160个CrackMe之029

cjt included in 逆向

2023-08-02 2023-08-02 1268 words 3 minutes

进入程序主界面，name输入：123456，serial输入：789000，弹出提示框，搜索字符串定位：

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119


004014B0  /.  55            push ebp
004014B1  |.  8BEC          mov ebp,esp
004014B3  |.  6A FF         push -0x1
004014B5  |.  68 C21B4000   push cosh_3.00401BC2                                  ;  溉%@; SE 处理程序安装
004014BA  |.  64:A1 0000000>mov eax,dword ptr fs:[0]
004014C0  |.  50            push eax
004014C1  |.  64:8925 00000>mov dword ptr fs:[0],esp
004014C8  |.  83EC 14       sub esp,0x14
004014CB  |.  53            push ebx
004014CC  |.  56            push esi                                              ;  cosh_3.004022E8
004014CD  |.  57            push edi
004014CE  |.  894D E0       mov [local.8],ecx
004014D1  |.  8D4D E4       lea ecx,[local.7]
004014D4  |.  E8 83030000   call <jmp.&MFC42.#CString::CString_540>
004014D9  |.  C745 FC 00000>mov [local.1],0x0
004014E0  |.  8D4D F0       lea ecx,[local.4]
004014E3  |.  E8 74030000   call <jmp.&MFC42.#CString::CString_540>
004014E8  |.  C645 FC 01    mov byte ptr ss:[ebp-0x4],0x1
004014EC  |.  8B4D E0       mov ecx,[local.8]
004014EF  |.  81C1 A0000000 add ecx,0xA0
004014F5  |.  E8 AA030000   call <jmp.&MFC42.#CWnd::GetWindowTextLengthA_3876>    ;  输入的name长度
004014FA  |.  8945 EC       mov [local.5],eax
004014FD  |.  837D EC 05    cmp [local.5],0x5                                     ;  长度要求大于5
00401501  |.  7F 05         jg short cosh_3.00401508
00401503  |.  E9 BB000000   jmp cosh_3.004015C3
00401508  |>  8B4D E0       mov ecx,[local.8]
0040150B  |.  83C1 60       add ecx,0x60
0040150E  |.  E8 91030000   call <jmp.&MFC42.#CWnd::GetWindowTextLengthA_3876>    ;  输入的serial的长度
00401513  |.  8945 E8       mov [local.6],eax
00401516  |.  837D E8 05    cmp [local.6],0x5
0040151A  |.  7F 05         jg short cosh_3.00401521                              ;  长度要求大于5
0040151C  |.  E9 A2000000   jmp cosh_3.004015C3
00401521  |>  8B45 E0       mov eax,[local.8]
00401524  |.  05 E0000000   add eax,0xE0
00401529  |.  50            push eax
0040152A  |.  8B4D E0       mov ecx,[local.8]
0040152D  |.  81C1 A0000000 add ecx,0xA0
00401533  |.  E8 66030000   call <jmp.&MFC42.#CWnd::GetWindowTextA_3874>
00401538  |.  8B4D E0       mov ecx,[local.8]                                     ;  123456
0040153B  |.  81C1 E4000000 add ecx,0xE4
00401541  |.  51            push ecx
00401542  |.  8B4D E0       mov ecx,[local.8]
00401545  |.  83C1 60       add ecx,0x60
00401548  |.  E8 51030000   call <jmp.&MFC42.#CWnd::GetWindowTextA_3874>
0040154D  |.  8B55 E0       mov edx,[local.8]                                     ;  789000
00401550  |.  81C2 E0000000 add edx,0xE0
00401556  |.  52            push edx
00401557  |.  8D4D E4       lea ecx,[local.7]                                     ;  789000
0040155A  |.  E8 39030000   call <jmp.&MFC42.#CString::operator=_858>
0040155F  |.  8B45 E0       mov eax,[local.8]
00401562  |.  05 E4000000   add eax,0xE4
00401567  |.  50            push eax
00401568  |.  8D4D F0       lea ecx,[local.4]
0040156B  |.  E8 28030000   call <jmp.&MFC42.#CString::operator=_858>
00401570  |.  33C0          xor eax,eax                                           ;  i = 0
00401572  |.  33DB          xor ebx,ebx
00401574  |.  33C9          xor ecx,ecx
00401576  |.  B9 01000000   mov ecx,0x1                                           ;  j = 1
0040157B  |.  33D2          xor edx,edx
0040157D  |.  8B45 E4       mov eax,[local.7]                                     ;  123456
00401580  |>  8A18          /mov bl,byte ptr ds:[eax]                             ;  0x31
00401582  |.  32D9          |xor bl,cl                                            ;  0x30
00401584  |.  8818          |mov byte ptr ds:[eax],bl
00401586  |.  41            |inc ecx
00401587  |.  40            |inc eax                                              ;  i++
00401588  |.  8038 00       |cmp byte ptr ds:[eax],0x0
