.text:00430983 mov [esp+1D8h+var_1A0], ecx
.text:00430987 push edx
.text:00430988 lea ecx, [esp+1DCh+var_A4]
.text:0043098F mov [esp+1DCh+var_A4], offset off_551B30
.text:0043099A mov byte ptr [esp+11h], 8Eh
.text:0043099F mov [esp+1DCh+var_1CA], 96h
.text:004309A4 mov [esp+1DCh+var_1C9], 12h
.text:004309A9 mov [esp+1DCh+var_1C8], 0ACh
.text:004309AE mov [esp+1DCh+var_1C7], 47h
.text:004309B3 mov [esp+1DCh+var_1C6], 0Dh
.text:004309B8 mov [esp+1DCh+var_1C5], 31h
.text:004309BD mov [esp+1DCh+var_1C4], 93h
.text:004309C2 mov [esp+1DCh+var_1C2], 1Ah
.text:004309C7 mov [esp+1DCh+var_1C1], 9Eh
.text:004309CC mov [esp+1DCh+var_1C0], 0DAh
.text:004309D1 mov [esp+1DCh+var_1BF], 82h
.text:004309D6 mov [esp+1DCh+var_1BE], 9Dh
.text:004309DB mov [esp+1DCh+var_1BD], 3Eh
.text:004309E0 mov [esp+1DCh+var_1BC], 0
.text:004309E5 mov [esp+1DCh+var_1A8], 0
.text:004309EA mov [esp+1DCh+var_1A4], eax
.text:004309EE call sub_40EEC0 ; 加密函数1
.text:004309F3 xor esi, esi
.text:004309F5
.text:004309F5 loc_4309F5: ; CODE XREF: sub_430910+107j
.text:004309F5 lea eax, [esp+esi+1D4h+var_19C]
.text:004309F9 lea ecx, [esp+esi+1D4h+var_11C]
.text:00430A00 push eax
.text:00430A01 push ecx
.text:00430A02 lea ecx, [esp+1DCh+var_A4]
.text:00430A09 call sub_40F040 ; 核心加密函数
.text:00430A0E add esi, 10h
.text:00430A11 lea edx, [esi+8]
.text:00430A14 cmp edx, 40h
.text:00430A17 jb short loc_4309F5
.text:00430A19 lea eax, [esp+1D4h+var_1CC]
.text:00430A1D push 80h
.text:00430A22 push eax
.text:00430A23 lea ecx, [esp+1DCh+var_A4]
.text:00430A2A call sub_40EEC0 ; 加密函数1
.text:00430A2F mov edi, [esp+1D4h+arg_0]
.text:00430A36 lea ecx, [esp+1D4h+var_1A4]
.text:00430A3A xor esi, esi
.text:00430A3C sub edi, ecx
.text:00430A3E
.text:00430A3E loc_430A3E: ; CODE XREF: sub_430910+149j
.text:00430A3E lea eax, [esp+esi+1D4h+var_1A4]
.text:00430A42 lea ecx, [esp+1D4h+var_A4]
.text:00430A49 lea edx, [edi+eax]
.text:00430A4C push edx
.text:00430A4D push eax
.text:00430A4E call sub_40F040 ; 核心加密函数,发送缓冲区数据的形成
.text:00430A53 add esi, 10h
.text:00430A56 cmp esi, 50h
.text:00430A59 jb short loc_430A3E
.text:00430A5B pop edi
.text:00430A5C pop esi
.text:00430A5D add esp, 1CCh
.text:00430A63 retn
.text:00430A63 sub_430910 endp
/////////////////////////////////////////////////////////////////////
加密函数1内容:
.text:0040EEC0 push ebx
.text:0040EEC1 mov ebx, ecx
.text:0040EEC3 mov ecx, [esp+arg_4]
.text:0040EEC7 shr ecx, 5
.text:0040EECA cmp ecx, 4
.text:0040EECD jb loc_40F035
.text:0040EED3 cmp ecx, 0Eh
.text:0040EED6 ja loc_40F035
.text:0040EEDC push ebp
.text:0040EEDD push esi
.text:0040EEDE test ecx, ecx
.text:0040EEE0 push edi
.text:0040EEE1 jbe short loc_40EEFB
.text:0040EEE3 mov edx, [esp+0Ch+arg_0]
.text:0040EEE7 mov eax, 5958C8h
.text:0040EEEC sub edx, eax
.text:0040EEEE mov esi, ecx
.text:0040EEF0
.text:0040EEF0 loc_40EEF0: ; CODE XREF: sub_40EEC0+39j
