【吾爱2013CM大赛解答】-- Fuc kKido -- Unsped 解码CM分析

xjun · 发表于 2013-12-15 15:13

本帖最后由 xjun 于 2013-12-15 16:11 编辑

文章标题】: 【吾爱2013CM大赛解答】-- Fuc kKido -- Unsped  解码CM分析
【文章作者】: Xjun
【作者主页】: www.52pojie.cn
【软件名称】: Fuc kKido -- Unsped
【下载地址】: http://www.52pojie.cn/thread-228711-1-1.html
【操作平台】: win xp
【作者声明】: 失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
CM主要是里面预先写好了密文，然后要我们逆出KEY  来使得解码内容为You win

载入OD 发现oepS 00401000 发现是自己改的，为易语言黑月编译的程序！

发现会弹出信息框！  下MessageBoxA断点！

断下后一直回朔来到这里：

下上断点点击按钮：
跟到
00401519 55             push ebp
0040151A 8BEC          mov    ebp, esp
0040151C 81EC 0C000000 sub    esp, 0xC
00401522 68 04000080    push 0x80000004
00401527 6A 00          push 0x0
00401529 A1 E1524000    mov    eax, dword ptr [0x4052E1]
0040152E 85C0          test eax, eax
00401530 75 05          jnz    short 00401537
00401532 B8 00524000    mov    eax, 00405200
00401537 50             push eax
00401538 68 01000000    push 0x1
0040153D BB 98010000    mov    ebx, 0x198
00401542 E8 590C0000    call 004021A0
00401547 83C4 10       add    esp, 0x10
0040154A 8945 FC       mov    dword ptr [ebp-0x4], eax
0040154D 8D45 FC       lea    eax, dword ptr [ebp-0x4]
00401550 50             push eax
00401551 B8 0E524000    mov    eax, 0040520E
00401556 8945 F8       mov    dword ptr [ebp-0x8], eax
00401559 8D45 F8       lea    eax, dword ptr [ebp-0x8]
0040155C 50             push eax
0040155D E8 E5010000    call 00401747                      ; //解密地方
00401562 8945 F4       mov    dword ptr [ebp-0xC], eax
00401565 8B5D F8       mov    ebx, dword ptr [ebp-0x8]

