Bigman's Crackme6的分析-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

Bigman's Crackme6的分析

发表于: 2009-9-7 17:36 4545

Bigman's Crackme6的分析

coldmoon

2009-9-7 17:36

4545

说明：此程序Bigman's Crackme6刊载在2007 PEDIY's CrackMe专辑上面序列号部分。
   原程序是加过壳的，但我初出茅庐，刚看完《加密与解密（第三版）》第五章常见演示版保护技术，还没学习到加壳部分，

   于是就下了脱壳版本来分析。限于我水平有限，讲解不清楚或错误的地方，欢迎指正。

第一步
用OD载入，查看取注册字符串的函数，嘿嘿，看到GetDlgItemTextA,  设置断点，运行，输入Name和Serial.

Name: dfghi
Serial: 87878787

断下来后，按ALT+F9回到程序领空。
下面是代码，我的分析在代码旁边。

00401528  |.  68 00010000 push 100                            ; /Count = 100 (256.)
0040152D  |.  8D85 00FFFFFF lea    eax, dword ptr [ebp-100]       ; |
00401533  |.  50          push eax                            ; |Buffer
00401534  |.  6A 65       push 65                            ; |ControlID = 65 (101.)
00401536  |.  FF75 08    push dword ptr [ebp+8]             ; |hWnd
00401539  |.  E8 FA010000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
0040153E  |.  89C3       mov    ebx, eax
00401540  |.  09DB       or    ebx, ebx                      ;Name[]不能为空
00401542  |.  75 04       jnz    short 00401548
00401544  |.  31C0       xor    eax, eax
00401546  |.  EB 50       jmp    short 00401598
00401548  |>  BF BC020000 mov    edi, 2BC
0040154D  |.  BE 30000000 mov    esi, 30
00401552  |.  B8 48000000 mov    eax, 48
00401557  |.  99          cdq
00401558  |.  F7FB       idiv ebx
0040155A  |.  29C6       sub    esi, eax
0040155C  |.  8D34B6       lea    esi, dword ptr [esi+esi*4]
0040155F  |.  29F7       sub    edi, esi
00401561  |.  6BFF 6B    imul edi, edi, 6B
00401564  |.  81EF 6CCF0000 sub    edi, 0CF6C
0040156A  |.  81FF 00230000 cmp    edi, 2300                ;EDI=(2bc-(30-48/NameLen)*5)*6b-cf6c, EDI必须在190-2300之间。
00401570  |.  7F 08       jg    short 0040157A
00401572  |.  81FF 90010000 cmp    edi, 190
00401578  |.  7D 04       jge    short 0040157E
0040157A  |>  31C0       xor    eax, eax
0040157C  |.  EB 1A       jmp    short 00401598
0040157E  |>  8D85 00FFFFFF lea    eax, dword ptr [ebp-100]
00401584  |.  50          push eax                            ；Name[]
00401585  |.  53          push ebx       ; NameLen
00401586  |.  FF75 08    push dword ptr [ebp+8]
00401589  |.  E8 77FDFFFF call 00401305
{
00401305  /$  55          push ebp
00401306  |.  89E5       mov    ebp, esp
00401308  |.  81EC 2C040000 sub    esp, 42C
0040130E  |.  53          push ebx
0040130F  |.  56          push esi
00401310  |.  57          push edi
00401311  |.  8DBD FCFEFFFF lea    edi, dword ptr [ebp-104]
00401317  |.  8D35 38204000 lea    esi, dword ptr [402038]
0040131D  |.  B9 40000000 mov    ecx, 40
00401322  |.  F3:A5       rep    movs dword ptr es:[edi], dword p>
00401324  |.  8DBD E1FBFFFF lea    edi, dword ptr [ebp-41F]
0040132A  |.  8D35 38214000 lea    esi, dword ptr [402138]
00401330  |.  B9 40000000 mov    ecx, 40
00401335  |.  F3:A5       rep    movs dword ptr es:[edi], dword p>
00401337  |.  8DBD E1FDFFFF lea    edi, dword ptr [ebp-21F]
0040133D  |.  8D35 38224000 lea    esi, dword ptr [402238]
00401343  |.  B9 40000000 mov    ecx, 40
00401348  |.  F3:A5       rep    movs dword ptr es:[edi], dword p>
0040134A  |.  8DBD E1FCFFFF lea    edi, dword ptr [ebp-31F]
00401350  |.  8D35 38234000 lea    esi, dword ptr [402338]
00401356  |.  B9 40000000 mov    ecx, 40
0040135B  |.  F3:A5       rep    movs dword ptr es:[edi], dword p>
0040135D  |.  8DBD DCFBFFFF lea    edi, dword ptr [ebp-424]
00401363  |.  8D35 38244000 lea    esi, dword ptr [402438]
