[原创]一个KeyGenMe的分析，大牛飘过-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[原创]一个KeyGenMe的分析，大牛飘过

发表于: 2013-8-31 15:18 6976

[原创]一个KeyGenMe的分析，大牛飘过

东山再起

2013-8-31 15:18

6976

分析了一个简单KeyGenMe，大牛飘过！！
用的是IDA静态分析的，有不对的地方恳求指正。

PS：我极品哥们老说要当一个“快乐的小2B”，到最后发现前面的4个字没有了

废话不多说，直接上分析代码，

.text:00401000                public start
.text:00401000 start          proc near
.text:00401000                push 0Ah          ; lpType
.text:00401002                push 29Ah          ; lpName
.text:00401007                push hModule       ; hModule
.text:0040100D                call FindResourceA
.text:00401012                push eax
.text:00401013                push eax          ; hResInfo
.text:00401014                push hModule       ; hModule
.text:0040101A                call SizeofResource
.text:0040101F                mov    dword_4061CC, eax
.text:00401024                pop    eax
.text:00401025                push eax          ; hResInfo
.text:00401026                push hModule       ; hModule
.text:0040102C                call LoadResource
.text:00401031                push eax          ; hResData
.text:00401032                call LockResource
.text:00401037                mov    esi, eax
.text:00401039                mov    eax, dword_4061CC
.text:0040103E                add    eax, 4
.text:00401041                push eax          ; dwBytes
.text:00401042                push 40h          ; uFlags
.text:00401044                call GlobalAlloc
.text:00401049                mov    hMem, eax
.text:0040104E                mov    ecx, dword_4061CC
.text:00401054                mov    [eax], ecx
.text:00401056                add    eax, 4
.text:00401059                mov    edi, eax
.text:0040105B                rep movsb    ;上面这些应该是音乐声音资源
.text:0040105D                pop    esi
.text:0040105E                push hMem
.text:00401064                call sub_4013A9    ;这里好像有个线程好像获取时间什么的，知道与我分析的无关，pass
.text:00401069                push 0             ; lpModuleName
.text:0040106B                call GetModuleHandleA
.text:00401070                mov    hModule, eax
.text:00401075                push 0             ; dwInitParam
.text:00401077                push offset DialogFunc ; lpDialogFunc ;分析的重点
.text:0040107C                push 0             ; hWndParent
.text:0040107E                push 65h          ; lpTemplateName
.text:00401080                push hModule       ; hInstance
.text:00401086                call DialogBoxParamA
.text:0040108B                push eax          ; uExitCode
.text:0040108C                call ExitProcess
.text:0040108C start          endp ; sp-analysis failed
.text:0040108C
.text:00401091
.text:00401091 ; =============== S U B R O U T I N E =======================================
.text:00401091
.text:00401091 ; Attributes: bp-based frame
.text:00401091
.text:00401091 ; INT_PTR __stdcall DialogFunc(HWND, UINT, WPARAM, LPARAM)
.text:00401091 DialogFunc    proc near             ; DATA XREF: start+77o
.text:00401091
.text:00401091 String2       = byte ptr -300h
.text:00401091 String1       = byte ptr -200h
.text:00401091 String       = byte ptr -100h
.text:00401091 hWnd          = dword ptr  8
.text:00401091 arg_4          = dword ptr  0Ch
.text:00401091 arg_8          = dword ptr  10h
.text:00401091 lParam       = dword ptr  14h
.text:00401091
.text:00401091                push ebp
.text:00401092                mov    ebp, esp
.text:00401094                add    esp, 0FFFFFCFCh
.text:0040109A                cmp    [ebp+arg_4], 111h
.text:004010A1                jnz    loc_40128B
.text:004010A7                cmp    [ebp+arg_8], 3EBh ;check按钮
.text:004010AE                jnz    loc_401264
.text:004010B4                mov    @Flag1, 0    ; 作者设置的标志用来判断
.text:004010BE                mov    @Flag2, 1    ; 作者设置的标志用来判断
.text:004010C8
.text:004010C8 loc_4010C8:                            ; CODE XREF: DialogFunc+16Aj
.text:004010C8                push 100h          ; cchMax
.text:004010CD                lea    eax, [ebp+String] ; string 里面为name
.text:004010D3                push eax          ; lpString
.text:004010D4                push 3E9h          ; nIDDlgItem
.text:004010D9                push [ebp+hWnd]    ; hDlg
.text:004010DC                call GetDlgItemTextA
.text:004010E1                cmp    eax, 2       ; 获取name的长度，必须大于2否则调走
.text:004010E4                jbe    loc_401204    ; len(name)< 3，提示
.text:004010EA                push 100h
.text:004010EF                lea    eax, [ebp+String1] ; 申请一个string1，清空
.text:004010F5                push eax
.text:004010F6                call RtlZeroMemory
.text:004010FB                lea    edi, [ebp+String]
.text:00401101                jmp    short loc_401111 ; 判断每一位是否为0
.text:00401103 ; ---------------------------------------------------------------------------
.text:00401103
.text:00401103 loc_401103:                            ; CODE XREF: DialogFunc+83j
.text:00401103                cmp    byte ptr [edi], 61h ; a<sting[i]<z
.text:00401106                jb    short loc_401110 ; i++ 循环下一位
.text:00401108                cmp    byte ptr [edi], 7Ah
.text:0040110B                ja    short loc_401110 ; i++ 循环下一位
.text:0040110D                sub    byte ptr [edi], 20h ; 小写字母变大写
.text:00401110
.text:00401110 loc_401110:                            ; CODE XREF: DialogFunc+75j
.text:00401110                                        ; DialogFunc+7Aj
