CrackMe破解【6】—— 入门级别

最新推荐文章于 2021-09-15 21:21:48 发布

BetaBin

最新推荐文章于 2021-09-15 21:21:48 发布

阅读量1.8k

点赞数

CC 4.0 BY-SA版权

分类专栏：安全文章标签：破解 byte c command 算法汇编

本文链接：https://blog.youkuaiyun.com/BetaBin/article/details/7519156

安全专栏收录该内容

34 篇文章

订阅专栏

本文详细解析了一个包含反调试机制的软件的验证算法。通过对MessageBoxA函数使用的深入探讨，以及对SEH异常处理的理解，逐步揭示了账号和序列号验证的具体流程。最终通过逆向工程还原了完整的算法逻辑。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

来源：http://download.youkuaiyun.com/detail/betabin/4263238

特点：有小小的Anti-debug，貌似有SEH来anti，还有扫描了下所有进程。不过，貌似这作用不大……

个人郁闷处：这里的MessageBoxA让我纠结了一下子。对第一个参数的理解不够透彻。MSDN（http://msdn.microsoft.com/en-us/library/windows/desktop/ms645505(v=vs.85).aspx）给出的讲解如下“A handle to the owner window of the message box to be created. If this parameter is NULL, the message box has no owner window.”，这就是说第一个参数句柄决定了消息窗口的父窗口。如果为NULL的话，默认为桌面，与桌面任何窗口平级。然而这里用到了serial[11]=='U'作为第一个参数，言下之意就是如果符合的话，则返回1，而父窗口句柄为1则不显示；如果为0则以为桌面为父窗口。

思路：消息断点，走到刚刚开始的处理函数块，这里确认了下账号及序列号的简单关系（账号6位，序列号12位，且序列号对应账号奇偶位有特定关系）；然后出现了个疑似SEH，往0x00000296（貌似是这个值，忘了）中写入数据，出错。由于对SEH学习还不透彻，跟得有点晕。所以就用字符串索引到了成功Box的地方，发现了还有另外一个函数块判断。这个就偏向于算法吧。反汇编如下：