00401369  |.  B9 05000000 mov    ecx, 5
0040136E  |.  F3:A4       rep    movs byte ptr es:[edi], byte ptr>
00401370  |.  8DBD D6FBFFFF lea    edi, dword ptr [ebp-42A]
00401376  |.  8D35 3D244000 lea    esi, dword ptr [40243D]
0040137C  |.  B9 03000000 mov    ecx, 3
00401381  |.  F3:66:A5    rep    movs word ptr es:[edi], word ptr>
00401384  |.  8DBD E1FEFFFF lea    edi, dword ptr [ebp-11F]
0040138A  |.  8D35 43244000 lea    esi, dword ptr [402443]
00401390  |.  B9 1B000000 mov    ecx, 1B
00401395  |.  F3:A4       rep    movs byte ptr es:[edi], byte ptr>
00401397  |.  C745 FC 00000>mov    dword ptr [ebp-4], 0
0040139E  |.  68 00010000 push 100                      ; /Count = 100 (256.)
004013A3  |.  8D85 E1FCFFFF lea    eax, dword ptr [ebp-31F]       ; |
004013A9  |.  50          push eax                            ; |Buffer
004013AA  |.  6A 66       push 66                            ; |ControlID = 66 (102.)
004013AC  |.  FF75 08    push dword ptr [ebp+8]             ; |hWnd
004013AF  |.  E8 84030000 call <jmp.&USER32.GetDlgItemTextA>          ;                                                             \GetDlgItemTextA
004013B4  |.  09C0       or    eax, eax                      ;  Serial不能为空
004013B6  |.  0F84 48010000 je    00401504
004013BC  |.  B8 CF110000 mov    eax, 11CF
004013C1  |.  0FB68D E1FCFF>movzx ecx, byte ptr [ebp-31F]  ; 读取Serial[0]
004013C8  |.  99          cdq
004013C9  |.  F7F9       idiv ecx
004013CB  |.  83FA 17    cmp    edx, 17 ; (11CF) % (Serial[0])=17H, 必须满足
004013CE  |.  74 07       je    short 004013D7
004013D0  |.  31C0       xor    eax, eax
004013D2  |.  E9 2D010000 jmp    00401504
004013D7  |>  31DB       xor    ebx, ebx                      ;  i清空
004013D9  |.  EB 0B       jmp    short 004013E6
004013DB  |>  8B45 10    /mov    eax, dword ptr [ebp+10] ;  把Name放到EAX中
004013DE  |.  0FBE0418    |movsx eax, byte ptr [eax+ebx]       ;  读取Name[i]
004013E2  |.  0145 FC |add    dword ptr [ebp-4], eax    ;  把Name[i]的各个ascii相加(SUM(NAME))    放到[ebp-4]中
004013E5  |.  43          |inc    ebx
004013E6  |>  3B5D 0C       cmp    ebx, dword ptr [ebp+C]       ;  i与NameLen比较
004013E9  |.^ 7C F0       \jl    short 004013DB
004013EB  |.  31DB       xor    ebx, ebx
004013ED  |.  E9 83000000 jmp    00401475
004013F2  |>  8B55 10    /mov    edx, dword ptr [ebp+10]       ;  Name放到edx中
004013F5  |.  0FBE3C1A    |movsx edi, byte ptr [edx+ebx]       ;  EDI=Name[i]
004013F9  |.  8B75 FC    |mov    esi, dword ptr [ebp-4]       ;  ESI=SUM
004013FC  |.  89D9       |mov    ecx, ebx                      ;  ECX=i
004013FE  |.  C1E1 02    |shl    ecx, 2                         ;  ECX=ECX*4=4*i
00401401  |.  89DA       |mov    edx, ebx                      ;  EDX=i
00401403  |.  42          |inc    edx                            ;  EDX++=i++
00401404  |.  29D1       |sub    ecx, edx                      ;  ECX=ECX-EDX=4*i-i-1=3*i-1
00401406  |.  0FB68C0D E1FE>|movzx ecx, byte ptr [ebp+ecx-11F]    ;  ASCII  41-5A（字母A-Z)Table[]="ABCDEFGHIJKLMNOPQRSTUVWSYZ"
0040140E  |.  89FA       |mov    edx, edi                      ;  EDX=EDI=Name[i]
00401410  |.  31CA       |xor    edx, ecx                      ;  EDX=EDX^ECX=Name[i]^Table[3*i-1]
00401412  |.  89F1       |mov    ecx, esi                      ;  ECX=SUM
00401414  |.  0FAFCB       |imul ecx, ebx                      ;  ECX=ECX*i 带进位
00401417  |.  29F1       |sub    ecx, esi                      ;  ECX=ECX-SUM(NAME)=i*SUM-SUM


