研究了幾天....
要求輸入帳號(hào) 密碼
隨意輸入 后 提示錯(cuò)誤。
00401410 . 53 push ebx
00401411 . 55 push ebp
00401412 . 56 push esi
00401413 . 57 push edi
00401414 . 8BF9 mov edi,ecx
00401416 . 6A 01 push 0x1
00401418 . E8 93030000 call
0040141D . 83C4 04 add esp,0x4
00401420 . 85C0 test eax,eax
00401422 . 74 07 je Xruhua.0040142B ; eax
00401424 . C600 18 mov byte ptr ds:[eax],0x18 ; eax為一個(gè)堆地址 [eax]=18
00401427 . 8BD8 mov ebx,eax ; 移棧
00401429 . EB 02 jmp Xruhua.0040142D
0040142B > 33DB xor ebx,ebx
0040142D > 6A 01 push 0x1
0040142F . E8 7C030000 call
00401434 . 83C4 04 add esp,0x4
00401437 . 85C0 test eax,eax
00401439 . 74 07 je Xruhua.00401442
0040143B . C600 18 mov byte ptr ds:[eax],0x18
0040143E . 8BF0 mov esi,eax
00401440 . EB 02 jmp Xruhua.00401444
00401442 > 33F6 xor esi,esi
00401444 > 6A 14 push 0x14
00401446 . 53 push ebx
00401447 . 8D8F A0000000 lea ecx,dword ptr ds:[edi+0xA0]
0040144D . E8 58030000 call
00401452 . 6A 14 push 0x14
00401454 . 56 push esi
00401455 . 8D4F 60 lea ecx,dword ptr ds:[edi+0x60]
00401458 . E8 4D030000 call
0040145D . 8BFB mov edi,ebx
0040145F . 83C9 FF or ecx,0xFFFFFFFF
00401462 . 33C0 xor eax,eax
00401464 . F2:AE repne scas byte ptr es:[edi] ; 串搜索
00401466 . F7D1 not ecx
00401468 . 49 dec ecx ; ecx = 6
00401469 . 8BFE mov edi,esi
0040146B . 8BE9 mov ebp,ecx ; 帳號(hào)
0040146D . 83C9 FF or ecx,0xFFFFFFFF
00401470 . F2:AE repne scas byte ptr es:[edi]
00401472 . F7D1 not ecx
00401474 . 49 dec ecx
00401475 . 83FD 0A cmp ebp,0xA ; 帳號(hào)長(zhǎng)度＞10 結(jié)束
00401478 . 77 60 ja Xruhua.004014DA
0040147A . 83F9 0A cmp ecx,0xA ; 密碼長(zhǎng)度＞10 結(jié)束
0040147D . 77 5B ja Xruhua.004014DA
0040147F . 53 push ebx
00401480 . E8 7B000000 call ruhua.00401500 ; 賬戶 每個(gè)元素 xor 3 - 0x14
00401485 . 56 push esi
00401486 . E8 A5000000 call ruhua.00401530 ; 密碼 每個(gè)元素 add 2 xor 0x10
0040148B . 83C4 08 add esp,0x8
0040148E > 8A0B mov cl,byte ptr ds:[ebx] ; cl存加密后的賬戶
00401490 . 8A16 mov dl,byte ptr ds:[esi] ; dl 存加密后的密碼
00401492 . 8AC1 mov al,cl
00401494 . 3ACA cmp cl,dl
00401496 75 1E jnz Xruhua.004014B6 ; 關(guān)鍵跳
00401498 . 84C0 test al,al
0040149A . 74 16 je Xruhua.004014B2 ; al = 0 跳
0040149C . 8A53 01 mov dl,byte ptr ds:[ebx+0x1]
0040149F . 8A4E 01 mov cl,byte ptr ds:[esi+0x1]
004014A2 . 8AC2 mov al,dl
004014A4 . 3AD1 cmp dl,cl
004014A6 . 75 0E jnz Xruhua.004014B6
004014A8 . 83C3 02 add ebx,0x2
004014AB . 83C6 02 add esi,0x2
004014AE . 84C0 test al,al ; al = 0
004014B0 ^ 75 DC jnz Xruhua.0040148E ; while
004014B2 > 33C0 xor eax,eax
004014B4 . EB 05 jmp Xruhua.004014BB
004014B6 > 1BC0 sbb eax,eax
004014B8 . 83D8 FF sbb eax,-0x1
004014BB > 85C0 test eax,eax ; eax=0?
