160 - 28 CoSH.2

最新推荐文章于 2023-08-23 12:53:28 发布

原创最新推荐文章于 2023-08-23 12:53:28 发布 · 424 阅读

1 ·

CC 4.0 BY-SA版权

160个CrackMe 专栏收录该内容

48 篇文章

订阅专栏

本文分析了一个无壳MFC程序的验证流程，通过OllyDbg和字符串搜索定位了程序验证逻辑的关键部分。该程序检查输入的Name和Serial是否符合特定格式，长度至少为5个字符，并详细展示了如何跟踪和理解这一过程。

环境
Windows xp sp3

工具
exeinfope
ollydbg

查壳
无壳的MFC程序

测试

输入
Nmae:123456
Serial:12345

点击“CHECK”后弹出错误提示的消息框，然后程序自己结束掉

依然是字符串搜索：

004014DB   .  8B1D FC214000 mov ebx,dword ptr ds:[<&USER32.PostQuitMessag>;  USER32.PostQuitMessage
004014E1   .  83F8 05       cmp eax,0x5
004014E4   .  7E 50         jle XCoSH_2.00401536
004014E6   .  8D6E 60       lea ebp,dword ptr ds:[esi+0x60]
004014E9   .  8BCD          mov ecx,ebp
004014EB   .  E8 5A030000   call <jmp.&MFC42.#CWnd::GetWindowTextLengthA_>
004014F0   .  83F8 05       cmp eax,0x5
004014F3   .  7E 41         jle XCoSH_2.00401536
004014F5   .  8D86 E0000000 lea eax,dword ptr ds:[esi+0xE0]
004014FB   .  8BCF          mov ecx,edi
004014FD   .  50            push eax
004014FE   .  E8 41030000   call <jmp.&MFC42.#CWnd::GetWindowTextA_3874>
00401503   .  8DBE E4000000 lea edi,dword ptr ds:[esi+0xE4]
00401509   .  8BCD          mov ecx,ebp
0040150B   .  57            push edi
0040150C   .  E8 33030000   call <jmp.&MFC42.#CWnd::GetWindowTextA_3874>
00401511   .  8B07          mov eax,dword ptr ds:[edi]
00401513   .  8038 36       cmp byte ptr ds:[eax],0x36
00401516   .  75 1E         jnz XCoSH_2.00401536
00401518   .  8078 01 32    cmp byte ptr ds:[eax+0x1],0x32
0040151C   .  75 18         jnz XCoSH_2.00401536
0040151E   .  8078 02 38    cmp byte ptr ds:[eax+0x2],0x38
00401522   .  75 12         jnz XCoSH_2.00401536
00401524   .  8078 03 37    cmp byte ptr ds:[eax+0x3],0x37
00401528   .  75 0C         jnz XCoSH_2.00401536
0040152A   .  8078 04 2D    cmp byte ptr ds:[eax+0x4],0x2D
0040152E   .  75 06         jnz XCoSH_2.00401536
00401530   .  8078 05 41    cmp byte ptr ds:[eax+0x5],0x41
00401534   .  74 17         je XCoSH_2.0040154D
00401536   >  6A 00         push 0x0
00401538   .  68 64304000   push CoSH_2.00403064                          ;  ASCII "ERROR"
0040153D   .  68 38304000   push CoSH_2.00403038                          ;  ASCII "One of the Details you entered was wrong"
00401542   .  8BCE          mov ecx,esi
00401544   .  E8 F5020000   call <jmp.&MFC42.#CWnd::MessageBoxA_4224>
00401549   .  6A 00         push 0x0
0040154B   .  FFD3          call ebx
0040154D   >  8D8E E0000000 lea ecx,dword ptr ds:[esi+0xE0]
00401553   .  8D5424 14     lea edx,dword ptr ss:[esp+0x14]
00401557   .  51            push ecx
00401558   .  68 2C304000   push CoSH_2.0040302C                          ;  ASCII "Well done,"
0040155D   .  52            push edx
0040155E   .  E8 D5020000   call <jmp.&MFC42.#operator+_926>
00401563   .  68 3C314000   push CoSH_2.0040313C
00401568   .  50            push eax
00401569   .  8D4424 18     lea eax,dword ptr ss:[esp+0x18]
0040156D   .  C74424 28 000>mov dword ptr ss:[esp+0x28],0x0
00401575   .  50            push eax
00401576   .  E8 B7020000   call <jmp.&MFC42.#operator+_924>
0040157B   .  8B00          mov eax,dword ptr ds:[eax]
0040157D   .  6A 00         push 0x0
0040157F   .  68 20304000   push CoSH_2.00403020                          ;  ASCII "YOU DID IT"
00401584   .  50            push eax
00401585   .  8BCE          mov ecx,esi
00401587   .  C64424 2C 01  mov byte ptr ss:[esp+0x2C],0x1
0040158C   .  E8 AD020000   call <jmp.&MFC42.#CWnd::MessageBoxA_4224>

[00401513]处开始比较内容:

00401513   .  8038 36       cmp byte ptr ds:[eax],0x36
00401516   .  75 1E         jnz XCoSH_2.00401536
00401518   .  8078 01 32    cmp byte ptr ds:[eax+0x1],0x32
0040151C   .  75 18         jnz XCoSH_2.00401536
0040151E   .  8078 02 38    cmp byte ptr ds:[eax+0x2],0x38
00401522   .  75 12         jnz XCoSH_2.00401536
00401524   .  8078 03 37    cmp byte ptr ds:[eax+0x3],0x37
00401528   .  75 0C         jnz XCoSH_2.00401536
0040152A   .  8078 04 2D    cmp byte ptr ds:[eax+0x4],0x2D
0040152E   .  75 06         jnz XCoSH_2.00401536
00401530   .  8078 05 41    cmp byte ptr ds:[eax+0x5],0x41
00401534   .  74 17         je XCoSH_2.0040154D

不相同则跳转到错误信息，于是就得到了一个字符串，但是并不知道这个比较的内容是对Name进行比较还是对Serial进行比较。
往上看一看有几个：

004014E1   .  83F8 05       cmp eax,0x5
004014F0   .  83F8 05       cmp eax,0x5

可以猜测输入的两个内容长度都要大于5
先猜猜比较的内容是Serial，于是有：