00401419  |.  89CE       |mov    esi, ecx                      ;  ESI=ECX
0040141B  |.  83F6 FF    |xor    esi, FFFFFFFF                ;  ESI=ESI^FFFFFFFF=(i*SUM-SUM)^0xffffffff
0040141E  |.  8DB432 4D0100>|lea    esi, dword ptr [edx+esi+14D] ;  ESI=EDX+ESI+14D=Name[i]^Table[3*i- 1]+(i*SUM- SUM)^0xffffffff+0x14d
00401425  |.  8B4D 0C    |mov    ecx, dword ptr [ebp+C]       ;  ECX=NameLen
00401428  |.  89DA       |mov    edx, ebx                      ;  EDX=i
0040142A  |.  83C2 03    |add    edx, 3                         ;  EDX=i+3
0040142D  |.  0FAFCA       |imul ecx, edx                      ;  ECX=ECX*EDX=NameLen*(i+3)  带进位
00401430  |.  0FAFCF       |imul ecx, edi                      ;  ECX=EDI*ECX=Name[i]*NameLen*(i+3) 带进位
00401433  |.  89F0       |mov    eax, esi                      ;  EAX=ESI
00401435  |.  01C8       |add    eax, ecx                      ;  EAX=EAX+ECX=Name[i]^Table[3*i-1]+(i*SUM-SUM)^0xffffffff+0x14d+                (i+3)*Name[i]*NameLen
00401437  |.  B9 0A000000 |mov    ecx, 0A                      ;  ECX=0xa
0040143C  |.  31D2       |xor    edx, edx                      ;  EDX=0
0040143E  |.  F7F1       |div    ecx                            ;  EDX=(EAX)%(ECX)=(Name[i]^Table[3*i- 1]+((i*SUM-SUM)^0xffffffff))
                                                                                                                           +0x14d+(i+3)*Name[i]*NameLen)%(0xa)