我们下断点到 0040155D

通过看call传递的参数看到加密的密文和你输入的key

我们来分析call的算法

00401747 55             push ebp
00401748 8BEC          mov    ebp, esp
0040174A 81EC 80000000 sub    esp, 0x80
00401750 C745 FC 0000000>mov    dword ptr [ebp-0x4], 0x0
00401757 C745 F8 0000000>mov    dword ptr [ebp-0x8], 0x0
0040175E C745 F4 0000000>mov    dword ptr [ebp-0xC], 0x0
00401765 C745 F0 0000000>mov    dword ptr [ebp-0x10], 0x0
0040176C C745 EC 0000000>mov    dword ptr [ebp-0x14], 0x0
00401773 C745 E8 0000000>mov    dword ptr [ebp-0x18], 0x0
0040177A C745 E4 0000000>mov    dword ptr [ebp-0x1C], 0x0
00401781 C745 E0 0000000>mov    dword ptr [ebp-0x20], 0x0
00401788 C745 DC 0000000>mov    dword ptr [ebp-0x24], 0x0
0040178F 8B5D 08       mov    ebx, dword ptr [ebp+0x8]
00401792 8B03          mov    eax, dword ptr [ebx]
00401794 85C0          test eax, eax
00401796 74 13          je    short 004017AB
00401798 50             push eax
00401799 8B40 04       mov    eax, dword ptr [eax+0x4]
0040179C 83C0 08       add    eax, 0x8
0040179F 50             push eax
004017A0 E8 28040000    call 00401BCD                         ; 申请一段内存
004017A5 59             pop    ecx
004017A6 5E             pop    esi
004017A7 8BF8          mov    edi, eax
004017A9 F3:A4          rep    movs byte ptr es:[edi], byte ptr >
004017AB 50             push eax
004017AC 8B5D FC       mov    ebx, dword ptr [ebp-0x4]
004017AF 85DB          test ebx, ebx
004017B1 74 09          je    short 004017BC
004017B3 53             push ebx
004017B4 E8 02040000    call 00401BBB
004017B9 83C4 04       add    esp, 0x4
004017BC 58             pop    eax
004017BD 8945 FC       mov    dword ptr [ebp-0x4], eax
004017C0 C745 F8 0000000>mov    dword ptr [ebp-0x8], 0x0
004017C7 8B5D 0C       mov    ebx, dword ptr [ebp+0xC]
004017CA 8B03          mov    eax, dword ptr [ebx]
004017CC 85C0          test eax, eax
004017CE 74 13          je    short 004017E3
004017D0 50             push eax
004017D1 8B40 04       mov    eax, dword ptr [eax+0x4]
004017D4 83C0 08       add    eax, 0x8
004017D7 50             push eax
004017D8 E8 F0030000    call 00401BCD                         ; 申请一段内存
004017DD 59             pop    ecx
004017DE 5E             pop    esi
004017DF 8BF8          mov    edi, eax
004017E1 F3:A4          rep    movs byte ptr es:[edi], byte ptr >
004017E3 50             push eax
004017E4 8B5D F4       mov    ebx, dword ptr [ebp-0xC]
004017E7 85DB          test ebx, ebx
004017E9 74 09          je    short 004017F4
004017EB 53             push ebx
004017EC E8 CA030000    call 00401BBB
004017F1 83C4 04       add    esp, 0x4
004017F4 58             pop    eax
004017F5 8945 F4       mov    dword ptr [ebp-0xC], eax
004017F8 68 05000080    push 0x80000005
004017FD 6A 00          push 0x0
004017FF 8B45 FC       mov    eax, dword ptr [ebp-0x4]
00401802 85C0          test eax, eax
00401804 75 05          jnz    short 0040180B
00401806 B8 2C524000    mov    eax, 0040522C
0040180B 50             push eax
0040180C 68 01000000    push 0x1
00401811 BB 94010000    mov    ebx, 0x194
00401816 E8 650A0000    call 00402280
0040181B 83C4 10       add    esp, 0x10
0040181E 8945 F0       mov    dword ptr [ebp-0x10], eax       ; 取密文长度密文已经固定长度是7
00401821 68 05000080    push 0x80000005
00401826 6A 00          push 0x0
00401828 8B45 F4       mov    eax, dword ptr [ebp-0xC]
0040182B 85C0          test eax, eax
0040182D 75 05          jnz    short 00401834
0040182F B8 2C524000    mov    eax, 0040522C
00401834 50             push eax