004017F0   .  55            push ebp
004017F1   .  8BEC          mov ebp,esp
004017F3   .  81EC 80000000 sub esp,80
004017F9   .  53            push ebx
004017FA   .  56            push esi
004017FB   .  57            push edi
004017FC   .  C745 FC 88354>mov dword ptr ss:[ebp-4],cm.00403588     ;  ASCII "ABCDEFGHIJKLMNOPQRSTUVWXY"
00401803   .  50            push eax
00401804   .  33C0          xor eax,eax
00401806   .  E8 00000000   call cm.0040180B
0040180B   $  58            pop eax
0040180C   .  57            push edi
0040180D   .  8D78 04       lea edi,dword ptr ds:[eax+4]
00401810   .  58            pop eax
00401811   .  5F            pop edi
00401812   .  8B45 FC       mov eax,dword ptr ss:[ebp-4]
00401815   .  8945 F8       mov dword ptr ss:[ebp-8],eax
00401818   .  C745 D8 00000>mov dword ptr ss:[ebp-28],0
0040181F   >  837D D8 18    cmp dword ptr ss:[ebp-28],18
00401823   .  0F84 92000000 je cm.004018BB
00401829   .  EB 05         jmp short cm.00401830
0040182B   $  F9            stc
0040182C   .  73 01         jnb short cm.0040182F
0040182E   .  C3            retn
0040182F   >  FFE8          jmp far eax                              ;  Illegal use of register
00401831   ?  F6FF          idiv bh
00401833   ?  FFFF          ???                                      ;  Unknown command
00401835   .  0FBE0D 6C4140>movsx ecx,byte ptr ds:[40416C]
0040183C   .  8B55 FC       mov edx,dword ptr ss:[ebp-4]
0040183F   .  0FBE02        movsx eax,byte ptr ds:[edx]
00401842   .  83C0 20       add eax,20
00401845   .  3BC8          cmp ecx,eax
00401847   .  74 21         je short cm.0040186A
00401849   .  68 6C414000   push cm.0040416C                         ; /s = "gcngcp"
0040184E   .  E8 AD0B0000   call <jmp.&MSVCRT.strlen>                ; \strlen
00401853   .  83C4 04       add esp,4
00401856   .  0FBE88 6B4140>movsx ecx,byte ptr ds:[eax+40416B]
0040185D   .  8B55 FC       mov edx,dword ptr ss:[ebp-4]
00401860   .  0FBE02        movsx eax,byte ptr ds:[edx]
00401863   .  83C0 20       add eax,20
00401866   .  3BC8          cmp ecx,eax
00401868   .  75 09         jnz short cm.00401873
0040186A   >  8B4D FC       mov ecx,dword ptr ss:[ebp-4]
0040186D   .  83C1 01       add ecx,1
00401870   .  894D FC       mov dword ptr ss:[ebp-4],ecx
00401873   >  8B55 D8       mov edx,dword ptr ss:[ebp-28]
00401876   .  8B45 FC       mov eax,dword ptr ss:[ebp-4]
00401879   .  8A08          mov cl,byte ptr ds:[eax]
0040187B   .  884C15 DC     mov byte ptr ss:[ebp+edx-24],cl
0040187F   .  8B55 D8       mov edx,dword ptr ss:[ebp-28]
00401882   .  83C2 01       add edx,1
00401885   .  8955 D8       mov dword ptr ss:[ebp-28],edx
00401888   .  8B45 FC       mov eax,dword ptr ss:[ebp-4]
0040188B   .  83C0 02       add eax,2
0040188E   .  8945 FC       mov dword ptr ss:[ebp-4],eax
00401891   .  EB 05         jmp short cm.00401898
00401893   $  F9            stc
00401894   .  73 01         jnb short cm.00401897
00401896   .  C3            retn
00401897   >  FFE8          jmp far eax                              ;  Illegal use of register
00401899   ?  F6FF          idiv bh
0040189B   ?  FFFF          ???                                      ;  Unknown command
0040189D   .  8B4D FC       mov ecx,dword ptr ss:[ebp-4]
004018A0   .  0FBE11        movsx edx,byte ptr ds:[ecx]
004018A3   .  85D2          test edx,edx
004018A5   .  75 0F         jnz short cm.004018B6
004018A7   .  837D D8 18    cmp dword ptr ss:[ebp-28],18
004018AB   .  7D 09         jge short cm.004018B6
004018AD   .  8B45 F8       mov eax,dword ptr ss:[ebp-8]
004018B0   .  83C0 01       add eax,1
004018B3   .  8945 FC       mov dword ptr ss:[ebp-4],eax
004018B6   >^ E9 64FFFFFF   jmp cm.0040181F
004018BB   >  6A 00         push 0                                   ; /Style = MB_OK|MB_APPLMODAL
004018BD   .  68 60354000   push cm.00403560                         ; |Title = "错了!"
004018C2   .  68 54354000   push cm.00403554                         ; |Text = "继续努力!"
004018C7   .  0FBE0D F64040>movsx ecx,byte ptr ds:[4040F6]           ; |
004018CE   .  83E9 55       sub ecx,55                               ; |
004018D1   .  F7D9          neg ecx                                  ; |
004018D3   .  1BC9          sbb ecx,ecx                              ; |
004018D5   .  41            inc ecx                                  ; |
004018D6   .  51            push ecx                                 ; |hOwner
004018D7   .  FF15 00324000 call dword ptr ds:[<&USER32.MessageBoxA>>; \MessageBoxA
004018DD   .  8945 D8       mov dword ptr ss:[ebp-28],eax
004018E0   .  837D D8 00    cmp dword ptr ss:[ebp-28],0
004018E4   .  74 15         je short cm.004018FB
004018E6   .  FF15 20304000 call dword ptr ds:[<&KERNEL32.GetCurrent>; [GetCurrentProcess
004018EC   .  8945 D4       mov dword ptr ss:[ebp-2C],eax
004018EF   .  6A 00         push 0                                   ; /ExitCode = 0
004018F1   .  8B55 D4       mov edx,dword ptr ss:[ebp-2C]            ; |
004018F4   .  52            push edx                                 ; |hProcess
004018F5   .  FF15 00304000 call dword ptr ds:[<&KERNEL32.TerminateP>; \TerminateProcess
004018FB   >  C745 D8 00000>mov dword ptr ss:[ebp-28],0
00401902   .  C745 D0 05000>mov dword ptr ss:[ebp-30],5
00401909   .  C745 CC 00000>mov dword ptr ss:[ebp-34],0
00401910   >  837D D8 0C    cmp dword ptr ss:[ebp-28],0C
00401914   .  0F84 BB000000 je cm.004019D5
0040191A   .  8B45 D0       mov eax,dword ptr ss:[ebp-30]
0040191D   .  8D0C85 FCFFFF>lea ecx,dword ptr ds:[eax*4-4]
00401924   .  894D C8       mov dword ptr ss:[ebp-38],ecx
00401927   >  8B55 D8       mov edx,dword ptr ss:[ebp-28]
0040192A   .  0FBE82 EC4040>movsx eax,byte ptr ds:[edx+4040EC]
00401931   .  8B4D C8       mov ecx,dword ptr ss:[ebp-38]
00401934   .  0FBE540D DC   movsx edx,byte ptr ss:[ebp+ecx-24]
00401939   .  8B4D C8       mov ecx,dword ptr ss:[ebp-38]
0040193C   .  83C1 01       add ecx,1
0040193F   .  894D C8       mov dword ptr ss:[ebp-38],ecx
00401942   .  3BC2          cmp eax,edx
00401944   .  74 13         je short cm.00401959
00401946   .  8B55 CC       mov edx,dword ptr ss:[ebp-34]
00401949   .  83C2 01       add edx,1
0040194C   .  8955 CC       mov dword ptr ss:[ebp-34],edx
0040194F   .  837D CC 04    cmp dword ptr ss:[ebp-34],4
00401953   .  7E 02         jle short cm.00401957
00401955   .  EB 02         jmp short cm.00401959
00401957   >^ EB CE         jmp short cm.00401927
00401959   >  837D CC 05    cmp dword ptr ss:[ebp-34],5
0040195D   .  75 3F         jnz short cm.0040199E
0040195F   .  C745 C4 78354>mov dword ptr ss:[ebp-3C],cm.00403578    ;  ASCII "ABCDEFGHIJKLMN"
00401966   .  C745 C0 68354>mov dword ptr ss:[ebp-40],cm.00403568    ;  ASCII "OPQRSTUVWXYZ"
0040196D   .  50            push eax
0040196E   .  8D85 C4FFFFFF lea eax,dword ptr ss:[ebp-3C]
00401974   .  50            push eax
00401975   .  FF75 C0       push dword ptr ss:[ebp-40]
00401978   .  58            pop eax
00401979   .  58            pop eax
0040197A   .  58            pop eax
0040197B   .  8945 CC       mov dword ptr ss:[ebp-34],eax
0040197E   .  837D CC 00    cmp dword ptr ss:[ebp-34],0
00401982   .  7E 07         jle short cm.0040198B
00401984   .  E8 27FEFFFF   call cm.004017B0
00401989   .  EB 0E         jmp short cm.00401999
0040198B   >  50            push eax
0040198C   .  8D85 C4FFFFFF lea eax,dword ptr ss:[ebp-3C]
00401992   .  50            push eax
00401993   .  FF75 C0       push dword ptr ss:[ebp-40]
00401996   .  58            pop eax
00401997   .  58            pop eax
00401998   .  58            pop eax
00401999   >  E8 12FEFFFF   call cm.004017B0
0040199E   >  8B45 D8       mov eax,dword ptr ss:[ebp-28]
004019A1   .  83C0 02       add eax,2
004019A4   .  8945 D8       mov dword ptr ss:[ebp-28],eax
004019A7   .  8B4D D0       mov ecx,dword ptr ss:[ebp-30]
004019AA   .  83E9 01       sub ecx,1
004019AD   .  894D D0       mov dword ptr ss:[ebp-30],ecx
004019B0   .  EB 05         jmp short cm.004019B7
004019B2   $  F9            stc
004019B3   .  73 01         jnb short cm.004019B6
004019B5   .  C3            retn
004019B6   >  FFE8          jmp far eax                              ;  Illegal use of register
004019B8   ?  F6FF          idiv bh
004019BA   ?  FFFF          ???                                      ;  Unknown command
004019BC   .  837D D0 00    cmp dword ptr ss:[ebp-30],0
004019C0   .  75 07         jnz short cm.004019C9
004019C2   .  C745 D0 06000>mov dword ptr ss:[ebp-30],6
004019C9   >  C745 CC 00000>mov dword ptr ss:[ebp-34],0
004019D0   .^ E9 3BFFFFFF   jmp cm.00401910
004019D5   >  E8 96FDFFFF   call cm.00401770
004019DA   .  5F            pop edi
004019DB   .  5E            pop esi
004019DC   .  5B            pop ebx
004019DD   .  8BE5          mov esp,ebp
004019DF   .  5D            pop ebp
004019E0   .  C3            retn

