-
-
[看雪CTF2016]第十七题分析
-
发表于:
2016-12-4 12:46
2216
-
CrackMeLibrary.dll中搜索字符串, 定位到成功点
.text:10007210 push 0 ; uType
.text:10007212 push offset Caption ; "Tips"
.text:10007217 push offset Text ; "Successful!"
.text:1000721C push 0 ; hWnd
.text:1000721E call ds:MessageBoxW
.text:10007224 retn
调用解密后的check函数
.text:10007B8F mov eax, [edx+edi*4]
.text:10007B92 push offset sn
.text:10007B97 call eax
.text:10007B99 add esp, 4
.text:10007B9C mov [ebp+var_454], eax
check函数, 返回0即可
seg000:00000000 push ebp
seg000:00000001 mov ebp, esp
seg000:00000003 sub esp, 18h
seg000:00000006 mov eax, [ebp+arg_0]
seg000:00000009 xor ecx, ecx
seg000:0000000B push esi
seg000:0000000C mov esi, 3A1h
seg000:00000011 movdqu xmm0, xmmword ptr [eax]
seg000:00000015 movdqu [ebp+var_18], xmm0
seg000:0000001A movq xmm0, qword ptr [eax+10h]
seg000:0000001F movq [ebp+var_8], xmm0
seg000:00000024
seg000:00000024 loc_24: ; CODE XREF: sub_0+4Bj
seg000:00000024 lea eax, [ecx+1]
seg000:00000027 and eax, 80000001h
seg000:0000002C jns short loc_33
seg000:0000002E dec eax
seg000:0000002F or eax, 0FFFFFFFEh
seg000:00000032 inc eax
seg000:00000033
seg000:00000033 loc_33: ; CODE XREF: sub_0+2Cj
seg000:00000033 jnz short loc_42
seg000:00000035 mov ax, word ptr [ebp+ecx*2+var_18]
seg000:0000003A neg ax
seg000:0000003D mov word ptr [ebp+ecx*2+var_18], ax
seg000:00000042
seg000:00000042 loc_42: ; CODE XREF: sub_0:loc_33j
seg000:00000042 xor word ptr [ebp+ecx*2+var_18], si
seg000:00000047 inc ecx
seg000:00000048 cmp ecx, 0Ch
seg000:0000004B jl short loc_24
seg000:0000004D xor eax, eax
seg000:0000004F pop esi
seg000:00000050
seg000:00000050 loc_50: ; CODE XREF: sub_0+64j
seg000:00000050 mov cx, word ptr [ebp+eax+var_18]
seg000:00000055 cmp cx, [eax+1549B50h]
seg000:0000005C jnz short loc_6C
seg000:0000005E add eax, 2
seg000:00000061 cmp eax, 18h
seg000:00000064 jl short loc_50
seg000:00000066 xor eax, eax
seg000:00000068 mov esp, ebp
seg000:0000006A pop ebp
seg000:0000006B retn
seg000:0000006C mov eax, 1
seg000:00000071 mov esp, ebp
seg000:00000073 pop ebp
seg000:00000074 retn
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
