文章作者：Crack_Qs[4st][PDG]
使用工具：Vs 2013、ollydbg 1.10
测试平台：windows 7 x64
/////////////////////////////////////////////////////////////////////////////////////////////////////
验证CALL：
013C1050 /$ 55 PUSH EBP ; 验证CALL
013C1051 |. 8BEC MOV EBP, ESP
013C1053 |. 51 PUSH ECX
013C1054 |. C745 FC 00000>MOV DWORD PTR SS:[EBP-0x4], 0x0 ; 循环计数器清0
013C105B |. EB 09 JMP SHORT Test.013C1066
013C105D |> 8B45 FC /MOV EAX, DWORD PTR SS:[EBP-0x4]
013C1060 |. 83C0 01 |ADD EAX, 0x1
013C1063 |. 8945 FC |MOV DWORD PTR SS:[EBP-0x4], EAX
013C1066 |> 837D FC 07 CMP DWORD PTR SS:[EBP-0x4], 0x7 ; 循环比较7次
013C106A |. 73 3A |JNB SHORT Test.013C10A6
013C106C |. 6A 04 |PUSH 0x4 ; int nCount;
013C106E |. 8B4D FC |MOV ECX, DWORD PTR SS:[EBP-0x4]
013C1071 |. 8B55 0C |MOV EDX, DWORD PTR SS:[EBP+0xC]
013C1074 |. 8D048A |LEA EAX, DWORD PTR DS:[EDX+ECX*4]
013C1077 |. 50 |PUSH EAX
013C1078 |. E8 83FFFFFF |CALL Test.013C1000 ; void Encryption(char *pInputBuf,int nCount);
013C107D |. 83C4 08 |ADD ESP, 0x8
013C1080 |. 8B4D FC |MOV ECX, DWORD PTR SS:[EBP-0x4]
013C1083 |. 39048D 18303C>|CMP DWORD PTR DS:[ECX*4+0x13C3018],>
013C108A |. 74 18 |JE SHORT Test.013C10A4
013C108C |. 6A 00 |PUSH 0x0 ; /Style = MB_OK|MB_APPLMODAL
013C108E |. 68 E8203C01 |PUSH Test.013C20E8 ; |Title = "ISG 2014"
013C1093 |. 68 F4203C01 |PUSH Test.013C20F4 ; |Text = "Wrong"
013C1098 |. 8B55 08 |MOV EDX, DWORD PTR SS:[EBP+0x8] ; |
013C109B |. 52 |PUSH EDX ; |hOwner
013C109C |. FF15 BC203C01 |CALL NEAR DWORD PTR DS:[<&USER32.Mes>; \MessageBoxA
013C10A2 |. EB 18 |JMP SHORT Test.013C10BC
013C10A4 |>^ EB B7 \JMP SHORT Test.013C105D
013C10A6 |> 6A 00 PUSH 0x0 ; /Style = MB_OK|MB_APPLMODAL
013C10A8 |. 68 FC203C01 PUSH Test.013C20FC ; |Title = "ISG 2014"
013C10AD |. 68 08213C01 PUSH Test.013C2108 ; |Text = "Correct!!"
013C10B2 |. 8B45 08 MOV EAX, DWORD PTR SS:[EBP+0x8] ; |
013C10B5 |. 50 PUSH EAX ; |hOwner
013C10B6 |. FF15 BC203C01 CALL NEAR DWORD PTR DS:[<&USER32.Mess>; \MessageBoxA
013C10BC |> 8BE5 MOV ESP, EBP
013C10BE |. 5D POP EBP
013C10BF \. C3 RETN
算法CALL：
013C1000 /$ 55 PUSH EBP void Encryption(char *pInputBuf,int nCount)：
013C1001 |. 8BEC MOV EBP, ESP
013C1003 |. 83EC 0C SUB ESP, 0xC
013C1006 |. C745 F8 83000>MOV DWORD PTR SS:[EBP-0x8], 0x83 ; nNum = 0x83
013C100D |. C745 FC 00000>MOV DWORD PTR SS:[EBP-0x4], 0x0 ; nKey = 0
013C1014 |. C745 F4 00000>MOV DWORD PTR SS:[EBP-0xC], 0x0 ; int i 循环计数器
013C101B |. EB 09 JMP SHORT Test.013C1026
013C101D |> 8B45 F4 /MOV EAX, DWORD PTR SS:[EBP-0xC]
013C1020 |. 83C0 01 |ADD EAX, 0x1
013C1023 |. 8945 F4 |MOV DWORD PTR SS:[EBP-0xC], EAX
013C1026 |> 8B4D F4 MOV ECX, DWORD PTR SS:[EBP-0xC]
013C1029 |. 3B4D 0C |CMP ECX, DWORD PTR SS:[EBP+0xC]
013C102C |. 73 17 |JNB SHORT Test.013C1045
013C102E |. 8B55 FC |MOV EDX, DWORD PTR SS:[EBP-0x4]
013C1031 |. 0FAF55 F8 |IMUL EDX, DWORD PTR SS:[EBP-0x8] ; nKey * nNum
013C1035 |. 8B45 08 |MOV EAX, DWORD PTR SS:[EBP+0x8]
013C1038 |. 0345 F4 |ADD EAX, DWORD PTR SS:[EBP-0xC]
013C103B |. 0FB608 |MOVZX ECX, BYTE PTR DS:[EAX]
013C103E |. 03D1 |ADD EDX, ECX ; nKey * nNum + pInputBuf[i]
013C1040 |. 8955 FC |MOV DWORD PTR SS:[EBP-0x4], EDX ; nKey = nKey * nNum + pInputBuf[i];
013C1043 |.^ EB D8 \JMP SHORT Test.013C101D
013C1045 |> 8B45 FC MOV EAX, DWORD PTR SS:[EBP-0x4]
013C1048 |. 8BE5 MOV ESP, EBP
013C104A |. 5D POP EBP
013C104B \. C3 RETN
其加密算法逆向后得知：
void Encryption1(char *pInputBuf,int nCount)
{
int nKey = 0;for (int i = 0; i < nCount ; i++)
{
nKey = (0x83 * nKey) + pInputBuf[i];
}
}
也就是说：
nKey = (0x83 * nKey ) + pInputBuf[0]
nKey = (0x83 * nKey ) + pInputBuf[1]
nKey = (0x83 * nKey ) + pInputBuf[2]
nKey = (0x83 * nKey ) + pInputBuf[3]
如此循环4次，计算完一次校验的值，那也就是说：
nKey == 0x83 * 0x83 * 0x83 * pInputBuf[1] + 0x83 * 0x83 * pInputBuf[1] + 0x83 * pInputBuf[2] + pInputBuf[3]
01361083 |. 39048D 183036>|CMP DWORD PTR DS:[ECX*4+0x1363018],>
data_0x1363018:
01363018 E5 AD 50 0D 89 27 30 0E 1F 6F D6 0E FF 63 D4 0C 瀛P.?0o?c?
01363028 DD 94 0D 0E 1F 46 A4 0F A2 1D D9 0C 輸.F???....
通过分析，知道该题是分为7次验证,验证的值为：0x0D50ADE5、0x0E302789、0x0ED66F1F、0x0CD463FF、0x0E0D94DD、0x0FA4461F、0x0CD91DA2
解密算法如下（以下代码肯定不是最优解）：
void Decryption()
{
int szKeyNum[] = {
0x0D50ADE5,0x0E302789,0x0ED66F1F,0x0CD463FF,
0x0E0D94DD,0x0FA4461F,0x0CD91DA2
};
char szBuf[40] = {0};for (int i = 0,nCount = 0; i < 7; i++, nCount+= 4)
{
for (int nBuf1 = 0; nBuf1 < 127; nBuf1++)
{
for (int nBuf2 = 0; nBuf2 < 127; nBuf2++)
{
for (int nBuf3 = 0; nBuf3 < 127; nBuf3++)
{
for (int nBuf4 = 0; nBuf4 < 127; nBuf4++)
{
if (szKeyNum[i] == 0x83 * 0x83 * 0x83 * nBuf1
+0x83 * 0x83 * nBuf2
+0x83 * nBuf3 + nBuf4)
{
szBuf[nCount+0] = nBuf1;
szBuf[nCount+1] = nBuf2;
szBuf[nCount+2] = nBuf3;
szBuf[nCount+3] = nBuf4;
}
}
}
}
}
}
printf("Key:%s\r\n",szBuf);
}
程序输出 Key:c011isi0n_is_a_thre4t_t0_sec
CrackMe附件：
链接: http://pan.baidu.com/s/1o61CIq2 密码: xkmn