160个CM之014爆破

growuphappily · 发表于 2020-3-30 21:27

本帖最后由 growuphappily 于 2020-3-31 13:14 编辑

0x00 前言

这几天比较忙，所以，，，失踪了21天

最近在练160个CrackMe，原帖如下：
https://www.52pojie.cn/thread-709699-1-1.html
目录：

题目	地址
第一题	https://www.52pojie.cn/forum.php?mod=viewthread&tid=1107523
第二题	https://www.52pojie.cn/forum.php?mod=viewthread&tid=1107888
第三题	ttps://www.52pojie.cn/thread-1108487-1-1.html
第四题	https://www.52pojie.cn/thread-1109140-1-1.html
第五题	太变态了，算了
第六题	https://www.52pojie.cn/thread-1111030-1-1.html
第七题	https://www.52pojie.cn/thread-1112318-1-1.html
第八题	https://www.52pojie.cn/thread-1113163-1-1.html
第九题爆破	https://www.52pojie.cn/thread-1113295-1-1.html
第九题算法	https://www.52pojie.cn/thread-1114003-1-1.html
第十题	https://www.52pojie.cn/thread-1116170-1-1.html
第十一题	https://www.52pojie.cn/thread-1119813-1-1.html
第十一题算法	https://www.52pojie.cn/thread-1120768-1-1.html
第十三题	https://www.52pojie.cn/forum.php?mod=viewthread&tid=1122833&page=1&extra=#pid30408289
第十四题	https://www.52pojie.cn/forum.php?mod=viewthread&tid=1144573&page=1&extra=#pid31010949

