【文章标题】: AAA AceCapture 1.95 算法分析
【文章作者】: qifeon
【软件名称】: AAA AceCapture 1.95
【下载地址】: 自己搜索下载
【使用工具】: od,peid
【操作平台】: winxp sp2
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
一、peid 查壳，显示无壳，编程语言为：Microsoft Visual C++ 6.0。
二、试运行软件，输入“qifeon,12345-67890”.有错误提示。“registration code is invalid”。
同时注意注册码部分无法输入字母，即只能为数字。
三、od载入程序，查找错误提示字符串。
Ultra String Reference, 条目 280
Address=0040FE47
Disassembly=push 0046E074
Text String=registration code is invalid!
双击来到
0040FE45 |. 57 push edi
0040FE46 |. 57 push edi
0040FE47 |. 68 74E04600 push 0046E074 ; registration code is invalid!
0040FE4C |. EB 22 jmp short 0040FE70 返回处
0040FE4E |> 837D EC 01 cmp dword ptr [ebp-14], 1
0040FE52 |. 75 21 jnz short 0040FE75
0040FE54 |. 57 push edi
0040FE55 |. 57 push edi
0040FE56 |. 68 58E04600 push 0046E058 ; thank you for supporting!
0040FE5B |. E8 34AB0200 call 0043A994
0040FE60 |. 8BCE mov ecx, esi
0040FE62 |. E8 57E70100 call 0042E5BE
0040FCF8 /$ B8 6C114500 mov eax, 0045116C 段首
0040FCFD |. E8 86CF0000 call 0041CC88
0040FD02 |. 81EC E0000000 sub esp, 0E0
0040FD08 |. 53 push ebx
0040FD09 |. 56 push esi
0040FD0A |. 57 push edi
0040FD0B |. 8BF1 mov esi, ecx
0040FD0D |. 33FF xor edi, edi
0040FD0F |. 8975 E4 mov dword ptr [ebp-1C], esi
0040FD12 |. 897D F0 mov dword ptr [ebp-10], edi
0040FD15 |. 8D45 F0 lea eax, dword ptr [ebp-10]
0040FD18 |. 897D FC mov dword ptr [ebp-4], edi
0040FD1B |. 50 push eax
0040FD1C |. E8 06020000 call 0040FF27
0040FD21 |. 85C0 test eax, eax
0040FD23 |. 0F84 4C010000 je 0040FE75
0040FD29 |. 57 push edi
0040FD2A |. 8BCE mov ecx, esi
0040FD2C |. E8 D2260200 call 00432403
0040FD31 |. 8B45 F0 mov eax, dword ptr [ebp-10]
0040FD34 |. 50 push eax
0040FD35 |. 8B08 mov ecx, dword ptr [eax]
0040FD37 |. FF51 1C call dword ptr [ecx+1C]
0040FD3A |. 3BC7 cmp eax, edi
0040FD3C |. 0F8C 33010000 jl 0040FE75
0040FD42 |. 8B45 F0 mov eax, dword ptr [ebp-10]
0040FD45 |. 8D55 E8 lea edx, dword ptr [ebp-18]
0040FD48 |. 897D E8 mov dword ptr [ebp-18], edi
0040FD4B |. 52 push edx
0040FD4C |. 8B08 mov ecx, dword ptr [eax]
0040FD4E |. 50 push eax
0040FD4F |. FF51 20 call dword ptr [ecx+20]
0040FD52 |. 3BC7 cmp eax, edi
0040FD54 |. 0F8C 1B010000 jl 0040FE75
0040FD5A |. 837D E8 01 cmp dword ptr [ebp-18], 1
0040FD5E |. 75 0C jnz short 0040FD6C
0040FD60 |. 57 push edi
0040FD61 |. 57 push edi
0040FD62 |. 68 94E04600 push 0046E094 ; you needn't register more than 1 time!
