恨浩申请加入[PYG]（三）

恨浩 · 发表于 2005-3-19 18:42:38

ShowDep 4.0 beta 1 注册算法分析

【软件主页】：http://www.sowdep.com/
【破解工具】：OllyDbg、系统自带计算器
【本文作者】：好好学习（恨浩）
【目标下载】：http://bbs.pediy.com/upload/file/2005/1/ShowDep.rar_949.rar

1. 运行ShowDep
2. 用鼠标单击ShowDep菜单->“Help”, 然后再单击“About”
3. 待弹出对话框后请再单击“Register”按钮
输入：name：h
      number:1-2-3-87654321
提示：“Invalid registration number”
4、运行OllyDbg加载ShowDep，搜索ASCII，找到“Invalid registration number”
5、代码向上看，找到可疑的地方：0041F1E1 E8 0AF9FFFF call chap70x6.0041EAF0
6、在0041F1E1处下断。

关键call：
①call chap70x6.0041EBD0
②call chap70x6.00421970
③call chap70x6.00421C10
④call chap70x6.00421BE0


=============================================================================================================================

0041F1E1 |.  E8 0AF9FFFF       call chap70x6.0041EAF0                ; \chap70x6.0041EAF0    //与注册码有关的call可以跟进去看看，把注册码1-2-3-87654321转换成0x1-2-3-87654321，后8位参与比较，前面的1-2-3参与计算。
0041F1E6 |.  83C4 08          add esp,8
0041F1E9 |.  85C0             test eax,eax                                                    //注册码为空就跳去出错，注册码应该是xxxx-xxxx-xxxx-xxxxxxxx的形式，如果不是这种形式在以后的比较中，比较地址内的值始终为0
0041F1EB |.  74 1D             je short chap70x6.0041F20A
0041F1ED |.  8B95 F0FEFFFF    mov edx,dword ptr ss:[ebp-110]
0041F1F3 |.  81C2 04010000    add edx,104
0041F1F9 |.  52                push edx                               ; /Arg2
0041F1FA |.  8B45 FC          mov eax,dword ptr ss:[ebp-4]          ; |
0041F1FD |.  50                push eax                               ; |Arg1
0041F1FE |.  E8 CDF9FFFF       call chap70x6.0041EBD0                ; \chap70x6.0041EBD0    //①跟进去，算法和比较都在里面
0041F203 |.  83C4 08          add esp,8
0041F206 |.  85C0             test eax,eax                                                    //测试eax
0041F208       75 1C             jnz short chap70x6.0041F226                                     //为0就送你上西天

=============================================================================================================================

①call chap70x6.0041EBD0:

0041EBD0       55                push ebp
0041EBD1       8BEC             mov ebp,esp
0041EBD3       83EC 0C          sub esp,0C
0041EBD6       C745 F4 78563412 mov dword ptr ss:[ebp-C],12345678
0041EBDD |.  C745 F8 89674523 mov dword ptr ss:[ebp-8],23456789
0041EBE4 |.  C745 FC 90785634 mov dword ptr ss:[ebp-4],34567890
0041EBEB |.  8D45 F4          lea eax,dword ptr ss:[ebp-C]
0041EBEE |.  50                push eax
0041EBEF |.  8B4D 08          mov ecx,dword ptr ss:[ebp+8]
0041EBF2 |.  51                push ecx
0041EBF3 |.  E8 48300000       call chap70x6.00421C40
0041EBF8 |.  83C4 04          add esp,4
0041EBFB |.  50                push eax                               ; |Arg2
0041EBFC |.  8B55 08          mov edx,dword ptr ss:[ebp+8]          ; |
0041EBFF |.  52                push edx                               ; |Arg1
0041EC00 |.  E8 6B2D0000       call chap70x6.00421970                ; \chap70x6.00421970  //②用户名的计算，跟进去
0041EC05 |.  83C4 0C          add esp,0C
0041EC08 |.  8D45 F4          lea eax,dword ptr ss:[ebp-C]
0041EC0B |.  50                push eax                               ; /Arg3
0041EC0C |.  6A 0C             push 0C                               ; |Arg2 = 0000000C
0041EC0E |.  8B4D 0C          mov ecx,dword ptr ss:[ebp+C]          ; |
0041EC11 |.  51                push ecx                               ; |Arg1
0041EC12 |.  E8 592D0000       call chap70x6.00421970                ; \chap70x6.00421970  //②注册码的计算，跟进去
0041EC17 |.  83C4 0C          add esp,0C
0041EC1A |.  8B55 0C          mov edx,dword ptr ss:[ebp+C]
0041EC1D |.  8B45 FC          mov eax,dword ptr ss:[ebp-4]
0041EC20 |.  3B42 0C          cmp eax,dword ptr ds:[edx+C]                               //关键比较，eax里的值是上面计算的结果，[edx+c]是我输入的假码。其实在eax里看到的就是明码了，用它直接替换我的假码87654321，就注册成功了，哈哈！
0041EC23       75 07             jnz short chap70x6.0041EC2C                                  //不相同就跳走，注册失败！（一般爆破点，7507-〉9090，每次运行都要重新注册）
0041EC25 |.  B8 01000000       mov eax,1                                                    //将1放入eax
0041EC2A |.  EB 02             jmp short chap70x6.0041EC2E                                  //无条件跳转
0041EC2C |>  33C0             xor eax,eax                                                 //eax与eax异或运算，就是eax清零
0041EC2E |>  8BE5             mov esp,ebp
0041EC30 |.  5D                pop ebp
0041EC31 \.  C3                retn                                                          //返回到：0041F203