0040158B  |.^ 75 F3         \jnz short cosh_3.00401580
0040158D  |.  33C0          xor eax,eax                                           ;  i = 0
0040158F  |.  33DB          xor ebx,ebx
00401591  |.  33C9          xor ecx,ecx
00401593  |.  B9 0A000000   mov ecx,0xA                                           ;  j = 0xA
00401598  |.  33D2          xor edx,edx
0040159A  |.  8B45 F0       mov eax,[local.4]                                     ;  789000
0040159D  |>  8A18          /mov bl,byte ptr ds:[eax]
0040159F  |.  32D9          |xor bl,cl
004015A1  |.  8818          |mov byte ptr ds:[eax],bl
004015A3  |.  41            |inc ecx
004015A4  |.  40            |inc eax
004015A5  |.  8038 00       |cmp byte ptr ds:[eax],0x0
004015A8  |.^ 75 F3         \jnz short cosh_3.0040159D
004015AA  |.  8B45 E4       mov eax,[local.7]                                     ;  000000
004015AD  |.  8B55 F0       mov edx,[local.4]                                     ;  "=35=>?"
004015B0  |>  33C9          /xor ecx,ecx
004015B2  |.  8A18          |mov bl,byte ptr ds:[eax]
004015B4  |.  8A0A          |mov cl,byte ptr ds:[edx]
004015B6  |.  3AD9          |cmp bl,cl
004015B8  |.  75 09         |jnz short cosh_3.004015C3                            ;  错误跳转
004015BA  |.  40            |inc eax
004015BB  |.  42            |inc edx
004015BC  |.  8038 00       |cmp byte ptr ds:[eax],0x0
004015BF  |.^ 75 EF         \jnz short cosh_3.004015B0
004015C1  |.  EB 16         jmp short cosh_3.004015D9
004015C3  |>  6A 00         push 0x0
004015C5  |.  68 6C304000   push cosh_3.0040306C                                  ;  ERROR
004015CA  |.  68 40304000   push cosh_3.00403040                                  ;  One of the Details you entered was wrong
004015CF  |.  8B4D E0       mov ecx,[local.8]
004015D2  |.  E8 BB020000   call <jmp.&MFC42.#CWnd::MessageBoxA_4224>             ;  错误提示框
004015D7  |.  EB 14         jmp short cosh_3.004015ED
004015D9  |>  6A 00         push 0x0
004015DB  |.  68 34304000   push cosh_3.00403034                                  ;  YOU DID IT
004015E0  |.  68 20304000   push cosh_3.00403020                                  ;  Well done,Cracker
004015E5  |.  8B4D E0       mov ecx,[local.8]
004015E8  |.  E8 A5020000   call <jmp.&MFC42.#CWnd::MessageBoxA_4224>
004015ED  |>  6A 64         push 0x64                                             ; /Timeout = 100. ms
004015EF  |.  FF15 00204000 call dword ptr ds:[<&KERNEL32.Sleep>]                 ; \Sleep
004015F5  |.  C645 FC 00    mov byte ptr ss:[ebp-0x4],0x0
004015F9  |.  8D4D F0       lea ecx,[local.4]
004015FC  |.  E8 65010000   call <jmp.&MFC42.#CString::~CString_800>
00401601  |.  C745 FC FFFFF>mov [local.1],-0x1
00401608  |.  8D4D E4       lea ecx,[local.7]
0040160B  |.  E8 56010000   call <jmp.&MFC42.#CString::~CString_800>
00401610  |.  8B4D F4       mov ecx,[local.3]
00401613  |.  64:890D 00000>mov dword ptr fs:[0],ecx
0040161A  |.  5F            pop edi
0040161B  |.  5E            pop esi                                               ;  cosh_3.004022E8
0040161C  |.  5B            pop ebx
0040161D  |.  8BE5          mov esp,ebp
0040161F  |.  5D            pop ebp
00401620  \.  C3            retn

分析得出，name和serial长度要求大于5，name和serial进行异或运算，结果进行比较，如果相等就会弹出提示框：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


#include <iostream>

int main()
{
	char name[] = "123456";
	char serial[] = "789000";

	
	if (strlen(name) > 5 && strlen(serial) > 5) {
		for (int i = 0, j = 1; name[i] != 0; i++, j++) {
			name[i] = name[i] ^ j;
		}

		for (int i = 0, j = 0xA; serial[i] != 0; i++, j++) {
			serial[i] = serial[i] ^ j;
		}
	
		for (int i = 0; name[i] != 0; i++) {
			if (name[i] != serial[i]) {
				printf("Error\n");
				break;
			}
		}

		// 序列号反推用户名，一个数异或一个数再异或就回到原来的数值
		char key[10] = { 0 };
		for (int i = 0, j = 1; serial[i] != 0; i++, j++) {
			key[i] = serial[i] ^ j;
		}

		printf("Serial: %s\n", key);
	}

	return 0;
}

一个数异或一个数再异或就回到原来的数值