感谢蚊香老大的支持与慷慨/:002 ,以下流程是本人的调试流程(未知反跟踪与调试陷井),先贴张图(跑这个CM用F7单步法效果好点/:014 )
如图所示,在引发错误的调用处我们都设置断点
为了使程序能正常的跑起来并设断,我们需要修改以下几个跳转好正常的分析算法
①
........
00401519 >mov edi, 00401296 ;入口地址
0040151E >mov ecx, 100
00401523 >mov al, 99
00401525 >xor al, 55
00401527 >repne scas byte ptr es:
00401529 >test ecx, ecx
0040152B >je short 00401533 ;此处改为jmp short 00401533,跳过后面的jmp short 004014F5
0040152D >pop esi
0040152E >xor esi, esi
00401530 >push edi
00401531 >jmp short 004014F5
00401533 >retn
00401534 >int3
................
②
.........
004014B1mov edi, dword ptr
004014B3mov ecx, 6
004014B8mov al, 0CC
004014BArepne scas byte ptr es:
004014BCtest ecx, ecx
004014BEje short 004014C6 ;同理，此处改为jmp short 004014C6
004014C0pop esi
004014C1xor esi, esi
004014C3push edi
004014C4jmp short 004014F5
004014C6retn
........
③
.......
0040139A mov byte ptr , dl
004013A0 mov cl, byte ptr
004013A6 cmp cl, 40
004013A9 jmp short 004013B0 ;此处改为jmp short 004013B0
004013AB jmp 004014F5
004013B0 jmp 00401480
004013B5 retn
........
④
接着往后走会发现
.......
00401510 mov al, byte ptr ;注册码的第二位赋值给al
00401515 cmp al, 45 ;由此可知注册码的第二位为"E"
00401517 jnz short 004014F5
00401519 mov edi, 00401296 ;入口地址
0040151E mov ecx, 100
00401523 mov al, 99
00401525 xor al, 55
00401527 repne scas byte ptr es:
00401529 test ecx, ecx
0040152B jmp short 00401533
0040152D pop esi
0040152E xor esi, esi
00401530 push edi
00401531 jmp short 004014F5
00401533 retn
.......
⑤
......
00401480 call 00401510
00401485 xor ebx, ebx
00401487 mov edi, 00401480
0040148C sub edi, 60
0040148F mov eax, 0DE
00401494 xor eax, 12
00401497 mov ecx, 59
0040149C repne scas byte ptr es:
0040149E test ecx, ecx
004014A0 je short 004014A8 ;改为jmp short 004014A8
004014A2 pop esi
004014A3 xor esi, esi
004014A5 push edi
004014A6 jmp short 004014F5
004014A8 retn
.......
将以上的修改另存为一个文件,用OD重新载入,断点看代码或者字串参考也知道了很好下的,bp GetDlgItemTextA,会断在以下代码
........
0040129Amov esi, 004012FE
0040129Fpush esi
004012A0push dword ptr fs:
004012A7mov dword ptr fs:, esp
004012AEpush dword ptr ; /Count = 1E (30.)
004012B4push 00403000 ; |Buffer = KGM1Tal1.00403000
004012B9push 3EC ; |ControlID = 3EC (1004.)
004012BEpush dword ptr ; |hWnd
004012C1call <jmp.&user32.GetDlgItemTextA>; \GetDlgItemTextA
004012C6push dword ptr ; /Count = 14 (20.)
004012CCpush 00403023 ; |Buffer = KGM1Tal1.00403023
004012D1push 3ED ; |ControlID = 3ED (1005.)
004012D6push dword ptr ; |hWnd
004012D9call <jmp.&user32.GetDlgItemTextA>; \GetDlgItemTextA
004012DEcall 00401332 ;这个Call要跟进一下,是判断注册码并对用户名进行初始计算的
004012E3push 00403053 ;ASCII "ZWATRQLCGHPSXYENVBJDFKMU",内置码表
004012E8call 004013B6 ;关键的算法Call了
004012EDcall 004014CE ;对注册码的最后一位进行判断的Call了
004012F2push 0 ; /Result = 0
004012F4push dword ptr ; |hWnd
004012F7call <jmp.&user32.EndDialog> ; \EndDialog
004012FCjmp short 00401324
.......
关键算法部分,未加注释,大家动态跟踪一下,很容易看懂的(主要是自己功力不够,怕越说越乱/:017 )
........
004013B6push ebp
004013B7mov ebp, esp
004013B9push 00403023 ;ASCII "1E2345678",假码
004013BEcall 00401540 ;取假码位数
004013C3cmp eax, 0A ;注册码的位数为10位
004013C6jnz 004014F5
004013CCmov esi, 00403023 ;ASCII "1E2345678",假码
004013D1mov eax, 0
004013D6mov ebx, 0
004013DBxor ecx, ecx
004013DDjmp short 004013E5
004013DFmov cl, byte ptr
004013E2add ebx, ecx
004013E4inc eax
004013E5cmp eax, 9 ;
004013E8jb short 004013DF
004013EAmov eax, ebx
004013ECmov ecx, 9
004013F1cdq
004013F2idiv ecx
004013F4mov dword ptr , eax
004013F9mov edi, dword ptr
004013FCmov dl, byte ptr
00401402mov al, dl
00401404cmp al, 18
00401406jbe short 0040140A
00401408sub al, 18
0040140Amov byte ptr , al
0040140Fxor eax, eax
00401411mov al, byte ptr
00401416mov ah, byte ptr
00401419mov dh, byte ptr
0040141Bcmp ah, dh
0040141Djnz 004014F5
00401423sub dh, 41
00401426mov dh, dl
00401428mov ah, 0
0040142Amov byte ptr , al
0040142Fxor eax, eax
00401431mov al, byte ptr
00401436add al, dl
00401438cmp al, 18
0040143Ajbe short 0040143E
0040143Csub al, 18
0040143Emov ecx, 2
00401443mov ah, byte ptr
00401446mov dh, byte ptr
00401449cmp ah, dh
0040144Bjnz 004014F5
00401451jmp short 00401477
00401453mov byte ptr , al
00401458xor eax, eax
0040145Amov al, byte ptr
0040145Fsub dh, 41
00401462mov dl, dh
00401464inc ecx
00401465add al, dl
00401467cmp al, 18
00401469jbe short 0040146D
0040146Bsub al, 18
0040146Dmov ah, byte ptr
00401470mov dh, byte ptr
00401473cmp ah, dh
00401475jnz short 004014F5
00401477cmp ecx, 8
0040147Ajb short 00401453
0040147Cleave
0040147Dretn 4
........
算法部分省略了,省点篇幅,以免看着眼花/:001 !个人感觉反跟踪调试部分搞定了其余的大家跟一下应该不难的.
[ 本帖最后由 x80x88 于 2008-8-30 23:41 编辑 ]
页:
1
[2]