00401835 68 01000000    push 0x1
0040183A BB 94010000    mov    ebx, 0x194
0040183F E8 3C0A0000    call 00402280                         ; 取key长度就是编辑框输入的
00401844 83C4 10       add    esp, 0x10
00401847 8945 EC       mov    dword ptr [ebp-0x14], eax
0040184A 8B45 F0       mov    eax, dword ptr [ebp-0x10]
0040184D 33C9          xor    ecx, ecx
0040184F 50             push eax
00401850 8D45 E8       lea    eax, dword ptr [ebp-0x18]
00401853 8BD8          mov    ebx, eax
00401855 58             pop    eax
00401856 41             inc    ecx                            ; 计次循环开始
00401857 51             push ecx
00401858 53             push ebx
00401859 890B          mov    dword ptr [ebx], ecx
0040185B 50             push eax
0040185C 3BC8          cmp    ecx, eax
0040185E 0F8F 1A020000 jg    00401A7E
00401864 8B5D FC       mov    ebx, dword ptr [ebp-0x4]
00401867 E8 CDFDFFFF    call 00401639
0040186C 53             push ebx
0040186D 51             push ecx
0040186E 8B45 E8       mov    eax, dword ptr [ebp-0x18]
00401871 48             dec    eax
00401872 79 0D          jns    short 00401881
00401874 68 04000000    push 0x4
00401879 E8 43030000    call 00401BC1
0040187E 83C4 04       add    esp, 0x4
00401881 59             pop    ecx
00401882 5B             pop    ebx
00401883 3BC1          cmp    eax, ecx
00401885 7C 0D          jl    short 00401894
00401887 68 01000000    push 0x1
0040188C E8 30030000    call 00401BC1
00401891 83C4 04       add    esp, 0x4
00401894 03D8          add    ebx, eax
00401896 895D D8       mov    dword ptr [ebp-0x28], ebx
00401899 8B5D D8       mov    ebx, dword ptr [ebp-0x28]
0040189C 8A03          mov    al, byte ptr [ebx]
0040189E 8845 E4       mov    byte ptr [ebp-0x1C], al
004018A1 8B5D F4       mov    ebx, dword ptr [ebp-0xC]
004018A4 E8 90FDFFFF    call 00401639
004018A9 53             push ebx
004018AA 51             push ecx
004018AB DB45 EC       fild dword ptr [ebp-0x14]             ; 取次数
004018AE DD5D D4       fstp qword ptr [ebp-0x2C]
004018B1 68 01060080    push 0x80000601
004018B6 FF75 D8       push dword ptr [ebp-0x28]
004018B9 FF75 D4       push dword ptr [ebp-0x2C]
004018BC DB45 E8       fild dword ptr [ebp-0x18]             ; 第几次循环
004018BF DD5D CC       fstp qword ptr [ebp-0x34]
004018C2 68 01060080    push 0x80000601
004018C7 FF75 D0       push dword ptr [ebp-0x30]
004018CA FF75 CC       push dword ptr [ebp-0x34]
004018CD 68 02000000    push 0x2
004018D2 BB 48000000    mov    ebx, 0x48
004018D7 E8 B4090000    call 00402290
004018DC 83C4 1C       add    esp, 0x1C
004018DF 8945 C4       mov    dword ptr [ebp-0x3C], eax
004018E2 8955 C8       mov    dword ptr [ebp-0x38], edx
004018E5 DD45 C4       fld    qword ptr [ebp-0x3C]             ; 循环次数加1
004018E8 DC05 34524000 fadd qword ptr [0x405234]
004018EE DD5D BC       fstp qword ptr [ebp-0x44]
004018F1 DD45 BC       fld    qword ptr [ebp-0x44]
004018F4 E8 60FDFFFF    call 00401659
004018F9 48             dec    eax
004018FA 79 0D          jns    short 00401909
004018FC 68 04000000    push 0x4
00401901 E8 BB020000    call 00401BC1
00401906 83C4 04       add    esp, 0x4
00401909 59             pop    ecx
0040190A 5B             pop    ebx
0040190B 3BC1          cmp    eax, ecx
0040190D 7C 0D          jl    short 0040191C
0040190F 68 01000000    push 0x1
00401914 E8 A8020000    call 00401BC1
00401919 83C4 04       add    esp, 0x4
0040191C 03D8          add    ebx, eax
0040191E 895D B8       mov    dword ptr [ebp-0x48], ebx