.text:0040EEF0 mov edi, [edx+eax]
.text:0040EEF3 mov [eax], edi
.text:0040EEF5 add eax, 4
.text:0040EEF8 dec esi
.text:0040EEF9 jnz short loc_40EEF0
.text:0040EEFB
.text:0040EEFB loc_40EEFB: ; CODE XREF: sub_40EEC0+21j
.text:0040EEFB lea eax, [ecx+1]
.text:0040EEFE mov dword ptr pszPath+28h[ecx*4], ecx
.text:0040EF05 cmp eax, 0Fh
.text:0040EF08 jnb short loc_40EF1C
.text:0040EF0A mov ecx, 0Fh
.text:0040EF0F lea edi, ds:5958C8h[eax*4]
.text:0040EF16 sub ecx, eax
.text:0040EF18 xor eax, eax
.text:0040EF1A rep stosd
.text:0040EF1C
.text:0040EF1C loc_40EF1C: ; CODE XREF: sub_40EEC0+48j
.text:0040EF1C xor edx, edx
.text:0040EF1E lea ecx, [ebx+4]
.text:0040EF21
.text:0040EF21 loc_40EF21: ; CODE XREF: sub_40EEC0+FCj
.text:0040EF21 xor eax, eax
.text:0040EF23
.text:0040EF23 loc_40EF23: ; CODE XREF: sub_40EEC0+9Bj
.text:0040EF23 mov esi, dword_585940[eax]
.text:0040EF29 mov edi, dword_58597C[eax]
.text:0040EF2F mov esi, dword ptr pszPath+28h[esi*4]
.text:0040EF36 mov ebp, dword ptr pszPath+28h[edi*4]
.text:0040EF3D xor esi, ebp
.text:0040EF3F mov ebp, [eax+5958C8h]
.text:0040EF45 rol esi, 3
.text:0040EF48 lea edi, [eax+edx]
.text:0040EF4B add eax, 4
.text:0040EF4E xor esi, edi
.text:0040EF50 xor ebp, esi
.text:0040EF52 cmp eax, 3Ch
.text:0040EF55 mov [eax+5958C4h], ebp
.text:0040EF5B jb short loc_40EF23
.text:0040EF5D mov esi, 4
.text:0040EF62
.text:0040EF62 loc_40EF62: ; CODE XREF: sub_40EEC0+D8j
.text:0040EF62 xor eax, eax
.text:0040EF64
.text:0040EF64 loc_40EF64: ; CODE XREF: sub_40EEC0+D5j
.text:0040EF64 mov edi, dword_585904[eax]
.text:0040EF6A mov ebp, [eax+5958C8h]
.text:0040EF70 add eax, 4
.text:0040EF73 mov edi, dword ptr pszPath+28h[edi*4]
.text:0040EF7A and edi, 1FFh
.text:0040EF80 mov edi, dword_585104[edi*4]
.text:0040EF87 add edi, ebp
.text:0040EF89 rol edi, 9
.text:0040EF8C mov [eax+5958C4h], edi
.text:0040EF92 cmp eax, 3Ch
.text:0040EF95 jb short loc_40EF64
.text:0040EF97 dec esi
.text:0040EF98 jnz short loc_40EF62
.text:0040EF9A mov eax, offset unk_5859B8
.text:0040EF9F
.text:0040EF9F loc_40EF9F: ; CODE XREF: sub_40EEC0+F6j
.text:0040EF9F mov esi, [eax]
.text:0040EFA1 add eax, 4
.text:0040EFA4 add ecx, 4
.text:0040EFA7 cmp eax, offset unk_5859E0
.text:0040EFAC mov esi, dword ptr pszPath+28h[esi*4]
.text:0040EFB3 mov [ecx-4], esi
.text:0040EFB6 jb short loc_40EF9F
.text:0040EFB8 inc edx
.text:0040EFB9 cmp edx, 4
.text:0040EFBC jb loc_40EF21
.text:0040EFC2 lea esi, [ebx+18h]
.text:0040EFC5 mov edi, 10h
.text:0040EFCA
.text:0040EFCA loc_40EFCA: ; CODE XREF: sub_40EEC0+170j
.text:0040EFCA mov ecx, [esi]
.text:0040EFCC mov edx, ecx
.text:0040EFCE or edx, 3
.text:0040EFD1 mov eax, edx
.text:0040EFD3 mov ebx, edx
.text:0040EFD5 not eax
.text:0040EFD7 and eax, 7FFFFFFFh
.text:0040EFDC shr ebx, 1
.text:0040EFDE xor eax, ebx
.text:0040EFE0 mov ebx, eax
.text:0040EFE2 mov ebp, eax
