Alive iPhone Video Converter 算法分析及注册机源码

onmiuncai · 发表于 2016-7-24 19:15

再来一篇算法分析，如有不对，欢迎指正。

今天的算法分析的目标是 Alive iPhone Video Converter，Borland Delphi 6.0 - 7.0

QQ截图20160724182832.jpg

输入用户名与随意注册码，弹出出错框后F12暂停，回溯来到下面这个地方

QQ截图20160724183206.jpg

然后从段首下好断点，开始逐步分析，把关键的字符都标记好，具体分析如下

[Asm] 纯文本查看 复制代码

0048809C  /$  55            push ebp
0048809D  |.  8BEC          mov ebp,esp
0048809F  |.  6A 00         push 0x0
004880A1  |.  6A 00         push 0x0
004880A3  |.  6A 00         push 0x0
004880A5  |.  6A 00         push 0x0
004880A7  |.  6A 00         push 0x0
004880A9  |.  53            push ebx
004880AA  |.  56            push esi
004880AB  |.  894D F8       mov [local.2],ecx
004880AE  |.  8955 FC       mov [local.1],edx                        ;  ntdll.KiFastSystemCallRet
004880B1  |.  8BF0          mov esi,eax
004880B3  |.  8B45 FC       mov eax,[local.1]
004880B6  |.  E8 B9C9F7FF   call MP4Conve.00404A74
004880BB  |.  8B45 F8       mov eax,[local.2]                        ;  注册码
004880BE  |.  E8 B1C9F7FF   call MP4Conve.00404A74
004880C3  |.  33C0          xor eax,eax
004880C5  |.  55            push ebp
004880C6  |.  68 93814800   push MP4Conve.00488193
004880CB  |.  64:FF30       push dword ptr fs:[eax]
004880CE  |.  64:8920       mov dword ptr fs:[eax],esp
004880D1  |.  33DB          xor ebx,ebx
004880D3  |.  33D2          xor edx,edx                              ;  ntdll.KiFastSystemCallRet
004880D5  |.  8B45 FC       mov eax,[local.1]                        ;  用户名
004880D8  |.  E8 EBCAF7FF   call MP4Conve.00404BC8
004880DD  |.  85C0          test eax,eax
004880DF  |.  7E 0B         jle short MP4Conve.004880EC
004880E1  |.  8D45 F8       lea eax,[local.2]
004880E4  |.  8B55 FC       mov edx,[local.1]
004880E7  |.  E8 80C5F7FF   call MP4Conve.0040466C
004880EC  |>  8D4D F4       lea ecx,[local.3]                        ;  注册码
004880EF  |.  8B55 FC       mov edx,[local.1]                        ;  用户名
004880F2  |.  8BC6          mov eax,esi
004880F4  |.  E8 2F010000   call MP4Conve.00488228                   ;  关键CALL
004880F9  |.  8B55 F4       mov edx,[local.3]                        ;  这里出现可疑字符串
004880FC  |.  8B45 F8       mov eax,[local.2]                        ;  假码
004880FF  |.  E8 EC06F8FF   call MP4Conve.004087F0                   ;  strcmp
00488104  |.  85C0          test eax,eax
00488106  |.  75 41         jnz short MP4Conve.00488149              ;  关键跳
00488108  |.  8B55 FC       mov edx,[local.1]
0048810B  |.  8BC6          mov eax,esi
0048810D  |.  E8 26FBFFFF   call MP4Conve.00487C38
00488112  |.  84C0          test al,al
00488114  |.  74 62         je short MP4Conve.00488178
00488116  |.  B3 01         mov bl,0x1
00488118  |.  6A 40         push 0x40
0048811A  |.  8D55 F0       lea edx,[local.4]
0048811D  |.  A1 149E4A00   mov eax,dword ptr ds:[0x4A9E14]
00488122  |.  8B00          mov eax,dword ptr ds:[eax]
00488124  |.  E8 53D2FDFF   call MP4Conve.0046537C
00488129  |.  8B45 F0       mov eax,[local.4]
0048812C  |.  E8 53C9F7FF   call MP4Conve.00404A84
00488131  |.  50            push eax                                 ; |Title = NULL
00488132  |.  68 A4814800   push MP4Conve.004881A4                   ; |Registered successfully, Thanks for your registration.
00488137  |.  A1 149E4A00   mov eax,dword ptr ds:[0x4A9E14]          ; |
0048813C  |.  8B00          mov eax,dword ptr ds:[eax]               ; |
0048813E  |.  8B40 30       mov eax,dword ptr ds:[eax+0x30]          ; |
00488141  |.  50            push eax                                 ; |hOwner = NULL
00488142  |.  E8 65F2F7FF   call <jmp.&user32.MessageBoxA>           ; \MessageBoxA