00401921 8B5D B8       mov    ebx, dword ptr [ebp-0x48]
00401924 8A03          mov    al, byte ptr [ebx]
00401926 8845 E0       mov    byte ptr [ebp-0x20], al
00401929 837D F8 01    cmp    dword ptr [ebp-0x8], 0x1
0040192D B8 00000000    mov    eax, 0x0
00401932 0F94C0       sete al
00401935 8945 D8       mov    dword ptr [ebp-0x28], eax
00401938 8B45 E4       mov    eax, dword ptr [ebp-0x1C]
0040193B 25 FF000000    and    eax, 0xFF
00401940 8945 D0       mov    dword ptr [ebp-0x30], eax
00401943 DB45 D0       fild dword ptr [ebp-0x30]             ; 这里依次取了密文的第1-7位的Hex值
00401946 DD5D D0       fstp qword ptr [ebp-0x30]
00401949 DD45 D0       fld    qword ptr [ebp-0x30]
0040194C 8B45 E0       mov    eax, dword ptr [ebp-0x20]
0040194F 25 FF000000    and    eax, 0xFF
00401954 8945 C8       mov    dword ptr [ebp-0x38], eax
00401957 DB45 C8       fild dword ptr [ebp-0x38]             ; 从key第二位取 Hex值
0040195A DD5D C8       fstp qword ptr [ebp-0x38]
0040195D DC45 C8       fadd qword ptr [ebp-0x38]             ; 整数相加
00401960 DD5D C0       fstp qword ptr [ebp-0x40]             ; 后来发现这段加法完全是不起作用的
00401963 68 01060080    push 0x80000601
00401968 68 00007040    push 0x40700000
0040196D 68 00000000    push 0x0
00401972 68 01060080    push 0x80000601
00401977 FF75 C4       push dword ptr [ebp-0x3C]
0040197A FF75 C0       push dword ptr [ebp-0x40]
0040197D 68 02000000    push 0x2
00401982 BB 48000000    mov    ebx, 0x48
00401987 E8 04090000    call 00402290
0040198C 83C4 1C       add    esp, 0x1C
0040198F 8945 B8       mov    dword ptr [ebp-0x48], eax       ; 保存了后6位
00401992 8955 BC       mov    dword ptr [ebp-0x44], edx
00401995 8B45 E4       mov    eax, dword ptr [ebp-0x1C]
00401998 25 FF000000    and    eax, 0xFF
0040199D 8945 B0       mov    dword ptr [ebp-0x50], eax
004019A0 DB45 B0       fild dword ptr [ebp-0x50]             ; 继续取第一位密文Hex
004019A3 DD5D B0       fstp qword ptr [ebp-0x50]
004019A6 DD45 B0       fld    qword ptr [ebp-0x50]
004019A9 8B45 E0       mov    eax, dword ptr [ebp-0x20]
004019AC 25 FF000000    and    eax, 0xFF
004019B1 8945 A8       mov    dword ptr [ebp-0x58], eax
004019B4 DB45 A8       fild dword ptr [ebp-0x58]             ; //继续从key第二位取
004019B7 DD5D A8       fstp qword ptr [ebp-0x58]
004019BA DC65 A8       fsub qword ptr [ebp-0x58]             ; //整数相减
004019BD DD5D A0       fstp qword ptr [ebp-0x60]
004019C0 68 01060080    push 0x80000601
004019C5 68 00007040    push 0x40700000
004019CA 68 00000000    push 0x0
004019CF 68 01060080    push 0x80000601
004019D4 FF75 A4       push dword ptr [ebp-0x5C]
004019D7 FF75 A0       push dword ptr [ebp-0x60]
004019DA 68 02000000    push 0x2
004019DF BB 48000000    mov    ebx, 0x48
004019E4 E8 A7080000    call 00402290
004019E9 83C4 1C       add    esp, 0x1C
004019EC 8945 98       mov    dword ptr [ebp-0x68], eax
004019EF 8955 9C       mov    dword ptr [ebp-0x64], edx
004019F2 837D D8 00    cmp    dword ptr [ebp-0x28], 0x0
004019F6 0F84 0B000000 je    00401A07                         ; //判断字符串输入过长或者过短把
004019FC 8B55 BC       mov    edx, dword ptr [ebp-0x44]
004019FF 8B45 B8       mov    eax, dword ptr [ebp-0x48]
00401A02 E9 06000000    jmp    00401A0D
00401A07 8B55 9C       mov    edx, dword ptr [ebp-0x64]
00401A0A 8B45 98       mov    eax, dword ptr [ebp-0x68]
00401A0D 8945 88       mov    dword ptr [ebp-0x78], eax
00401A10 8955 8C       mov    dword ptr [ebp-0x74], edx
00401A13 DD45 88       fld    qword ptr [ebp-0x78]
00401A16 E8 3EFCFFFF    call 00401659
00401A1B 68 01010080    push 0x80000101
00401A20 6A 00          push 0x0
00401A22 50             push eax
00401A23 68 01000000    push 0x1
00401A28 BB 40010000    mov    ebx, 0x140
00401A2D E8 8E080000    call 004022C0
00401A32 83C4 10       add    esp, 0x10
00401A35 8945 84       mov    dword ptr [ebp-0x7C], eax       ; //保存相减的结果位为解码的第一位
00401A38 FF75 84       push dword ptr [ebp-0x7C]
00401A3B FF75 DC       push dword ptr [ebp-0x24]
00401A3E B9 02000000    mov    ecx, 0x2
00401A43 E8 A3FCFFFF    call 004016EB
00401A48 83C4 08       add    esp, 0x8
00401A4B 8945 80       mov    dword ptr [ebp-0x80], eax
00401A4E 8B5D 84       mov    ebx, dword ptr [ebp-0x7C]
00401A51 85DB          test ebx, ebx
00401A53 74 09          je    short 00401A5E
00401A55 53             push ebx
00401A56 E8 60010000    call 00401BBB
00401A5B 83C4 04       add    esp, 0x4
00401A5E 8B45 80       mov    eax, dword ptr [ebp-0x80]
00401A61 50             push eax
00401A62 8B5D DC       mov    ebx, dword ptr [ebp-0x24]
00401A65 85DB          test ebx, ebx
00401A67 74 09          je    short 00401A72
00401A69 53             push ebx
00401A6A E8 4C010000    call 00401BBB
00401A6F 83C4 04       add    esp, 0x4
00401A72 58             pop    eax
00401A73 8945 DC       mov    dword ptr [ebp-0x24], eax
00401A76 58             pop    eax
00401A77 5B             pop    ebx
00401A78 59             pop    ecx
00401A79  ^ E9 D8FDFFFF    jmp    00401856                         ; 继续下一次寻坏
00401A7E 83C4 0C       add    esp, 0xC                         ; 循环完成
00401A81 8B45 DC       mov    eax, dword ptr [ebp-0x24]
00401A84 85C0          test eax, eax
00401A86 74 15          je    short 00401A9D
00401A88 50             push eax
00401A89 8BD8          mov    ebx, eax
00401A8B E8 F0FBFFFF    call 00401680
00401A90 40             inc    eax
00401A91 50             push eax
00401A92 E8 36010000    call 00401BCD
00401A97 59             pop    ecx
00401A98 5E             pop    esi
00401A99 8BF8          mov    edi, eax
00401A9B F3:A4          rep    movs byte ptr es:[edi], byte ptr >
00401A9D E9 00000000    jmp    00401AA2
00401AA2 50             push eax
00401AA3 8B5D FC       mov    ebx, dword ptr [ebp-0x4]
00401AA6 85DB          test ebx, ebx
00401AA8 74 09          je    short 00401AB3
00401AAA 53             push ebx
00401AAB E8 0B010000    call 00401BBB
00401AB0 83C4 04       add    esp, 0x4
00401AB3 8B5D F4       mov    ebx, dword ptr [ebp-0xC]
00401AB6 85DB          test ebx, ebx
00401AB8 74 09          je    short 00401AC3
00401ABA 53             push ebx
00401ABB E8 FB000000    call 00401BBB
00401AC0 83C4 04       add    esp, 0x4
00401AC3 8B5D DC       mov    ebx, dword ptr [ebp-0x24]
00401AC6 85DB          test ebx, ebx
00401AC8 74 09          je    short 00401AD3
00401ACA 53             push ebx
00401ACB E8 EB000000    call 00401BBB
00401AD0 83C4 04       add    esp, 0x4
00401AD3 58             pop    eax
00401AD4 8BE5          mov    esp, ebp
00401AD6 5D             pop    ebp
00401AD7 C2 0800       retn 0x8

然后计算
第一位随便输入
第二位=CE-59=75 u
第三位=D2-6F=63 c
第四位=E0-75=6B k
第五位=40-20=20  空格
第六位=A2-57=4B K
第七位=D2-69=69 i
第八位 D2-6E=64 d

发现第一位没有计算，输入什么都行。

brack · 发表于 2013-12-15 15:30

@Unsped 不详师傅,你的菊花被爆了.

小布和小东 · 发表于 2013-12-15 15:30

哈哈真的很喜欢不要B啊。。。

zz100179 · 发表于 2015-4-2 15:57

你们太牛了，我还是研究怎么在64位win8利用esp脱asp的壳吧

蚯蚓翔龙 · 发表于 2015-4-5 16:17

逆算法厉害

ollydebug · 发表于 2015-4-6 20:34

膜拜算法大神

帐号		自动登录	找回密码
密码			注册[Register]

[CrackMe] 【吾爱2013CM大赛解答】-- Fuc kKido -- Unsped 解码CM分析

本帖子中包含更多资源

免费评分