=============================================================================================================================

②call chap70x6.00421970

00421970 /$  55                push ebp
00421971 |.  8BEC             mov ebp,esp
00421973 |.  83EC 10          sub esp,10
00421976 |.  8B4D 08          mov ecx,dword ptr ss:[ebp+8]
00421979 |.  53                push ebx
0042197A |.  56                push esi
0042197B |.  57                push edi
0042197C |.  85C9             test ecx,ecx
0042197E |.  C745 FC 00000000 mov dword ptr ss:[ebp-4],0
00421985 |.  0F84 83000000    je chap70x6.00421A0E
0042198B |.  8B7D 10          mov edi,dword ptr ss:[ebp+10]
0042198E |.  85FF             test edi,edi
00421990 |.  74 7C             je short chap70x6.00421A0E
00421992 |.  8B45 0C          mov eax,dword ptr ss:[ebp+C]
00421995 |.  85C0             test eax,eax
00421997 |.  75 07             jnz short chap70x6.004219A0
00421999 |.  5F                pop edi
0042199A |.  5E                pop esi
0042199B |.  5B                pop ebx
0042199C |.  8BE5             mov esp,ebp
0042199E |.  5D                pop ebp
0042199F |.  C3                retn
004219A0 |>  8B35 78C14200    mov esi,dword ptr ds:[<&KERNEL32.IsBadR>;  kernel32.IsBadReadPtr
004219A6 |.  50                push eax                               ; /DataSize
004219A7 |.  51                push ecx                               ; |DataAddress
004219A8 |.  FFD6             call esi                               ; \IsBadReadPtr
004219AA |.  85C0             test eax,eax
004219AC |.  75 4F             jnz short chap70x6.004219FD
004219AE |.  6A 0C             push 0C                               ; /DataSize = C (12.)
004219B0 |.  57                push edi                               ; |DataAddress
004219B1 |.  FFD6             call esi                               ; \IsBadReadPtr
004219B3 |.  85C0             test eax,eax
004219B5 |.  75 46             jnz short chap70x6.004219FD
004219B7 |.  8B07             mov eax,dword ptr ds:[edi]
004219B9 |.  8945 F0          mov dword ptr ss:[ebp-10],eax
004219BC |.  8B4F 04          mov ecx,dword ptr ds:[edi+4]
004219BF |.  894D F4          mov dword ptr ss:[ebp-C],ecx
004219C2 |.  8B57 08          mov edx,dword ptr ds:[edi+8]
004219C5 |.  8955 F8          mov dword ptr ss:[ebp-8],edx
004219C8 |.  60                pushad
004219C9 |.  FC                cld
004219CA |.  8B4D 0C          mov ecx,dword ptr ss:[ebp+C]
004219CD |.  8DBD F0FFFFFF    lea edi,dword ptr ss:[ebp-10]
004219D3 |.  8B75 08          mov esi,dword ptr ss:[ebp+8]
004219D6 |>  AC                /lods byte ptr ds:[esi]                                              //取字符串元素,关循环，你的用户名有几位就循环几次，我偷懒，只输入了一位数，呵呵~~~
004219D7 |.  E8 34020000       |call chap70x6.00421C10                                              //③核心计算部分，跟进！
004219DC |.^ E2 F8             \loopd short chap70x6.004219D6                                        //按字符元素循环
004219DE |.  61                popad
004219DF |.  8B45 10          mov eax,dword ptr ss:[ebp+10]
004219E2 |.  8B4D F0          mov ecx,dword ptr ss:[ebp-10]
004219E5 |.  8B55 F4          mov edx,dword ptr ss:[ebp-C]
004219E8 |.  8908             mov dword ptr ds:[eax],ecx
004219EA |.  8B4D F8          mov ecx,dword ptr ss:[ebp-8]
004219ED |.  8950 04          mov dword ptr ds:[eax+4],edx
004219F0 |.  8948 08          mov dword ptr ds:[eax+8],ecx
004219F3 |.  8B45 FC          mov eax,dword ptr ss:[ebp-4]
004219F6 |.  5F                pop edi
004219F7 |.  5E                pop esi
004219F8 |.  5B                pop ebx
004219F9 |.  8BE5             mov esp,ebp
004219FB |.  5D                pop ebp
004219FC |.  C3                retn                                                    //返回到：0041EC05