.text:00401110                inc    edi          ; i++ 循环下一位
.text:00401111
.text:00401111 loc_401111:                            ; CODE XREF: DialogFunc+70j
.text:00401111                cmp    byte ptr [edi], 0 ; 判断每一位是否为0
.text:00401114                jnz    short loc_401103 ; a<sting[i]<z
.text:00401116                xor    edx, edx       ; 清空edx
.text:00401118                lea    esi, [ebp+String] ; 给ESI 此时 string中的小写字母已经变大写
.text:0040111E                jmp    short loc_401169
.text:00401120 ; ---------------------------------------------------------------------------
.text:00401120
.text:00401120 loc_401120:                            ; CODE XREF: DialogFunc+DBj
.text:00401120                lea    edi, a0123456789abcd ; "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
.text:00401126                mov    ecx, 0FFFFFFFFh
.text:0040112B                movzx eax, byte ptr [esi]
.text:0040112E                repne scasb          ; 寻找string[i]每个字符在固定字符串（0123..）中的位置
.text:00401130                not    ecx
.text:00401132                dec    ecx          ; ecx为第几位
.text:00401133                cmp    @Flag1, 1    ; 判断标志
.text:0040113A                jz    short loc_40114F ; 偶数在byte_4060B0这个数组中选值
.text:0040113A                                        ;
.text:0040113A                                        ; 奇数在byte_4060D5这个数组中选值
.text:0040113C                movzx eax, byte_4060B0[ecx] ; 偶数数在这里选
.text:0040113C                                        ;
.text:0040113C                                        ; 将固定数组中相应的第ecx位的数值赋值给eax
.text:00401143                mov    @Flag1, 1    ; 改变标志
.text:0040114D                jmp    short loc_401160 ; 将字符串放到申请的string1中
.text:0040114F ; ---------------------------------------------------------------------------
.text:0040114F
.text:0040114F loc_40114F:                            ; CODE XREF: DialogFunc+A9j
.text:0040114F                movzx eax, byte_4060D5[ecx] ; 奇数在这里选
.text:0040114F                                        ;
.text:0040114F                                        ; 将固定数组中相应的第ecx位的数值赋值给eax
.text:00401156                mov    @Flag1, 0    ; 改变标志
.text:00401160
.text:00401160 loc_401160:                            ; CODE XREF: DialogFunc+BCj
.text:00401160                mov    [ebp+edx+String1], al ; 将字符串放到申请的string1中
.text:00401167                inc    edx
.text:00401168                inc    esi
.text:00401169
.text:00401169 loc_401169:                            ; CODE XREF: DialogFunc+8Dj
.text:00401169                cmp    byte ptr [esi], 0
.text:0040116C                jnz    short loc_401120 ; 判断是否为0
.text:0040116E                lea    esi, [ebp+String]
.text:00401174                mov    edx, @Flag1    ; 标志数给edx
.text:0040117A                xor    ebx, ebx       ; 清空ebx
.text:0040117C                jmp    short loc_401193 ; 再次判断是否为0
.text:0040117E ; ---------------------------------------------------------------------------
.text:0040117E
.text:0040117E loc_40117E:                            ; CODE XREF: DialogFunc+105j
.text:0040117E                movzx eax, byte ptr [esi]
.text:00401181                xor    eax, edx
.text:00401183                shl    eax, 0Ah
.text:00401186                xor    eax, 0A4ED0F7h
.text:0040118B                sub    eax, 29Ah    ; sum = string[0] xor 2Flag1 << 0Ah xor A4ED0F7H - 19AH
.text:00401190                add    ebx, eax       ; sum = sum+sunm[i]
.text:00401192                inc    esi
.text:00401193
.text:00401193 loc_401193:                            ; CODE XREF: DialogFunc+EBj
.text:00401193                cmp    byte ptr [esi], 0 ; 再次判断是否为0
.text:00401196                jnz    short loc_40117E
.text:00401198                push offset String2  ; "-%.d"
.text:0040119D                lea    eax, [ebp+String1]
.text:004011A3                push eax          ; lpString1
.text:004011A4                call lstrcatA       ; 固定字符串“-%.d”连接到string1
.text:004011A9                push ebx          ; ebx == string经过加密的数值
.text:004011AA                lea    eax, [ebp+String1]
.text:004011B0                push eax          ; LPCSTR
.text:004011B1                lea    eax, [ebp+String]
.text:004011B7                push eax          ; LPSTR
.text:004011B8                call wsprintfA    ; 拼接成string1-sum，以%d十进制形式
.text:004011BD                add    esp, 0Ch
.text:004011C0                lea    eax, [ebp+String]
.text:004011C6                push eax          ; lpString
.text:004011C7                call lstrlenA       ; 获取string长度
.text:004011CC                cmp    eax, 18h
.text:004011CF                jbe    short loc_4011E2 ; 长度len < = 18h
.text:004011D1                push offset aLongName ; "Long Name"
.text:004011D6                lea    eax, [ebp+String] ; 大于18h将字符串“Long Nme”复制给string
.text:004011DC                push eax          ; lpString1
.text:004011DD                call lstrcpyA
.text:004011E2
.text:004011E2 loc_4011E2:                            ; CODE XREF: DialogFunc+13Ej
.text:004011E2                cmp    @Flag2, 0    ; 标志是否为0
.text:004011E9                jz    short loc_401202
.text:004011EB                dec    @Flag2       ; @Flag2--
.text:004011F1                mov    @Flag1, 1    ; @Flag1赋值1
.text:004011FB                jmp    loc_4010C8    ; 再来一次大循环，Flag改变，
.text:004011FB                                        ; 奇数在byte_4060B0这个数组中选值
.text:004011FB                                        ;