.text:0040EFE4 shr ebx, 2
.text:0040EFE7 shr ebp, 1
.text:0040EFE9 and ebx, ebp
.text:0040EFEB and eax, ebx
.text:0040EFED mov ebx, eax
.text:0040EFEF mov ebp, eax
.text:0040EFF1 shr ebx, 6
.text:0040EFF4 shr ebp, 3
.text:0040EFF7 and ebx, ebp
.text:0040EFF9 and eax, ebx
.text:0040EFFB jz short loc_40F02A
.text:0040EFFD shl eax, 1
.text:0040EFFF and ecx, 3
.text:0040F002 lea ebx, [eax+eax]
.text:0040F005 or eax, ebx
.text:0040F007 lea ebx, ds:0[eax*4]
.text:0040F00E or eax, ebx
.text:0040F010 mov ebx, dword_5859F4[ecx*4]
.text:0040F017 mov ecx, [esi-4]
.text:0040F01A rol ebx, cl
.text:0040F01C mov ecx, eax
.text:0040F01E shl ecx, 4
.text:0040F021 or ecx, eax
.text:0040F023 and ebx, ecx
.text:0040F025 and ebx, 0FFFFFFFCh
.text:0040F028 xor edx, ebx
.text:0040F02A
.text:0040F02A loc_40F02A: ; CODE XREF: sub_40EEC0+13Bj
.text:0040F02A mov [esi], edx
.text:0040F02C add esi, 8
.text:0040F02F dec edi
.text:0040F030 jnz short loc_40EFCA
.text:0040F032 pop edi
.text:0040F033 pop esi
.text:0040F034 pop ebp
.text:0040F035
.text:0040F035 loc_40F035: ; CODE XREF: sub_40EEC0+Dj
.text:0040F035 ; sub_40EEC0+16j
.text:0040F035 pop ebx
.text:0040F036 retn 8
.text:0040F036 sub_40EEC0 endp
///////////////////////////////////////////////////////////////////
核心加密函数
.text:0040F040 sub esp, 8
.text:0040F043 push ebx
.text:0040F044 mov ebx, [esp+0Ch+arg_0]
.text:0040F048 push ebp
.text:0040F049 mov eax, ecx
.text:0040F04B push esi
.text:0040F04C mov esi, [ebx+4]
.text:0040F04F mov ecx, [eax+4]
.text:0040F052 push edi
.text:0040F053 mov edi, [ebx]
.text:0040F055 add ecx, edi
.text:0040F057 mov edi, [eax+8]
.text:0040F05A add esi, edi
.text:0040F05C mov edx, ecx
.text:0040F05E mov edi, ecx
.text:0040F060 ror edx, 8
.text:0040F063 and edi, 0FFh
.text:0040F069 and edx, 0FFh
.text:0040F06F mov ebp, dword_585104[edi*4]
.text:0040F076 mov edx, dword_585504[edx*4]
.text:0040F07D xor esi, ebp
.text:0040F07F mov ebp, [eax+0Ch]
.text:0040F082 add edx, esi
.text:0040F084 mov esi, ecx
.text:0040F086 ror esi, 10h
.text:0040F089 ror ecx, 18h
.text:0040F08C and esi, 0FFh
.text:0040F092 mov edi, ecx
.text:0040F094 mov ecx, dword_585104[esi*4]
.text:0040F09B mov esi, [ebx+8]
.text:0040F09E add ecx, esi
.text:0040F0A0 mov esi, [ebx+0Ch]
.text:0040F0A3 mov ebx, [eax+10h]
.text:0040F0A6 add ecx, ebp
.text:0040F0A8 add esi, ebx
.text:0040F0AA mov ebx, edi
.text:0040F0AC and ebx, 0FFh
.text:0040F0B2 mov ebp, dword_585504[ebx*4]
.text:0040F0B9 mov ebx, edx
.text:0040F0BB xor esi, ebp
.text:0040F0BD mov ebp, edx
.text:0040F0BF add edi, esi
.text:0040F0C1 and ebp, 0FFh
.text:0040F0C7 ror ebx, 8
.text:0040F0CA mov ebp, dword_585104[ebp*4]
.text:0040F0D1 and ebx, 0FFh
.text:0040F0D7 xor ebp, ecx
.text:0040F0D9 mov ecx, dword_585504[ebx*4]
.text:0040F0E0 mov ebx, edx
.text:0040F0E2 add ecx, ebp
.text:0040F0E4 ror ebx, 10h
.text:0040F0E7 and ebx, 0FFh
.text:0040F0ED ror edx, 18h
.text:0040F0F0 mov ebp, dword_585104[ebx*4]
.text:0040F0F7 mov ebx, edx
.text:0040F0F9 and ebx, 0FFh
.text:0040F0FF add esi, ebp
.text:0040F101 add edx, ecx
.text:0040F103 mov ebp, dword_585504[ebx*4]
.text:0040F10A mov ebx, ecx
.text:0040F10C xor edi, ebp
.text:0040F10E mov ebp, ecx
.text:0040F110 and ebp, 0FFh
.text:0040F116 ror ebx, 8
.text:0040F119 mov ebp, dword_585104[ebp*4]
.text:0040F120 and ebx, 0FFh
.text:0040F126 xor ebp, esi
.text:0040F128 mov esi, dword_585504[ebx*4]
.text:0040F12F mov ebx, ecx
.text:0040F131 add esi, ebp
.text:0040F133 ror ebx, 10h
.text:0040F136 and ebx, 0FFh
.text:0040F13C ror ecx, 18h
.text:0040F13F mov ebp, dword_585104[ebx*4]
.text:0040F146 mov ebx, esi
.text:0040F148 add edi, ebp
.text:0040F14A mov ebp, esi
.text:0040F14C and ebp, 0FFh
.text:0040F152 ror ebx, 8
.text:0040F155 mov ebp, dword_585104[ebp*4]
.text:0040F15C and ebx, 0FFh
.text:0040F162 xor ebp, edi
.text:0040F164 mov edi, dword_585504[ebx*4]
.text:0040F16B mov ebx, esi
.text:0040F16D add edi, ebp
.text:0040F16F mov ebp, ecx
.text:0040F171 and ebp, 0FFh
.text:0040F177 ror ebx, 10h
.text:0040F17A mov ebp, dword_585504[ebp*4]
.text:0040F181 and ebx, 0FFh
.text:0040F187 xor ebp, edx
.text:0040F189 mov edx, dword_585104[ebx*4]
.text:0040F190 mov ebx, edi
.text:0040F192 add ebp, edx
.text:0040F194 mov edx, edi
.text:0040F196 ror esi, 18h
.text:0040F199 ror edx, 8
.text:0040F19C and ebx, 0FFh
.text:0040F1A2 and edx, 0FFh
.text:0040F1A8 mov ebx, dword_585104[ebx*4]
.text:0040F1AF mov edx, dword_585504[edx*4]
.text:0040F1B6 xor ebx, ebp
.text:0040F1B8 mov ebp, esi
.text:0040F1BA add edx, ebx
.text:0040F1BC mov ebx, edi
.text:0040F1BE and ebp, 0FFh
.text:0040F1C4 ror ebx, 10h
.text:0040F1C7 mov ebp, dword_585504[ebp*4]
.text:0040F1CE and ebx, 0FFh
.text:0040F1D4 xor ebp, ecx
.text:0040F1D6 mov ecx, dword_585104[ebx*4]
.text:0040F1DD ror edi, 18h
.text:0040F1E0 add ebp, ecx
.text:0040F1E2 mov ecx, edi
.text:0040F1E4 and ecx, 0FFh
.text:0040F1EA mov ebx, dword_585504[ecx*4]
.text:0040F1F1 mov ecx, edx
.text:0040F1F3 xor esi, ebx
.text:0040F1F5 mov ebx, edx
.text:0040F1F7 add edi, esi
.text:0040F1F9 and ebx, 0FFh
.text:0040F1FF ror ecx, 8
.text:0040F202 mov ebx, dword_585104[ebx*4]
.text:0040F209 and ecx, 0FFh
.text:0040F20F xor ebx, ebp
.text:0040F211 mov ecx, dword_585504[ecx*4]
.text:0040F218 add ecx, ebx
.text:0040F21A mov ebx, edx
.text:0040F21C ror ebx, 10h
.text:0040F21F and ebx, 0FFh
.text:0040F225 ror edx, 18h
.text:0040F228 mov ebp, dword_585104[ebx*4]
.text:0040F22F mov ebx, edx
.text:0040F231 and ebx, 0FFh
.text:0040F237 add esi, ebp
.text:0040F239 add edx, ecx
.text:0040F23B mov ebp, dword_585504[ebx*4]
.text:0040F242 mov ebx, ecx
.text:0040F244 xor edi, ebp
.text:0040F246 mov ebp, ecx
.text:0040F248 and ebp, 0FFh
.text:0040F24E ror ebx, 8
