系统 ： Windows xp
程序 ： noodles-crackme2
程序下载地址 ：http://pan.baidu.com/s/1mhJ4Ems
要求 ： 编写KeyFile
使用工具 ： OD
可在看雪论坛中查找关于此程序的破文：传送门
废话不多说，直接下断点
CreateFileA
断在系统函数中，然后ctrl+k查看调用栈，回溯到文件处理代码：
00401499 > \6A 00 push 0x0 ; /hTemplateFile = NULL 0040149B . 68 80000000 push 0x80 ; |Attributes = NORMAL 004014A0 . 6A 03 push 0x3 ; |Mode = OPEN_EXISTING 004014A2 . 6A 00 push 0x0 ; |pSecurity = NULL 004014A4 . 6A 00 push 0x0 ; |ShareMode = 0 004014A6 . 68 00000080 push 0x80000000 ; |Access = GENERIC_READ 004014AB . 68 F1354000 push noodles-.004035F1 ; |FileName = "spook.key" 004014B0 . E8 6F010000 call <jmp.&KERNEL32.CreateFileA> ; \CreateFileA 004014B5 . 83F8 FF cmp eax,-0x1 004014B8 . 0F84 99000000 je noodles-.00401557 004014BE . A3 E9354000 mov dword ptr ds:[0x4035E9],eax 004014C3 . FF35 E9354000 push dword ptr ds:[0x4035E9] ; /hFile = NULL 004014C9 . E8 32010000 call <jmp.&KERNEL32.GetFileType> ; \GetFileType 004014CE . 68 FB354000 push noodles-.004035FB ; /pFileSizeHigh = noodles-.004035FB 004014D3 . FF35 E9354000 push dword ptr ds:[0x4035E9] ; |hFile = NULL 004014D9 . E8 1C010000 call <jmp.&KERNEL32.GetFileSize> ; \GetFileSize 004014DE . A3 ED354000 mov dword ptr ds:[0x4035ED],eax 004014E3 . 83F8 08 cmp eax,0x8 ; 大小是否等于8？ 004014E6 . 75 6F jnz Xnoodles-.00401557 004014E8 . 6A 00 push 0x0 ; /pOverlapped = NULL 004014EA . 68 FB354000 push noodles-.004035FB ; |pBytesRead = noodles-.004035FB 004014EF . 50 push eax ; |BytesToRead 004014F0 . 68 FF354000 push noodles-.004035FF ; |Buffer = noodles-.004035FF 004014F5 . FF35 E9354000 push dword ptr ds:[0x4035E9] ; |hFile = NULL 004014FB . E8 BE000000 call <jmp.&KERNEL32.ReadFile> ; \ReadFile 00401500 . 85C0 test eax,eax 00401502 . 74 53 je Xnoodles-.00401557 00401504 . 33C0 xor eax,eax 00401506 . FF35 E9354000 push dword ptr ds:[0x4035E9] ; /hObject = NULL 0040150C . E8 A7000000 call <jmp.&KERNEL32.CloseHandle> ; \CloseHandle 00401511 . B8 FF354000 mov eax,noodles-.004035FF 00401516 . C100 05 rol dword ptr ds:[eax],0x5 00401519 . 8300 0F add dword ptr ds:[eax],0xF 0040151C . C148 04 07 ror dword ptr ds:[eax+0x4],0x7 00401520 . 8368 04 05 sub dword ptr ds:[eax+0x4],0x5 00401524 . 8178 04 BDD84>cmp dword ptr ds:[eax+0x4],0xC642D8BD 0040152B . 75 2A jnz Xnoodles-.00401557 0040152D . 8138 FC098E2E cmp dword ptr ds:[eax],0x2E8E09FC 00401533 . 75 22 jnz Xnoodles-.00401557 00401535 . 68 88130000 push 0x1388 0040153A . 68 94334000 push noodles-.00403394 ; /Text = "Your keyfile is fine happy happy joy joy" 0040153F . 68 8B130000 push 0x138B ; |ControlID = 138B (5003.) 00401544 . FF75 08 push dword ptr ss:[ebp+0x8] ; |hWnd 00401547 . E8 62010000 call <jmp.&USER32.SetDlgItemTextA> ; \SetDlgItemTextA 0040154C . 8B25 BD334000 mov esp,dword ptr ds:[0x4033BD] 00401552 .^ E9 CBFDFFFF jmp noodles-.00401322 00401557 > 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL 00401559 . 68 63364000 push noodles-.00403663 ; |Title = "Error!" 0040155E . 68 6A364000 push noodles-.0040366A ; |Text = "Ketfile not present or incorrect" 00401563 . 6A 00 push 0x0 ; |hOwner = NULL 00401565 . E8 4A010000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA 0040156A . 6A 01 push 0x1 ; /ExitCode = 1 0040156C . E8 5F000000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
可以看出这是一个很简单的数据运算过程，只要反推四步即可得到keyfile的内容。
以下上生成keyfile的c++代码：
#include <iostream>
#include <fstream>
using namespace std;
int main( void )
{
unsigned int v1 = 0x2E8E09FC,v2 = 0xC642D8BD;
__asm{
push eax
push ebx
mov eax,v1
mov ebx,v2
sub eax,0xF
ror eax,0x5
add ebx,0x5
rol ebx,0x7
mov v1,eax
mov v2,ebx
pop ebx
pop eax
}
ofstream out( "spook.key",ios::out | ios::binary | ios::trunc );
if ( out.is_open() ){
out.write( (const char *)&v1,4 );
out.write( (const char *)&v2,4 );
}
else
cout << "Open file failed." << endl;
out.close();
return 0;
}
给出可用的KeyFIle内容：
4F 70 74 69 63 61 6C 21
时间： 2024-10-22 06:07:30