00401440  |.  83C2 30    |add    edx, 30                      ;  EDX+=0x30
00401443  |.  88941D FCFEFF>|mov    byte ptr [ebp+ebx-104], dl    ;  [ebp+ebx-104]=12F7F0 = LOWORD(EDX)
0040144A  |.  0FB6BC1D FCFE>|movzx edi, byte ptr [ebp+ebx-104]       EDI=LOWORD(EDX)
00401452  |.  81F7 ACAD0000 |xor    edi, 0ADAC                   ;  EDI^=0xadac
00401458  |.  89DE       |mov    esi, ebx                      ;  ESI=i
0040145A  |.  83C6 02    |add    esi, 2                         ;  ESI=i+2
0040145D  |.  89F8       |mov    eax, edi                      ;  EAX=EDI
0040145F  |.  0FAFC6       |imul eax, esi                      ;  EAX=EAX*ESI=EDI*(i+2)
00401462  |.  B9 0A000000 |mov    ecx, 0A                      ;  ECX=0xa
00401467  |.  99          |cdq
00401468  |.  F7F9       |idiv ecx                            ;  EDX=(EAX)%(ECX)=(EAX)%(0xa)
0040146A  |.  83C2 30    |add    edx, 30                      ;  EDX=EDX+0x30


这是写注册机的一个关键
EDX=EAX%ECX=((((Name[i]^Table[3*i-1]+((i*SUM-SUM)^0xffffffff))+0x14d+(i+3)*Name[i]*NameLen)%(0xa) +0x30)^0xadac)*(i+2))% 0xa+0x30;程序产生的部分中间注册码(TempSerial)

0040146D  |.  88941D FCFEFF>|mov    byte ptr [ebp+ebx-104], dl
00401474  |.  43          |inc    ebx
00401475  |>  3B5D 0C       cmp    ebx, dword ptr [ebp+C]       ;  i与NameLen比较
00401478  |.^ 0F8C 74FFFFFF \jl    004013F2
0040147E  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]       ;  TempSerial放到eax
00401484  |.  50          push eax
00401485  |.  6A 54       push 54                            ;  54是'T'的ASCII值
00401487  |.  8D85 DCFBFFFF lea    eax, dword ptr [ebp-424]
0040148D  |.  50          push eax                            ; |Format
0040148E  |.  8D85 E1FBFFFF lea    eax, dword ptr [ebp-41F]       ; |
00401494  |.  50          push eax                            ; |s
00401495  |.  E8 CE020000 call <jmp.&USER32.wsprintfA>       ; \wsprintfA// 在TempSerial前面加个'T'
0040149A  |.  8B7D 0C    mov    edi, dword ptr [ebp+C]
0040149D  |.  89F8       mov    eax, edi
0040149F  |.  0FAF45 FC    imul eax, dword ptr [ebp-4]          ;  EAX=NameLen*SUM
004014A3  |.  B9 64000000 mov    ecx, 64
004014A8  |.  99          cdq
004014A9  |.  F7F9       idiv ecx
004014AB  |.  89D7       mov    edi, edx
004014AD  |.  83C7 30    add    edi, 30
004014B0  |.  57          push edi                            ;  (NameLen*SUM)%64+30
004014B1  |.  8DBD E1FBFFFF lea    edi, dword ptr [ebp-41F]       ;  EDI=TempSerial
004014B7  |.  57          push edi
004014B8  |.  8DBD D6FBFFFF lea    edi, dword ptr [ebp-42A]
004014BE  |.  57          push edi                            ; |Format
004014BF  |.  8DBD E1FDFFFF lea    edi, dword ptr [ebp-21F]       ; |
004014C5  |.  57          push edi                            ; |s
004014C6  |.  E8 9D020000 call <jmp.&USER32.wsprintfA>       ;\wsprintfA//TempSerial='T'+TempSerial  +'-'+(NameLen*SUM)%64+30
                                                                                                                  这是完整中间注册码我的是T41856-118
004014CB  |.  83C4 20    add    esp, 20
004014CE  |.  8D8D E1FDFFFF lea    ecx, dword ptr [ebp-21F]
004014D4  |.  83C8 FF    or    eax, FFFFFFFF
004014D7  |>  40          /inc    eax
004014D8  |.  803C01 00    |cmp    byte ptr [ecx+eax], 0
004014DC  |.^ 75 F9       \jnz    short 004014D7
004014DE  |.  50          push eax                            ;  SerialLen 中间注册码的长度
004014DF  |.  8D85 E1FCFFFF lea    eax, dword ptr [ebp-31F]       ;  用户输入的验证码
004014E5  |.  50          push eax
004014E6  |.  8D85 E1FDFFFF lea    eax, dword ptr [ebp-21F]       ;  TempSerial
004014EC  |.  50          push eax
004014ED  |.  E8 D0FDFFFF call 004012C2
{
004012C2  /$  55          push ebp
004012C3  |.  89E5       mov    ebp, esp
004012C5  |.  53          push ebx
004012C6  |.  56          push esi
004012C7  |.  57          push edi
004012C8  |.  8B5D 10    mov    ebx, dword ptr [ebp+10]       ;  SerialLen
004012CB  |.  31F6       xor    esi, esi
004012CD  |.  46          inc    esi                            ;  i=1
004012CE  |.  EB 29       jmp    short 004012F9
004012D0  |>  8B55 08    /mov    edx, dword ptr [ebp+8]       ;  TempSerial
004012D3  |.  0FBE3C32    |movsx edi, byte ptr [edx+esi]       ;  EDI=TempSerial[i]
004012D7  |.  89F8       |mov    eax, edi
004012D9  |.  83F0 20    |xor    eax, 20                      ;  EAX=TempSerial[i]^0x20
004012DC  |.  B9 0A000000 |mov    ecx, 0A
004012E1  |.  99          |cdq
004012E2  |.  F7F9       |idiv ecx                            ;  EDX=(TempSerial[i]^0x20)%0xa
004012E4  |.  89D7       |mov    edi, edx
004012E6  |.  83C7 30    |add    edi, 30                      ;

另一个写注册机的关键
EDI=(TempSerial[i]^0x20)% 0xa+0x30这是还原后的真注册码

004012E9  |.  8B55 0C    |mov    edx, dword ptr [ebp+C]
004012EC  |.  0FBE1432    |movsx edx, byte ptr [edx+esi]       ;  用户输入的注册码
004012F0  |.  39D7       |cmp    edi, edx                      ;  关键比较
004012F2    74 04       je    short 004012F8
004012F4  |.  31C0       |xor    eax, eax
004012F6  |.  EB 08       |jmp    short 00401300
004012F8  |>  46          |inc    esi
004012F9  |>  39DE          cmp    esi, ebx                      ;  i和SerialLen比较
004012FB  |.^ 7C D3       \jl    short 004012D0
004012FD  |.  31C0       xor    eax, eax
004012FF  |.  40          inc    eax
00401300  |>  5F          pop    edi
00401301  |.  5E          pop    esi
00401302  |.  5B          pop    ebx
00401303  |.  5D          pop    ebp
00401304  \.  C3          retn
}
004014F2  |.  83C4 0C    add    esp, 0C
004014F5  |.  83F8 00    cmp    eax, 0
004014F8  |.  75 07       jnz    short 00401501
004014FA  |.  B8 00000000 mov    eax, 0
004014FF  |.  EB 03       jmp    short 00401504
00401501  |>  31C0       xor    eax, eax
00401503  |.  40          inc    eax
00401504  |>  5F          pop    edi
00401505  |.  5E          pop    esi
00401506  |.  5B          pop    ebx
00401507  |.  C9          leave
00401508  \.  C3          retn
}
0040158E  |.  83C4 0C    add    esp, 0C
00401591  |.  09C0       or    eax, eax
00401593  |.  74 03       je    short 00401598
00401595  |.  31C0       xor    eax, eax
00401597  |.  40          inc    eax
00401598  |>  5F          pop    edi
00401599  |.  5E          pop    esi
0040159A  |.  5B          pop    ebx
0040159B  |.  C9          leave
0040159C  \.  C3          retn

相信各位看完后，写注册码不是难事了。