DCAA  |.  8D4424 1C    lea    eax, dword ptr [esp+1C]
0041DCAE  |.  52          push edx
0041DCAF  |.  50          push eax
0041DCB0  |.  E8 5BFCFFFF call 0041D910                ;  md5_Final
0041DCB5  |.  8D4C24 24    lea    ecx, dword ptr [esp+24]
0041DCB9  |.  51          push ecx
0041DCBA  |.  E8 C1FEFFFF call 0041DB80                ;  md5与取自资源的保存值比较（资源类型：RT_RCDATA，DB）
0041DCBF  |.  83C4 1C    add    esp, 1C
0041DCC2  |.  85C0       test eax, eax                ;  一致则认为注册成功
0041DCC4    75 07       jnz    short 0041DCCD
0041DCC6  |.  5F          pop    edi
0041DCC7  |.  5D          pop    ebp
0041DCC8  |.  5B          pop    ebx
0041DCC9  |.  83C4 6C    add    esp, 6C
0041DCCC  |.  C3          retn
0041DCCD  |>  A1 60BE4300 mov    eax, dword ptr [43BE60]
0041DCD2  |.  85C0       test eax, eax
0041DCD4  |.  75 14       jnz    short 0041DCEA
0041DCD6  |.  53          push ebx
0041DCD7  |.  55          push ebp
0041DCD8  |.  E8 03FEFFFF call 0041DAE0
0041DCDD  |.  83C4 08    add    esp, 8
0041DCE0  |.  C705 60BE4300>mov    dword ptr [43BE60], 1
0041DCEA  |>  5F          pop    edi
0041DCEB  |.  5D          pop    ebp
0041DCEC  |.  B8 01000000 mov    eax, 1                   ;  成功
0041DCF1  |.  5B          pop    ebx
0041DCF2  |.  83C4 6C    add    esp, 6C
0041DCF5  \.  C3          retn

软件注册过程:
1.输入注册码
2.比较注册位数是否小于6,小于则直接错误
3.测试注册码位数是否是偶数,不是则直接错误
4.注册码长度加4 除以2, 取注册其长度,如:假注册码为"helloworld", 则取其"hellowo";
5.计算"hellowo"的md5值
6.取内存437168处的值(固定值),同时与"hellowo"md5值比较, 成功则继续,否则失败.
7. 再来一次md5，这次是整个注册码的md5，即"helloworld"
8. 取得(RT_RCdata，DB)资源数据，在此资源数据中寻找第七步计算的md5值，找到则认为注册成功
9. 返回，开启软件所有功能，注册版本可用

比较遗憾的是,我不能找到一个有效的注册码,除非去穷举md5了, 爆破的点有很多处,不过爆破就没啥意思了. 逆向是一个学习的过程，共享出来大家讨论一下也好

顺便请教各位大侠一个问题：它是如何把md5值写入资源的？我对资源一窍不通，还有，象这种注册程序，除了爆破，真的就不能找出有效的注册码吗？
恳请大侠指点。

登录后可查看完整内容

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

#调试逆向

上传的附件：

AIMPR.rar （244.37kb，79次下载）

收藏・1

免费・7

支持

最新回复 (1)
arryang 雪币： 205 活跃值： (171) 能力值： ( LV4，RANK：50 ) 在线值：发帖 100 回帖 264 粉丝 0 关注私信	arryang 1 2 楼谢谢版主的鼓励，竟然加了精，^_^ 2008-5-24 19:13 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

arryang

100

发帖

264

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (1)
arryang 雪币： 205 活跃值： (171) 能力值： ( LV4，RANK：50 ) 在线值：发帖 100 回帖 264 粉丝 0 关注私信	arryang 1 2 楼谢谢版主的鼓励，竟然加了精，^_^ 2008-5-24 19:13 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复