0x01 正文

打开姗姗来迟的第14个CM：

这次只有Serial？
0x01.01 爆破

不多说，拖入OD
先输入假码
假码.PNG

应该是rtcMsgBox，下断点
下断.gif

运行到返回，单步

来到这里

[Asm] 纯文本查看 复制代码

004036E3   .  33C9          xor ecx,ecx
004036E5   .  83F8 09       cmp eax,0x9                              ;  长度必须为9
004036E8   .  0F95C1        setne cl                                 ;  长度为9cl为0，不为9cl为1
004036EB   .  F7D9          neg ecx
004036ED   .  8BF1          mov esi,ecx
004036EF   .  8D4D E4       lea ecx,dword ptr ss:[ebp-0x1C]
004036F2   .  FF15 C0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStr
004036F8   .  8D4D D4       lea ecx,dword ptr ss:[ebp-0x2C]
004036FB   .  FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj
00403701   .  66:3BF3       cmp si,bx
00403704   .  0F85 1A030000 jnz bjanes_1.00403A24                    ;  如果cl不等于0则跳（失败）
0040370A   .  8B17          mov edx,dword ptr ds:[edi]
0040370C   .  57            push edi
0040370D   .  FF92 08030000 call dword ptr ds:[edx+0x308]
00403713   .  50            push eax
00403714   .  8D45 D4       lea eax,dword ptr ss:[ebp-0x2C]
00403717   .  50            push eax
00403718   .  FF15 2C104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet
0040371E   .  8BF0          mov esi,eax
00403720   .  8D55 E4       lea edx,dword ptr ss:[ebp-0x1C]
00403723   .  52            push edx
00403724   .  56            push esi                                 ;  msvbvm60.__vbaVarDup
00403725   .  8B0E          mov ecx,dword ptr ds:[esi]
00403727   .  FF91 A0000000 call dword ptr ds:[ecx+0xA0]
0040372D   .  3BC3          cmp eax,ebx
0040372F   .  DBE2          fclex
00403731   .  7D 12         jge short bjanes_1.00403745
00403733   .  68 A0000000   push 0xA0
00403738   .  68 44224000   push bjanes_1.00402244
0040373D   .  56            push esi                                 ;  msvbvm60.__vbaVarDup
0040373E   .  50            push eax
0040373F   .  FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
00403745   >  8B45 E4       mov eax,dword ptr ss:[ebp-0x1C]
00403748   .  50            push eax                                 ; /String = 00000001 ???
00403749   .  FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBs>; \__vbaLenBstr
0040374F   .  8BC8          mov ecx,eax
00403751   .  FF15 50104000 call dword ptr ds:[<&MSVBVM60.__vbaI2I4>>;  msvbvm60.__vbaI2I4
00403757   .  8D4D E4       lea ecx,dword ptr ss:[ebp-0x1C]
0040375A   .  8985 14FFFFFF mov dword ptr ss:[ebp-0xEC],eax
00403760   .  C745 E8 01000>mov dword ptr ss:[ebp-0x18],0x1
00403767   .  FF15 C0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStr
0040376D   .  8D4D D4       lea ecx,dword ptr ss:[ebp-0x2C]
00403770   .  FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj
00403776   .  8B35 AC104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaSt>;  msvbvm60.__vbaStrMove
0040377C   >  66:8B8D 14FFF>mov cx,word ptr ss:[ebp-0xEC]
00403783   .  66:394D E8    cmp word ptr ss:[ebp-0x18],cx
00403787   .  0F8F 17030000 jg bjanes_1.00403AA4   ;这里跳向成功
0040378D   .  8B17          mov edx,dword ptr ds:[edi]
0040378F   .  57            push edi
00403790   .  FF92 08030000 call dword ptr ds:[edx+0x308]
00403796   .  50            push eax
00403797   .  8D45 D4       lea eax,dword ptr ss:[ebp-0x2C]
0040379A   .  50            push eax
0040379B   .  FF15 2C104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet
004037A1   .  8BD8          mov ebx,eax
004037A3   .  8D55 E4       lea edx,dword ptr ss:[ebp-0x1C]
004037A6   .  52            push edx
004037A7   .  53            push ebx
004037A8   .  8B0B          mov ecx,dword ptr ds:[ebx]
004037AA   .  FF91 A0000000 call dword ptr ds:[ecx+0xA0]
004037B0   .  85C0          test eax,eax
004037B2   .  DBE2          fclex
004037B4   .  7D 12         jge short bjanes_1.004037C8
004037B6   .  68 A0000000   push 0xA0
004037BB   .  68 44224000   push bjanes_1.00402244
004037C0   .  53            push ebx
004037C1   .  50            push eax
004037C2   .  FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
004037C8   >  8B07          mov eax,dword ptr ds:[edi]
004037CA   .  57            push edi
004037CB   .  FF90 08030000 call dword ptr ds:[eax+0x308]
004037D1   .  8D4D D0       lea ecx,dword ptr ss:[ebp-0x30]
004037D4   .  50            push eax
004037D5   .  51            push ecx
004037D6   .  FF15 2C104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet
004037DC   .  8BF8          mov edi,eax
