文章作者：Crack_Qs[4st][PDG]

使用工具：Vs 2013、ollydbg 1.10

测试平台：windows 7 x64

/////////////////////////////////////////////////////////////////////////////////////////////////////

验证CALL：

013C1050 /$ 55 PUSH EBP ; 验证CALL
013C1051 |. 8BEC MOV EBP, ESP
013C1053 |. 51 PUSH ECX
013C1054 |. C745 FC 00000>MOV DWORD PTR SS:[EBP-0x4], 0x0 ; 循环计数器清0
013C105B |. EB 09 JMP SHORT Test.013C1066
013C105D |> 8B45 FC /MOV EAX, DWORD PTR SS:[EBP-0x4]
013C1060 |. 83C0 01 |ADD EAX, 0x1
013C1063 |. 8945 FC |MOV DWORD PTR SS:[EBP-0x4], EAX
013C1066 |> 837D FC 07 CMP DWORD PTR SS:[EBP-0x4], 0x7 ; 循环比较7次
013C106A |. 73 3A |JNB SHORT Test.013C10A6
013C106C |. 6A 04 |PUSH 0x4 ; int nCount;
013C106E |. 8B4D FC |MOV ECX, DWORD PTR SS:[EBP-0x4]
013C1071 |. 8B55 0C |MOV EDX, DWORD PTR SS:[EBP+0xC]
013C1074 |. 8D048A |LEA EAX, DWORD PTR DS:[EDX+ECX*4]
013C1077 |. 50 |PUSH EAX
013C1078 |. E8 83FFFFFF |CALL Test.013C1000 ; void Encryption(char *pInputBuf,int nCount);
013C107D |. 83C4 08 |ADD ESP, 0x8
013C1080 |. 8B4D FC |MOV ECX, DWORD PTR SS:[EBP-0x4]
013C1083 |. 39048D 18303C>|CMP DWORD PTR DS:[ECX*4+0x13C3018],>
013C108A |. 74 18 |JE SHORT Test.013C10A4
013C108C |. 6A 00 |PUSH 0x0 ; /Style = MB_OK|MB_APPLMODAL
013C108E |. 68 E8203C01 |PUSH Test.013C20E8 ; |Title = "ISG 2014"
013C1093 |. 68 F4203C01 |PUSH Test.013C20F4 ; |Text = "Wrong"
013C1098 |. 8B55 08 |MOV EDX, DWORD PTR SS:[EBP+0x8] ; |
013C109B |. 52 |PUSH EDX ; |hOwner
013C109C |. FF15 BC203C01 |CALL NEAR DWORD PTR DS:[<&USER32.Mes>; \MessageBoxA
013C10A2 |. EB 18 |JMP SHORT Test.013C10BC
013C10A4 |>^ EB B7 \JMP SHORT Test.013C105D
013C10A6 |> 6A 00 PUSH 0x0 ; /Style = MB_OK|MB_APPLMODAL
013C10A8 |. 68 FC203C01 PUSH Test.013C20FC ; |Title = "ISG 2014"
013C10AD |. 68 08213C01 PUSH Test.013C2108 ; |Text = "Correct!!"
013C10B2 |. 8B45 08 MOV EAX, DWORD PTR SS:[EBP+0x8] ; |
013C10B5 |. 50 PUSH EAX ; |hOwner
013C10B6 |. FF15 BC203C01 CALL NEAR DWORD PTR DS:[<&USER32.Mess>; \MessageBoxA
013C10BC |> 8BE5 MOV ESP, EBP
013C10BE |. 5D POP EBP
013C10BF \. C3 RETN

