系统 ： Windows xp

程序 ： keyfileme

程序下载地址 ：http://pan.baidu.com/s/1qYVfvu0

要求 ： 编写KeyFile

使用工具 ： OD

可在看雪论坛中查找关于此程序的破文：传送门

 

趁着小长假还没结束，赶紧来个CM暖暖手。废话不多说，直接用DIE查看程序。

提示MASM编写，没有保护壳。

再用OD载入，发现关键子串：no keyfile found!

0040113E   .  E8 F0010000   call    00401333
00401143   .  803D 2C604000>cmp     byte ptr [40602C], 1
0040114A   .  74 20         je      short 0040116C
0040114C   .  803D 2C604000>cmp     byte ptr [40602C], 2
00401153   .  74 2C         je      short 00401181
00401155   .  803D 2C604000>cmp     byte ptr [40602C], 3
0040115C   .  74 38         je      short 00401196
0040115E   .  803D 2C604000>cmp     byte ptr [40602C], 4
00401165   .  74 44         je      short 004011AB
00401167   .  E9 C1010000   jmp     0040132D
0040116C   >  68 51624000   push    00406251                         ; /no keyfile found!
00401171   .  FF35 76604000 push    dword ptr [406076]               ; |hWnd = NULL
00401177   .  E8 5A030000   call    <jmp.&user32.SetWindowTextA>     ; \SetWindowTextA
0040117C   .  E9 AC010000   jmp     0040132D
00401181   >  68 63624000   push    00406263                         ; /wrong size!
00401186   .  FF35 76604000 push    dword ptr [406076]               ; |hWnd = NULL
0040118C   .  E8 45030000   call    <jmp.&user32.SetWindowTextA>     ; \SetWindowTextA
00401191   .  E9 97010000   jmp     0040132D
00401196   >  68 6F624000   push    0040626F                         ; /invalid keyfile!
0040119B   .  FF35 76604000 push    dword ptr [406076]               ; |hWnd = NULL
004011A1   .  E8 30030000   call    <jmp.&user32.SetWindowTextA>     ; \SetWindowTextA
004011A6   .  E9 82010000   jmp     0040132D
004011AB   >  68 09604000   push    00406009                         ; /registered! good job!
004011B0   .  FF35 76604000 push    dword ptr [406076]               ; |hWnd = NULL
004011B6   .  E8 1B030000   call    <jmp.&user32.SetWindowTextA>     ; \SetWindowTextA