从上面的分析来看，我们首先要分析的是004880F4 这个call,所以，下好断点，F7步入，然后依然老样子，把注释做好，方便分析

[Asm] 纯文本查看 复制代码

00488228  /$  55            push ebp
00488229  |.  8BEC          mov ebp,esp
0048822B  |.  6A 00         push 0x0
0048822D  |.  6A 00         push 0x0
0048822F  |.  6A 00         push 0x0
00488231  |.  6A 00         push 0x0
00488233  |.  6A 00         push 0x0
00488235  |.  6A 00         push 0x0
00488237  |.  6A 00         push 0x0
00488239  |.  6A 00         push 0x0
0048823B  |.  53            push ebx
0048823C  |.  56            push esi
0048823D  |.  57            push edi                                 ;  ntdll.7C930228
0048823E  |.  8BD9          mov ebx,ecx
00488240  |.  8955 FC       mov [local.1],edx                        ;  name ASCII "kkapskok"
00488243  |.  8BF8          mov edi,eax
00488245  |.  8B45 FC       mov eax,[local.1]
00488248  |.  E8 27C8F7FF   call MP4Conve.00404A74
0048824D  |.  33C0          xor eax,eax
0048824F  |.  55            push ebp
00488250  |.  68 83834800   push MP4Conve.00488383
00488255  |.  64:FF30       push dword ptr fs:[eax]
00488258  |.  64:8920       mov dword ptr fs:[eax],esp
0048825B  |.  8D45 FC       lea eax,[local.1]
0048825E  |.  BA 9C834800   mov edx,MP4Conve.0048839C                ;  Ae2G0I|hl
00488263  |.  E8 2CC6F7FF   call MP4Conve.00404894
00488268  |.  8B45 FC       mov eax,[local.1]                        ;  strcat ASCII "kkapskokAe2G0I|hl"
0048826B  |.  E8 1CC6F7FF   call MP4Conve.0040488C
00488270  |.  8BF0          mov esi,eax
00488272  |.  D1FE          sar esi,1
00488274  |.  79 03         jns short MP4Conve.00488279
00488276  |.  83D6 00       adc esi,0x0
00488279  |>  8D45 F0       lea eax,[local.4]
0048827C  |.  50            push eax
0048827D  |.  8BCE          mov ecx,esi
0048827F  |.  BA 01000000   mov edx,0x1
00488284  |.  8B45 FC       mov eax,[local.1]
00488287  |.  E8 58C8F7FF   call MP4Conve.00404AE4
0048828C  |.  8B45 F0       mov eax,[local.4]                        ;  name ASCII "kkapskok"
0048828F  |.  50            push eax
00488290  |.  8D45 EC       lea eax,[local.5]
00488293  |.  50            push eax
00488294  |.  8B45 FC       mov eax,[local.1]                        ;  ASCII "kkapskokAe2G0I|hl"
00488297  |.  E8 F0C5F7FF   call MP4Conve.0040488C
0048829C  |.  8BC8          mov ecx,eax                              ;  11h -> 17位
0048829E  |.  8D56 01       lea edx,dword ptr ds:[esi+0x1]           ;  edx 9位
004882A1  |.  8B45 FC       mov eax,[local.1]
004882A4  |.  E8 3BC8F7FF   call MP4Conve.00404AE4
004882A9  |.  8B55 EC       mov edx,[local.5]                        ;  从第9位开始取 ASCII "Ae2G0I|hl"
004882AC  |.  8D45 FC       lea eax,[local.1]
004882AF  |.  59            pop ecx                                  ;  kernel32.7C816037
004882B0  |.  E8 23C6F7FF   call MP4Conve.004048D8
004882B5  |.  8D45 F8       lea eax,[local.2]                        ;  name ASCII "kkapskok"
004882B8  |.  50            push eax
004882B9  |.  B9 0A000000   mov ecx,0xA                              ;  ecx 10位
004882BE  |.  BA 01000000   mov edx,0x1
004882C3  |.  8B45 FC       mov eax,[local.1]                        ;  ASCII "Ae2G0I|hlkkapskok"
004882C6  |.  E8 19C8F7FF   call MP4Conve.00404AE4
004882CB  |.  8D45 F4       lea eax,[local.3]                        ;  截取前面10位 Ae2G0I|hlk
004882CE  |.  50            push eax