004014BD 75 1B jnz Xruhua.004014DA ; ZF = 0
004014BF . 85ED test ebp,ebp
004014C1 74 17 je Xruhua.004014DA
004014C3 . 50 push eax ; /Style
004014C4 . 68 50304000 push ruhua.00403050 ; |Ok
004014C9 . 68 2C304000 push ruhua.0040302C ; |Congratulations!This is the key!
004014CE . 50 push eax ; |hOwner
004014CF . FF15 D8214000 call dword ptr ds:[<&USER32.MessageBoxA>>; \MessageBoxA
004014D5 . 5F pop edi
004014D6 . 5E pop esi
004014D7 . 5D pop ebp
004014D8 . 5B pop ebx
004014D9 . C3 retn
004014DA > 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL
004014DC . 68 28304000 push ruhua.00403028 ; |Msg
004014E1 . 68 20304000 push ruhua.00403020 ; |Wrong!
004014E6 . 6A 00 push 0x0 ; |hOwner = NULL
004014E8 . FF15 D8214000 call dword ptr ds:[<&USER32.MessageBoxA>>; \MessageBoxA
004014EE . 5F pop edi
004014EF . 5E pop esi
004014F0 . 5D pop ebp
004014F1 . 5B pop ebx
004014F2 . C3 retn
基本流程就是 輸入帳號(hào)密碼，進(jìn)入帳號(hào)加密子程序，進(jìn)入密碼加密子程序
上圖是帳號(hào)密碼的子程序
上圖為帳號(hào)加密過(guò)程
上圖為密碼加密過(guò)程
這一段比較模糊，不是很懂,最后翻看IDA 最后得知是strcmp()操作，也即將原來(lái)加密后的帳號(hào)與加密后的密碼進(jìn)行比較，若相同則OK.
IDA XX后的代碼，果然是最強(qiáng)王者級(jí)別逆向工具。
int __thiscall sub_401410(void *this)
{
void *v1; // edi@1
int v2; // eax@1
char *v3; // ebx@2
int v4; // eax@4
char *v5; // esi@5
unsigned int v6; // kr04_4@7
unsigned int v7; // kr0C_4@7
int result; // eax@11
v1 = this;
v2 = operator new();
if ( v2 )
{
*(_BYTE *)v2 = 24;
v3 = (char *)v2;
}
else
{
v3 = 0;
}
v4 = operator new();
if ( v4 )
{
*(_BYTE *)v4 = 24;
v5 = (char *)v4;
}
else
{
v5 = 0;
}
CWnd::GetWindowTextA((CWnd *)((char *)v1 + 160), v3, 20);
CWnd::GetWindowTextA((CWnd *)((char *)v1 + 96), v5, 20);
v6 = strlen(v3) + 1; // v6 帳號(hào)
// v7 密碼
v7 = strlen(v5) + 1;
if ( v6 - 1 > 0xA || v7 - 1 > 0xA || (sub_401500(v3), sub_401530(v5), strcmp(v3, v5)) || v6 == 1 )
result = MessageBoxA(0, "Wrong!", "Msg", 0);
else
result = MessageBoxA(0, "Congratulations!This is the key!", "Ok", 0);
return result;
}
另外有需要云服務(wù)器可以了解下創(chuàng)新互聯(lián)scvps.cn，海內(nèi)外云服務(wù)器15元起步，三天無(wú)理由+7*72小時(shí)售后在線，公司持有idc許可證，提供“云服務(wù)器、裸金屬服務(wù)器、高防服務(wù)器、香港服務(wù)器、美國(guó)服務(wù)器、虛擬主機(jī)、免備案服務(wù)器”等云主機(jī)租用服務(wù)以及企業(yè)上云的綜合解決方案，具有“安全穩(wěn)定、簡(jiǎn)單易用、服務(wù)可用性高、性價(jià)比高”等特點(diǎn)與優(yōu)勢(shì)，專為企業(yè)上云打造定制，能夠滿足用戶豐富、多元化的應(yīng)用場(chǎng)景需求。
重慶分公司
重慶分公司
