自写的玩具VM CrackMe一枚
本帖最后由 二娃 于 2020-7-19 02:46 编辑折腾了一段时间终于大概写了个满是bug的vm框架出来，勉强可以vm一个十几行代码的函数了
CM原文件的核心代码就十几行，并且vm模拟的指令还很少，基本上都是以原指令的形式出现，所以只要找到关键地方应该还是很好看出来的。
成功界面
该文件仅在win10 x64下测试过，其他系统暂时不清楚，好像有很小的概率会打开后就崩溃，暂时不明原因，再重新打开就好了，如果一直打不开的话请留言一下你的系统。
（框架写得有点乱，基本都是随想随写，如果有大佬愿意逆向的话希望不要喷我的代码{:1_937:}）
谢谢分享 本帖最后由 solly 于 2020-7-19 18:03 编辑
VM 分析：
000000014002D00004 04 00 00 48 83 EC 38 opcode=04, size=0x04, x64opcode = 48 83 EC 38 (sub rsp,0x38)
000000014002D00804 09 00 00 48 C7 44 24 20 00 00 00 00 opcode=04, size=0x09, x64opcode = 48 C7 44 24 20 00 00 00 00 (mov qword ptr ss:,0x0)
000000014002D01501 55 00 00 20 02 00 opcode1=01, opcode2=0x55, value=0x00, var_val=0x00022000, var_alloc, var==> buff
000000014002D01C01 57 opcode1=01, opcode2=0x57, value=0x0000000140000000, var_init, var = 0 or null
000000014002D01E05 10 opcode1=05, param1=0x10, = 0x00022000, var_set, var ==>"password:"
000000014002D02001 10 opcode1=01, param1=0x10, = 0x00022000, var_ref, var ==>"password:"
000000014002D02202 01 opcode1=02, param1=0x01, = 0x00022000, var_push, var ==>"password:"
000000014002D02403 55 20 10 00 00 opcode1=03, param1=0x55, param2 = 0x00001020, ==> msg, call_api, printf(msg)
000000014002D02A04 05 00 00 48 8D 54 24 20 opcode=04, size=0x04, x64opcode = 48 8D 54 24 20 (lea rdx,qword ptr ss:)
000000014002D03301 55 00 0C 20 02 00 opcode1=01, opcode2=0x55, value=0x00, var_val=0x0002200C, var_alloc, var==> buff
000000014002D03A01 57 opcode1=01, opcode2=0x57, value=0x0000000140000000, var_init, var = 0 or null
000000014002D03C05 10 opcode1=05, param1=0x10, = 0x0002200C, var_set, var ==>"%d"
000000014002D03E01 10 opcode1=01, param1=0x10, = 0x0002200C, var_ref, var ==>"%d"
000000014002D04002 01 opcode1=02, param1=0x01, = 0x0002200C, var_push, var ==>"%d"
;input
000000014002D04203 55 80 10 00 00 opcode1=03, param1=0x55, param2 = 0x00001080, ==> fmt, call_api, scanf(fmt)
000000014002D04704 05 00 00 48 8B 44 24 20 opcode=04, size=0x05, x64opcode = 48 8B 44 24 20 (mov rax,qword ptr ss:)，get integer with scanf
;compare
000000014002D05104 06 00 00 48 2D 78 56 34 12 opcode=04, size=0x06, x64opcode = 48 2D 78 56 34 12 (sub rax,12345678), sub
000000014002D05B04 06 00 00 48 35 96 43 96 43 opcode=04, size=0x06, x64opcode = 48 35 96 43 96 43 (xor rax,43964396), xor
000000014002D06504 05 00 00 48 89 44 24 28 opcode=04, size=0x05, x64opcode = 48 89 44 24 28 (mov qword ptr ss:,rax), save
000000014002D06E04 09 00 00 48 81 7C 24 28 FD 5F 97 4A opcode=04, size=0x09, x64opcode = 48 81 7C 24 28 FD 5F 97 4A (cmp qword ptr ss:,4A975FFD), compare
000000014002D07B00 10 1B 00 00 00 opcode=00, opcode2=0x10(jne), param1=0x0000001B, true: rip = $+2+4+param1 (0x1F, rip=000000014002D09C), false: rip = $+2+4 (0x6, rip=000000014002D081)
;success
000000014002D08101 55 00 10 20 02 00 (var_alloc)
000000014002D08801 57
000000014002D08A05 10
000000014002D08C01 10
000000014002D08E02 01
000000014002D09003 55 20 10 00 00 (printf("good job!"))
000000014002D09600 1F 15 00 00 00 (jmp 000000014002D0B1)
;failure
000000014002D09C01 55 00 20 20 02 00 (var_alloc)
000000014002D0A301 57
000000014002D0A505 10
000000014002D0A701 10
000000014002D0A902 01
000000014002D0AB03 55 20 10 00 00 (printf("error!"))
;exit
000000014002D0B101 55 00 28 20 02 00 (var_alloc)
000000014002D0B801 57
000000014002D0BA05 10
000000014002D0BC01 10
000000014002D0BE02 01 (msg = "pause")
000000014002D0C006 (system("pause"), output "请按任意键继续. . ." and pause)
000000014002D0C13C 11 00 00 00 00 00 00 00 00 00 00 00 00 00
1、正确码：
2、暴破：
000000014002D07B00 10 1B 00 00 00 (jne $+0x1B)
改为：
000000014002D07B00 10 00 00 00 00 (jne $+0x00，即不跳转)
跟花指令一样。。 本帖最后由 TL90 于 2020-7-19 21:02 编辑
膜拜大佬！随随便便就能写出个crackme solly 发表于 2020-7-19 17:56
VM 分析：
000000014002D00004 04 00 00 48 83 EC 38 ...
还真的有人愿意逆我这坨乱七八糟的代码，膜拜膜拜 Sound 发表于 2020-7-19 20:48
跟花指令一样。。
不好意思献丑了，第一次写vm，很多东西都是随想随写的，现在看起来我自己也觉得乱，写这种东西还是要先好好构思一下比较好:lol 膜拜大佬！
学习了，谢谢楼主分享！
页:
[1]