.text:004011FB                                        ; 偶数在byte_4060D5这个数组中选值
.text:00401200 ; ---------------------------------------------------------------------------
.text:00401200                jmp    short loc_401216
.text:00401202 ; ---------------------------------------------------------------------------
.text:00401202
.text:00401202 loc_401202:                            ; CODE XREF: DialogFunc+158j
.text:00401202                jmp    short loc_401216
.text:00401204 ; ---------------------------------------------------------------------------
.text:00401204
.text:00401204 loc_401204:                            ; CODE XREF: DialogFunc+53j
.text:00401204                push offset String ; len(name)< 3，提示
.text:00401209                push 3EAh          ; nIDDlgItem
.text:0040120E                push [ebp+hWnd]    ; hDlg
.text:00401211                call SetDlgItemTextA
.text:00401216
.text:00401216 loc_401216:                            ; CODE XREF: DialogFunc+16Fj
.text:00401216                                        ; DialogFunc:loc_401202j
.text:00401216                push 100h          ; cchMax
.text:0040121B                lea    eax, [ebp+String2]
.text:00401221                push eax          ; lpString
.text:00401222                push 3EAh          ; nIDDlgItem
.text:00401227                push [ebp+hWnd]    ; hDlg
.text:0040122A                call GetDlgItemTextA ; 获取注册码
.text:0040122A                                        ; 给string2
.text:0040122F                lea    eax, [ebp+String2]
.text:00401235                push eax          ; lpString2
.text:00401236                lea    eax, [ebp+String]
.text:0040123C                push eax          ; lpString1
.text:0040123D                call lstrcmpA       ; 真假注册码比较
.text:00401242                or    eax, eax
.text:00401244                jnz    short loc_40125F ; 相同提示成功注册框
.text:00401246                push 20h          ; uType
.text:00401248                push offset Caption  ; "Info"
.text:0040124D                push offset Text    ; "Good boy"
.text:00401252                push [ebp+hWnd]    ; hWnd
.text:00401255                call MessageBoxA
.text:0040125A                jmp    loc_4012E7
.text:0040125F ; ---------------------------------------------------------------------------
.text:0040125F
.text:0040125F loc_40125F:                            ; CODE XREF: DialogFunc+1B3j
.text:0040125F                jmp    loc_4012E7
.text:00401264 ; ---------------------------------------------------------------------------
.text:00401264
.text:00401264 loc_401264:                            ; CODE XREF: DialogFunc+1Dj
.text:00401264                cmp    [ebp+arg_8], 3ECh
.text:0040126B                jnz    short loc_4012E7
.text:0040126D                push 0
.text:0040126F                call sub_4013A9
.text:00401274                push hMem          ; hMem
.text:0040127A                call GlobalFree
.text:0040127F                push 0             ; nResult
.text:00401281                push [ebp+hWnd]    ; hDlg
.text:00401284                call EndDialog
.text:00401289                jmp    short loc_4012E7
.text:0040128B ; ---------------------------------------------------------------------------
.text:0040128B
.text:0040128B loc_40128B:                            ; CODE XREF: DialogFunc+10j
.text:0040128B                cmp    [ebp+arg_4], 10h
.text:0040128F                jnz    short loc_40129D
.text:00401291                push 0             ; nResult
.text:00401293                push [ebp+hWnd]    ; hDlg
.text:00401296                call EndDialog
.text:0040129B                jmp    short loc_4012E7
.text:0040129D ; ---------------------------------------------------------------------------
.text:0040129D
.text:0040129D loc_40129D:                            ; CODE XREF: DialogFunc+1FEj
.text:0040129D                cmp    [ebp+arg_4], 110h
.text:004012A4                jnz    short loc_4012CB
.text:004012A6                push offset SystemTime ; lpSystemTime
.text:004012AB                call GetLocalTime
.text:004012B0                mov    eax, dword ptr SystemTime.wYear
.text:004012B5                mov    eax, dword ptr SystemTime.wMonth
.text:004012BA                mov    eax, dword ptr SystemTime.wDayOfWeek
.text:004012BF                mov    eax, dword ptr SystemTime.wDay
.text:004012C4                mov    eax, dword ptr SystemTime.wHour
.text:004012C9                jmp    short loc_4012E7
.text:004012CB ; ---------------------------------------------------------------------------
.text:004012CB
.text:004012CB loc_4012CB:                            ; CODE XREF: DialogFunc+213j
.text:004012CB                cmp    [ebp+arg_4], 201h
.text:004012D2                jnz    short loc_4012E7
.text:004012D4                mov    eax, [ebp+lParam]
.text:004012D7                push eax          ; lParam
.text:004012D8                push 2             ; wParam
.text:004012DA                push 0A1h          ; Msg
.text:004012DF                push [ebp+hWnd]    ; hWnd
.text:004012E2                call PostMessageA
.text:004012E7
.text:004012E7 loc_4012E7:                            ; CODE XREF: DialogFunc+1C9j
.text:004012E7                                        ; DialogFunc:loc_40125Fj ...
.text:004012E7                xor    eax, eax
.text:004012E9                leave
.text:004012EA                retn 10h
.text:004012EA DialogFunc    endp

