利用IDA+Hex-Rays快速分析一个CM的算法

ximo

初次使用IDA，总算感受到了IDA的强大，以及更加强大的F5，呵呵。

外壳是UPX的，很简单，用IDA分析更加简单明了，不过不会静态脱壳，因此就用OD脱掉了，再来用IDA进行分析。

IDA载入，由于知道此CM的提示信息是用对话框的形式，因此，在IDA的name选项，选messsagebox函数。然后双击，来到下面的地方：

UPX0:004013EE ; =============== S U B R O U T I N E =======================================UPX0:004013EEUPX0:004013EE ; Attributes: thunkUPX0:004013EEUPX0:004013EE ; int __stdcall MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType)UPX0:004013EE MessageBoxA proc near ; CODE XREF: sub_4011E2+A4pUPX0:004013EE ; sub_4011E2+10Bp ...UPX0:004013EE jmp __imp_MessageBoxAUPX0:004013EE MessageBoxA endp

再双击上面的交叉参考,于是,来到了此CM的关键算法处:

UPX0:004012DF ; ---------------------------------------------------------------------------UPX0:004012DFUPX0:004012DF loc_4012DF: ; CODE XREF: sub_4011E2+E3jUPX0:004012DF ; sub_4011E2+F9jUPX0:004012DF push0 ; uTypeUPX0:004012E1 pushoffset Caption; "Key/CrackMe #2 "UPX0:004012E6 pushoffset aPleaseFillIn1M ; "Please Fill in 1 more Char!!"UPX0:004012EB push0 ; hWndUPX0:004012ED callMessageBoxAUPX0:004012F2 leaveUPX0:004012F3 retn10hUPX0:004012F6 ; ---------------------------------------------------------------------------UPX0:004012F6UPX0:004012F6 loc_4012F6: ; CODE XREF: sub_4011E2+FBjUPX0:004012F6 pushoffset dword_403038UPX0:004012FB calllstrlenUPX0:00401300 xor esi, esiUPX0:00401302 mov ecx, eaxUPX0:00401304 mov eax, 1UPX0:00401309UPX0:00401309 loc_401309: ; CODE XREF: sub_4011E2+14AjUPX0:00401309 mov edx, dword_403038UPX0:0040130F mov dl, byte_403037[eax]UPX0:00401315 and edx, 0FFhUPX0:0040131B mov ebx, edxUPX0:0040131D imulebx, edxUPX0:00401320 add esi, ebxUPX0:00401322 mov ebx, edxUPX0:00401324 sar ebx, 1UPX0:00401326 add esi, ebxUPX0:00401328 sub esi, edxUPX0:0040132A inc eaxUPX0:0040132B dec ecxUPX0:0040132C jnz short loc_401309UPX0:0040132E pushesiUPX0:0040132F pushoffset byte_403138UPX0:00401334 callsub_401383UPX0:00401339 pop esiUPX0:0040133A cmp eax, esiUPX0:0040133C jnz short loc_401353UPX0:0040133E push0 ; uTypeUPX0:00401340 pushoffset Caption; "Key/CrackMe #2 "UPX0:00401345 pushoffset aGoodJobIWishYo ; " Good Job, I Wish You the Very Best"UPX0:0040134A push0 ; hWndUPX0:0040134C callMessageBoxAUPX0:00401351 jmp short loc_401366UPX0:00401353 ; ---------------------------------------------------------------------------UPX0:00401353UPX0:00401353 loc_401353: ; CODE XREF: sub_4011E2+15AjUPX0:00401353 push0 ; uTypeUPX0:00401355 pushoffset Caption; "Key/CrackMe #2 "UPX0:0040135A pushoffset aYouHaveEnterAW ; " You Have Enter A Wrong Serial, Please "...UPX0:0040135F push0 ; hWndUPX0:00401361 callMessageBoxAUPX0:00401366UPX0:00401366 loc_401366: ; CODE XREF: sub_4011E2+BFjUPX0:00401366 ; sub_4011E2+C9j ...UPX0:00401366 jmp short loc_40137DUPX0:00401368 ; ---------------------------------------------------------------------------UPX0:00401368UPX0:00401368 loc_401368: ; CODE XREF: sub_4011E2+7FjUPX0:00401368 push[ebp+lParam]; lParamUPX0:0040136B push[ebp+wParam]; wParamUPX0:0040136E push[ebp+Msg] ; MsgUPX0:00401371 push[ebp+hWnd]; hWndUPX0:00401374 callDefWindowProcAUPX0:00401379 leaveUPX0:0040137A retn10hUPX0:0040137D ; ---------------------------------------------------------------------------UPX0:0040137DUPX0:0040137D loc_40137D: ; CODE XREF: sub_4011E2+B0jUPX0:0040137D ; sub_4011E2:loc_401366jUPX0:0040137D xor eax, eaxUPX0:0040137F leaveUPX0:00401380 retn10hUPX0:00401380 sub_4011E2endp ; sp-analysis failed

其实从这些代码来看,爆破点已经相当明了.
UPX0:0040133C jnz short loc_401353此处既为爆破点了.

