本帖最后由 qzhsjz 于 2020-7-30 12:16 编辑
分析按钮代码并下断点可得到如下被反序列化并执行的VB代码：
[Visual Basic .NET] 纯文本查看 复制代码 {
'垃圾字符一定要多
Public Class MS
Inherits Methods'继承
Public Function Process() As Boolean
Try
Dim resultFag As Boolean = True
'Public Class MS
'Inherits Methods'继承
'Public Function Process() As Boolean
ModuleForm.registcode=123
if TimeClass.InitRegedit=0 then
'messagebox.show("傻逼了把，这些都不是真的代码")
messagebox.show("懵逼了把，被忽悠成这样！")'大写的懵逼
'messagebox.show("fuck you!")
end if
Return resultFag
Catch ex As Exception
'LogError(ex.ToString()) 大家自己可以打印日志
Return false
'end if
'Return resultFag
'Catch ex As Exception
'End Try
'End Function
End Try
End Function
End Class}
根据这段VB代码可知，点击验证按钮后真正有用的代码是TimeClass.InitRegedit，并且它成功运行的话需要返回0。于是分析之：
[C#] 纯文本查看 复制代码 public static int InitRegedit(){
int result;
try
{
string text = TimeClass.DisEncryPW(ModuleForm.registcode, TimeClass.password);
bool flag = text == "-1";
if (flag)
{
result = 1;
}
else
{
string softEndDateAllCpuId = TimeClass.GetSoftEndDateAllCpuId(1, text);
string cpuId = TimeClass.GetCpuId();
bool flag2 = softEndDateAllCpuId != cpuId;
if (flag2)
{
result = 2;
}
else
{
string nowDate = TimeClass.GetNowDate();
string softEndDateAllCpuId2 = TimeClass.GetSoftEndDateAllCpuId(0, text);
bool flag3 = Convert.ToInt32(softEndDateAllCpuId2) - Convert.ToInt32(nowDate) < 0;
if (flag3)
{
result = 3;
}
else
{
result = 0;
}
}
}
}
catch (Exception)
{
result = 1;
}
return result;
}
通过调用分析可知它调用了以下几个方法来构造序列号：
[C#] 纯文本查看 复制代码 public static string GetSoftEndDateAllCpuId(int i, string SerialNumber)
{
bool flag = i == 1;
string result;
if (flag)
{
string text = SerialNumber.Substring(0, SerialNumber.LastIndexOf("-"));
result = text;
}
else
{
bool flag2 = i == 0;
if (flag2)
{
string text2 = SerialNumber.Substring(SerialNumber.LastIndexOf("-") + 1);
result = text2;
}
else
{
result = string.Empty;
}
}
return result;
}
[C#] 纯文本查看 复制代码 public static string GetNowDate()
{
return DateTime.Now.ToString("yyyyMMdd");
}
[C#] 纯文本查看 复制代码 public static string GetCpuId()
{
ManagementClass managementClass = new ManagementClass("Win32_Processor");
ManagementObjectCollection instances = managementClass.GetInstances();
string str = null;
using (ManagementObjectCollection.ManagementObjectEnumerator enumerator = instances.GetEnumerator())
{
if (enumerator.MoveNext())
{
ManagementObject managementObject = (ManagementObject)enumerator.Current;
str = managementObject.Properties["ProcessorId"].Value.ToString();
}
}
return TimeClass.encode(str);
}
构造分析完毕，接下来是加密算法，是普通的DES，密码是52pojie.
算法部分代码如下：
[C#] 纯文本查看 复制代码 public static string encode(string str)
{
string text = "";
for (int i = 0; i < str.Length; i++)
{
text += str[i].ToString();
i++;
}
for (int j = 1; j < str.Length; j++)
{
text += str[j].ToString();
j++;
}
return TimeClass.EncryPW(text, TimeClass.password);
}
[C#] 纯文本查看 复制代码 public static string EncryPW(string Pass, string Key)
{
return TimeClass.DesEncrypt(Pass, Key);
}
[C#] 纯文本查看 复制代码 public static string DesEncrypt(string encryptString, string key)
{
byte[] bytes = Encoding.UTF8.GetBytes(key.Substring(0, 8));
byte[] rgbIV = bytes;
byte[] bytes2 = Encoding.UTF8.GetBytes(encryptString);
DESCryptoServiceProvider descryptoServiceProvider = new DESCryptoServiceProvider();
MemoryStream memoryStream = new MemoryStream();
CryptoStream cryptoStream = new CryptoStream(memoryStream, descryptoServiceProvider.CreateEncryptor(bytes, rgbIV), CryptoStreamMode.Write);
cryptoStream.Write(bytes2, 0, bytes2.Length);
cryptoStream.FlushFinalBlock();
return Convert.ToBase64String(memoryStream.ToArray());
}
懒得跑注册码了，但是根据那段VB代码，弹窗内容应该是：
懵逼了把，被忽悠成这样！
嗯，我是挺懵逼的。
| 
发表于 2020-7-30 11:25
|
发表于 2020-7-30 12:59