然后自己逆了下算法伪代码如下：

val_4 = &("ABCDEFGHIJKLMNOPQRSTUVWXY");
val_8 = val_4;
val_28 = 0;
char val_24[28];//由24h-8h=28而来

//18h == 24;
//val_24数组初始化
while (val_28 != 18h)
{
	if (name[0] == val_4[0] + 20h || name[5] == val_4[0] + 20h)
	{
		val_4++;
	}
	
	val_24[val_28++] = val_4[0];
	val_4 += 2h;
	
	if (val_4[0] == 0 && val_28 < 18h)
	{
		val_4 = val_8 + 1;
	}
}

//序列号倒数第二位是'U'；
if (serial[10] != 'U')
{
	return failure;
}
	
val_28 = 0;
val_30 = 5;
val_34 = 0;
	
//0ch == 12；
while (val_28 != 0ch)
{
	val_38 = val_30 * 4 - 4;
	
	do
	{
		eax = Serial[val_28];
		edx = val_24[val_38++];
		if (eax == edx)
		{
			break;
		}
		val_34++;
	}while(val_34 <= 4);
	
	//不能为5否则错误
	if (val_34 == 5)
	{
		val_3c = &("ABCDEFGHIJKLMN");
		val_40 = &("OPQRSTUVWXYZ");
		if (eax > 0)
		{
			return failure;
		}
		return failure;
	}
	
	val_28 += 2;
	val_30--;
	
	if (!val_30)
	{
		val_30 = 6;
	}
	
	val_34 = 0;
}

return success;

最后，注册机，有空再写，其实也不难，有点小烦的，呵呵。