004882CF  |.  8B45 FC       mov eax,[local.1]                        ;  ASCII "Ae2G0I|hlkkapskok"
004882D2  |.  E8 B5C5F7FF   call MP4Conve.0040488C
004882D7  |.  8BC8          mov ecx,eax                              ;  11h -> 17位
004882D9  |.  BA 06000000   mov edx,0x6                              ;  edx 6位
004882DE  |.  8B45 FC       mov eax,[local.1]
004882E1  |.  E8 FEC7F7FF   call MP4Conve.00404AE4
004882E6  |.  837D F4 00    cmp [local.3],0x0                        ;  从第6位开始取 ASCII "I|hlkkapskok"
004882EA  |.  75 10         jnz short MP4Conve.004882FC
004882EC  |.  8D45 F4       lea eax,[local.3]
004882EF  |.  BA 9C834800   mov edx,MP4Conve.0048839C                ;  Ae2G0I|hl
004882F4  |.  8B4D F8       mov ecx,[local.2]                        ;  kernel32.7C816040
004882F7  |.  E8 DCC5F7FF   call MP4Conve.004048D8
004882FC  |>  53            push ebx
004882FD  |.  8B4D F4       mov ecx,[local.3]                        ;  ASCII "I|hlkkapskok"
00488300  |.  8B55 F8       mov edx,[local.2]                        ;  ASCII "Ae2G0I|hlk"
00488303  |.  8BC7          mov eax,edi                              ;  ntdll.7C930228
00488305  |.  E8 DEF7FFFF   call MP4Conve.00487AE8                   ;  继续跟进CALL
0048830A  |.  8D45 E8       lea eax,[local.6]
0048830D  |.  50            push eax
0048830E  |.  8B03          mov eax,dword ptr ds:[ebx]               ;  ASCII "1000B0C56F149F9170F0818"
00488310  |.  B9 05000000   mov ecx,0x5                              ;  ecx 5位
00488315  |.  BA 01000000   mov edx,0x1
0048831A  |.  E8 C5C7F7FF   call MP4Conve.00404AE4
0048831F  |.  FF75 E8       push [local.6]                           ;  ASCII "1000B"
00488322  |.  68 B0834800   push MP4Conve.004883B0                   ;  -
00488327  |.  8D45 E4       lea eax,[local.7]
0048832A  |.  50            push eax
0048832B  |.  8B03          mov eax,dword ptr ds:[ebx]
0048832D  |.  B9 05000000   mov ecx,0x5                              ;  ecx 5位
00488332  |.  BA 06000000   mov edx,0x6
00488337  |.  E8 A8C7F7FF   call MP4Conve.00404AE4
0048833C  |.  FF75 E4       push [local.7]                           ;  ASCII "0C56F"
0048833F  |.  68 B0834800   push MP4Conve.004883B0                   ;  -
00488344  |.  8D45 E0       lea eax,[local.8]
00488347  |.  50            push eax
00488348  |.  8B03          mov eax,dword ptr ds:[ebx]
0048834A  |.  B9 05000000   mov ecx,0x5                              ;  ecx 5位
0048834F  |.  BA 0B000000   mov edx,0xB
00488354  |.  E8 8BC7F7FF   call MP4Conve.00404AE4
00488359  |.  FF75 E0       push [local.8]                           ;  ASCII "149F9"
0048835C  |.  8BC3          mov eax,ebx
0048835E  |.  BA 05000000   mov edx,0x5
00488363  |.  E8 E4C5F7FF   call MP4Conve.0040494C
00488368  |.  33C0          xor eax,eax
0048836A  |.  5A            pop edx                                  ;  kernel32.7C816037
0048836B  |.  59            pop ecx                                  ;  kernel32.7C816037
0048836C  |.  59            pop ecx                                  ;  kernel32.7C816037
0048836D  |.  64:8910       mov dword ptr fs:[eax],edx               ;  ntdll.KiFastSystemCallRet
00488370  |.  68 8A834800   push MP4Conve.0048838A
00488375  |>  8D45 E0       lea eax,[local.8]
00488378  |.  BA 08000000   mov edx,0x8
0048837D  |.  E8 76C2F7FF   call MP4Conve.004045F8
00488382  \.  C3            retn