算法CALL：

013C1000 /$ 55 PUSH EBP                                 void Encryption(char *pInputBuf,int nCount)：
013C1001 |. 8BEC MOV EBP, ESP
013C1003 |. 83EC 0C SUB ESP, 0xC
013C1006 |. C745 F8 83000>MOV DWORD PTR SS:[EBP-0x8], 0x83 ; nNum = 0x83
013C100D |. C745 FC 00000>MOV DWORD PTR SS:[EBP-0x4], 0x0 ; nKey = 0
013C1014 |. C745 F4 00000>MOV DWORD PTR SS:[EBP-0xC], 0x0 ; int i 循环计数器
013C101B |. EB 09 JMP SHORT Test.013C1026
013C101D |> 8B45 F4 /MOV EAX, DWORD PTR SS:[EBP-0xC]
013C1020 |. 83C0 01 |ADD EAX, 0x1
013C1023 |. 8945 F4 |MOV DWORD PTR SS:[EBP-0xC], EAX
013C1026 |> 8B4D F4 MOV ECX, DWORD PTR SS:[EBP-0xC]
013C1029 |. 3B4D 0C |CMP ECX, DWORD PTR SS:[EBP+0xC]
013C102C |. 73 17 |JNB SHORT Test.013C1045
013C102E |. 8B55 FC |MOV EDX, DWORD PTR SS:[EBP-0x4]
013C1031 |. 0FAF55 F8 |IMUL EDX, DWORD PTR SS:[EBP-0x8] ; nKey * nNum
013C1035 |. 8B45 08 |MOV EAX, DWORD PTR SS:[EBP+0x8]
013C1038 |. 0345 F4 |ADD EAX, DWORD PTR SS:[EBP-0xC]
013C103B |. 0FB608 |MOVZX ECX, BYTE PTR DS:[EAX]
013C103E |. 03D1 |ADD EDX, ECX ; nKey * nNum + pInputBuf[i]
013C1040 |. 8955 FC |MOV DWORD PTR SS:[EBP-0x4], EDX ; nKey = nKey * nNum + pInputBuf[i];
013C1043 |.^ EB D8 \JMP SHORT Test.013C101D
013C1045 |> 8B45 FC MOV EAX, DWORD PTR SS:[EBP-0x4]
013C1048 |. 8BE5 MOV ESP, EBP
013C104A |. 5D POP EBP
013C104B \. C3 RETN

其加密算法逆向后得知：

void Encryption1(char *pInputBuf,int nCount)
{
    int nKey = 0;

    for (int i = 0; i < nCount ; i++)
    {
    nKey = (0x83 * nKey) + pInputBuf[i];
    }
}

也就是说：

nKey = (0x83 * nKey ) + pInputBuf[0]

nKey = (0x83 * nKey ) + pInputBuf[1]

nKey = (0x83 * nKey ) + pInputBuf[2]

nKey = (0x83 * nKey ) + pInputBuf[3]

如此循环4次，计算完一次校验的值，那也就是说：

nKey == 0x83 * 0x83 * 0x83 * pInputBuf[1] + 0x83 * 0x83 * pInputBuf[1] + 0x83 * pInputBuf[2] + pInputBuf[3]

01361083 |. 39048D 183036>|CMP DWORD PTR DS:[ECX*4+0x1363018],>

data_0x1363018:

01363018 E5 AD 50 0D 89 27 30 0E 1F 6F D6 0E FF 63 D4 0C 瀛P.?0o?c?
01363028 DD 94 0D 0E 1F 46 A4 0F A2 1D D9 0C 輸.F???....

通过分析，知道该题是分为7次验证,验证的值为：0x0D50ADE5、0x0E302789、0x0ED66F1F、0x0CD463FF、0x0E0D94DD、0x0FA4461F、0x0CD91DA2

解密算法如下（以下代码肯定不是最优解）：

void Decryption()
{
    int szKeyNum[] = {
    0x0D50ADE5,0x0E302789,0x0ED66F1F,0x0CD463FF,
    0x0E0D94DD,0x0FA4461F,0x0CD91DA2
    };
    char szBuf[40] = {0};

    for (int i = 0,nCount = 0; i < 7; i++, nCount+= 4)
    {
        for (int nBuf1 = 0; nBuf1 < 127; nBuf1++)
        {
            for (int nBuf2 = 0; nBuf2 < 127; nBuf2++)
            {
                for (int nBuf3 = 0; nBuf3 < 127; nBuf3++)
                {
                    for (int nBuf4 = 0; nBuf4 < 127; nBuf4++)
                    {
                        if (szKeyNum[i] == 0x83 * 0x83 * 0x83 * nBuf1
                                                  +0x83 * 0x83 * nBuf2
                                                  +0x83 * nBuf3 + nBuf4)
                        {
                            szBuf[nCount+0] = nBuf1;
                            szBuf[nCount+1] = nBuf2;
                            szBuf[nCount+2] = nBuf3;
                            szBuf[nCount+3] = nBuf4;
                        }
                    }
                }
            }
        }
    }
    printf("Key:%s\r\n",szBuf);
}

程序输出 Key:c011isi0n_is_a_thre4t_t0_sec

CrackMe附件：

链接: http://pan.baidu.com/s/1o61CIq2 密码: xkmn

ISG 2014 逆向题分析