这个是在两个固定的字符串中选字符，然后在和加密的Name拼接起来，最后是明码比较，典型的lstrcmp字符串比较

作者是用ASM编写的，稍微改下就可以得到源码。

下面是我的整理的主要代码如下，

.386
.model flat, stdcall
option casemap :none

include windows.inc
include kernel32.inc
include user32.inc
include Comctl32.inc
include shell32.inc
includelib kernel32.lib
includelib user32.lib
includelib Comctl32.lib
includelib shell32.lib

DlgProc PROTO :HWND,:UINT,:WPARAM,:LPARAM

.const

IDD_DIALOG1 equ 101
IDC_BTN1    EQU 1005
IDC_EDT1    EQU 1001
IDC_EDT2    EQU 1002

;#########################################################################

.data?

hInstance dd ?
@Flag1       dd ?
@Flag2       dd ?
hWnd1       HWND ?

.DATA

;char String2[]
String2 db '-%.d',0
; char String[]
String4 db 'Min 3 charts!',0

a0123456789abcd db '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ',0

byte_4060B0 db 41h
aHyukjsdfkjsdfn db 'HyukjsdfkjsdfnPQU5xWERY67345aq9nFyR',0

byte_4060D5 db 6Fh
a3zyzai1982tv2f db '3zYzaI1982Tv2FasgjkkjhkjlJt5Dpe32Ax',0

; char aLongName[]
aLongName db 'Long Name',0
aBadBoy db 'Bad boy',0
; char Text[]
Text db 'Good boy',0
; char Caption[]
Caption db 'Info',0