[ Last edited by 恨浩 on 2005-3-19 at 06:57 PM ]

恨浩 · 发表于 2005-3-19 18:43:11

=============================================================================================================================
③call chap70x6.00421C10：

00421C10 /$  8B1F             mov ebx,dword ptr ds:[edi]             //ebx=ebi所指向地址内的值
00421C12 |.  E8 C9FFFFFF       call chap70x6.00421BE0                //④计算，跟进去
00421C17 |.  8907             mov dword ptr ds:[edi],eax             //将eax内的计算结果放到edi所指向的地址内
00421C19 |.  25 FF000000       and eax,0FF
00421C1E |.  0347 04          add eax,dword ptr ds:[edi+4]          //eax=eax+[edi+4]所指向地址内的值
00421C21 |.  8947 04          mov dword ptr ds:[edi+4],eax          //[edi+4]所指向地址内的值=eax
00421C24 |.  BA 05840808       mov edx,8088405                      //edx=8088405
00421C29 |.  F7E2             mul edx                               //edx=edx乘以eax，结果的前8位放到edx，后8位放到eax里
00421C2B |.  40                inc eax                               //eax=eax+1
00421C2C |.  8947 04          mov dword ptr ds:[edi+4],eax          //[edi+4]所指向地址内的值=eax
00421C2F |.  C1E8 18          shr eax,18                            //eax逻辑右移
00421C32 |.  8B5F 08          mov ebx,dword ptr ds:[edi+8]          //ebx=eax+[edi+8]所指向地址内的值
00421C35 |.  E8 A6FFFFFF       call chap70x6.00421BE0                //④计算，跟进去
00421C3A |.  8947 08          mov dword ptr ds:[edi+8],eax          //[edi+8]所指向地址内的值=eax
00421C3D \.  C3                retn                                  //返回到004219DC

=============================================================================================================================
④all chap70x6.00421BE0

00421BE0 /$  8BD3             mov edx,ebx                            //edx=ebx
00421BE2 |.  C1EA 08          shr edx,8                            //edx逻辑右移
00421BE5 |.  32D8             xor bl,al                            //bl与al进行异或运算
00421BE7 |.  81E3 FF000000    and ebx,0FF
00421BED |.  8B049D 286E4300    mov eax,dword ptr ds:[ebx*4+436E28]    //eax=[ebx*4+436E28]所指向地址内的值
00421BF4 |.  33C2             xor eax,edx                            //eax与edx进行异或运算
00421BF6 \.  C3                retn                                  //返回到00421C17

程序计算比较过程代码完！

=============================================================================================================================

完美爆破点：

00401559 /$  55                push ebp
0040155A |.  8BEC             mov ebp,esp
0040155C |.  81EC 00010000    sub esp,100
00401562 |.  833D D4D34700 00 cmp dword ptr ds:[47D3D4],0
00401569 |.  74 5D             je short chap70x6.004015C8                                           //745D-〉9090，运行程序已不需要注册！~~~啊哈哈哈！强奸的感觉好像比诱奸更爽！
0040156B |.  68 68F14200       push chap70x6.0042F168                ;  ASCII "Registered to: "
00401570 |.  8D85 00FFFFFF    lea eax,dword ptr ss:[ebp-100]
00401576 |.  50                push eax
00401577 |.  E8 44070200       call chap70x6.00421CC0
0040157C |.  83C4 08          add esp,8
0040157F |.  68 C4D24700       push chap70x6.0047D2C4
00401584 |.  8D8D 00FFFFFF    lea ecx,dword ptr ss:[ebp-100]
0040158A |.  51                push ecx
0040158B |.  E8 40070200       call chap70x6.00421CD0
00401590 |.  83C4 08          add esp,8
00401593 |.  8D95 00FFFFFF    lea edx,dword ptr ss:[ebp-100]
00401599 |.  52                push edx                               ; /Text
0040159A |.  68 00040000       push 400                               ; |/ControlID = 400 (1024.)
0040159F |.  8B45 08          mov eax,dword ptr ss:[ebp+8]          ; ||
004015A2 |.  50                push eax                               ; ||hWnd
004015A3 |.  FF15 D4C24200    call dword ptr ds:[<&USER32.GetDlgItem>>; |\GetDlgItem
004015A9 |.  50                push eax                               ; |hWnd
004015AA |.  FF15 B8C24200    call dword ptr ds:[<&USER32.SetWindowTe>; \SetWindowTextA
004015B0 |.  6A 00             push 0                               ; /ShowState = SW_HIDE
004015B2 |.  68 FF030000       push 3FF                               ; |/ControlID = 3FF (1023.)
004015B7 |.  8B4D 08          mov ecx,dword ptr ss:[ebp+8]          ; ||
004015BA |.  51                push ecx                               ; ||hWnd
004015BB |.  FF15 D4C24200    call dword ptr ds:[<&USER32.GetDlgItem>>; |\GetDlgItem
004015C1 |.  50                push eax                               ; |hWnd
004015C2 |.  FF15 8CC34200    call dword ptr ds:[<&USER32.ShowWindow>>; \ShowWindow
004015C8 |>  8BE5             mov esp,ebp
004015CA |.  5D                pop ebp
004015CB \.  C3                retn

*****************************************************************************************************************************

计算过程：

用户名进行计算：h=68
68 xor 78（取12345678的后两位，程序给出的12345678）=10
10*4+436E28=436E68地址内的值等于=1DB71064
1DB71064 xor （12345678 shr 8）=1DB71064 xor 00123456=1DA52432
1DA52432 and ff = 32
32+（程序给出的23456789）=234567BB
234567BB*8088405（固定值）=11B5799 8FAF72A7 （11B5799放到edx）（8FAF72A7放到eax进行下面的计算，以下都是如此）
8FAF72A7+1=8FAF72A8
8FAF72A8 shr 18 =8F
8F xor 90（取程序给出的34567890的后两位）=1F
1F*4+436E28（固定地址）=00436EA4地址内的值等于=8D080DF5
8D080DF5 xor （34567890 shr 8）=8D080DF5 xor 00345678=8D3C5B8D

注册码进行计算：注册码形式为xxxx-xxxx-xxxx-xxxxxxxx，这里的计算只取前面的xxxx-xxxx-xxxx，我输入的是1-2-3，那就是对1 0 0 0 2 0 0 0 3 0 0 0进行计算，总共12次循环计算。
1=01
01 xor 32（1DA52432取的后两位）=33
33*4+436E28=00436EF4地址内的值等于=BFD06116
BFD06116 xor （1DA52432 shr 8）= BFD06116 xor 001DA524=BFCDC432
BFCDC432 and ff = 32
32+8FAF72A8=8FAF72DA
8FAF72DA*8088405=482432B AC75A642
AC75A642+1=AC75A643
AC75A643 shr 18 =AC
AC xor 8D（8D3C5B8D取的后两位）=21
21*4+436E28=00436EAC地址内的值等于=4C69105E
4C69105E xor（8D3C5B8D shr 8）= 4C69105E xor 008D3C5B= 4CE42C05

0=00
00 xor 32（BFCDC432取的后两位）=32
32*4+436E28=00436EF0地址内的值等于=C8D75180
C8D75180 xor （BFCDC432 shr 8）= C8D75180 xor BFCDC4 = C8689C44
C8689C44 and ff = 44
44+AC75A643=AC75A687
AC75A687*8088405=56969D1 7461DCA3
7461DCA3+1=7461DCA4
7461DCA4 shr 18 = 74
74 xor 05（4CE42C05取的后两位）=71
71*4+436E28=00436FEC地址内的值等于=270241AA
270241AA xor（4CE42C05 shr 8）= 270241AA xor 004CE42C= 274EA586

0=00......以下计算略
0=00......
2=02......
0=00......
0=00......
0=00......
3=03......
0=00......
0=00......
0=00......
最后的计算结果是：1CFA6E16
替换我假码的后8位，注册成功

地址00436E28---00437020的内容如下：
00436E20  1B DF 05 5A  8D EF 02 2D  00 00 00 00  96 30 07 77
00436E30  2C 61 0E EE  BA 51 09 99  19 C4 6D 07  8F F4 6A 70
00436E40  35 A5 63 E9  A3 95 64 9E  32 88 DB 0E  A4 B8 DC 79
00436E50  1E E9 D5 E0  88 D9 D2 97  2B 4C B6 09  BD 7C B1 7E
00436E60  07 2D B8 E7  91 1D BF 90  64 10 B7 1D  F2 20 B0 6A
00436E70  48 71 B9 F3  DE 41 BE 84  7D D4 DA 1A  EB E4 DD 6D
00436E80  51 B5 D4 F4  C7 85 D3 83  56 98 6C 13  C0 A8 6B 64
00436E90  7A F9 62 FD  EC C9 65 8A  4F 5C 01 14  D9 6C 06 63
00436EA0  63 3D 0F FA  F5 0D 08 8D  C8 20 6E 3B  5E 10 69 4C
00436EB0  E4 41 60 D5  72 71 67 A2  D1 E4 03 3C  47 D4 04 4B
00436EC0  FD 85 0D D2  6B B5 0A A5  FA A8 B5 35  6C 98 B2 42
00436ED0  D6 C9 BB DB  40 F9 BC AC  E3 6C D8 32  75 5C DF 45
00436EE0  CF 0D D6 DC  59 3D D1 AB  AC 30 D9 26  3A 00 DE 51
00436EF0  80 51 D7 C8  16 61 D0 BF  B5 F4 B4 21  23 C4 B3 56
00436F00  99 95 BA CF  0F A5 BD B8  9E B8 02 28  08 88 05 5F
00436F10  B2 D9 0C C6  24 E9 0B B1  87 7C 6F 2F  11 4C 68 58
00436F20  AB 1D 61 C1  3D 2D 66 B6  90 41 DC 76  06 71 DB 01
00436F30  BC 20 D2 98  2A 10 D5 EF  89 85 B1 71  1F B5 B6 06
00436F40  A5 E4 BF 9F  33 D4 B8 E8  A2 C9 07 78  34 F9 00 0F
00436F50  8E A8 09 96  18 98 0E E1  BB 0D 6A 7F  2D 3D 6D 08
00436F60  97 6C 64 91  01 5C 63 E6  F4 51 6B 6B  62 61 6C 1C
00436F70  D8 30 65 85  4E 00 62 F2  ED 95 06 6C  7B A5 01 1B
00436F80  C1 F4 08 82  57 C4 0F F5  C6 D9 B0 65  50 E9 B7 12
00436F90  EA B8 BE 8B  7C 88 B9 FC  DF 1D DD 62  49 2D DA 15
00436FA0  F3 7C D3 8C  65 4C D4 FB  58 61 B2 4D  CE 51 B5 3A
00436FB0  74 00 BC A3  E2 30 BB D4  41 A5 DF 4A  D7 95 D8 3D
00436FC0  6D C4 D1 A4  FB F4 D6 D3  6A E9 69 43  FC D9 6E 34
00436FD0  46 88 67 AD  D0 B8 60 DA  73 2D 04 44  E5 1D 03 33
00436FE0  5F 4C 0A AA  C9 7C 0D DD  3C 71 05 50  AA 41 02 27
00436FF0  10 10 0B BE  86 20 0C C9  25 B5 68 57  B3 85 6F 20
00437000  09 D4 66 B9  9F E4 61 CE  0E F9 DE 5E  98 C9 D9 29
00437010  22 98 D0 B0  B4 A8 D7 C7  17 3D B3 59  81 0D B4 2E
00437020  3B 5C BD B7  AD 6C BA C0  20 83 B8 ED  B6 B3 BF 9A

=============================================================================================================================
用户名：h
注册码：1-2-3-1CFA6E16

用户名：henhao
注册码：6568-6866-6461-1776406D
=============================================================================================================================

用户名注册码保存在注册表HKEY_CURRENT_USER\Software\Sergey Sorokin\ShowDep\2.00
RegName：h
RegNumber:01 00 00 00 02 00 00 00 03 00 00 00 16 6e fa 1c

删除可以重新注册

                                                好好学习（恨浩）

		自动登录	找回密码
密码			加入我们