好友
阅读权限10
听众
最后登录1970-1-1
|
CM是什么？Crackme是什么？这是什么东西？楼主发的什么？
他们都是一些公开给别人尝试破解的小程序，制作 Crackme 的人可能是程序员，想测试一下自己的软件保护技术，也可能是一位 Cracker，想挑战一下其它 Cracker 的破解实力，也可能是一些正在学习破解的人，自己编一些小程序给自己破解，KeyGenMe是要求别人做出它的 keygen (序号产生器)， ReverseMe 要求别人把它的算法做出逆向分析， UnpackMe 是要求别人把它成功脱壳，本版块禁止回复非技术无关水贴。
本帖最后由 ainddky 于 2014-8-3 04:47 编辑
求助大神 分析以下CM 算法 想弄个注册机
00409DC0 /$ 53 push ebx
00409DC1 |. 56 push esi
00409DC2 |. 83C4 F4 add esp,-0xC 获取一个固定码
00409DC5 |. 8BD8 mov ebx,eax ;
00409DC7 |. 8BD4 mov edx,esp
00409DC9 |. 8BC3 mov eax,ebx
00409DCB |. E8 4C96FFFF call unpacked.0040341C 进入 算法 1
00409DD0 |. 8BF0 mov esi,eax
00409DD2 |. 833C24 00 cmp dword ptr ss:[esp],0x0
00409DD6 |. 74 19 je short unpacked.00409DF1
00409DD8 |. 895C24 04 mov dword ptr ss:[esp+0x4],ebx
00409DDC |. C64424 08 0B mov byte ptr ss:[esp+0x8],0xB
00409DE1 |. 8D5424 04 lea edx,dword ptr ss:[esp+0x4]
00409DE5 |. A1 0C4DCA00 mov eax,dword ptr ds:[0xCA4D0C]
00409DEA |. 33C9 xor ecx,ecx
00409DEC |. E8 5BF7FFFF call unpacked.0040954C
00409DF1 |> 8BC6 mov eax,esi
00409DF3 |. 83C4 0C add esp,0xC
00409DF6 |. 5E pop esi
00409DF7 |. 5B pop ebx
00409DF8 \. C3 retn
00409DCB |. E8 4C96FFFF call unpacked.0040341C 进入 算法 1
如下
0040341C /$ 53 push ebx
0040341D |. 56 push esi
0040341E |. 57 push edi
0040341F |. 89C6 mov esi,eax
00403421 |. 50 push eax
00403422 |. 85C0 test eax,eax
00403424 |. 74 6C je short unpacked.00403492
00403426 |. 31C0 xor eax,eax
00403428 |. 31DB xor ebx,ebx
0040342A |. BF CCCCCC0C mov edi,0xCCCCCCC
0040342F |> 8A1E /mov bl,byte ptr ds:[esi]
00403431 |. 46 |inc esi
00403432 |. 80FB 20 |cmp bl,0x20 ;
00403435 |.^ 74 F8 \je short unpacked.0040342F
00403437 |. B5 00 mov ch,0x0
00403439 |. 80FB 2D cmp bl,0x2D
0040343C |. 74 62 je short unpacked.004034A0
0040343E |. 80FB 2B cmp bl,0x2B
00403441 |. 74 5F je short unpacked.004034A2
00403443 |> 80FB 24 cmp bl,0x24 ; Switch (cases 0..78)
00403446 |. 74 5F je short unpacked.004034A7
00403448 |. 80FB 78 cmp bl,0x78
0040344B |. 74 5A je short unpacked.004034A7
0040344D |. 80FB 58 cmp bl,0x58
00403450 |. 74 55 je short unpacked.004034A7
00403452 |. 80FB 30 cmp bl,0x30
00403455 |. 75 13 jnz short unpacked.0040346A
00403457 |. 8A1E mov bl,byte ptr ds:[esi] ; Case 30 ('0') of switch 00403443
00403459 |. 46 inc esi
0040345A |. 80FB 78 cmp bl,0x78
0040345D |. 74 48 je short unpacked.004034A7
0040345F |. 80FB 58 cmp bl,0x58
00403462 |. 74 43 je short unpacked.004034A7
00403464 |. 84DB test bl,bl
00403466 |. 74 20 je short unpacked.00403488
00403468 |. EB 04 jmp short unpacked.0040346E
0040346A |> 84DB test bl,bl
0040346C |. 74 2D je short unpacked.0040349B