.code

start:

invoke GetModuleHandle,NULL
mov hInstance,eax

invoke InitCommonControls
invoke DialogBoxParam,hInstance,IDD_DIALOG1,NULL,addr DlgProc,NULL
invoke ExitProcess,0

;########################################################################

_GetSerial proc
;LOCAL String2[100]:BYTE
LOCAL String1[100]:BYTE
LOCAL String[100]:BYTE

mov @Flag1, 0
mov @Flag2, 1

L:

invoke GetDlgItemText,hWnd1,IDC_EDT1,ADDR String,100
cmp eax, 2
jbe L1

invoke RtlZeroMemory,addr String1,100
lea edi, String
jmp L2
L3:
cmp byte ptr [edi], 61h
jb short L4
cmp byte ptr [edi], 7Ah
ja short L4
sub byte ptr [edi], 20h

L4:
inc edi

L2:
cmp byte ptr [edi], 0
jnz short L3
xor edx, edx
lea esi, String
jmp short L5

L6: ; "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
lea edi, a0123456789abcd
mov ecx, 0FFFFFFFFh
movzx eax, byte ptr [esi]
repne scasb
not ecx
dec ecx
cmp @Flag1, 1
jz short L7
movzx eax, byte_4060B0[ecx]
mov @Flag1, 1
jmp short L8

L7:
movzx eax, byte_4060D5[ecx]
mov @Flag1, 0

L8:

mov    [String1+edx], al ;?????
inc edx
inc esi

L5:
cmp byte ptr [esi], 0
jnz short L6
lea esi, String
mov edx, @Flag1
xor ebx, ebx
jmp short L9

LA:
movzx eax, byte ptr [esi]
xor eax, edx
shl eax, 0Ah
xor eax, 0A4ED0F7h
sub eax, 29Ah
add ebx, eax
inc esi

L9:
cmp byte ptr [esi], 0
jnz short LA
push offset String2 ; "-%.d"
lea eax, String1
push eax ; lpString1
call lstrcat
push ebx
lea eax, String1
push eax ; LPCSTR
lea eax, String
push eax ; LPSTR
call wsprintf
;add esp, 0Ch
lea eax, String
push eax ; lpString
call lstrlen
cmp eax, 18h
jbe short LB
push offset aLongName ; "Long Name"
lea eax, String
push eax ; lpString1
call lstrcpy

LB:
cmp @Flag2, 0
jz short LC
dec @Flag2
mov @Flag1, 1
jmp L
jmp short LD

LC:
jmp short LD

L1: ; "Min 3 charts!"
push offset String4
push IDC_EDT1 ; nIDDlgItem
push hWnd1 ; hDlg
call SetDlgItemText

JMP L12

LD:

lea ebx,String
invoke SetDlgItemText,hWnd1,IDC_EDT2,ebx

push MB_OK ; uType
push offset Caption ; "Info"
push offset Text ; "Good boy"
push hWnd1 ; hWnd
call MessageBox

JMP  L12

L12:

ret

_GetSerial endp

DlgProc proc hWin:HWND,uMsg:UINT,wParam:WPARAM,lParam:LPARAM

mov eax,uMsg
.if eax==WM_INITDIALOG

.elseif eax==WM_COMMAND
mov eax,wParam
.if ax==IDC_BTN1
mov eax,hWin
mov hWnd1 ,eax
invoke _GetSerial
.endif

.elseif eax==WM_CLOSE
invoke EndDialog,hWin,0
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret

DlgProc endp

end start

分析完了！！！

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

上传的附件：

KeyGenMe.rar （95.17kb，20次下载）

收藏・1

免费・0

支持

最新回复 (2)
学者learner 雪币： 153 活跃值： (404) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 173 粉丝 1 关注私信	学者learner 2 楼反正要做实验，。。又一个样本 2013-9-14 19:51 0
Einsbing 雪币： 135 活跃值： (15) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 128 粉丝 1 关注私信	Einsbing 3 楼楼主的分析太给力了。谢谢楼主。 2013-9-14 20:03 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

东山再起

发帖

回帖

RANK

关注

私信

他的文章

[原创]一个KeyGenMe的分析，大牛飘过 6977

关于我们

联系我们

企业服务

看雪公众号

最新回复 (2)
学者learner 雪币： 153 活跃值： (404) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 173 粉丝 1 关注私信	学者learner 2 楼反正要做实验，。。又一个样本 2013-9-14 19:51 0
Einsbing 雪币： 135 活跃值： (15) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 128 粉丝 1 关注私信	Einsbing 3 楼楼主的分析太给力了。谢谢楼主。 2013-9-14 20:03 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复