0040FD67 |. E9 04010000 jmp 0040FE70
0040FD6C |> 68 40040000 push 440
0040FD71 |. 8BCE mov ecx, esi
0040FD73 |. E8 9DF90100 call 0042F715
0040FD78 |. 8D8D 14FFFFFF lea ecx, dword ptr [ebp-EC]
0040FD7E |. 68 C7000000 push 0C7
0040FD83 |. 51 push ecx
0040FD84 |. 8BC8 mov ecx, eax
0040FD86 |. E8 01FB0100 call 0042F88C
0040FD8B |. 8D85 14FFFFFF lea eax, dword ptr [ebp-EC] ; 用户名
0040FD91 |. 50 push eax
0040FD92 |. E8 19CF0000 call 0041CCB0
0040FD97 |. 83F8 05 cmp eax, 5 ; 用户名长度与5相比较
0040FD9A |. 59 pop ecx
0040FD9B |. 0F8C C8000000 jl 0040FE69 低于5位则跳向失败
0040FDA1 |. 3D 96000000 cmp eax, 96 用户名长度与150比较
0040FDA6 |. 0F8F BD000000 jg 0040FE69 大于150则跳向失败
0040FDAC |. 8D85 14FFFFFF lea eax, dword ptr [ebp-EC]
0040FDB2 |. 85C0 test eax, eax
0040FDB4 |. 75 04 jnz short 0040FDBA
0040FDB6 |. 33DB xor ebx, ebx
0040FDB8 |. EB 38 jmp short 0040FDF2
0040FDBA |> 8D85 14FFFFFF lea eax, dword ptr [ebp-EC]
0040FDC0 |. 50 push eax ; /String
0040FDC1 |. FF15 54424500 call dword ptr [<&KERNEL32.lstrlenA>] ; \lstrlenA
0040FDC7 |. 8BF0 mov esi, eax ; 用户名长度
0040FDC9 |. 46 inc esi
0040FDCA |. 8D0436 lea eax, dword ptr [esi+esi]
0040FDCD |. 83C0 03 add eax, 3
0040FDD0 |. 24 FC and al, 0FC
0040FDD2 |. E8 B9D50000 call 0041D390
0040FDD7 |. 8BDC mov ebx, esp
0040FDD9 |. 56 push esi ; /WideBufSize
0040FDDA |. 53 push ebx ; |WideCharBuf
0040FDDB |. 8D85 14FFFFFF lea eax, dword ptr [ebp-EC] ; |
0040FDE1 |. 6A FF push -1 ; |StringSize = FFFFFFFF (-1.)
0040FDE3 |. 50 push eax ; |StringToMap
0040FDE4 |. 57 push edi ; |Options
0040FDE5 |. 57 push edi ; |CodePage
0040FDE6 |. 66:893B mov word ptr [ebx], di ; |
0040FDE9 |. FF15 90424500 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar
0040FDEF |. 8B75 E4 mov esi, dword ptr [ebp-1C] ; 单字节转化为宽字节
0040FDF2 |> 53 push ebx
0040FDF3 |. FF15 5C444500 call dword ptr [<&OLEAUT32.#2>] ; OLEAUT32.SysAllocString
0040FDF9 |. 8B4D F0 mov ecx, dword ptr [ebp-10]
0040FDFC |. 50 push eax
0040FDFD |. 51 push ecx ;
0040FDFE |. 8B11 mov edx, dword ptr [ecx]
0040FE00 |. FF52 28 call dword ptr [edx+28]
0040FE03 |. 3BC7 cmp eax, edi
0040FE05 |. 7C 6E jl short 0040FE75
0040FE07 |. 8B86 00020000 mov eax, dword ptr [esi+200] ; 试炼码第一部分16进制
0040FE0D |. 8D55 DC lea edx, dword ptr [ebp-24]
0040FE10 |. 8945 DC mov dword ptr [ebp-24], eax
0040FE13 |. 8B86 04020000 mov eax, dword ptr [esi+204] ; 试炼码第2部分16进制
0040FE19 |. 8945 E0 mov dword ptr [ebp-20], eax
0040FE1C |. 8B45 F0 mov eax, dword ptr [ebp-10]
0040FE1F |. 6A 02 push 2
0040FE21 |. 52 push edx
0040FE22 |. 8B08 mov ecx, dword ptr [eax]
0040FE24 |. 50 push eax
0040FE25 |. FF51 2C call dword ptr [ecx+2C]
0040FE28 |. 3BC7 cmp eax, edi
0040FE2A |. 7C 49 jl short 0040FE75
0040FE2C |. 8B45 F0 mov eax, dword ptr [ebp-10]
0040FE2F |. 8D55 EC lea edx, dword ptr [ebp-14]
0040FE32 |. 897D EC mov dword ptr [ebp-14], edi
0040FE35 |. 52 push edx
0040FE36 |. 8B08 mov ecx, dword ptr [eax]
0040FE38 |. 50 push eax
0040FE39 |. FF51 30 call dword ptr [ecx+30] ; 算法call，待会进入
0040FE3C |. 3BC7 cmp eax, edi 关键跳转
0040FE3E |. 7C 35 jl short 0040FE75
0040FE40 |. 397D EC cmp dword ptr [ebp-14], edi
0040FE43 |. 75 09 jnz short 0040FE4E
0040FE45 |. 57 push edi
0040FE46 |. 57 push edi
0040FE47 |. 68 74E04600 push 0046E074 ; registration code is invalid!