0040346E |> 80EB 30 /sub bl,0x30 ; Default case of switch 00403443
00403471 |. 80FB 09 |cmp bl,0x9
00403474 |. 77 25 |ja short unpacked.0040349B
00403476 |. 39F8 |cmp eax,edi
00403478 |. 77 21 |ja short unpacked.0040349B
0040347A |. 8D0480 |lea eax,dword ptr ds:[eax+eax*4]
0040347D |. 01C0 |add eax,eax
0040347F |. 01D8 |add eax,ebx
00403481 |. 8A1E |mov bl,byte ptr ds:[esi]
00403483 |. 46 |inc esi
00403484 |. 84DB |test bl,bl
00403486 |.^ 75 E6 \jnz short unpacked.0040346E
00403488 |> FECD dec ch
0040348A |. 74 09 je short unpacked.00403495
0040348C |. 85C0 test eax,eax
0040348E |. 7D 54 jge short unpacked.004034E4
00403490 |. EB 09 jmp short unpacked.0040349B
00403492 |> 46 inc esi
00403493 |. EB 06 jmp short unpacked.0040349B
00403495 |> F7D8 neg eax
00403497 |. 7E 4B jle short unpacked.004034E4
00403499 |. 78 49 js short unpacked.004034E4
0040349B |> 5B pop ebx ; Default case of switch 004034BB
0040349C |. 29DE sub esi,ebx
0040349E |. EB 47 jmp short unpacked.004034E7
004034A0 |> FEC5 inc ch
004034A2 |> 8A1E mov bl,byte ptr ds:[esi]
004034A4 |. 46 inc esi
004034A5 |.^ EB 9C jmp short unpacked.00403443
004034A7 |> BF FFFFFF0F mov edi,0xFFFFFFF ; Cases 24 ('$'),58 ('X'),78 ('x') of switch 00403443
004034AC |. 8A1E mov bl,byte ptr ds:[esi]
004034AE |. 46 inc esi
004034AF |. 84DB test bl,bl
004034B1 |.^ 74 DF je short unpacked.00403492
004034B3 |> 80FB 61 /cmp bl,0x61
004034B6 |. 72 03 |jb short unpacked.004034BB
004034B8 |. 80EB 20 |sub bl,0x20
004034BB |> 80EB 30 |sub bl,0x30 ; Switch (cases 30..46)
004034BE |. 80FB 09 |cmp bl,0x9
004034C1 |. 76 0B |jbe short unpacked.004034CE
004034C3 |. 80EB 11 |sub bl,0x11
004034C6 |. 80FB 05 |cmp bl,0x5
004034C9 |.^ 77 D0 |ja short unpacked.0040349B
004034CB |. 80C3 0A |add bl,0xA ; Cases 41 ('A'),42 ('B'),43 ('C'),44 ('D'),45 ('E'),46 ('F') of switch 004034BB
004034CE |> 39F8 |cmp eax,edi ; Cases 30 ('0'),31 ('1'),32 ('2'),33 ('3'),34 ('4'),35 ('5'),36 ('6'),37 ('7'),38 ('8'),39 ('9') of switch 004034BB
004034D0 |.^ 77 C9 |ja short unpacked.0040349B
004034D2 |. C1E0 04 |shl eax,0x4
004034D5 |. 01D8 |add eax,ebx
004034D7 |. 8A1E |mov bl,byte ptr ds:[esi]
004034D9 |. 46 |inc esi
004034DA |. 84DB |test bl,bl
004034DC |.^ 75 D5 \jnz short unpacked.004034B3
004034DE |. FECD dec ch
004034E0 |. 75 02 jnz short unpacked.004034E4
004034E2 |. F7D8 neg eax
004034E4 |> 59 pop ecx
004034E5 |. 31F6 xor esi,esi
004034E7 |> 8932 mov dword ptr ds:[edx],esi
004034E9 |. 5F pop edi
004034EA |. 5E pop esi
004034EB |. 5B pop ebx
004034EC \. C3 retn
|
|
发表于 2014-8-3 04:46
|
发表于 2014-8-4 02:02