分析完之后，我们来总结一下这个CALL做了哪些事，记录一下。
1. 00488240 获取了用户名，0048825E 这个地址获取了一个常量字符串” Ae2G0I|hl“ 用户名与 Ae2G0I|hl 连接组成新的字符串，通过esi寄存器 sar esi,1 截取一半字符串，然后取后面字符串与前面的另一半连接,再次组成新的字符串。
2. 004882B9 截取了0Ah == 10位出来，变成了新的字符串，压入堆栈保存。
3.再次对此字符串从第6位开始截取到完，变成了又一串新的字符串，堆栈保存。
注意这个地址00488305，过了这个call 后会发现生成一串可疑字符串。这个我们不知道来路，所以这个CALL稍后还得继续分析，我们接着看下面的，
4.依然把这个可疑字符串5个一段，分成了 3段，只取前面15个字符，并用"-"连接。从前面还没进CALL之前我们得知其实这个就是真码，所以我们要对00488305进行分析。

[Asm] 纯文本查看 复制代码

00487AE8  /$  55            push ebp
00487AE9  |.  8BEC          mov ebp,esp
00487AEB  |.  83C4 E0       add esp,-0x20
00487AEE  |.  53            push ebx
00487AEF  |.  56            push esi
00487AF0  |.  57            push edi                                 ;  ntdll.7C930228
00487AF1  |.  33DB          xor ebx,ebx
00487AF3  |.  895D E0       mov [local.8],ebx
00487AF6  |.  895D F0       mov [local.4],ebx
00487AF9  |.  894D F8       mov [local.2],ecx                        ;  ASCII "lsooAe2"
00487AFC  |.  8955 FC       mov [local.1],edx                        ;  ASCII "G0I|hlsooA"
00487AFF  |.  8B45 FC       mov eax,[local.1]
00487B02  |.  E8 6DCFF7FF   call MP4Conve.00404A74
00487B07  |.  8B45 F8       mov eax,[local.2]                        ;  kernel32.7C816040
00487B0A  |.  E8 65CFF7FF   call MP4Conve.00404A74
00487B0F  |.  33C0          xor eax,eax
00487B11  |.  55            push ebp
00487B12  |.  68 047C4800   push MP4Conve.00487C04
00487B17  |.  64:FF30       push dword ptr fs:[eax]
00487B1A  |.  64:8920       mov dword ptr fs:[eax],esp
00487B1D  |.  8B45 F8       mov eax,[local.2]                        ;  kernel32.7C816040
00487B20  |.  E8 67CDF7FF   call MP4Conve.0040488C
00487B25  |.  8945 F4       mov [local.3],eax                        ;  ASCII "lsooAe2" 获取长度
00487B28  |.  837D F4 00    cmp [local.3],0x0
00487B2C  |.  75 0D         jnz short MP4Conve.00487B3B
00487B2E  |.  8D45 F8       lea eax,[local.2]
00487B31  |.  BA 1C7C4800   mov edx,MP4Conve.00487C1C                ;  Think Space
00487B36  |.  E8 31CBF7FF   call MP4Conve.0040466C
00487B3B  |>  33F6          xor esi,esi
00487B3D  |.  BB 00010000   mov ebx,0x100                            ;  ebx = 100
00487B42  |.  8D45 F0       lea eax,[local.4]
00487B45  |.  50            push eax
00487B46  |.  C745 E4 00010>mov [local.7],0x100
00487B4D  |.  C645 E8 00    mov byte ptr ss:[ebp-0x18],0x0
00487B51  |.  8D55 E4       lea edx,[local.7]
00487B54  |.  33C9          xor ecx,ecx
00487B56  |.  B8 307C4800   mov eax,MP4Conve.00487C30                ;  %1.2x
00487B5B  |.  E8 641EF8FF   call MP4Conve.004099C4                   ;  转成ASCII "100"
00487B60  |.  8B45 FC       mov eax,[local.1]                        ;  ASCII "G0I|hlsooA"
00487B63  |.  E8 24CDF7FF   call MP4Conve.0040488C
00487B68  |.  8BF8          mov edi,eax                              ;  ASCII "G0I|hlsooA"  获取长度
00487B6A  |.  85FF          test edi,edi                             ;  ntdll.7C930228
00487B6C  |.  7E 60         jle short MP4Conve.00487BCE
00487B6E  |.  C745 EC 01000>mov [local.5],0x1                        ;  计数
00487B75  |>  8B45 FC       /mov eax,[local.1]                       ;  ASCII "G0I|hlsooA"
00487B78  |.  8B55 EC       |mov edx,[local.5]
00487B7B  |.  0FB64410 FF   |movzx eax,byte ptr ds:[eax+edx-0x1]     ;  逐个取字
