爆破一个二元函数加密的cm

系统 ： Windows xp

程序 ： cztria~1

程序下载地址 ：http://pan.baidu.com/s/1slUwmVr

要求 ： 爆破

使用工具 ： OD 

可在看雪论坛中查找关于此程序的破文：传送门

 

废话不多说，直接查询到字符串：“            you did it!”，双击定位：

0040137B  |.  6A 40         push    40                               ; /Count = 40 (64.)
0040137D  |.  68 20334000   push    00403320                         ; |pediy
00401382  |.  FF35 66324000 push    dword ptr [403266]               ; |hWnd = 000405D8 (class='Edit',parent=000505C0)
00401388  |.  E8 A3080000   call    <jmp.&USER32.GetWindowTextA>     ; \GetWindowTextA
0040138D  |.  83F8 04       cmp     eax, 4                           ;  小于等于4？
00401390  |.  0F8E 9F000000 jle     00401435
00401396  |.  6A 40         push    40                               ; /Count = 40 (64.)
00401398  |.  68 60334000   push    00403360                         ; |12345
0040139D  |.  68 B90B0000   push    0BB9                             ; |ControlID = BB9 (3001.)
004013A2  |.  FF75 08       push    dword ptr [ebp+8]                ; |hWnd
004013A5  |.  E8 6E080000   call    <jmp.&USER32.GetDlgItemTextA>    ; \GetDlgItemTextA
004013AA  |.  83F8 04       cmp     eax, 4                           ;  小于等于4？
004013AD  |.  0F8E 82000000 jle     00401435
004013B3  |.  A3 62324000   mov     dword ptr [403262], eax
004013B8  |.  FF35 66324000 push    dword ptr [403266]               ; /hWnd = 000405D8 (class='Edit',parent=000505C0)
004013BE  |.  E8 AF080000   call    <jmp.&USER32.SetFocus>           ; \SetFocus
004013C3  |.  BF 20334000   mov     edi, 00403320                    ;  pediy
004013C8  |.  BE 20334000   mov     esi, 00403320                    ;  pediy
004013CD  |>  AC            /lods    byte ptr [esi]                  ;  循环迭代用户名字符串
004013CE  |.  0C 00         |or      al, 0
004013D0  |.  74 05         |je      short 004013D7
004013D2  |.  0C 20         |or      al, 20
004013D4  |.  AA            |stos    byte ptr es:[edi]
004013D5  |.^ EB F6         \jmp     short 004013CD
004013D7  |>  BF A0324000   mov     edi, 004032A0
004013DC  |.  BE 60334000   mov     esi, 00403360                    ;  12345
004013E1  |.  8D1D 20334000 lea     ebx, dword ptr [403320]
004013E7  |.  33C9          xor     ecx, ecx
004013E9  |>  AC            /lods    byte ptr [esi]                  ;  循环迭代 密码
004013EA  |.  0C 00         |or      al, 0
004013EC  |.  74 17         |je      short 00401405
004013EE  |.  8A13          |mov     dl, byte ptr [ebx]              ;  循环迭代 用户名
004013F0  |.  2AD0          |sub     dl, al                          ;  用户名字符 - 密码字符
004013F2  |.  80CA 00       |or      dl, 0                           ;  如果相同，则跳转出错
004013F5  |.  74 3E         |je      short 00401435
004013F7  |.  8AC2          |mov     al, dl
004013F9  |.  24 0F         |and     al, 0F
004013FB  |.  0C 00         |or      al, 0                           ;  al为0？
004013FD  |.  74 36         |je      short 00401435                  ;  为0则跳转出错
004013FF  |.  AA            |stos    byte ptr es:[edi]               ;  保存al成表
00401400  |.  02C8          |add     cl, al                          ;  结果累加
00401402  |.  43            |inc     ebx
00401403  |.^ EB E4         \jmp     short 004013E9
00401405  |>  890D 6A324000 mov     dword ptr [40326A], ecx          ;  保存累加结果
0040140B  |.  E8 27020000   call    00401637                         ;  关键call
00401410  |.  BE A0324000   mov     esi, 004032A0
00401415  |.  8B15 62324000 mov     edx, dword ptr [403262]          ;  取密码长度
0040141B  |.  C1EA 02       shr     edx, 2                           ;  逻辑右移
0040141E  |.  03F2          add     esi, edx
00401420  |.  8A06          mov     al, byte ptr [esi]               ;  表中取值
00401422  |.  33D2          xor     edx, edx
00401424  |.  8B15 6E324000 mov     edx, dword ptr [40326E]
0040142A  |.  2BD0          sub     edx, eax
0040142C  |.  A1 6A324000   mov     eax, dword ptr [40326A]
00401431  |.  3BC2          cmp     eax, edx
00401433      75 31         jz     short 00401466
00401435  |>  68 00200000   push    2000                             ; /Style = MB_OK|MB_TASKMODAL
0040143A  |.  68 D1314000   push    004031D1                         ; |              error
0040143F  |.  68 F9314000   push    004031F9                         ; | sorry cracker, wrong.
00401444  |.  FF75 08       push    dword ptr [ebp+8]                ; |hOwner
00401447  |.  E8 02080000   call    <jmp.&USER32.MessageBoxA>        ; \MessageBoxA
0040144C  |.  6A 40         push    40                               ; /Length = 40 (64.)
0040144E  |.  68 E0324000   push    004032E0                         ; |Destination = cztria~1.004032E0
00401453  |.  E8 56080000   call    <jmp.&KERNEL32.RtlZeroMemory>    ; \RtlZeroMemory
00401458  |.  6A 40         push    40                               ; /Length = 40 (64.)
0040145A  |.  68 A0334000   push    004033A0                         ; |Destination = cztria~1.004033A0
0040145F  |.  E8 4A080000   call    <jmp.&KERNEL32.RtlZeroMemory>    ; \RtlZeroMemory
00401464  |.  EB 2F         jmp     short 00401495
00401466  |>  68 00200000   push    2000                             ; /Style = MB_OK|MB_TASKMODAL
0040146B  |.  68 E5314000   push    004031E5                         ; |       <registered>
00401470  |.  68 10324000   push    00403210                         ; |            you did it!
00401475  |.  FF75 08       push    dword ptr [ebp+8]                ; |hOwner
00401478  |.  E8 D1070000   call    <jmp.&USER32.MessageBoxA>        ; \MessageBoxA
0040147D  |.  6A 40         push    40                               ; /Length = 40 (64.)
0040147F  |.  68 E0324000   push    004032E0                         ; |Destination = cztria~1.004032E0
00401484  |.  E8 25080000   call    <jmp.&KERNEL32.RtlZeroMemory>    ; \RtlZeroMemory
00401489  |.  6A 40         push    40                               ; /Length = 40 (64.)
0040148B  |.  68 A0334000   push    004033A0                         ; |Destination = cztria~1.004033A0
00401490  |.  E8 19080000   call    <jmp.&KERNEL32.RtlZeroMemory>    ; \RtlZeroMemory