004037DE   .  8D45 DC       lea eax,dword ptr ss:[ebp-0x24]
004037E1   .  50            push eax
004037E2   .  57            push edi
004037E3   .  8B17          mov edx,dword ptr ds:[edi]
004037E5   .  FF92 A0000000 call dword ptr ds:[edx+0xA0]
004037EB   .  85C0          test eax,eax
004037ED   .  DBE2          fclex
004037EF   .  7D 12         jge short bjanes_1.00403803
004037F1   .  68 A0000000   push 0xA0
004037F6   .  68 44224000   push bjanes_1.00402244
004037FB   .  57            push edi
004037FC   .  50            push eax
004037FD   .  FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
00403803   >  0FBF7D E8     movsx edi,word ptr ss:[ebp-0x18]
00403807   .  8B55 DC       mov edx,dword ptr ss:[ebp-0x24]
0040380A   .  B9 01000000   mov ecx,0x1
0040380F   .  894D C8       mov dword ptr ss:[ebp-0x38],ecx
00403812   .  894D B8       mov dword ptr ss:[ebp-0x48],ecx
00403815   .  8D4D B0       lea ecx,dword ptr ss:[ebp-0x50]
;太长了，中间这段省略
00403A48   .  8945 90       mov dword ptr ss:[ebp-0x70],eax
00403A4B   .  8945 A0       mov dword ptr ss:[ebp-0x60],eax
00403A4E   .  C785 58FFFFFF>mov dword ptr ss:[ebp-0xA8],bjanes_1.004>;  UNICODE "Wrong serial!"
00403A58   .  89BD 50FFFFFF mov dword ptr ss:[ebp-0xB0],edi
00403A5E   .  FFD6          call esi                                 ;  msvbvm60.__vbaVarDup; <&MSVBVM60.__vbaVarDup>
00403A60   .  8D95 60FFFFFF lea edx,dword ptr ss:[ebp-0xA0]
00403A66   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
00403A69   .  C785 68FFFFFF>mov dword ptr ss:[ebp-0x98],bjanes_1.004>;  UNICODE "Sorry, try again!"
00403A73   .  89BD 60FFFFFF mov dword ptr ss:[ebp-0xA0],edi
00403A79   .  FFD6          call esi                                 ;  msvbvm60.__vbaVarDup
00403A7B   .  8D45 90       lea eax,dword ptr ss:[ebp-0x70]
00403A7E   .  8D4D A0       lea ecx,dword ptr ss:[ebp-0x60]
00403A81   .  50            push eax
00403A82   .  8D55 B0       lea edx,dword ptr ss:[ebp-0x50]
00403A85   .  51            push ecx
00403A86   .  52            push edx
00403A87   .  8D45 C0       lea eax,dword ptr ss:[ebp-0x40]
00403A8A   .  53            push ebx
00403A8B   .  50            push eax
00403A8C   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.#595>]     ;  msvbvm60.rtcMsgBox
00403A92   .  8D4D 90       lea ecx,dword ptr ss:[ebp-0x70]
00403A95   .  8D55 A0       lea edx,dword ptr ss:[ebp-0x60]
00403A98   .  51            push ecx
00403A99   .  8D45 B0       lea eax,dword ptr ss:[ebp-0x50]
00403A9C   .  52            push edx
00403A9D   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
00403AA0   .  50            push eax
00403AA1   .  51            push ecx
00403AA2   .  EB 7E         jmp short bjanes_1.00403B22
00403AA4   >  8B35 A4104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaVa>;  msvbvm60.__vbaVarDup
00403AAA   .  B9 04000280   mov ecx,0x80020004
00403AAF   .  894D 98       mov dword ptr ss:[ebp-0x68],ecx
00403AB2   .  B8 0A000000   mov eax,0xA
00403AB7   .  894D A8       mov dword ptr ss:[ebp-0x58],ecx
00403ABA   .  BF 08000000   mov edi,0x8
00403ABF   .  8D95 50FFFFFF lea edx,dword ptr ss:[ebp-0xB0]
00403AC5   .  8D4D B0       lea ecx,dword ptr ss:[ebp-0x50]
00403AC8   .  8945 90       mov dword ptr ss:[ebp-0x70],eax
00403ACB   .  8945 A0       mov dword ptr ss:[ebp-0x60],eax
00403ACE   .  C785 58FFFFFF>mov dword ptr ss:[ebp-0xA8],bjanes_1.004>;  UNICODE "Correct serial!"
00403AD8   .  89BD 50FFFFFF mov dword ptr ss:[ebp-0xB0],edi
00403ADE   .  FFD6          call esi                                 ;  msvbvm60.__vbaVarDup; <&MSVBVM60.__vbaVarDup>
00403AE0   .  8D95 60FFFFFF lea edx,dword ptr ss:[ebp-0xA0]
00403AE6   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
00403AE9   .  C785 68FFFFFF>mov dword ptr ss:[ebp-0x98],bjanes_1.004>;  UNICODE "Good job, tell me how you do that!"
00403AF3   .  89BD 60FFFFFF mov dword ptr ss:[ebp-0xA0],edi
00403AF9   .  FFD6          call esi                                 ;  msvbvm60.__vbaVarDup
00403AFB   .  8D55 90       lea edx,dword ptr ss:[ebp-0x70]
00403AFE   .  8D45 A0       lea eax,dword ptr ss:[ebp-0x60]
00403B01   .  52            push edx
00403B02   .  8D4D B0       lea ecx,dword ptr ss:[ebp-0x50]
00403B05   .  50            push eax
00403B06   .  51            push ecx
00403B07   .  8D55 C0       lea edx,dword ptr ss:[ebp-0x40]
00403B0A   .  53            push ebx
00403B0B   .  52            push edx