下面继续来分析算法:
此时,就用到了相当强大的F5.

int __stdcall sub_4011E2(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam){signed int v4; // eax@22int v5; // ecx@22int v6; // esi@22int result; // eax@23switch ( Msg ){case 2u:PostQuitMessage(0);break;case 0x201u:ReleaseCapture();SendMessageA(hWnd, 0xA1u, 2u, 0);break;case 0x111u:if ( !(wParam >> 16) ){if ( wParam == 109 )ExitProcess(0);}break;}if ( Msg == 273 ){if ( !(wParam >> 16) ){if ( wParam == 113 )ShowWindow(hWnd, 6);}}if ( Msg == 273 ){if ( !(wParam >> 16) ){if ( wParam == 112 )MessageBoxA(0," +=================================+\r\n |Key/CrackMe - 2 Created on 21/9/2001| \r\n +=================================+\r\n\r\nSpecial Thanks And Gratidutes Goes To:\r ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nCoDe_InSiDe , fusS , _Nordic_ , PGC Members ,\r+SandMan , +ORC , +HCU , Muad'D1b, gogamoga.\r\n\r Other Thanks Goes To: \r ~~~~~~~~~~~~~~~~\r\n Icezelion , Hutch , Goofy , Rizzah , Termin-X \r\n ManDind , Kanabis , Bl00dBath , Sheep , Nchanta , \r\n CrackZ , Kilby , Predator , Zeus , Krobar , +Tsehp ,\r\n +Spalth , +Fravia , The+Q , Snacker , And YOU! .","Key/CrackMe #2 ",0);}if ( Msg == 273 && !(wParam >> 16) && wParam == 108 ){if ( !GetDlgItemTextA(hWnd, 106, dword_403038, 64) || !GetDlgItemTextA(hWnd, 107, byte_403138, 64) )return MessageBoxA(0, "Please Fill in 1 more Char!!", "Key/CrackMe #2 ", 0);v6 = 0;v5 = lstrlen(dword_403038);v4 = 1;do{v6 = (byte_403037[v4] >> 1) + byte_403037[v4] * byte_403037[v4] + v6 - byte_403037[v4];++v4;--v5;}while ( v5 );if ( sub_401383(byte_403138) == v6 )MessageBoxA(0, " Good Job, I Wish You the Very Best", "Key/CrackMe #2 ", 0);elseMessageBoxA(0, " You Have Enter A Wrong Serial, Please Try Again ", "Key/CrackMe #2 ", 0);}result = 0;}else{result = DefWindowProcA(hWnd, Msg, wParam, lParam);}return result;}

由上面的代码可得,算法已经相当简单明了了.

v6 = 0;v5 = lstrlen(dword_403038);v4 = 1;do{v6 = (byte_403037[v4] >> 1) + byte_403037[v4] * byte_403037[v4] + v6 - byte_403037[v4];++v4;--v5;}

此代码即为最关键的算法;

懂C语言的已经很清楚了,大致意思为:

就是取注册名的每一位的ASCII值,然后做平方运算,所得的值加上这个ASCII除2的商,再减这个ASCII值,然后每一位都进行这运算,最后把那些值全加起来,转化为10进制,就是注册码


用VB实现如下:

'''添加2个textbox和一个commandbuttonDim name As StringDim l As IntegerDim temp As IntegerDim i As IntegerDim code As Doublename = CStr(Text1.Text)For i = 1 To Len(name)temp = Asc(Mid(name, i, 1))code = code + temp ^ 2 + Int(temp / 2) - tempNext iText2.Text = code

分析到此,总结一下,IDA相当的强大,而F5更加强大和变态.

tianxj

超哥很强大， [s:39][s:39][s:39]

莱沙

检个板凳坐坐! [s:41][s:41][s:41]

小生我菜菜

厉害，还是没有看懂，看来得学C语言了 [s:17][s:17][s:17]

zzage

[s:40][s:40] ~
学习学习！.
终于会F5了..谢超哥指点噢！

Hmily

F5很强大，有视频教程就更好了~

冷血书生

v6 = 0;
v5 = lstrlen(dword_403038);
v4 = 1;
do
{
v6 = (byte_403037[v4] >> 1) + byte_403037[v4] * byte_403037[v4] + v6 - byte_403037[v4];
++v4;
--v5;
}

完全看不懂这个尿东东!!!

gongsui

也可以直接找string
f5半天还没反应。。。。原来是俺的5.0没有安这个插件，下载5.2的插件，f5还是没反应，汗一个，因该是这个插件only for 5.2的。看来明天得去下载个ida5.2

playboysen

听说这个东东很强大，还不会用，o(∩_∩)o...

hqsfang

楼主你也做个视频出来给大家看看,这样才能学习更快一点