跟入 0040140B |. E8 27020000 call 00401637 ; 关键call

00401637  /$  BE A0324000   mov     esi, 004032A0
0040163C  |.  8B15 62324000 mov     edx, dword ptr [403262]          ;  取密码长度
00401642  |.  52            push    edx
00401643  |.  33C0          xor     eax, eax
00401645  |.  83EA 01       sub     edx, 1
00401648  |.  03F2          add     esi, edx
0040164A  |.  8A06          mov     al, byte ptr [esi]               ;  表中取值
0040164C  |.  F7E0          mul     eax
0040164E  |.  5A            pop     edx
0040164F  |.  83EA 01       sub     edx, 1
00401652  |.  F7E2          mul     edx
00401654  |.  B9 01000000   mov     ecx, 1
00401659  |>  2BC1          /sub     eax, ecx
0040165B  |.  83F8 00       |cmp     eax, 0                          ;  eax为0？
0040165E  |.  7E 08         |jle     short 00401668
00401660  |.  83C2 01       |add     edx, 1
00401663  |.  83C1 02       |add     ecx, 2
00401666  |.^ EB F1         \jmp     short 00401659
00401668  |>  52            push    edx                              ;  保存edx
00401669  |.  BE A0324000   mov     esi, 004032A0
0040166E  |.  8BFE          mov     edi, esi
00401670  |.  8B15 62324000 mov     edx, dword ptr [403262]          ;  取密码长度
00401676  |.  33C0          xor     eax, eax
00401678  |.  83EA 01       sub     edx, 1
0040167B  |.  03F2          add     esi, edx
0040167D  |.  8A06          mov     al, byte ptr [esi]               ;  表中取值
0040167F  |.  83C0 01       add     eax, 1
00401682  |.  5A            pop     edx
00401683  |.  03C2          add     eax, edx
00401685  |.  D1E8          shr     eax, 1
00401687  |.  8B15 62324000 mov     edx, dword ptr [403262]          ;  取密码长度
0040168D  |.  03FA          add     edi, edx
0040168F  |.  AA            stos    byte ptr es:[edi]
00401690  |.  F7E0          mul     eax
00401692  |.  8B15 62324000 mov     edx, dword ptr [403262]          ;  取密码长度
00401698  |.  83EA 01       sub     edx, 1
0040169B  |.  F7E2          mul     edx
0040169D  |.  B9 01000000   mov     ecx, 1
004016A2  |>  2BC1          /sub     eax, ecx
004016A4  |.  83F8 00       |cmp     eax, 0                          ;  eax为0？
004016A7  |.  7E 08         |jle     short 004016B1
004016A9  |.  83C2 01       |add     edx, 1
004016AC  |.  83C1 02       |add     ecx, 2
004016AF  |.^ EB F1         \jmp     short 004016A2
004016B1  |>  52            push    edx
004016B2  |.  BE A0324000   mov     esi, 004032A0
004016B7  |.  8B15 62324000 mov     edx, dword ptr [403262]          ;  取密码长度
004016BD  |.  33C0          xor     eax, eax
004016BF  |.  03F2          add     esi, edx
004016C1  |.  8A06          mov     al, byte ptr [esi]               ;  取表中末位
004016C3  |.  83C0 01       add     eax, 1
004016C6  |.  5A            pop     edx
004016C7  |.  03C2          add     eax, edx
004016C9  |.  D1E8          shr     eax, 1
004016CB  |.  A3 6E324000   mov     dword ptr [40326E], eax          ;  保存结果
004016D0  \.  C3            retn

这是一个典型的二元函数加密，将用户名与密码的差值生成一个表 和 累加值。再根据表生成两个特殊值。

输入的结果差值要符合 特殊值1 - 特殊值2 == 累加结果

我们可以直接将判断的条件修改成：

00401433 /75 31 jnz short 00401466

 就可以完成爆破了。