爆破还是很简单，只要把00403704的跳转NOP掉，把00403787的跳转改成JMP就行了
0x01.02 算法...穷举?

终于又到了最令人头疼的算法时间
用一下VBDecompiler

[Visual Basic] 纯文本查看 复制代码

Private Sub Command1_Click() '403620
  Dim var_2C As TextBox
  loc_004036BB: var_1C = Text1.Text
  loc_004036E8: setnz cl
  loc_00403704: If ecx <> 0 Then GoTo loc_00403A24
  loc_00403727: var_1C = Text1.Text
  loc_0040375A: var_EC = Len(var_1C)
  loc_0040377C: 
  loc_00403787: If var_18 > 0 Then GoTo loc_00403AA4
  loc_004037AA: var_1C = Text1.Text
  loc_004037E5: var_24 = Text1.Text
  loc_00403831: var_28 = Mid$(var_24, vbNull, 1)
  loc_00403848: setg bl
  loc_00403859: var_20 = Mid$(var_1C, vbNull, 1)
  loc_00403868: setl dl
  loc_004038AD: If var_2C <> 0 Then GoTo loc_00403A22
  loc_004038D3: var_1C = Text1.Text
  loc_00403909: var_58 = var_18 xor 0002h
  loc_0040391B: var_28 = Str$()
  loc_0040393F: var_20 = Mid$(var_1C, vbNull, 1)
  loc_0040394B: var_48 = Asc(var_20)
  loc_0040395E: var_24 = Str$(Asc(var_20))
  loc_00403997: var_68 = var_28
  loc_004039A5: var_80 = Right(var_28, 1)
  loc_00403A04: If ((var_24 - 48#) <> var_80) <> 0 Then GoTo loc_00403A22
  loc_00403A0E: 00000001h = 00000001h + var_18
  loc_00403A1D: GoTo loc_0040377C
  loc_00403A22: 'Referenced from: 004038AD
  loc_00403A24: 'Referenced from: 00403704
  loc_00403A5E: var_50 = "Wrong serial!"
  loc_00403A79: var_40 = "Sorry, try again!"
  loc_00403AA2: GoTo loc_00403B22
  loc_00403AA4: 'Referenced from: 00403787
  loc_00403ADE: var_50 = "Correct serial!"
  loc_00403AF9: var_40 = "Good job, tell me how you do that!"
  loc_00403B22: 'Referenced from: 00403AA2
  loc_00403B36: GoTo loc_00403B87
  loc_00403B86: Exit Sub
  loc_00403B87: 'Referenced from: 00403B36
  loc_00403B87: Exit Sub
End Sub

这是反编译出来的代码

之后就有空再写吧

0x02 最后

别白嫖了，评个分呗！回帖有70%几率中奖哦！

ycy0536 · 发表于 2020-3-30 21:39

厉害了，感谢

gjp18961105915 · 发表于 2020-3-30 21:41

大神厉害

loveve · 发表于 2020-3-30 21:51

厉害厉害。
想学把Serial算法逆出来的能力。爆破会一点。

hyoulin68 · 发表于 2020-3-31 06:44

厉害厉害。

gh0st_ · 发表于 2020-3-31 08:58

学习了。

细水流长 · 发表于 2020-3-31 10:03

提示: 作者被禁止或删除内容自动屏蔽

浩然123 · 发表于 2020-3-31 10:06

厉害厉害厉害

兜OxO · 发表于 2020-3-31 12:09

提示: 作者被禁止或删除内容自动屏蔽

a2581069 · 发表于 2020-3-31 12:39

我信你个鬼。我有看不懂

帐号		自动登录	找回密码
密码			注册[Register]

细水流长细水流长当前离线好友阅读权限 0 听众最后登录 1970-1-1 头像被屏蔽	细水流长发表于 2020-3-31 10:03 回帖奖励 +1 CB吾爱币提示: 作者被禁止或删除内容自动屏蔽
细水流长细水流长当前离线好友阅读权限 0 听众最后登录 1970-1-1 头像被屏蔽
	回复支持举报

兜OxO 兜OxO 当前离线好友阅读权限 0 听众最后登录 1970-1-1 头像被屏蔽	兜OxO 发表于 2020-3-31 12:09 回帖奖励 +1 CB吾爱币提示: 作者被禁止或删除内容自动屏蔽
兜OxO 兜OxO 当前离线好友阅读权限 0 听众最后登录 1970-1-1 头像被屏蔽
	回复支持举报

[原创] 160个CM之014爆破

免费评分

回帖奖励 +1 CB吾爱币

回帖奖励 +1 CB吾爱币

回帖奖励 +1 CB吾爱币

回帖奖励 +1 CB吾爱币

回帖奖励 +1 CB吾爱币

回帖奖励 +1 CB吾爱币