00487B80  |.  03C3          |add eax,ebx                             ;  EBX初始化100，循环后去上一次的结果
00487B82  |.  B9 FF000000   |mov ecx,0xFF
00487B87  |.  99            |cdq
00487B88  |.  F7F9          |idiv ecx
00487B8A  |.  8BDA          |mov ebx,edx                             ;  ebx = (eax+100[第2次开始为上次结果]) mod 0xff
00487B8C  |.  3B75 F4       |cmp esi,[local.3]                       ;  ASCII "lsooAe2" 长度
00487B8F  |.  7D 03         |jge short MP4Conve.00487B94
00487B91  |.  46            |inc esi                                 ;  计数("lsooAe2" 长度)
00487B92  |.  EB 05         |jmp short MP4Conve.00487B99
00487B94  |>  BE 01000000   |mov esi,0x1
00487B99  |>  8B45 F8       |mov eax,[local.2]                       ;  kernel32.7C816040
00487B9C  |.  0FB64430 FF   |movzx eax,byte ptr ds:[eax+esi-0x1]     ;  逐个取字
00487BA1  |.  33D8          |xor ebx,eax                             ;  取出的字符与前面计算的字符 xor
00487BA3  |.  8D45 E0       |lea eax,[local.8]
00487BA6  |.  50            |push eax
00487BA7  |.  895D E4       |mov [local.7],ebx
00487BAA  |.  C645 E8 00    |mov byte ptr ss:[ebp-0x18],0x0
00487BAE  |.  8D55 E4       |lea edx,[local.7]
00487BB1  |.  33C9          |xor ecx,ecx
00487BB3  |.  B8 307C4800   |mov eax,MP4Conve.00487C30               ;  %1.2x
00487BB8  |.  E8 071EF8FF   |call MP4Conve.004099C4                  ;  把结果转成ASCII
00487BBD  |.  8B55 E0       |mov edx,[local.8]
00487BC0  |.  8D45 F0       |lea eax,[local.4]
00487BC3  |.  E8 CCCCF7FF   |call MP4Conve.00404894
00487BC8  |.  FF45 EC       |inc [local.5]
00487BCB  |.  4F            |dec edi                                 ;  循环 ASCII "G0I|hlsooA"  的长度
00487BCC  |.^ 75 A7         \jnz short MP4Conve.00487B75
00487BCE  |>  8B45 08       mov eax,[arg.1]                          ;  最后组合成 100+计算的结果
00487BD1  |.  8B55 F0       mov edx,[local.4]
00487BD4  |.  E8 4FCAF7FF   call MP4Conve.00404628
00487BD9  |.  33C0          xor eax,eax
00487BDB  |.  5A            pop edx                                  ;  kernel32.7C816037
00487BDC  |.  59            pop ecx                                  ;  kernel32.7C816037
00487BDD  |.  59            pop ecx                                  ;  kernel32.7C816037
00487BDE  |.  64:8910       mov dword ptr fs:[eax],edx               ;  ntdll.KiFastSystemCallRet
00487BE1  |.  68 0B7C4800   push MP4Conve.00487C0B
00487BE6  |>  8D45 E0       lea eax,[local.8]
00487BE9  |.  E8 E6C9F7FF   call MP4Conve.004045D4
00487BEE  |.  8D45 F0       lea eax,[local.4]
00487BF1  |.  E8 DEC9F7FF   call MP4Conve.004045D4
00487BF6  |.  8D45 F8       lea eax,[local.2]
00487BF9  |.  BA 02000000   mov edx,0x2
00487BFE  |.  E8 F5C9F7FF   call MP4Conve.004045F8
00487C03  \.  C3            retn

通过上面的分析再来总结一下这个CALL，把上一层的CALL堆栈保存的2个字符串进行处理，将取10位的字符串作为循环开始处理，逐个取字，与EBX初始化100h进行相加然后与FF求余，得出的结果在与第二个字符串逐个取字进行XOR，最后把结果保存给初始化的EBX，然后把初始化的100与结果转ASCII相连接。

QQ截图20160724191003.jpg

注意这里，因为当第2个字符串比第1个字符串段，所以这里做了个判断，若小于第一个字符串后，则从新从第一位开始取值与前面的第一个结果进行XOR。
最终循环完计算的结果就是出CALL后的那串可疑字符串，到此，我们就把算法的部分全部分析完了。下面是易语言的源码与注册机，有兴趣的朋友可以自己动动手分析分析。

QQ截图20160724191444.jpg

Alive iPhone Video Converter KeyGen.rar (298.99 KB, 下载次数: 25)

quintionmon · 发表于 2016-8-13 21:27

好强大，看起来还不错啊。厉害人物！

帐号		自动登录	找回密码
密码			注册[Register]

[原创] Alive iPhone Video Converter 算法分析及注册机源码

免费评分

本帖被以下淘专辑推荐: