算法分析中间难住了,那位老大指点一下?
od中截取代码如下:
03551060 55 push ebp
03551061 8BEC mov ebp,esp
03551063 81EC AC000000 sub esp,0AC ; 变量空间 172
03551069 53 push ebx
0355106A 56 push esi
0355106B 57 push edi
0355106C 8DBD 54FFFFFF lea edi,dword ptr ss:[ebp-AC]
03551072 B9 2B000000 mov ecx,2B
03551077 B8 CCCCCCCC mov eax,CCCCCCCC
0355107C F3:AB rep stos dword ptr es:[edi] ; 43个CCCCCCCC
0355107E 8B45 08 mov eax,dword ptr ss:[ebp+8] ; 待加密字符串
03551081 50 push eax
03551082 E8 89020000 call zt_etax.03551310 ; 计算待加密字符串长度
03551087 83C4 04 add esp,4
0355108A 8945 AC mov dword ptr ss:[ebp-54],eax ; var21=长度
0355108D C745 A4 00000000 mov dword ptr ss:[ebp-5C],0 ; var23=0
03551094 EB 09 jmp short zt_etax.0355109F
03551096 8B4D A4 mov ecx,dword ptr ss:[ebp-5C] ;var23 i
03551099 83C1 01 add ecx,1 ;var23 i
0355109C 894D A4 mov dword ptr ss:[ebp-5C],ecx ;var23 i=i+1
0355109F 837D A4 40 cmp dword ptr ss:[ebp-5C],40 ; var23 在64密钥表中取值 初值=0
035510A3 0F8D E5000000 jge zt_etax.0355118E
035510A9 8B55 A4 mov edx,dword ptr ss:[ebp-5C] ; var23 i
035510AC 8B0495 B0BA5703 mov eax,dword ptr ds:[edx*4+357BAB0]
035510B3 8945 B8 mov dword ptr ss:[ebp-48],eax ; var18 akey
035510B6 C745 A8 00000000 mov dword ptr ss:[ebp-58],0 ; var22=0
035510BD EB 09 jmp short zt_etax.035510C8
035510BF 8B4D A8 mov ecx,dword ptr ss:[ebp-58] ; var22循环变量
035510C2 83C1 01 add ecx,1 ; 循环变量
035510C5 894D A8 mov dword ptr ss:[ebp-58],ecx ; 循环变量j=j+1
035510C8 8B55 A8 mov edx,dword ptr ss:[ebp-58]
035510CB 3B55 AC cmp edx,dword ptr ss:[ebp-54] ; var21=字符串长度
035510CE 0F8D 9C000000 jge zt_etax.03551170 ; >=长度
035510D4 8B45 A8 mov eax,dword ptr ss:[ebp-58] ; j
035510D7 0345 A4 add eax,dword ptr ss:[ebp-5C] ; j=j+i
035510DA 99 cdq
035510DB F77D AC idiv dword ptr ss:[ebp-54]
035510DE 8955 A0 mov dword ptr ss:[ebp-60],edx ; var24
035510E1 8B45 08 mov eax,dword ptr ss:[ebp+8]
035510E4 0345 A0 add eax,dword ptr ss:[ebp-60]
035510E7 0FBE08 movsx ecx,byte ptr ds:[eax] ; 取字符
035510EA 894D 94 mov dword ptr ss:[ebp-6C],ecx ; var27存放字符
035510ED 8B45 B8 mov eax,dword ptr ss:[ebp-48] ; var18 计算结果
035510F0 99 cdq
035510F1 83E2 0F and edx,0F
035510F4 03C2 add eax,edx
035510F6 C1F8 04 sar eax,4
035510F9 8945 B4 mov dword ptr ss:[ebp-4C],eax ; var19=sar(var18)
035510FC 8B55 B8 mov edx,dword ptr ss:[ebp-48] ;var18
035510FF 81E2 0F000080 and edx,8000000F
03551105 79 05 jns short zt_etax.0355110C
03551107 4A dec edx
03551108 83CA F0 or edx,FFFFFFF0
0355110B 42 inc edx
0355110C 8955 B0 mov dword ptr ss:[ebp-50],edx ; var20 var18的低4位
0355110F 8B45 94 mov eax,dword ptr ss:[ebp-6C] ; var27 ASCII
03551112 99 cdq
03551113 83E2 0F and edx,0F
03551116 03C2 add eax,edx
03551118 C1F8 04 sar eax,4
0355111B 8945 9C mov dword ptr ss:[ebp-64],eax ; var25 ASCII高
0355111E 8B45 94 mov eax,dword ptr ss:[ebp-6C] ; var27 ASCII字符
03551121 25 0F000080 and eax,8000000F
03551126 79 05 jns short zt_etax.0355112D
03551128 48 dec eax
03551129 83C8 F0 or eax,FFFFFFF0
0355112C 40 inc eax
0355112D 8945 98 mov dword ptr ss:[ebp-68],eax ; var26 ASCII低
03551130 8B4D 9C mov ecx,dword ptr ss:[ebp-64] ; var25
03551133 334D B4 xor ecx,dword ptr ss:[ebp-4C] ; var19 计算结果var18 sar4
03551136 894D 9C mov dword ptr ss:[ebp-64],ecx ; var25=var25 or var19
03551139 8B55 98 mov edx,dword ptr ss:[ebp-68] ; var26
0355113C 3355 B0 xor edx,dword ptr ss:[ebp-50] ; var20
0355113F 8955 98 mov dword ptr ss:[ebp-68],edx ; var26=var26 or var20
03551142 8B45 9C mov eax,dword ptr ss:[ebp-64] ;ascii 高位取密码key
03551145 8B0C85 30BA5703 mov ecx,dword ptr ds:[eax*4+357BA30] ; 取密码
0355114C C1E1 04 shl ecx,4 ;key shl 4
0355114F 8B55 98 mov edx,dword ptr ss:[ebp-68] ;ascii 低 取密码 key
03551152 030C95 30BA5703 add ecx,dword ptr ds:[edx*4+357BA30] ;取key
03551159 894D B8 mov dword ptr ss:[ebp-48],ecx ; var18 mwkey
0355115C 837D B8 00 cmp dword ptr ss:[ebp-48],0
03551160 75 09 jnz short zt_etax.0355116B
03551162 8B45 A0 mov eax,dword ptr ss:[ebp-60] ;var24
03551165 83C0 01 add eax,1
03551168 8945 B8 mov dword ptr ss:[ebp-48],eax var18=var24+1
0355116B ^ E9 4FFFFFFF jmp zt_etax.035510BF
03551170 837D B8 00 cmp dword ptr ss:[ebp-48],0
03551174 75 09 jnz short zt_etax.0355117F
03551176 8B4D A4 mov ecx,dword ptr ss:[ebp-5C] var23
03551179 83C1 01 add ecx,1
0355117C 894D B8 mov dword ptr ss:[ebp-48],ecx
0355117F 8B55 A4 mov edx,dword ptr ss:[ebp-5C] ; var23
03551182 8A45 B8 mov al,byte ptr ss:[ebp-48] ;var18
03551185 884415 BC mov byte ptr ss:[ebp+edx-44],al
03551189 ^ E9 08FFFFFF jmp zt_etax.03551096
0355118E 8B4D A4 mov ecx,dword ptr ss:[ebp-5C] ;var23
03551191 C6440D BC 00 mov byte ptr ss:[ebp+ecx-44],0
03551196 8D55 BC lea edx,dword ptr ss:[ebp-44]
03551199 52 push edx
0355119A 8B45 0C mov eax,dword ptr ss:[ebp+C]
0355119D 50 push eax
0355119E E8 7D000000 call zt_etax.03551220
035511A3 83C4 08 add esp,8
035511A6 B8 01000000 mov eax,1
035511AB 5F pop edi
035511AC 5E pop esi
035511AD 5B pop ebx
035511AE 81C4 AC000000 add esp,0AC
035511B4 3BEC cmp ebp,esp
035511B6 E8 D5010000 call zt_etax.03551390
035511BB 8BE5 mov esp,ebp
035511BD 5D pop ebp
035511BE C2 0800 retn 8
我用delphi实现如下:
type
Tmw = array[1..64] of Byte;
Tkey = array[0..31] of Integer;
EKey = array[0..63] of Integer;
//密钥表
const
ll_key: Tkey = ($06, $0C, $05, $09, $0A, $00, $0D, $08, $0F, $03, $0E, $04, $02, $0B, $01, $07, $05, $0E, $0C, $09, $0B, $02, $00, $0F, $07, $03, $04, $0D, $01, $06, $0A, $08);
lc_key: EKey = ($00, $0C, $22, $38, $4E, $5A, $66, $D5, $01, $17, $2D, $43, $59, $67, $D6, $02, $0D, $18, $23, $2E, $39, $44, $4F, $51, $72, $E1, $03, $29, $34, $3F, $4A, $55, $60, $73, $E2, $33, $3E, $49, $54, $5D, $30, $27, $0B, $6B, $DA, $3D, $48, $53, $5E, $31, $26, $1B, $10, $77, $E3, $47, $52, $5B, $11, $2F, $51, $5C, $19, $24);
function EnCrypt(aStr: string): Tmw;
var
i, j, k: Integer;
mw: Tmw;
ASCII_H, ASCII_L, aKey, aKey_H, aKey_L: Byte;
begin
for i := 0 to 63 do
begin
aKey := lc_key;
for j := 0 to Length(aStr) - 1 do
begin
k := (i + j) mod Length(aStr);
aKey_H := aKey shr 4;
aKey_L := aKey and $0F;
if aKey_L = 0 then
begin
aKey_L := ((aKey_L - 1) or $F0) + 1;
end;
ASCII_H := Ord(aStr[k + 1]) shr 4;
ASCII_L := Ord(aStr[k + 1]) and $0F;
if ASCII_L = 0 then
begin
ASCII_L := ((ASCII_L - 1) or $F0) + 1;
end;
ASCII_H := ASCII_H xor aKey_H;
ASCII_L := ASCII_L xor aKey_L;
aKey := (ll_key[ASCII_H] shl 4) + ll_key[ASCII_L];
if aKey = 0 then aKey := k + 1;
end;
if aKey = 0 then aKey := i + 1;
mw[i + 1] := aKey;
end;
EnCrypt := mw;
end;
计算中文ascii码值时发现 akey值与od中动态调试的结果不一样了。哪位老大指点一下?
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)