本帖最后由 小菜鸟一枚 于 2020-7-5 12:39 编辑
跑不出来，OD CTRL+A也不太好用，这就是混淆吗？一下子选中三行代码，请问楼主这是c/c加加写的吗，能不能请教一下这个混淆和花指令该怎么做，或者给个教程吧，谢谢！
[C] 纯文本查看 复制代码 int sub_401020()
{
__int128 v1; // [sp+0h] [bp-1Ch]@1
__int64 v2; // [sp+10h] [bp-Ch]@1
int v3; // [sp+18h] [bp-4h]@1
v3 = 0;
v1 = 0i64;
_mm_storel_epi64((__m128i *)&v2, 0i64);
sub_401070((int)"Input:", 0);
sub_4010A0("%16s", &v1);
sub_40180B(&v1, sub_41A35B);
return 0;
}
[C] 纯文本查看 复制代码 signed int __cdecl sub_41A35B(const char *a1)
{
signed int result; // eax@2
int v2; // eax@3
signed int v3; // eax@4
signed int v4; // edx@4
_BYTE *v5; // esi@4
_BYTE *v6; // eax@6
int *v7; // [sp+0h] [bp-14h]@14
const char **v8; // [sp+4h] [bp-10h]@14
int *v9; // [sp+8h] [bp-Ch]@14
unsigned int v10; // [sp+Ch] [bp-8h]@14
int v11; // [sp+10h] [bp-4h]@3
if ( a1 )
{
v2 = sub_41A1FC(1);
v11 = v2;
if ( (*(_DWORD *)(v2 + 12) >> 12) & 1 )
goto LABEL_17;
v3 = sub_42295B(v2);
v4 = v3;
v5 = &unk_4350F8;
if ( v3 == -1 || v3 == -2 )
v6 = &unk_4350F8;
else
v6 = (_BYTE *)(dword_435F18[v3 >> 6] + 48 * (v3 & 0x3F));
if ( v6[41] )
goto LABEL_18;
if ( v4 != -1 && v4 != -2 )
v5 = (_BYTE *)(dword_435F18[v4 >> 6] + 48 * (v4 & 0x3F));
if ( v5[45] & 1 )
{
LABEL_18:
*(_DWORD *)sub_421F2E() = 22;
sub_421E72();
result = -1;
}
else
{
LABEL_17:
v10 = strlen(a1);
v7 = &v11;
v8 = &a1;
v9 = (int *)&v10;
result = sub_41A2D1(v11, &v7);
}
}
else
{
*(_DWORD *)sub_421F2E() = 22;
sub_421E72();
result = -1;
}
return result;
}
函数里面调函数，学习了，里面的那个函数有一次参数*a1，用OD跑了下参数也是输入的字符串，里面那个函数两个地方返回-1，应该是错误跳转，LANLE 17可能是正确的流程，然后跟丢了，没什么好的思路
OD层层回溯，也只能看到在哪里把false入栈的
[Asm] 纯文本查看 复制代码 004274C0 . F64408 28 01 test byte ptr ds:[eax+ecx+0x28],0x1
004274C5 . 75 15 jnz short CrackMe.004274DC
004274C7 . E8 62AAFFFF call CrackMe.00421F2E
004274CC . C700 09000000 mov dword ptr ds:[eax],0x9
004274D2 . E8 44AAFFFF call CrackMe.00421F1B
004274D7 . 8320 00 and dword ptr ds:[eax],0x0
004274DA . EB 14 jmp short CrackMe.004274F0
004274DC > FF75 10 push dword ptr ss:[ebp+0x10] ;这是字符串false\r\n长度，为7
004274DF . FF75 0C push dword ptr ss:[ebp+0xC] ;这就是字符串false\r\n
解不开了
| 
发表于 2020-7-5 11:15
|
发表于 2020-7-5 13:05