可见结果是由Call直接产生，右击Call指令，选择Follow：

00401333  /$  6A 00         push    0                                ; /hTemplateFile = NULL
00401335  |.  68 80000000   push    80                               ; |Attributes = NORMAL
0040133A  |.  6A 03         push    3                                ; |Mode = OPEN_EXISTING
0040133C  |.  6A 00         push    0                                ; |pSecurity = NULL
0040133E  |.  6A 01         push    1                                ; |ShareMode = FILE_SHARE_READ
00401340  |.  68 00000080   push    80000000                         ; |Access = GENERIC_READ
00401345  |.  68 32604000   push    00406032                         ; |keyfile.dat
0040134A  |.  E8 93010000   call    <jmp.&kernel32.CreateFileA>      ; \CreateFileA
0040134F  |.  A3 62604000   mov     dword ptr [406062], eax
00401354  |.  83F8 FF       cmp     eax, -1
00401357  |.  0F84 DB000000 je      00401438
0040135D  |.  6A 00         push    0                                ; /pFileSizeHigh = NULL
0040135F  |.  FF35 62604000 push    dword ptr [406062]               ; |hFile = NULL
00401365  |.  E8 8A010000   call    <jmp.&kernel32.GetFileSize>      ; \GetFileSize
0040136A  |.  83F8 20       cmp     eax, 20                          ;  长度一定要是32个字符
0040136D  |.  0F85 CE000000 jnz     00401441                         ;  ↓读取前十六个字符
00401373  |.  6A 00         push    0                                ; /pOverlapped = NULL
00401375  |.  68 48634000   push    00406348                         ; |pBytesRead = keyfilem.00406348
0040137A  |.  6A 10         push    10                               ; |BytesToRead = 10 (16.)
0040137C  |.  68 3E604000   push    0040603E                         ; |Buffer = keyfilem.0040603E
00401381  |.  FF35 62604000 push    dword ptr [406062]               ; |hFile = NULL
00401387  |.  E8 86010000   call    <jmp.&kernel32.ReadFile>         ; \ReadFile
0040138C  |.  FF35 62604000 push    dword ptr [406062]               ; /hObject = NULL
00401392  |.  E8 45010000   call    <jmp.&kernel32.CloseHandle>      ; \CloseHandle
00401397  |.  33C9          xor     ecx, ecx
00401399  |.  33D2          xor     edx, edx
0040139B  |.  BA 0F000000   mov     edx, 0F
004013A0  |>  0FBE8A 3E6040>/movsx   ecx, byte ptr [edx+40603E]      ;  循环迭代字符串
004013A7  |.  4A            |dec     edx
004013A8  |.  83F9 20       |cmp     ecx, 20                         ;  是否是空格？
004013AB  |.  75 09         |jnz     short 004013B6                  ;  发现不是空格则跳转
004013AD  |.  C682 3F604000>|mov     byte ptr [edx+40603F], 0
004013B4  |.^ EB EA         \jmp     short 004013A0
004013B6  |>  E9 A1000000   jmp     0040145C
004013BB  |>  6A 00         push    0                                ; /hTemplateFile = NULL
004013BD  |.  68 80000000   push    80                               ; |Attributes = NORMAL
004013C2  |.  6A 03         push    3                                ; |Mode = OPEN_EXISTING
004013C4  |.  6A 00         push    0                                ; |pSecurity = NULL
004013C6  |.  6A 01         push    1                                ; |ShareMode = FILE_SHARE_READ
004013C8  |.  68 00000080   push    80000000                         ; |Access = GENERIC_READ
004013CD  |.  68 32604000   push    00406032                         ; |keyfile.dat
004013D2  |.  E8 0B010000   call    <jmp.&kernel32.CreateFileA>      ; \CreateFileA
004013D7  |.  A3 62604000   mov     dword ptr [406062], eax          ;  ↓读取文件后半部分
004013DC  |.  68 A7624000   push    004062A7                         ; /pOverlapped = keyfilem.004062A7
004013E1  |.  68 48634000   push    00406348                         ; |pBytesRead = keyfilem.00406348
004013E6  |.  6A 10         push    10                               ; |BytesToRead = 10 (16.)
004013E8  |.  68 4E604000   push    0040604E                         ; |Buffer = keyfilem.0040604E
004013ED  |.  FF35 62604000 push    dword ptr [406062]               ; |hFile = NULL
004013F3  |.  E8 1A010000   call    <jmp.&kernel32.ReadFile>         ; \ReadFile
004013F8  |.  FF35 62604000 push    dword ptr [406062]               ; /hObject = NULL
004013FE  |.  E8 D9000000   call    <jmp.&kernel32.CloseHandle>      ; \CloseHandle
00401403  |.  33C9          xor     ecx, ecx
00401405  |.  33D2          xor     edx, edx
00401407  |.  BA 0F000000   mov     edx, 0F
0040140C  |>  0FBE8A 4E6040>/movsx   ecx, byte ptr [edx+40604E]      ;  把多余的空格部分去除
00401413  |.  4A            |dec     edx
00401414  |.  83F9 20       |cmp     ecx, 20
00401417  |.  75 09         |jnz     short 00401422
00401419  |.  C682 4F604000>|mov     byte ptr [edx+40604F], 0
00401420  |.^ EB EA         \jmp     short 0040140C
00401422  |>  68 87624000   push    00406287                         ; /String2 = ""
00401427  |.  68 4E604000   push    0040604E                         ; |String1 = ""
0040142C  |.  E8 ED000000   call    <jmp.&kernel32.lstrcmpA>         ; \lstrcmpA
00401431  |.  83F8 00       cmp     eax, 0
00401434  |.  74 1D         je      short 00401453
00401436  |.  75 12         jnz     short 0040144A
00401438  |>  C605 2C604000>mov     byte ptr [40602C], 1
0040143F  |.  EB 63         jmp     short 004014A4
00401441  |>  C605 2C604000>mov     byte ptr [40602C], 2
00401448  |.  EB 5A         jmp     short 004014A4
0040144A  |>  C605 2C604000>mov     byte ptr [40602C], 3
00401451  |.  EB 51         jmp     short 004014A4
00401453  |>  C605 2C604000>mov     byte ptr [40602C], 4
0040145A  |.  EB 48         jmp     short 004014A4
0040145C  |>  53            push    ebx
0040145D  |.  57            push    edi
0040145E  |.  68 3E604000   push    0040603E                         ; /String = ""
00401463  |.  E8 BC000000   call    <jmp.&kernel32.lstrlenA>         ; \lstrlenA
00401468  |.  8BD0          mov     edx, eax
0040146A  |.  33C9          xor     ecx, ecx
0040146C  |.  33DB          xor     ebx, ebx
0040146E  |>  0FB681 3E6040>/movzx   eax, byte ptr [ecx+40603E]      ;  循环迭代字符串
00401475  |.  83C0 0F       |add     eax, 0F
00401478  |.  83F0 20       |xor     eax, 20
0040147B  |.  03D8          |add     ebx, eax
0040147D  |.  41            |inc     ecx                             ;  循环变量自增
0040147E  |.  3BCA          |cmp     ecx, edx                        ;  是否遍历完毕？
00401480  |.^ 75 EC         \jnz     short 0040146E
00401482  |.  33C9          xor     ecx, ecx
00401484  |.  69DB 697A0000 imul    ebx, ebx, 7A69
0040148A  |.  53            push    ebx                              ; /<%X>
0040148B  |.  68 84624000   push    00406284                         ; |%x
00401490  |.  68 87624000   push    00406287                         ; |s = keyfilem.00406287
00401495  |.  E8 0C000000   call    <jmp.&user32.wsprintfA>          ; \wsprintfA
0040149A  |.  83C4 0C       add     esp, 0C
0040149D  |.  5F            pop     edi
0040149E  |.  5B            pop     ebx
0040149F  |.^ E9 17FFFFFF   jmp     004013BB
004014A4  \>  C3            retn

KeyFile长度必须为32，前面写着用户名，后面是密码。而CM的计算方式是简单的F(用户名) = 密码。

给出可用的KeyFIle内容：

DreamCracker    26F86D8

运行效果：