.text:0040F251 mov ebp, dword_585104[ebp*4]
.text:0040F258 and ebx, 0FFh
.text:0040F25E xor ebp, esi
.text:0040F260 mov esi, dword_585504[ebx*4]
.text:0040F267 mov ebx, ecx
.text:0040F269 add esi, ebp
.text:0040F26B ror ebx, 10h
.text:0040F26E ror ecx, 18h
.text:0040F271 and ebx, 0FFh
.text:0040F277 mov ebp, ecx
.text:0040F279 mov ecx, dword_585104[ebx*4]
.text:0040F280 mov ebx, esi
.text:0040F282 add edi, ecx
.text:0040F284 mov ecx, esi
.text:0040F286 ror ecx, 8
.text:0040F289 and ebx, 0FFh
.text:0040F28F and ecx, 0FFh
.text:0040F295 mov ebx, dword_585104[ebx*4]
.text:0040F29C mov ecx, dword_585504[ecx*4]
.text:0040F2A3 xor ebx, edi
.text:0040F2A5 add ecx, ebx
.text:0040F2A7 mov edi, ebp
.text:0040F2A9 mov ebx, esi
.text:0040F2AB and edi, 0FFh
.text:0040F2B1 ror ebx, 10h
.text:0040F2B4 mov edi, dword_585504[edi*4]
.text:0040F2BB and ebx, 0FFh
.text:0040F2C1 xor edi, edx
.text:0040F2C3 mov edx, dword_585104[ebx*4]
.text:0040F2CA mov ebx, [eax+14h]
.text:0040F2CD add ebx, ecx
.text:0040F2CF add edi, edx
.text:0040F2D1 ror esi, 18h
.text:0040F2D4 rol ecx, 0Dh
.text:0040F2D7 mov edx, ecx
.text:0040F2D9 mov ecx, [eax+18h]
.text:0040F2DC imul ecx, edx
.text:0040F2DF rol ecx, 5
.text:0040F2E2 mov [esp+18h+arg_0], ebx
.text:0040F2E6 rol ebx, cl
.text:0040F2E8 mov [esp+18h+var_8], ebx
.text:0040F2EC mov ebx, esi
.text:0040F2EE and ebx, 0FFh
.text:0040F2F4 mov ebx, dword_585504[ebx*4]
.text:0040F2FB xor ebx, ebp
.text:0040F2FD mov ebp, ebx
.text:0040F2FF mov ebx, [esp+18h+var_8]
.text:0040F303 add ebx, ebp
.text:0040F305 mov ebp, [esp+18h+arg_0]
.text:0040F309 and ebp, 1FFh
.text:0040F30F mov ebp, dword_585104[ebp*4]
.text:0040F316 xor ebp, ecx
.text:0040F318 rol ecx, 5
.text:0040F31B xor ebp, ecx
.text:0040F31D xor esi, ecx
.text:0040F31F rol ebp, cl
.text:0040F321 mov ecx, [eax+20h]
.text:0040F324 add edi, ebp
...
.text:0040F8C8 mov ebp, dword_585104[ebx*4]
.text:0040F8CF mov ebx, ecx
.text:0040F8D1 sub esi, ebp
.text:0040F8D3 rol ebx, 10h
.text:0040F8D6 and ebx, 0FFh
.text:0040F8DC rol ecx, 18h
.text:0040F8DF mov ebp, dword_585504[ebx*4]
.text:0040F8E6 mov ebx, ecx
.text:0040F8E8 and ebx, 0FFh
.text:0040F8EE sub edx, ebp
.text:0040F8F0 mov ebp, dword_585104[ebx*4]
.text:0040F8F7 mov ebx, [eax+94h]
.text:0040F8FD sub edi, ebx
.text:0040F8FF mov ebx, [esp+18h+arg_4]
.text:0040F903 xor edx, ebp
.text:0040F905 mov [ebx], edi
.text:0040F907 mov edi, [eax+98h]
.text:0040F90D sub esi, edi
.text:0040F90F mov [ebx+4], esi
.text:0040F912 mov esi, [eax+9Ch]
.text:0040F918 sub edx, esi
.text:0040F91A mov [ebx+8], edx
.text:0040F91D mov edx, [eax+0A0h]
.text:0040F923 sub ecx, edx
.text:0040F925 pop edi
.text:0040F926 pop esi
.text:0040F927 mov [ebx+0Ch], ecx
.text:0040F92A pop ebp
.text:0040F92B pop ebx
.text:0040F92C add esp, 8
.text:0040F92F retn 8
.text:0040F92F sub_40F040 endp
[课程]Android-CTF解题方法汇总！