0040FE4C |. EB 22 jmp short 0040FE70 返回处
0040FE4E |> 837D EC 01 cmp dword ptr [ebp-14], 1
0040FE52 |. 75 21 jnz short 0040FE75
0040FE54 |. 57 push edi
0040FE55 |. 57 push edi
0040FE56 |. 68 58E04600 push 0046E058 ; thank you for supporting!
0040FE5B |. E8 34AB0200 call 0043A994
0040FE60 |. 8BCE mov ecx, esi
0040FE62 |. E8 57E70100 call 0042E5BE
0040FE67 |. EB 0C jmp short 0040FE75
0040FE69 |> 57 push edi
0040FE6A |. 57 push edi
0040FE6B |. 68 3CE04600 push 0046E03C ; must the length of name>=5
0040FE70 |> E8 1FAB0200 call 0043A994
0040FE75 |> 8B45 F0 mov eax, dword ptr [ebp-10]
0040FE78 |. 834D FC FF or dword ptr [ebp-4], FFFFFFFF
0040FE7C |. 3BC7 cmp eax, edi
0040FE7E |. 74 06 je short 0040FE86
0040FE80 |. 8B08 mov ecx, dword ptr [eax]
0040FE82 |. 50 push eax
0040FE83 |. FF51 08 call dword ptr [ecx+8]
0040FE86 |> 8B4D F4 mov ecx, dword ptr [ebp-C]
0040FE89 |. 8DA5 08FFFFFF lea esp, dword ptr [ebp-F8]
0040FE8F |. 64:890D 00000>mov dword ptr fs:[0], ecx
0040FE96 |. 5F pop edi
0040FE97 |. 5E pop esi
0040FE98 |. 5B pop ebx
0040FE99 |. C9 leave
0040FE9A \. C3 retn
100014C1 55 push ebp
100014C2 8BEC mov ebp, esp
100014C4 81EC 08040000 sub esp, 408
100014CA 53 push ebx
100014CB 56 push esi
100014CC 57 push edi
100014CD 8B7D 08 mov edi, dword ptr [ebp+8]
100014D0 33F6 xor esi, esi
100014D2 3977 08 cmp dword ptr [edi+8], esi
100014D5 0F84 F2000000 je 100015CD
100014DB 3977 0C cmp dword ptr [edi+C], esi
100014DE 0F84 E9000000 je 100015CD
100014E4 8B5F 10 mov ebx, dword ptr [edi+10]
100014E7 3BDE cmp ebx, esi
100014E9 74 30 je short 1000151B
100014EB 53 push ebx
100014EC FF15 A4500010 call dword ptr [<&KERNEL32.lstrlenW>] ; kernel32.lstrlenW
100014F2 8D7C00 02 lea edi, dword ptr [eax+eax+2] ; 取用户名长度
100014F6 8BC7 mov eax, edi
100014F8 83C0 03 add eax, 3
100014FB 24 FC and al, 0FC
100014FD E8 EE270000 call 10003CF0
10001502 33C0 xor eax, eax
10001504 8BF4 mov esi, esp
10001506 50 push eax
10001507 50 push eax
10001508 8026 00 and byte ptr [esi], 0
1000150B 57 push edi
1000150C 56 push esi
1000150D 6A FF push -1
1000150F 53 push ebx
10001510 50 push eax
10001511 50 push eax
10001512 FF15 A8500010 call dword ptr [<&KERNEL32.WideCharTo>; kernel32.WideCharToMultiByte
10001518 8B7D 08 mov edi, dword ptr [ebp+8] ; 宽字节转化为单字节
1000151B 8D85 F8FBFFFF lea eax, dword ptr [ebp-408]
10001521 56 push esi
10001522 50 push eax
10001523 E8 D8260000 call 10003C00
10001528 59 pop ecx
10001529 33D2 xor edx, edx ; edx初值为0
1000152B 59 pop ecx
1000152C 33F6 xor esi, esi ; esi 初值为0
1000152E 8955 FC mov dword ptr [ebp-4], edx ; [ebp-4]初值为0
10001531 8D85 F8FBFFFF lea eax, dword ptr [ebp-408] ; 用户名地址入eax
10001537 0FBE18 movsx ebx, byte ptr [eax] ; 循环取用户名ASCII值扩展送入ebx
1000153A 83FA 04 cmp edx, 4 ; 比较edx是否小于4，进入不同算法
1000153D 7D 14 jge short 10001553 ; 大于或等于4则跳向算法2，即针对用户名4位后字符
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
